circle-ir-ai 2.7.17 → 2.8.0

package/dist/secret-scan/scanner.d.ts

@@ -1,15 +1,18 @@
 /**
- * Secret Scanner Module
+ * Secret Scanner Module (Refactored)
  *
- * Scans code and Git history for secrets and credentials.
+ * Architecture:
+ * - SAST detection: Delegates to circle-ir's ScanSecretsPass (no regex duplication)
+ * - Git history: Scans commits for secrets introduced historically (circle-ir-ai domain)
+ * - LLM verification: Reduces false positives via context-aware analysis
+ *
+ * This module consumes CircleIR findings rather than reimplementing SAST logic.
  */
-import { type SecretPattern, type SecretSeverity } from './patterns.js';
+export type SecretSeverity = 'critical' | 'high' | 'medium' | 'low';
 /**
  * Options for secret scanning
  */
 export interface SecretScanOptions {
-    /** Patterns to use (defaults to all) */
-    patterns?: SecretPattern[];
     /** Categories to include (defaults to all) */
     includeCategories?: string[];
     /** Categories to exclude */
@@ -24,6 +27,8 @@ export interface SecretScanOptions {
     includeFiles?: string[];
     /** File patterns to exclude (glob) */
     excludeFiles?: string[];
+    /** Enable LLM verification to reduce false positives */
+    llmVerify?: boolean;
     /** Progress callback */
     onProgress?: (progress: ScanProgress) => void;
 }
@@ -31,7 +36,7 @@ export interface SecretScanOptions {
  * Scan progress information
  */
 export interface ScanProgress {
-    phase: 'indexing' | 'scanning-files' | 'scanning-history' | 'complete';
+    phase: 'indexing' | 'scanning-files' | 'scanning-history' | 'verifying' | 'complete';
     currentFile?: string;
     filesScanned: number;
     totalFiles: number;
@@ -69,6 +74,10 @@ export interface DetectedSecret {
     commitDate?: string;
     /** Whether secret is still present in HEAD */
     presentInHead: boolean;
+    /** LLM verification result */
+    llmVerified?: boolean;
+    /** LLM confidence score */
+    llmConfidence?: number;
 }
 /**
  * Scan result summary
@@ -99,51 +108,40 @@ export interface SecretScanResult {
  * Secret Scanner class
  */
 export declare class SecretScanner {
-    private patterns;
     private options;
     constructor(options?: SecretScanOptions);
-    /**
-     * Select patterns based on options
-     */
-    private selectPatterns;
     /**
      * Scan a directory for secrets
      */
     scan(directory: string): Promise<SecretScanResult>;
     /**
-     * Scan a single file for secrets
+     * Scan a single file using circle-ir's ScanSecretsPass
      */
-    scanFile(filePath: string, _baseDir: string): Promise<DetectedSecret[]>;
+    private scanFileWithCircleIR;
     /**
-     * Scan a single line for secrets
+     * Scan git history for secrets
+     * Uses minimal patterns since we can't run circle-ir on diffs
      */
-    private scanLine;
+    private scanGitHistory;
     /**
-     * Check if a match position falls inside a regex literal (/.../).
-     * Looks for unescaped `/` delimiters surrounding the match range.
+     * Scan a git diff for secrets using minimal history patterns
      */
-    private isInsideRegexLiteral;
+    private scanDiff;
     /**
-     * Scan git history for secrets
+     * Scan a single line using minimal history patterns
+     * This is only used for git history scanning where we can't use circle-ir
      */
-    private scanGitHistory;
+    private scanLineWithPatterns;
     /**
-     * Scan a git diff for secrets
+     * LLM verification to reduce false positives
      */
-    private scanDiff;
+    private llmVerifySecrets;
     /**
-     * Built-in path-skip regexes shared between the working-tree walk
-     * (`getFiles`) and the git-history diff path (`scanDiff`). #60: previously
-     * only the working-tree walk applied these — git-history scans walked
-     * every diff including `Cargo.lock`, `*.lock`, binary blobs, etc.,
-     * producing noisy "Status: Historical" findings on paths the user had
-     * already excluded from their working-tree scan.
+     * Built-in path-skip patterns
      */
     private static readonly BUILTIN_EXCLUDE_PATTERNS;
     /**
-     * #60: returns true when a path should be filtered out per built-in
-     * regex excludes + user-supplied include/exclude minimatch globs.
-     * Used by both the working-tree walk and the git-history diff parser.
+     * Check if path should be excluded
      */
     private isPathExcluded;
     /**
@@ -154,14 +152,6 @@ export declare class SecretScanner {
      * Check if directory is a git repo
      */
     private isGitRepo;
-    /**
-     * Redact a secret for safe display
-     */
-    private redactSecret;
-    /**
-     * Truncate long lines
-     */
-    private truncateLine;
     /**
      * Generate .gitignore recommendations
      */

package/dist/secret-scan/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/secret-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAEvB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,8CAA8C;IAC9C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,4BAA4B;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iCAAiC;IACjC,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,kCAAkC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,UAAU,CAAC;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE,cAAc,CAAC;IACzB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,cAAc,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3C,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACpC;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,OAAO,CAAoB;gBAEvB,OAAO,GAAE,iBAAsB;IAK3C;;OAEG;IACH,OAAO,CAAC,cAAc;IA2BtB;;OAEG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8FxD;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAsB7E;;OAEG;IACH,OAAO,CAAC,QAAQ;IA+EhB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAiB5B;;OAEG;YACW,cAAc;IA0D5B;;OAEG;IACH,OAAO,CAAC,QAAQ;IA2DhB;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CA4B9C;IAEF;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAetB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAgDhB;;OAEG;IACH,OAAO,CAAC,SAAS;IAYjB;;OAEG;IACH,OAAO,CAAC,YAAY;IAYpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAKpB;;OAEG;IACH,OAAO,CAAC,gCAAgC;CAqDzC;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAK3B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAkFnE"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/secret-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,4BAA4B;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iCAAiC;IACjC,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,kCAAkC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wBAAwB;IACxB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,WAAW,GAAG,UAAU,CAAC;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB;IACrB,QAAQ,EAAE,cAAc,CAAC;IACzB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;IACvB,8BAA8B;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,cAAc,EAAE,MAAM,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3C,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,mDAAmD;IACnD,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACpC;AA4DD;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,OAAO,CAAoB;gBAEvB,OAAO,GAAE,iBAAsB;IAI3C;;OAEG;IACG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgIxD;;OAEG;YACW,oBAAoB;IA8BlC;;;OAGG;YACW,cAAc;IAmD5B;;OAEG;IACH,OAAO,CAAC,QAAQ;IAmDhB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAkD5B;;OAEG;YACW,gBAAgB;IAgD9B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CA4B9C;IAEF;;OAEG;IACH,OAAO,CAAC,cAAc;IAetB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAuChB;;OAEG;IACH,OAAO,CAAC,SAAS;IAYjB;;OAEG;IACH,OAAO,CAAC,gCAAgC;CAmDzC;AAyBD;;GAEG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAK3B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAiFnE"}