@vaultcompass/vault-guard 1.3.0 → 1.4.1

package/dist/cli-entry.js

@@ -8,6 +8,12 @@ if (nodeMajor < 22) {
         'Some features may not work correctly.');
 }
 const program = (0, cli_1.buildCli)();
+// npx (and some wrappers) forward a leading `--` into argv. Commander treats
+// that as end-of-options, so `--format sarif` is ignored and text banners
+// pollute machine-readable stdout. Drop a single leading separator.
+if (process.argv[2] === '--') {
+    process.argv.splice(2, 1);
+}
 // Parse arguments and execute command
 program.parseAsync().catch((error) => {
     // Handle errors

package/dist/cli.js

@@ -79,9 +79,10 @@ function buildCli() {
         .argument('[path]', 'Path to scan', '.')
         .option('-f, --format <format>', 'Output format: text | json | sarif', 'text')
         .option('--staged', 'Scan git staged files only (uses index vs HEAD)', false)
+        .option('--fail-on <severity>', 'Minimum severity that fails the scan: critical | high | medium | low | none (default: medium, or fail_on in .vault-guard.json)')
         .action(async (path, options) => {
         const format = options.format ?? 'text';
-        const exitCode = await (0, scan_1.scanCommand)(path, format, Boolean(options.staged));
+        const exitCode = await (0, scan_1.scanCommand)(path, format, Boolean(options.staged), options.failOn);
         setExitCode(exitCode);
     });
     program
@@ -149,8 +150,9 @@ function buildCli() {
         .command('check')
         .description('Scan files with config and baselines')
         .argument('[files...]', 'Files to check')
-        .action(async (files) => {
-        const exitCode = await (0, check_1.checkCommand)(files);
+        .option('--fail-on <severity>', 'Minimum severity that fails the check: critical | high | medium | low | none (default: medium, or fail_on in .vault-guard.json)')
+        .action(async (files, options) => {
+        const exitCode = await (0, check_1.checkCommand)(files, options.failOn);
         setExitCode(exitCode);
     });
     program

package/dist/commands/check.d.ts

@@ -1 +1 @@
-export declare function checkCommand(files: string[]): Promise<number>;
+export declare function checkCommand(files: string[], failOn?: string): Promise<number>;

package/dist/commands/check.js

@@ -2,6 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkCommand = checkCommand;
 const scan_1 = require("./scan");
-async function checkCommand(files) {
-    return (0, scan_1.scanCommand)(files.length > 0 ? files : '.', 'text', false);
+async function checkCommand(files, failOn) {
+    return (0, scan_1.scanCommand)(files.length > 0 ? files : '.', 'text', false, failOn);
 }

package/dist/commands/scan.d.ts

@@ -1,2 +1,2 @@
 export type OutputFormat = 'text' | 'json' | 'sarif';
-export declare function scanCommand(targetPath: string | string[], format?: OutputFormat, staged?: boolean): Promise<number>;
+export declare function scanCommand(targetPath: string | string[], format?: OutputFormat, staged?: boolean, failOnFlag?: string): Promise<number>;

package/dist/commands/scan.js

@@ -7,7 +7,7 @@ exports.scanCommand = scanCommand;
 const vault_guard_core_1 = require("@vaultcompass/vault-guard-core");
 const chalk_1 = __importDefault(require("chalk"));
 const scan_utils_1 = require("../utils/scan-utils");
-async function scanCommand(targetPath, format = 'text', staged = false) {
+async function scanCommand(targetPath, format = 'text', staged = false, failOnFlag) {
     const cwd = process.cwd();
     const targetPaths = Array.isArray(targetPath) ? targetPath : [targetPath];
     const targetLabel = targetPaths.length === 1 ? targetPaths[0] : `${targetPaths.length} paths`;
@@ -25,6 +25,18 @@ async function scanCommand(targetPath, format = 'text', staged = false) {
         }
         throw e;
     }
+    // Resolve the gate threshold before scanning so an invalid value fails fast
+    // rather than after a long scan.
+    const failOnResolved = (0, vault_guard_core_1.resolveFailOn)(failOnFlag, config.fail_on);
+    if (!failOnResolved.ok) {
+        console.error(chalk_1.default.red('❌ Invalid fail-on value:'), chalk_1.default.white(failOnResolved.invalid));
+        console.error(chalk_1.default.gray(`   Expected one of: ${vault_guard_core_1.FAIL_ON_VALUES.join(' | ')}\n`));
+        return 1;
+    }
+    const failOn = failOnResolved.threshold;
+    // True when neither the flag nor the config chose a threshold. Drives the
+    // 1.4.0 upgrade notice below: users who picked a value have already decided.
+    const gateIsImplicitDefault = failOnFlag === undefined && config.fail_on === undefined;
     const scanner = new vault_guard_core_1.SecretScanner(config);
     // Merge config ignore paths and patterns into a single list for file filtering.
     const configIgnorePatterns = [
@@ -125,21 +137,36 @@ async function scanCommand(targetPath, format = 'text', staged = false) {
         const { results: afterBaseline, suppressed: baselineSuppressed } = (0, vault_guard_core_1.filterResultsByBaseline)(process.cwd(), results, baselineLoad.fingerprints);
         results = afterBaseline;
         const durationMs = Date.now() - t0;
+        const totalMatches = results.reduce((n, r) => n + r.matches.length, 0);
+        const blocking = (0, vault_guard_core_1.countBlockingMatches)(results, failOn);
         const run = {
             duration_ms: durationMs,
             files_scanned: stats.filesScanned,
             bytes_scanned: stats.bytesScanned,
             patterns_active: scanner.getActivePatternCount(),
             diagnostics_count: diagnostics.length,
+            fail_on: failOn,
+            blocking_matches: blocking,
             ...(baselineSuppressed > 0 ? { baseline_suppressed: baselineSuppressed } : {}),
         };
+        // Upgrade notice for the 1.4.0 default change. Before 1.4.0 any finding
+        // failed the scan; now the implicit default is `medium`. When that
+        // difference is what decides this run's outcome (findings exist, none
+        // block, and the user never chose a threshold), say so once on stderr —
+        // stderr so JSON/SARIF stdout stays parseable, and only for the implicit
+        // default so setting `fail_on` anywhere silences it for good.
+        if (gateIsImplicitDefault && totalMatches > 0 && blocking === 0) {
+            console.error(chalk_1.default.yellow(`note: earlier vault-guard versions failed on any finding; since 1.4.0 the default gate is "medium".`));
+            console.error(chalk_1.default.gray(`      This run would have failed before. Set "fail_on" in .vault-guard.json ("low" restores the old\n` +
+                `      behaviour, "medium" keeps this one) to silence this note.`));
+        }
         if (format === 'json') {
             process.stdout.write((0, scan_utils_1.formatJson)(results, { diagnostics, run }) + '\n');
-            return results.reduce((n, r) => n + r.matches.length, 0) === 0 ? 0 : 1;
+            return blocking === 0 ? 0 : 1;
         }
         if (format === 'sarif') {
             process.stdout.write((0, scan_utils_1.formatSarif)(results, { diagnostics, run }) + '\n');
-            return results.reduce((n, r) => n + r.matches.length, 0) === 0 ? 0 : 1;
+            return blocking === 0 ? 0 : 1;
         }
         // Text mode: print one-line diagnostic summary when any non-fatal issues occurred
         if (diagnostics.length > 0) {
@@ -149,7 +176,14 @@ async function scanCommand(targetPath, format = 'text', staged = false) {
             console.log(chalk_1.default.green.bold('✅ SUCCESS:'), chalk_1.default.white('No secrets found\n'));
             return 0;
         }
-        (0, scan_utils_1.displayScanResults)(results);
+        (0, scan_utils_1.displayScanResults)(results, blocking);
+        if (blocking === 0) {
+            // Findings exist but all sit below the gate. Say so explicitly — a silent
+            // exit 0 after printing findings reads like a bug.
+            console.log(chalk_1.default.white(`${totalMatches} finding(s), none at or above severity "${failOn}" — not failing the gate.`));
+            console.log(chalk_1.default.gray(`   Tighten with --fail-on low or "fail_on": "low" in .vault-guard.json\n`));
+            return 0;
+        }
         return 1;
     }
     catch (error) {

package/dist/utils/scan-utils.d.ts

@@ -70,4 +70,4 @@ export declare function scanFiles(targetPaths: string[], scanner: SecretScanner,
  *   - The redacted match value (`sk-a…(37c)`) is shown last and intentionally
  *     low-information.
  */
-export declare function displayScanResults(results: ScanResult[]): void;
+export declare function displayScanResults(results: ScanResult[], blocking?: number): void;

package/dist/utils/scan-utils.js

@@ -296,13 +296,22 @@ function scanFiles(targetPaths, scanner, options = {}) {
  *   - The redacted match value (`sk-a…(37c)`) is shown last and intentionally
  *     low-information.
  */
-function displayScanResults(results) {
+function displayScanResults(results, blocking) {
     if (results.length === 0) {
         console.log(chalk_1.default.green.bold('✅ SUCCESS:'), chalk_1.default.white('No secrets found\n'));
         return;
     }
     const totalSecrets = results.reduce((sum, r) => sum + r.matches.length, 0);
-    console.log(chalk_1.default.red.bold('🚨 BLOCKED:'), chalk_1.default.white(`Found ${totalSecrets} secret${totalSecrets > 1 ? 's' : ''}\n`));
+    // `blocking` is how many findings sit at or above the `--fail-on` threshold.
+    // When none do we still list everything, but the headline must not say
+    // "BLOCKED" over a run that is about to exit 0.
+    const willBlock = blocking === undefined || blocking > 0;
+    if (willBlock) {
+        console.log(chalk_1.default.red.bold('🚨 BLOCKED:'), chalk_1.default.white(`Found ${totalSecrets} secret${totalSecrets > 1 ? 's' : ''}\n`));
+    }
+    else {
+        console.log(chalk_1.default.yellow.bold('⚠️  REPORT:'), chalk_1.default.white(`Found ${totalSecrets} finding${totalSecrets > 1 ? 's' : ''} below the fail threshold\n`));
+    }
     for (const { file, matches } of results) {
         const relativePath = relativeForDisplay(file);
         for (const match of matches) {
@@ -313,7 +322,9 @@ function displayScanResults(results) {
         }
     }
     console.log('');
-    console.log(chalk_1.default.red.bold('❌ BLOCKED:'), chalk_1.default.white('Commit blocked — remove secrets before pushing\n'));
+    if (willBlock) {
+        console.log(chalk_1.default.red.bold('❌ BLOCKED:'), chalk_1.default.white('Commit blocked — remove secrets before pushing\n'));
+    }
 }
 /** cwd-relative when inside cwd, absolute otherwise. Matches scan-output behaviour. */
 function relativeForDisplay(file) {
@@ -346,8 +357,10 @@ function getSeverityEmoji(severity) {
             return '⚠️';
         case 'medium':
             return 'ℹ️';
+        // Not a checkmark: every line here is a finding, and a green tick beside
+        // one reads as "this file is clean".
         case 'low':
-            return '✅';
+            return '🔵';
         default:
             return '•';
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Block secrets at commit and in CI. Pre-commit hooks, SARIF output, and fast staged-file scans for AI-native workflows.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -36,8 +36,8 @@
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^12.0.0",
-    "@vaultcompass/vault-guard-core": "1.3.0",
-    "@vaultcompass/vault-guard-telemetry": "1.3.0"
+    "@vaultcompass/vault-guard-core": "1.4.1",
+    "@vaultcompass/vault-guard-telemetry": "1.4.1"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",