@vaultcompass/vault-guard 1.4.0 → 1.4.2

package/dist/cli-entry.js

@@ -8,6 +8,12 @@ if (nodeMajor < 22) {
         'Some features may not work correctly.');
 }
 const program = (0, cli_1.buildCli)();
+// npx (and some wrappers) forward a leading `--` into argv. Commander treats
+// that as end-of-options, so `--format sarif` is ignored and text banners
+// pollute machine-readable stdout. Drop a single leading separator.
+if (process.argv[2] === '--') {
+    process.argv.splice(2, 1);
+}
 // Parse arguments and execute command
 program.parseAsync().catch((error) => {
     // Handle errors

package/dist/cli.js

@@ -1,41 +1,6 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildCli = buildCli;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
 const commander_1 = require("commander");
 const scan_1 = require("./commands/scan");
 const install_hook_1 = require("./commands/install-hook");
@@ -48,11 +13,7 @@ const proxy_1 = require("./commands/proxy");
 const data_1 = require("./commands/data");
 const config_1 = require("./commands/config");
 const init_1 = require("./commands/init");
-function readCliVersion() {
-    const pkgPath = path.join(__dirname, '..', 'package.json');
-    const raw = fs.readFileSync(pkgPath, 'utf-8');
-    return JSON.parse(raw).version;
-}
+const version_1 = require("./version");
 function setExitCode(exitCode) {
     if (exitCode !== 0) {
         process.exitCode = exitCode;
@@ -63,7 +24,7 @@ function buildCli() {
     program
         .name('vault-guard')
         .description('Security and optimization layer for AI-native coding')
-        .version(readCliVersion());
+        .version((0, version_1.readCliVersion)());
     const configCmd = program.command('config').description('Inspect and validate Vault Guard configuration');
     configCmd
         .command('validate')

package/dist/commands/data.js

@@ -50,41 +50,36 @@ const vault_guard_telemetry_1 = require("@vaultcompass/vault-guard-telemetry");
 async function dataStatusCommand(options = {}) {
     const dbPath = options.dbPath ?? (0, vault_guard_telemetry_1.getDefaultDbPath)();
     const asJson = Boolean(options.json);
-    let store;
+    const store = new vault_guard_telemetry_1.TelemetryStore(dbPath);
     try {
-        store = new vault_guard_telemetry_1.TelemetryStore(dbPath);
-    }
-    catch (e) {
-        if (e instanceof vault_guard_telemetry_1.TelemetryUnavailableError) {
-            const payload = {
-                error: 'telemetry_unavailable',
-                message: e.message,
-                db_path: dbPath,
-            };
+        // TelemetryStore never throws; `data status` is specifically a telemetry
+        // diagnostic, so unlike scan/statusline/MCP (which just get zeroed
+        // no-op results) it keeps reporting "unavailable" explicitly via exit
+        // code 2 rather than silently showing an all-zero status that would be
+        // indistinguishable from "genuinely no usage yet".
+        if (!store.isAvailable()) {
+            const message = store.getUnavailableReason() ?? 'better-sqlite3 native bindings unavailable.';
+            const payload = { error: 'telemetry_unavailable', message, db_path: dbPath };
             if (asJson) {
                 process.stdout.write(`${JSON.stringify(payload)}\n`);
             }
             else {
-                process.stderr.write(`vault-guard data status: telemetry unavailable — ${e.message}\n` +
+                process.stderr.write(`vault-guard data status: telemetry unavailable — ${message}\n` +
                     `expected db path: ${dbPath}\n`);
             }
             return 2;
         }
-        throw e;
-    }
-    let status;
-    try {
-        status = store.getDataStatus(dbPath);
+        const status = store.getDataStatus(dbPath);
+        if (asJson) {
+            process.stdout.write(`${JSON.stringify(status)}\n`);
+            return 0;
+        }
+        printStatusHuman(status);
+        return 0;
     }
     finally {
         store.close();
     }
-    if (asJson) {
-        process.stdout.write(`${JSON.stringify(status)}\n`);
-        return 0;
-    }
-    printStatusHuman(status);
-    return 0;
 }
 function printStatusHuman(s) {
     const sizeKb = (s.db_size_bytes / 1024).toFixed(1);
@@ -250,18 +245,16 @@ async function confirmReset(confirmFn, files) {
 async function dataExportCommand(options) {
     const dbPath = options.dbPath ?? (0, vault_guard_telemetry_1.getDefaultDbPath)();
     const format = options.format ?? 'json';
-    let store;
+    const store = new vault_guard_telemetry_1.TelemetryStore(dbPath);
     try {
-        store = new vault_guard_telemetry_1.TelemetryStore(dbPath);
-    }
-    catch (e) {
-        if (e instanceof vault_guard_telemetry_1.TelemetryUnavailableError) {
-            process.stderr.write(`vault-guard data export: telemetry unavailable — ${e.message}\n`);
+        // See dataStatusCommand: `data export` is a telemetry diagnostic, so it
+        // keeps reporting "unavailable" explicitly rather than silently writing
+        // an empty export file.
+        if (!store.isAvailable()) {
+            const message = store.getUnavailableReason() ?? 'better-sqlite3 native bindings unavailable.';
+            process.stderr.write(`vault-guard data export: telemetry unavailable — ${message}\n`);
             return 2;
         }
-        throw e;
-    }
-    try {
         const usage = store.exportUsageEvents();
         const sessions = store.exportSessionEvents();
         if (format === 'jsonl') {

package/dist/commands/proxy.js

@@ -137,9 +137,19 @@ async function proxyCommand(opts) {
         server.listen(port, host, () => resolve());
         server.on('error', reject);
     });
+    const telemetryAvailable = store.isAvailable();
     process.stderr.write(`vault-guard proxy listening on http://${host}:${port}\n` +
-        `Forward Anthropic traffic here (e.g. ANTHROPIC_BASE_URL=http://${host}:${port}). ` +
-        `Non-stream JSON responses log usage to ${path_1.default.join('~', '.vault-guard', 'usage.sqlite')}.\n`);
+        `Forward Anthropic traffic here (e.g. ANTHROPIC_BASE_URL=http://${host}:${port}).` +
+        (telemetryAvailable
+            ? ` Non-stream JSON responses log usage to ${path_1.default.join('~', '.vault-guard', 'usage.sqlite')}.\n`
+            : '\n'));
+    if (!telemetryAvailable) {
+        // Telemetry degrades silently to a no-op store when better-sqlite3 is
+        // unavailable (packages/telemetry/src/store.ts); the banner above must
+        // not claim usage is being logged when it is not. One notice, matching
+        // the MCP server's wording style (see server.ts's getTelemetry()).
+        process.stderr.write(`vault-guard proxy: telemetry unavailable, usage will NOT be recorded: ${store.getUnavailableReason() ?? 'better-sqlite3 native bindings unavailable.'}\n`);
+    }
     if (options.allowEnvFallback) {
         process.stderr.write(`⚠️  --allow-env-fallback is active: requests without x-api-key will use ` +
             `ANTHROPIC_API_KEY from the proxy host's environment.\n`);

package/dist/commands/statusline.js

@@ -2,23 +2,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.statuslineCommand = statuslineCommand;
 const vault_guard_telemetry_1 = require("@vaultcompass/vault-guard-telemetry");
+// TelemetryStore never throws (a missing/incompatible better-sqlite3 native
+// binding degrades it to a no-op that reports zeroed stats), so this command
+// never needs to special-case "telemetry unavailable": it always constructs,
+// always prints something, and never prints an unavailability warning on
+// every invocation (statusline can be invoked by an editor every few
+// seconds; see @vaultcompass/vault-guard-telemetry's store.ts for the
+// single, opt-in (VG_DEBUG=1) debug notice logged once per process instead).
 function statuslineCommand(asJson) {
-    let store;
-    try {
-        store = new vault_guard_telemetry_1.TelemetryStore();
-    }
-    catch (e) {
-        if (e instanceof vault_guard_telemetry_1.TelemetryUnavailableError) {
-            if (asJson) {
-                process.stdout.write(`${JSON.stringify({ error: 'telemetry_unavailable', message: e.message })}\n`);
-            }
-            else {
-                process.stderr.write(`vault-guard statusline: telemetry unavailable — ${e.message}\n`);
-            }
-            return;
-        }
-        throw e;
-    }
+    const store = new vault_guard_telemetry_1.TelemetryStore();
     try {
         const payload = store.getStatuslinePayload();
         if (asJson) {

package/dist/commands/suggest-model.js

@@ -2,23 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.suggestModelCommand = suggestModelCommand;
 const vault_guard_telemetry_1 = require("@vaultcompass/vault-guard-telemetry");
+// TelemetryStore never throws: with better-sqlite3 unavailable,
+// store.suggestModel() below returns { suggested_model: null, reason: '...',
+// by_model: [] } rather than needing this command to special-case it.
 function suggestModelCommand(options) {
-    let store;
-    try {
-        store = new vault_guard_telemetry_1.TelemetryStore();
-    }
-    catch (e) {
-        if (e instanceof vault_guard_telemetry_1.TelemetryUnavailableError) {
-            if (options.json) {
-                process.stdout.write(`${JSON.stringify({ error: 'telemetry_unavailable', message: e.message }, null, 2)}\n`);
-            }
-            else {
-                process.stderr.write(`vault-guard suggest-model: telemetry unavailable — ${e.message}\n`);
-            }
-            return;
-        }
-        throw e;
-    }
+    const store = new vault_guard_telemetry_1.TelemetryStore();
     try {
         const s = store.suggestModel({ cwd: options.cwd, language: options.language });
         if (options.json) {

package/dist/init/templates.d.ts

@@ -1,4 +1,4 @@
-/** Stable init template version — bump when file contents change materially. */
+/** Stable init template version; bump when file contents change materially. */
 export declare const INIT_TEMPLATE_VERSION = "1";
 export declare const MANIFEST_RELATIVE_PATH = ".vault-guard/manifest.json";
 export declare const MANAGED_FILE_PATHS: readonly [".vault-guard.json", ".github/workflows/vault-guard.yml", ".vault-guard/mcp-snippet.json", ".vault-guard/agent-rules.md", ".vault-guard/manifest.json"];

package/dist/init/templates.js

@@ -7,7 +7,8 @@ exports.mcpSnippetJson = mcpSnippetJson;
 exports.agentRulesMarkdown = agentRulesMarkdown;
 exports.templateContentForPath = templateContentForPath;
 exports.buildManifestContent = buildManifestContent;
-/** Stable init template version — bump when file contents change materially. */
+const version_1 = require("../version");
+/** Stable init template version; bump when file contents change materially. */
 exports.INIT_TEMPLATE_VERSION = '1';
 exports.MANIFEST_RELATIVE_PATH = '.vault-guard/manifest.json';
 exports.MANAGED_FILE_PATHS = [
@@ -38,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: vaultcompasshq/vault-guard@v1.2.0
+      - uses: vaultcompasshq/vault-guard@v${(0, version_1.readCliVersion)()}
         with:
           version: latest
           path: .

package/dist/version.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Read the CLI's own package.json `version` at runtime.
+ *
+ * Resolves relative to *this module's own* compiled location, not the
+ * caller's, which is exactly why this lives in its own file rather than
+ * being duplicated per call site: `__dirname` here is always
+ * `<package root>/dist` once built (this file compiles to
+ * `dist/version.js`, directly under `dist/`, same as `dist/cli.js`) and
+ * always `<package root>/src` under ts-jest, so `path.join(__dirname, '..',
+ * 'package.json')` lands on `<package root>/package.json` either way,
+ * regardless of how deep the *caller* (e.g. `src/init/templates.ts`,
+ * compiled to `dist/init/templates.js`) sits.
+ *
+ * A static `import pkg from '../../package.json'` is not viable from
+ * `templates.ts`: that path resolves outside this package's
+ * `rootDir` (`./src`), which `tsc` rejects.
+ */
+export declare function readCliVersion(): string;

package/dist/version.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readCliVersion = readCliVersion;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Read the CLI's own package.json `version` at runtime.
+ *
+ * Resolves relative to *this module's own* compiled location, not the
+ * caller's, which is exactly why this lives in its own file rather than
+ * being duplicated per call site: `__dirname` here is always
+ * `<package root>/dist` once built (this file compiles to
+ * `dist/version.js`, directly under `dist/`, same as `dist/cli.js`) and
+ * always `<package root>/src` under ts-jest, so `path.join(__dirname, '..',
+ * 'package.json')` lands on `<package root>/package.json` either way,
+ * regardless of how deep the *caller* (e.g. `src/init/templates.ts`,
+ * compiled to `dist/init/templates.js`) sits.
+ *
+ * A static `import pkg from '../../package.json'` is not viable from
+ * `templates.ts`: that path resolves outside this package's
+ * `rootDir` (`./src`), which `tsc` rejects.
+ */
+function readCliVersion() {
+    const pkgPath = path.join(__dirname, '..', 'package.json');
+    const raw = fs.readFileSync(pkgPath, 'utf-8');
+    return JSON.parse(raw).version;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Block secrets at commit and in CI. Pre-commit hooks, SARIF output, and fast staged-file scans for AI-native workflows.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -36,8 +36,8 @@
   "dependencies": {
     "chalk": "^4.1.2",
     "commander": "^12.0.0",
-    "@vaultcompass/vault-guard-telemetry": "1.4.0",
-    "@vaultcompass/vault-guard-core": "1.4.0"
+    "@vaultcompass/vault-guard-core": "1.4.2",
+    "@vaultcompass/vault-guard-telemetry": "1.4.2"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",