@vaultcompass/vault-guard 1.0.6 → 1.1.1

package/dist/cli.js

@@ -115,7 +115,7 @@ function buildCli() {
     // Check command
     program
         .command('check')
-        .description('Quick check')
+        .description('Scan files with config and baselines')
         .argument('[files...]', 'Files to check')
         .action(async (files) => {
         const exitCode = await (0, check_1.checkCommand)(files);

package/dist/commands/check.js

@@ -1,39 +1,7 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkCommand = checkCommand;
-const vault_guard_core_1 = require("@vaultcompass/vault-guard-core");
-const chalk_1 = __importDefault(require("chalk"));
-const path_1 = __importDefault(require("path"));
-const scan_utils_1 = require("../utils/scan-utils");
+const scan_1 = require("./scan");
 async function checkCommand(files) {
-    const scanner = new vault_guard_core_1.SecretScanner();
-    const filesToCheck = files.length > 0 ? files : ['.'];
-    console.log(chalk_1.default.blue('✅ Quick check\n'));
-    // Use async scanning logic with same safeguards as scan command
-    const results = await (0, scan_utils_1.scanFilesAsync)(filesToCheck, scanner, {
-        verbose: false,
-        skipBinary: true,
-        progress: false
-    });
-    if (results.length === 0) {
-        console.log(chalk_1.default.green.bold('✅ Clean:'), chalk_1.default.white('No secrets found\n'));
-        return 0; // Success exit code
-    }
-    else {
-        const totalSecrets = results.reduce((sum, r) => sum + r.matches.length, 0);
-        console.log(chalk_1.default.red.bold('🔴 BLOCKED:'), chalk_1.default.white(`Found ${totalSecrets} secret${totalSecrets > 1 ? 's' : ''}\n`));
-        // Display simplified results
-        for (const { file, matches } of results) {
-            const relativePath = relativePathCwd(file);
-            console.log(chalk_1.default.red('🔴'), chalk_1.default.white(`${relativePath}: ${matches.length} secret${matches.length > 1 ? 's' : ''}`));
-        }
-        console.log('');
-        return 1; // Error exit code (secrets found)
-    }
-}
-function relativePathCwd(filePath) {
-    return path_1.default.relative(process.cwd(), filePath);
+    return (0, scan_1.scanCommand)(files.length > 0 ? files : '.', 'text', false);
 }

package/dist/commands/proxy-sse.d.ts

@@ -0,0 +1,19 @@
+export interface SseUsage {
+    inputTokens: number;
+    outputTokens: number;
+    model: string | null;
+}
+/**
+ * Extract token usage from a buffered Anthropic SSE stream.
+ *
+ * Pure and synchronous — no HTTP dependencies — so it can be unit-tested
+ * without spinning up a server. Call after the full response has been teed.
+ *
+ * Anthropic usage token delivery:
+ *   message_start  → message.usage.input_tokens  (and initial output_tokens)
+ *   message_delta  → usage.output_tokens          (cumulative; last one wins)
+ *   message_stop   → no usage fields
+ *
+ * Unknown or malformed `data:` lines are silently skipped.
+ */
+export declare function parseAnthropicSseUsage(raw: string, fallbackModel: string | null): SseUsage;

package/dist/commands/proxy-sse.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseAnthropicSseUsage = parseAnthropicSseUsage;
+/**
+ * Extract token usage from a buffered Anthropic SSE stream.
+ *
+ * Pure and synchronous — no HTTP dependencies — so it can be unit-tested
+ * without spinning up a server. Call after the full response has been teed.
+ *
+ * Anthropic usage token delivery:
+ *   message_start  → message.usage.input_tokens  (and initial output_tokens)
+ *   message_delta  → usage.output_tokens          (cumulative; last one wins)
+ *   message_stop   → no usage fields
+ *
+ * Unknown or malformed `data:` lines are silently skipped.
+ */
+function parseAnthropicSseUsage(raw, fallbackModel) {
+    let inputTokens = 0;
+    let outputTokens = 0;
+    let model = fallbackModel;
+    for (const line of raw.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('data:'))
+            continue;
+        const payload = trimmed.slice('data:'.length).trim();
+        if (!payload || payload === '[DONE]')
+            continue;
+        let evt;
+        try {
+            evt = JSON.parse(payload);
+        }
+        catch {
+            continue;
+        }
+        if (evt.type === 'message_start' && evt.message) {
+            if (typeof evt.message.model === 'string')
+                model = evt.message.model;
+            const u = evt.message.usage ?? {};
+            if (typeof u.input_tokens === 'number')
+                inputTokens = u.input_tokens;
+            if (typeof u.output_tokens === 'number')
+                outputTokens = u.output_tokens;
+        }
+        else if (evt.type === 'message_delta' && evt.usage) {
+            if (typeof evt.usage.input_tokens === 'number')
+                inputTokens = evt.usage.input_tokens;
+            if (typeof evt.usage.output_tokens === 'number')
+                outputTokens = evt.usage.output_tokens;
+        }
+    }
+    return { inputTokens, outputTokens, model };
+}

package/dist/commands/proxy.js

@@ -41,6 +41,7 @@ const http = __importStar(require("http"));
 const https = __importStar(require("https"));
 const path_1 = __importDefault(require("path"));
 const vault_guard_telemetry_1 = require("@vaultcompass/vault-guard-telemetry");
+const proxy_sse_1 = require("./proxy-sse");
 /**
  * Bound inbound request buffering. 32 MB is a generous ceiling for
  * Anthropic-shaped JSON bodies (multi-megabyte system prompts, large
@@ -266,15 +267,47 @@ async function handleRequest(req, res, store, options, takeRateSlot) {
             const headers = { ...pres.headers };
             res.writeHead(pres.statusCode ?? 502, headers);
             if (stream) {
+                // Pipe to client immediately (bounded by the OS pipe, not us). Tee a
+                // bounded copy purely to parse SSE usage events after the stream ends.
+                // On tee overflow the client still receives the full stream; we record
+                // a distinct source so missing usage is visible in telemetry.
                 pres.pipe(res);
+                const teeChunks = [];
+                let teeLen = 0;
+                let teeAbandoned = false;
+                pres.on('data', chunk => {
+                    if (teeAbandoned)
+                        return;
+                    const b = chunk;
+                    teeLen += b.length;
+                    if (teeLen > MAX_TEE_BYTES) {
+                        teeAbandoned = true;
+                        teeChunks.length = 0;
+                        return;
+                    }
+                    teeChunks.push(b);
+                });
                 pres.on('end', () => {
+                    const model = typeof bodyJson.model === 'string' ? bodyJson.model : null;
+                    if (teeAbandoned) {
+                        store.recordUsage({
+                            provider: 'anthropic',
+                            model,
+                            cwd,
+                            inputTokens: 0,
+                            outputTokens: 0,
+                            source: 'proxy-stream-overflow',
+                        });
+                        resolve();
+                        return;
+                    }
+                    const usage = (0, proxy_sse_1.parseAnthropicSseUsage)(Buffer.concat(teeChunks).toString('utf8'), model);
                     store.recordUsage({
                         provider: 'anthropic',
-                        model: typeof bodyJson.model === 'string' ? bodyJson.model : null,
+                        model: usage.model,
                         cwd,
-                        inputTokens: 0,
-                        outputTokens: 0,
-                        estCostUsd: 0,
+                        inputTokens: usage.inputTokens,
+                        outputTokens: usage.outputTokens,
                         source: 'proxy-stream',
                     });
                     resolve();

package/dist/commands/scan.d.ts

@@ -1,2 +1,2 @@
 export type OutputFormat = 'text' | 'json' | 'sarif';
-export declare function scanCommand(targetPath: string, format?: OutputFormat, staged?: boolean): Promise<number>;
+export declare function scanCommand(targetPath: string | string[], format?: OutputFormat, staged?: boolean): Promise<number>;

package/dist/commands/scan.js

@@ -9,6 +9,8 @@ const chalk_1 = __importDefault(require("chalk"));
 const scan_utils_1 = require("../utils/scan-utils");
 async function scanCommand(targetPath, format = 'text', staged = false) {
     const cwd = process.cwd();
+    const targetPaths = Array.isArray(targetPath) ? targetPath : [targetPath];
+    const targetLabel = targetPaths.length === 1 ? targetPaths[0] : `${targetPaths.length} paths`;
     let config;
     try {
         config = (0, vault_guard_core_1.loadConfig)(cwd);
@@ -54,7 +56,7 @@ async function scanCommand(targetPath, format = 'text', staged = false) {
             'you have audited every pattern.\n'));
     }
     if (format === 'text' && !staged) {
-        console.log(chalk_1.default.blue('🔍 Scanning'), chalk_1.default.cyan(targetPath));
+        console.log(chalk_1.default.blue('🔍 Scanning'), chalk_1.default.cyan(targetLabel));
     }
     const stats = { filesScanned: 0, bytesScanned: 0 };
     const t0 = Date.now();
@@ -96,7 +98,7 @@ async function scanCommand(targetPath, format = 'text', staged = false) {
             });
         }
         else {
-            results = await (0, scan_utils_1.scanFilesAsync)([targetPath], scanner, {
+            results = await (0, scan_utils_1.scanFilesAsync)(targetPaths, scanner, {
                 verbose: format === 'text',
                 skipBinary: true,
                 progress: format === 'text',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard",
-  "version": "1.0.6",
+  "version": "1.1.1",
   "description": "Block secrets at commit and in CI. Pre-commit hooks, SARIF output, and fast staged-file scans for AI-native workflows.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -36,12 +36,12 @@
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^12.0.0",
-    "@vaultcompass/vault-guard-core": "1.0.6",
-    "@vaultcompass/vault-guard-telemetry": "1.0.6"
+    "@vaultcompass/vault-guard-core": "1.1.1",
+    "@vaultcompass/vault-guard-telemetry": "1.1.1"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.3",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^5.3.3"