arcane-cli 0.33.9 → 0.34.0

package/dist/index.js

@@ -4817,6 +4817,9 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
   }
 }
 
+// src/commands/ward.ts
+import { readFile as readFile11 } from "fs/promises";
+
 // src/modules/ward.ts
 import { readdir as readdir6, readFile as readFile10 } from "fs/promises";
 import { join as join13, relative as relative2 } from "path";
@@ -4942,8 +4945,24 @@ function parseTerms(raw) {
   if (!raw) return [];
   return raw.split(",").map((t) => t.trim()).filter(Boolean);
 }
+function parseTermsFileContent(raw) {
+  return raw.split(/[,\r\n]+/).map((t) => t.trim()).filter(Boolean);
+}
+async function readTermsFile(filePath) {
+  try {
+    return parseTermsFileContent(await readFile11(filePath, "utf8"));
+  } catch (error) {
+    console.warn(
+      `\u26A0 arcane: could not read --terms-file "${filePath}": ${error.message}`
+    );
+    return [];
+  }
+}
 async function runWardCli(targetDir, options = {}, exclusions = []) {
-  const terms = parseTerms(options.terms);
+  const terms = [
+    ...parseTerms(options.terms),
+    ...options.termsFile ? await readTermsFile(options.termsFile) : []
+  ];
   const report = await runWard(targetDir, { terms, exclusions });
   console.log("\nspell ward \u2014 scanning for leaked identifiers\n");
   const leaks = report.findings.filter((f) => f.category === "leak");
@@ -5154,6 +5173,9 @@ program.command("doctor").description("Check your environment for Arcane prerequ
 program.command("ward").description("Scan the repo for leaked identifiers -- third-party trademarks and the operator's own personal identifiers alike (T18)").option(
   "--terms <terms>",
   "Comma-separated denylist terms, in addition to the built-in vendor-identifier list. Seed this from your OWN identity too, not just org/venture names -- usernames, machine names, and personal handles leak the same way a private venture name does (I1)"
+).option(
+  "--terms-file <path>",
+  "Read denylist terms from a file instead of --terms, to avoid shell-history exposure (ARC-041). Same comma/newline-separated format as ARCANE_ORG_TOKENS."
 ).option("--gate", "Exit non-zero if any leak is found (for CI)").action(async (opts) => {
   await runWardCli(process.cwd(), opts);
 });