@vaultcompass/vault-guard-core 1.2.3 → 1.3.0

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export * from './scan-output';
 export * from './diagnostics';
 export { shannonEntropy, DEFAULT_ENTROPY_THRESHOLD } from './utils/entropy';
 export { isPlaceholderSecret, isNonSecretConnectionString, isSampleJwt, isRedactedTemplateValue, isEnvVarNameToken } from './utils/placeholder';
-export { getGitStagedFilePaths, isInsideGitWorkTree } from './utils/git-utils';
+export { getGitStagedFilePaths, readGitIndexFile, isInsideGitWorkTree } from './utils/git-utils';
 export { validateRegexSafety, validateRegexLength, mapRegexSafetyReasonToDiagnosticCode, mapPatternRejectionReasonToDiagnosticCode, REGEX_REASON_TO_DIAGNOSTIC_CODE, REGEX_MAX_LENGTH, REGEX_MAX_QUANTIFIERS, } from './utils/regex-safety';
 export { scanTextFileAsync, scanTextFileSync } from './utils/scan-file';
 export { applyPathAwareSeverity, isTestFilePath } from './utils/path-severity';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTestFilePath = exports.applyPathAwareSeverity = exports.scanTextFileSync = exports.scanTextFileAsync = exports.REGEX_MAX_QUANTIFIERS = exports.REGEX_MAX_LENGTH = exports.REGEX_REASON_TO_DIAGNOSTIC_CODE = exports.mapPatternRejectionReasonToDiagnosticCode = exports.mapRegexSafetyReasonToDiagnosticCode = exports.validateRegexLength = exports.validateRegexSafety = exports.isInsideGitWorkTree = exports.getGitStagedFilePaths = exports.isEnvVarNameToken = exports.isRedactedTemplateValue = exports.isSampleJwt = exports.isNonSecretConnectionString = exports.isPlaceholderSecret = exports.DEFAULT_ENTROPY_THRESHOLD = exports.shannonEntropy = exports.fingerprintForMatch = void 0;
+exports.isTestFilePath = exports.applyPathAwareSeverity = exports.scanTextFileSync = exports.scanTextFileAsync = exports.REGEX_MAX_QUANTIFIERS = exports.REGEX_MAX_LENGTH = exports.REGEX_REASON_TO_DIAGNOSTIC_CODE = exports.mapPatternRejectionReasonToDiagnosticCode = exports.mapRegexSafetyReasonToDiagnosticCode = exports.validateRegexLength = exports.validateRegexSafety = exports.isInsideGitWorkTree = exports.readGitIndexFile = exports.getGitStagedFilePaths = exports.isEnvVarNameToken = exports.isRedactedTemplateValue = exports.isSampleJwt = exports.isNonSecretConnectionString = exports.isPlaceholderSecret = exports.DEFAULT_ENTROPY_THRESHOLD = exports.shannonEntropy = exports.fingerprintForMatch = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./errors"), exports);
 __exportStar(require("./scanners"), exports);
@@ -37,6 +37,7 @@ Object.defineProperty(exports, "isRedactedTemplateValue", { enumerable: true, ge
 Object.defineProperty(exports, "isEnvVarNameToken", { enumerable: true, get: function () { return placeholder_1.isEnvVarNameToken; } });
 var git_utils_1 = require("./utils/git-utils");
 Object.defineProperty(exports, "getGitStagedFilePaths", { enumerable: true, get: function () { return git_utils_1.getGitStagedFilePaths; } });
+Object.defineProperty(exports, "readGitIndexFile", { enumerable: true, get: function () { return git_utils_1.readGitIndexFile; } });
 Object.defineProperty(exports, "isInsideGitWorkTree", { enumerable: true, get: function () { return git_utils_1.isInsideGitWorkTree; } });
 var regex_safety_1 = require("./utils/regex-safety");
 Object.defineProperty(exports, "validateRegexSafety", { enumerable: true, get: function () { return regex_safety_1.validateRegexSafety; } });

package/dist/scanners/pre-commit-hook.d.ts

@@ -18,6 +18,10 @@ export declare class PreCommitHook {
      * Absolute path to the \`pre-commit\` hook file for the given manager.
      */
     getPreCommitHookPath(cwd: string, manager?: HookManager): string;
+    /**
+     * Absolute path to the Windows \`pre-commit.cmd\` companion (native manager only).
+     */
+    getPreCommitCmdPath(cwd: string): string;
     install(options?: InstallHookOptions): {
         success: boolean;
         message: string;
@@ -28,6 +32,12 @@ export declare class PreCommitHook {
         message: string;
     };
     isInstalled(options?: InstallHookOptions): boolean;
+    /**
+     * Write or refresh our `pre-commit.cmd`. Never overwrites a foreign file.
+     * @returns whether our companion is present afterwards
+     */
+    private writeNativeCmdCompanion;
+    private removeNativeCmdCompanion;
     private installNative;
     private uninstallNative;
     private installHusky;

package/dist/scanners/pre-commit-hook.js

@@ -35,6 +35,30 @@ echo "❌ COMMIT BLOCKED: secrets detected in staged files"
 echo "💡 Fix or unstage, then retry. Emergency bypass (discouraged): git commit --no-verify"
 exit 1
 `;
+/**
+ * Optional `pre-commit.cmd` beside the POSIX hook. Git for Windows runs the
+ * extensionless `pre-commit` via sh; a few clients may invoke `.cmd` directly.
+ */
+const NATIVE_HOOK_CMD = `@echo off
+REM vault-guard pre-commit (installed by @vaultcompass/vault-guard)
+where vault-guard >nul 2>&1
+if errorlevel 1 (
+  echo ❌ vault-guard: command not found ^(install: npm i -g @vaultcompass/vault-guard^)
+  exit /b 1
+)
+
+echo 🔍 vault-guard: scanning staged files...
+call vault-guard scan --staged
+if errorlevel 1 (
+  echo.
+  echo ❌ COMMIT BLOCKED: secrets detected in staged files
+  echo 💡 Fix or unstage, then retry. Emergency bypass ^(discouraged^): git commit --no-verify
+  exit /b 1
+)
+
+echo ✅ vault-guard: no secrets in staged files
+exit /b 0
+`;
 /** Husky-friendly hook (sources \`_/husky.sh\` when present). */
 const HUSKY_HOOK_SCRIPT = `#!/usr/bin/env sh
 if [ -f "$(dirname "$0")/_/husky.sh" ]; then
@@ -110,6 +134,12 @@ class PreCommitHook {
         }
         return path_1.default.join(this.getEffectiveHooksDir(cwd).hooksDir, 'pre-commit');
     }
+    /**
+     * Absolute path to the Windows \`pre-commit.cmd\` companion (native manager only).
+     */
+    getPreCommitCmdPath(cwd) {
+        return path_1.default.join(this.getEffectiveHooksDir(cwd).hooksDir, 'pre-commit.cmd');
+    }
     install(options = {}) {
         const cwd = options.cwd ?? process.cwd();
         const manager = options.manager ?? 'native';
@@ -160,9 +190,37 @@ class PreCommitHook {
     // -------------------------------------------------------------------------
     // native (Git hooks / core.hooksPath)
     // -------------------------------------------------------------------------
+    /**
+     * Write or refresh our `pre-commit.cmd`. Never overwrites a foreign file.
+     * @returns whether our companion is present afterwards
+     */
+    writeNativeCmdCompanion(hooksDir) {
+        const cmdPath = path_1.default.join(hooksDir, 'pre-commit.cmd');
+        if (fs_1.default.existsSync(cmdPath)) {
+            const existing = fs_1.default.readFileSync(cmdPath, 'utf-8');
+            const isOurs = existing.includes('vault-guard') && existing.includes('scan --staged');
+            if (!isOurs) {
+                return false;
+            }
+        }
+        fs_1.default.writeFileSync(cmdPath, NATIVE_HOOK_CMD, { encoding: 'utf-8' });
+        return true;
+    }
+    removeNativeCmdCompanion(hooksDir) {
+        const cmdPath = path_1.default.join(hooksDir, 'pre-commit.cmd');
+        if (!fs_1.default.existsSync(cmdPath))
+            return false;
+        const content = fs_1.default.readFileSync(cmdPath, 'utf-8');
+        if (!content.includes('vault-guard') || !content.includes('scan --staged')) {
+            return false;
+        }
+        fs_1.default.unlinkSync(cmdPath);
+        return true;
+    }
     installNative(cwd) {
         const { hooksDir, viaHooksPath } = this.getEffectiveHooksDir(cwd);
         const hookPath = path_1.default.join(hooksDir, 'pre-commit');
+        const cmdPath = path_1.default.join(hooksDir, 'pre-commit.cmd');
         try {
             if (!fs_1.default.existsSync(hooksDir)) {
                 fs_1.default.mkdirSync(hooksDir, { recursive: true });
@@ -170,18 +228,31 @@ class PreCommitHook {
             if (fs_1.default.existsSync(hookPath)) {
                 const existing = fs_1.default.readFileSync(hookPath, 'utf-8');
                 if (existing.includes('vault-guard') && existing.includes('scan --staged')) {
+                    // Refresh the Windows companion if missing or stale (never clobber foreign).
+                    const cmdOk = this.writeNativeCmdCompanion(hooksDir);
                     return {
                         success: true,
-                        message: 'Hook already installed',
+                        message: cmdOk
+                            ? 'Hook already installed (POSIX + Windows .cmd companion)'
+                            : fs_1.default.existsSync(cmdPath)
+                                ? 'Hook already installed (left foreign pre-commit.cmd untouched)'
+                                : 'Hook already installed',
                         hookPath,
                     };
                 }
             }
             fs_1.default.writeFileSync(hookPath, NATIVE_HOOK_SCRIPT, { mode: 0o755 });
+            const cmdOk = this.writeNativeCmdCompanion(hooksDir);
             const hint = viaHooksPath
                 ? `Installed to hooksPath: ${hooksDir}`
-                : 'Installed to .git/hooks/pre-commit';
-            return { success: true, message: `Pre-commit hook installed (${hint})`, hookPath };
+                : cmdOk
+                    ? 'Installed to .git/hooks/pre-commit (+ pre-commit.cmd)'
+                    : 'Installed to .git/hooks/pre-commit';
+            return {
+                success: true,
+                message: `Pre-commit hook installed (${hint})`,
+                hookPath,
+            };
         }
         catch (error) {
             const hookError = new errors_1.HookError(`Failed to install hook: ${error}`, 'install');
@@ -189,17 +260,34 @@ class PreCommitHook {
         }
     }
     uninstallNative(cwd) {
-        const hookPath = this.getPreCommitHookPath(cwd, 'native');
+        const { hooksDir } = this.getEffectiveHooksDir(cwd);
+        const hookPath = path_1.default.join(hooksDir, 'pre-commit');
+        const cmdRemoved = this.removeNativeCmdCompanion(hooksDir);
         if (!fs_1.default.existsSync(hookPath)) {
-            return { success: true, message: 'No hook to remove' };
+            return {
+                success: true,
+                message: cmdRemoved
+                    ? 'Removed Windows pre-commit.cmd companion'
+                    : 'No hook to remove',
+            };
         }
         const content = fs_1.default.readFileSync(hookPath, 'utf-8');
         if (!content.includes('vault-guard')) {
-            return { success: true, message: 'No vault-guard hook to remove' };
+            return {
+                success: true,
+                message: cmdRemoved
+                    ? 'Removed Windows pre-commit.cmd companion'
+                    : 'No vault-guard hook to remove',
+            };
         }
         try {
             fs_1.default.unlinkSync(hookPath);
-            return { success: true, message: 'Pre-commit hook removed' };
+            return {
+                success: true,
+                message: cmdRemoved
+                    ? 'Pre-commit hook and Windows .cmd companion removed'
+                    : 'Pre-commit hook removed',
+            };
         }
         catch (error) {
             const hookError = new errors_1.HookError(`Failed to remove hook: ${error}`, 'uninstall');

package/dist/scanners/token-counter.js

@@ -96,8 +96,9 @@ class TokenCounter {
         return ['.png', '.jpg', '.jpeg', '.gif', '.pdf', '.zip', '.lock', '.log'].includes(ext);
     }
     getExtension(filePath) {
-        const parts = filePath.split('.');
-        return parts.length > 1 ? `.${parts[parts.length - 1]}` : '(no ext)';
+        // Use basename so parent dirs with '.' (e.g. macOS temp paths) are ignored.
+        const ext = path_1.default.extname(path_1.default.basename(filePath));
+        return ext.length > 0 ? ext : '(no ext)';
     }
 }
 exports.TokenCounter = TokenCounter;

package/dist/utils/git-utils.d.ts

@@ -1,11 +1,20 @@
 /**
  * Return absolute paths of files staged for commit (cached index vs HEAD).
- * Excludes deleted paths; only returns paths that still exist on disk.
+ *
+ * Uses `--diff-filter=ACMRT` so deleted index entries are excluded, but
+ * **does not** require the path to exist in the worktree. A staged add that
+ * was later deleted from disk (`AD` in `git status`) still appears — that
+ * blob will be committed and must be scanned.
  *
  * Throws `GitError` on git failure rather than returning an empty list.
  * Returning `[]` silently on git failure would produce a false "✅ nothing
  * staged" result in pre-commit, letting secrets through undetected.
  */
 export declare function getGitStagedFilePaths(cwd?: string): string[];
+/**
+ * Read a staged blob from the index (`git show :path`), not the worktree.
+ * `relativePath` may use OS separators; it is normalized to git's `/` form.
+ */
+export declare function readGitIndexFile(cwd: string, relativePath: string): string;
 /** True when `cwd` is inside a work tree with a `.git` directory or file. */
 export declare function isInsideGitWorkTree(cwd?: string): boolean;

package/dist/utils/git-utils.js

@@ -4,24 +4,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getGitStagedFilePaths = getGitStagedFilePaths;
+exports.readGitIndexFile = readGitIndexFile;
 exports.isInsideGitWorkTree = isInsideGitWorkTree;
 const child_process_1 = require("child_process");
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const errors_1 = require("../errors");
 /**
  * Return absolute paths of files staged for commit (cached index vs HEAD).
- * Excludes deleted paths; only returns paths that still exist on disk.
+ *
+ * Uses `--diff-filter=ACMRT` so deleted index entries are excluded, but
+ * **does not** require the path to exist in the worktree. A staged add that
+ * was later deleted from disk (`AD` in `git status`) still appears — that
+ * blob will be committed and must be scanned.
  *
  * Throws `GitError` on git failure rather than returning an empty list.
  * Returning `[]` silently on git failure would produce a false "✅ nothing
  * staged" result in pre-commit, letting secrets through undetected.
  */
 function getGitStagedFilePaths(cwd = process.cwd()) {
-    const cmd = 'git diff --cached --name-only --diff-filter=ACMRT';
+    const args = ['diff', '--cached', '--name-only', '--diff-filter=ACMRT', '-z'];
     let out;
     try {
-        out = (0, child_process_1.execSync)(cmd, {
+        out = (0, child_process_1.execFileSync)('git', args, {
             cwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
@@ -29,19 +33,37 @@ function getGitStagedFilePaths(cwd = process.cwd()) {
     }
     catch (err) {
         throw new errors_1.GitError(`Failed to list staged files — is this a git repository? (cwd: ${cwd})\n` +
-            `Run 'git status' to verify.\nUnderlying error: ${String(err)}`, cmd, err);
+            `Run 'git status' to verify.\nUnderlying error: ${String(err)}`, `git ${args.join(' ')}`, err);
     }
     return out
-        .split('\n')
+        .split('\0')
         .map((line) => line.trim())
         .filter(Boolean)
-        .map((rel) => path_1.default.resolve(cwd, rel))
-        .filter((abs) => fs_1.default.existsSync(abs) && fs_1.default.statSync(abs).isFile());
+        .map((rel) => path_1.default.resolve(cwd, rel));
+}
+/**
+ * Read a staged blob from the index (`git show :path`), not the worktree.
+ * `relativePath` may use OS separators; it is normalized to git's `/` form.
+ */
+function readGitIndexFile(cwd, relativePath) {
+    const normalized = relativePath.split(path_1.default.sep).join('/');
+    const args = ['show', `:${normalized}`];
+    try {
+        return (0, child_process_1.execFileSync)('git', args, {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            maxBuffer: 32 * 1024 * 1024,
+        });
+    }
+    catch (err) {
+        throw new errors_1.GitError(`Failed to read staged blob for ${normalized}\nUnderlying error: ${String(err)}`, `git ${args.join(' ')}`, err);
+    }
 }
 /** True when `cwd` is inside a work tree with a `.git` directory or file. */
 function isInsideGitWorkTree(cwd = process.cwd()) {
     try {
-        (0, child_process_1.execSync)('git rev-parse --is-inside-work-tree', {
+        (0, child_process_1.execFileSync)('git', ['rev-parse', '--is-inside-work-tree'], {
             cwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-core",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",