arcane-cli 0.24.1 → 0.25.0

package/dist/index.js

@@ -6,7 +6,7 @@ const require = __createRequire(import.meta.url);
 import { Command } from "commander";
 import { createRequire as createRequire2 } from "module";
 import { fileURLToPath } from "url";
-import { dirname as dirname4, join as join12 } from "path";
+import { dirname as dirname4, join as join14 } from "path";
 
 // src/commands/init.ts
 import { select as select2, confirm, input as input2 } from "@inquirer/prompts";
@@ -3858,8 +3858,8 @@ async function checkVSCodeExtension(id, label) {
   ];
   for (const dir of extDirs) {
     try {
-      const { readdir: readdir5 } = await import("fs/promises");
-      const entries = await readdir5(dir);
+      const { readdir: readdir7 } = await import("fs/promises");
+      const entries = await readdir7(dir);
       const prefix = id.toLowerCase() + "-";
       const found = entries.some(
         (e) => e.toLowerCase() === id.toLowerCase() || e.toLowerCase().startsWith(prefix)
@@ -4194,6 +4194,215 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
   }
 }
 
+// src/modules/ward.ts
+import { readdir as readdir6, readFile as readFile8 } from "fs/promises";
+import { join as join13, relative as relative2 } from "path";
+
+// src/modules/denylist-scan.ts
+import { readFile as readFile7, readdir as readdir5 } from "fs/promises";
+import { join as join12, relative } from "path";
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function createDenylistRules(tokens, labelPrefix) {
+  return tokens.map((token, index) => ({
+    label: `${labelPrefix}-${index + 1}`,
+    pattern: new RegExp(
+      `(?:^|[^A-Za-z0-9])${escapeRegExp(token)}(?=$|[^A-Za-z0-9])`,
+      "i"
+    )
+  }));
+}
+var SKIP_DIRECTORIES = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "coverage",
+  ".vitest"
+]);
+var DEFAULT_SCANNABLE_EXTENSIONS = [".md", ".ts", ".js", ".json", ".yml", ".yaml"];
+async function collectScannableFiles(root, repoRoot = root, extensions = DEFAULT_SCANNABLE_EXTENSIONS) {
+  const collected = [];
+  let entries;
+  try {
+    entries = await readdir5(root, { withFileTypes: true });
+  } catch {
+    return collected;
+  }
+  for (const entry of entries) {
+    const absolutePath = join12(root, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRECTORIES.has(entry.name)) continue;
+      collected.push(...await collectScannableFiles(absolutePath, repoRoot, extensions));
+    } else if (extensions.some((ext) => entry.name.endsWith(ext))) {
+      const displayPath = relative(repoRoot, absolutePath).replace(/\\/g, "/");
+      collected.push([absolutePath, displayPath]);
+    }
+  }
+  return collected;
+}
+
+// src/modules/ward.ts
+async function scanFileAllRules(absolutePath, displayPath, rules) {
+  const findings = [];
+  let content;
+  try {
+    content = await readFile8(absolutePath, "utf8");
+  } catch {
+    return findings;
+  }
+  const lines = content.split("\n");
+  for (let index = 0; index < lines.length; index++) {
+    const searchable = lines[index].replace(/\{[A-Z][A-Z0-9_]*\}/g, "");
+    for (const rule of rules) {
+      if (rule.pattern.test(searchable)) {
+        findings.push({ file: displayPath, line: index + 1, rule: rule.label });
+      }
+    }
+  }
+  return findings;
+}
+var VENDOR_IDENTIFIER_PROTECTION_LIST = [
+  "claude",
+  "gpt-4",
+  "gpt-3.5",
+  "gemini",
+  "llama",
+  "mistral",
+  "copilot",
+  "anthropic",
+  "openai"
+];
+var GREP_PROOF_EXTENSIONS = [".gif", ".png", ".jpg", ".jpeg", ".mp4", ".mov", ".mp3", ".wav"];
+var WARD_TEXT_EXTENSIONS = [
+  ".md",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".json",
+  ".yml",
+  ".yaml",
+  ".txt",
+  ".mdx"
+];
+function applyExclusions(findings, fileLines, exclusions) {
+  if (exclusions.length === 0) return findings;
+  return findings.filter((finding) => {
+    const applicable = exclusions.filter((e) => e.rule === finding.rule);
+    if (applicable.length === 0) return true;
+    const lines = fileLines.get(finding.file);
+    const lineText = lines?.[finding.line - 1] ?? "";
+    return !applicable.some((e) => lineText.includes(e.context));
+  });
+}
+async function scanFilenames(root, rules, repoRoot = root) {
+  const findings = [];
+  let entries;
+  try {
+    entries = await readdir6(root, { withFileTypes: true });
+  } catch {
+    return findings;
+  }
+  for (const entry of entries) {
+    const absolutePath = join13(root, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRECTORIES.has(entry.name)) continue;
+      findings.push(...await scanFilenames(absolutePath, rules, repoRoot));
+      continue;
+    }
+    const displayPath = relative2(repoRoot, absolutePath).replace(/\\/g, "/");
+    for (const rule of rules) {
+      if (rule.pattern.test(entry.name)) {
+        findings.push({ file: displayPath, line: 0, rule: rule.label });
+        break;
+      }
+    }
+  }
+  return findings;
+}
+async function flagGrepProofMedia(root, repoRoot = root) {
+  const files = await collectScannableFiles(root, repoRoot, GREP_PROOF_EXTENSIONS);
+  return files.map(([, displayPath]) => ({
+    file: displayPath,
+    reason: "binary media format -- text extraction is unreliable; review manually for embedded identifiers"
+  }));
+}
+async function runWard(repoRoot, options = {}) {
+  const userTerms = options.terms ?? [];
+  const exclusions = options.exclusions ?? [];
+  const extensions = [...WARD_TEXT_EXTENSIONS, ...options.binaryExtensions ?? []];
+  const userRules = createDenylistRules(userTerms, "ward-term");
+  const vendorRules = createDenylistRules([...VENDOR_IDENTIFIER_PROTECTION_LIST], "ward-vendor");
+  const allRules = [...userRules, ...vendorRules];
+  const contentFiles = await collectScannableFiles(repoRoot, repoRoot, extensions);
+  const fileLines = /* @__PURE__ */ new Map();
+  const contentFindings = [];
+  for (const [absolutePath, displayPath] of contentFiles) {
+    const findings2 = await scanFileAllRules(absolutePath, displayPath, allRules);
+    if (findings2.length > 0) {
+      try {
+        fileLines.set(displayPath, (await readFile8(absolutePath, "utf8")).split("\n"));
+      } catch {
+      }
+    }
+    contentFindings.push(...findings2);
+  }
+  const filenameFindings = await scanFilenames(repoRoot, allRules);
+  const combined = [...contentFindings, ...filenameFindings];
+  const excluded = applyExclusions(combined, fileLines, exclusions);
+  const vendorLabels = new Set(vendorRules.map((r) => r.label));
+  const findings = excluded.map((f) => ({
+    ...f,
+    category: vendorLabels.has(f.rule) ? "protected-vendor-identifier" : "leak"
+  }));
+  const mediaFlags = await flagGrepProofMedia(repoRoot);
+  return { findings, mediaFlags };
+}
+
+// src/commands/ward.ts
+function parseTerms(raw) {
+  if (!raw) return [];
+  return raw.split(",").map((t) => t.trim()).filter(Boolean);
+}
+async function runWardCli(targetDir, options = {}, exclusions = []) {
+  const terms = parseTerms(options.terms);
+  const report = await runWard(targetDir, { terms, exclusions });
+  console.log("\nspell ward \u2014 scanning for leaked identifiers\n");
+  const leaks = report.findings.filter((f) => f.category === "leak");
+  const protectedHits = report.findings.filter((f) => f.category === "protected-vendor-identifier");
+  if (leaks.length === 0 && protectedHits.length === 0) {
+    console.log("  \u2713 No denylisted terms found.");
+  }
+  for (const finding of leaks) {
+    const where = finding.line === 0 ? `${finding.file} (filename)` : `${finding.file}:${finding.line}`;
+    console.log(`  \u2717 [leak] ${where} \u2014 rule: ${finding.rule}`);
+  }
+  for (const finding of protectedHits) {
+    const where = finding.line === 0 ? `${finding.file} (filename)` : `${finding.file}:${finding.line}`;
+    console.log(
+      `  \u26A0 [protected-vendor-identifier] ${where} \u2014 rule: ${finding.rule} \u2014 verify before any automated rename touches this line`
+    );
+  }
+  if (report.mediaFlags.length > 0) {
+    console.log("\n  Grep-proof media flagged for manual review:");
+    for (const flag of report.mediaFlags) {
+      console.log(`    ? ${flag.file} \u2014 ${flag.reason}`);
+    }
+  }
+  console.log();
+  if (options.gate && leaks.length > 0) {
+    console.log(`  ${leaks.length} leak(s) found. Failing (--gate mode).
+`);
+    process.exitCode = 1;
+    return;
+  }
+  if (leaks.length > 0) {
+    console.log(`  ${leaks.length} leak(s) found. Run with --gate to fail CI on this.
+`);
+  }
+}
+
 // src/commands/unblock-push.ts
 import { basename as basename2, resolve as resolve2 } from "path";
 import { input as input4 } from "@inquirer/prompts";
@@ -4296,7 +4505,7 @@ Name did not match ("${typed.trim()}" \u2260 "${repoName}"). Nothing changed.`);
 import { realpathSync } from "fs";
 var require3 = createRequire2(import.meta.url);
 var pkg = require3("../package.json");
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join12(dirname4(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join14(dirname4(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 program.name("spell").description("Arcane framework CLI \u2014 scaffold and manage governance files").version(pkg.version).action(async () => {
   if (program.args.length > 0) {
@@ -4362,6 +4571,9 @@ program.command("unblock-push").description("Lift this repository's push block (
 program.command("doctor").description("Check your environment for Arcane prerequisites").option("--fix", "Automatically create missing session continuity files").action(async (opts) => {
   await runDoctor(process.cwd(), { fix: opts.fix }, ASSETS_DIR);
 });
+program.command("ward").description("Scan the repo for leaked third-party identifiers and trademarks (T18)").option("--terms <terms>", "Comma-separated denylist terms, in addition to the built-in vendor-identifier list").option("--gate", "Exit non-zero if any leak is found (for CI)").action(async (opts) => {
+  await runWardCli(process.cwd(), opts);
+});
 var agentsCommand = program.command("agents").description("Manage the portable agent system (init, sync, list)");
 agentsCommand.command("init").description(
   "Interactive agent roster setup \u2014 choose profile, naming strategy, and install definitions"