@vibecodeqa/cli 0.39.0 → 0.39.1

package/dist/runners/secrets.d.ts

@@ -1,3 +1,5 @@
-/** Secret detection — delegates to gitleaks when available, falls back to built-in regex. */
+/** Secret detection — delegates to gitleaks when available; otherwise scans with
+ *  secretlint's recommended ruleset (broad coverage) PLUS our own patterns (which
+ *  add LLM keys — OpenAI/Anthropic — that secretlint's preset doesn't cover). */
 import type { CheckResult } from "../types.js";
-export declare function runSecrets(cwd: string): CheckResult;
+export declare function runSecrets(cwd: string): Promise<CheckResult>;

package/dist/runners/secrets.js

@@ -1,9 +1,20 @@
-/** Secret detection — delegates to gitleaks when available, falls back to built-in regex. */
+/** Secret detection — delegates to gitleaks when available; otherwise scans with
+ *  secretlint's recommended ruleset (broad coverage) PLUS our own patterns (which
+ *  add LLM keys — OpenAI/Anthropic — that secretlint's preset doesn't cover). */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { lintSource } from "@secretlint/core";
+import { creator as secretlintPreset } from "@secretlint/secretlint-rule-preset-recommend";
 import { collectAllFiles } from "../fs-utils.js";
 import { gradeFromScore } from "../types.js";
 import { run } from "./exec.js";
+const SECRETLINT_CONFIG = { rules: [{ id: "@secretlint/secretlint-rule-preset-recommend", rule: secretlintPreset }] };
+/** Human-readable kind from a secretlint message, without leaking the secret value. */
+function secretlintKind(msg) {
+    if (msg.messageId)
+        return msg.messageId.replace(/_/g, " ").toLowerCase();
+    return (msg.ruleId ?? "secret").replace(/.*secretlint-rule-/, "");
+}
 /** Try running gitleaks for secret detection. Returns true if gitleaks ran. */
 function tryGitleaks(cwd, issues) {
     const { stdout, ok } = run("gitleaks detect --no-git --report-format json --report-path /dev/stdout 2>/dev/null", cwd, 30_000);
@@ -58,37 +69,61 @@ const SECRET_PATTERNS = [
         pattern: /(?:password|secret|api_key|apikey|token|auth)\s*[:=]\s*['"][A-Za-z0-9+/=]{20,}['"]/,
     },
 ];
-export function runSecrets(cwd) {
-    const start = Date.now();
-    const issues = [];
-    // Try gitleaks first (industry standard, 800+ patterns)
-    const gitleaksResult = tryGitleaks(cwd, issues);
-    const tool = gitleaksResult ? "gitleaks" : "built-in";
-    if (!gitleaksResult) {
-        // Fallback: built-in regex patterns
-        const sourceFiles = collectAllFiles(cwd, { extraExts: true });
-        for (const sf of sourceFiles) {
-            if (sf.isTest || sf.path.includes("__mock"))
+function scanPatterns(files, add) {
+    for (const sf of files) {
+        const lines = sf.content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (line.trim().startsWith("//") || line.trim().startsWith("*"))
                 continue;
-            const lines = sf.content.split("\n");
-            for (let i = 0; i < lines.length; i++) {
-                const line = lines[i];
-                if (line.trim().startsWith("//") || line.trim().startsWith("*"))
-                    continue;
-                for (const { name, pattern } of SECRET_PATTERNS) {
-                    if (pattern.test(line)) {
-                        issues.push({
-                            severity: "error",
-                            message: `Possible ${name}`,
-                            file: sf.path,
-                            line: i + 1,
-                            rule: "secret-detected",
-                        });
-                    }
-                }
+            for (const { name, pattern } of SECRET_PATTERNS) {
+                if (pattern.test(line))
+                    add({ severity: "error", message: `Possible ${name}`, file: sf.path, line: i + 1, rule: "secret-detected" });
             }
         }
     }
+}
+async function scanSecretlint(files, add) {
+    for (const sf of files) {
+        try {
+            const result = await lintSource({
+                source: { filePath: sf.path, content: sf.content, contentType: "text" },
+                options: { config: SECRETLINT_CONFIG },
+            });
+            for (const m of result.messages) {
+                add({ severity: "error", message: `Possible ${secretlintKind(m)} — remove and rotate`, file: sf.path, line: m.loc?.start?.line ?? 1, rule: "secret-detected" });
+            }
+        }
+        catch {
+            /* unparseable file — skip */
+        }
+    }
+}
+/** Built-in fallback when gitleaks isn't installed: curated patterns first (nice
+ *  names + LLM keys, winning dedup), then secretlint's broad ruleset augments. */
+async function scanFallback(cwd) {
+    const files = collectAllFiles(cwd, { extraExts: true }).filter((sf) => !sf.isTest && !sf.path.includes("__mock"));
+    const issues = [];
+    const seen = new Set();
+    const add = (iss) => {
+        const key = `${iss.file}:${iss.line}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            issues.push(iss);
+        }
+    };
+    scanPatterns(files, add);
+    await scanSecretlint(files, add);
+    return issues;
+}
+export async function runSecrets(cwd) {
+    const start = Date.now();
+    const issues = [];
+    // Try gitleaks first (industry standard, 800+ patterns)
+    const gitleaksResult = tryGitleaks(cwd, issues);
+    const tool = gitleaksResult ? "gitleaks" : "secretlint";
+    if (!gitleaksResult)
+        issues.push(...(await scanFallback(cwd)));
     // ── .env file audit ──
     const envFiles = [".env", ".env.local", ".env.production", ".env.development"];
     const gitignore = existsSync(join(cwd, ".gitignore")) ? readFileSync(join(cwd, ".gitignore"), "utf-8") : "";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vibecodeqa/cli",
-	"version": "0.39.0",
+	"version": "0.39.1",
 	"description": "Code health scanner for the AI coding era. 25 checks, zero config, full report.",
 	"type": "module",
 	"bin": {
@@ -54,6 +54,8 @@
 	},
 	"dependencies": {
 		"@jscpd/core": "^4.2.4",
+		"@secretlint/core": "^13.0.2",
+		"@secretlint/secretlint-rule-preset-recommend": "^13.0.2",
 		"dependency-cruiser": "^17.4.3",
 		"ink": "^5.2.1",
 		"react": "^18.3.1"