claude-flow 2.5.0-alpha.141 → 2.7.0-alpha.1

package/dist/src/hooks/redaction-hook.js

@@ -0,0 +1,89 @@
+import { KeyRedactor } from '../utils/key-redactor.js';
+import { readFileSync } from 'fs';
+import { execSync } from 'child_process';
+export async function validateNoSensitiveData() {
+    const issues = [];
+    try {
+        const stagedFiles = execSync('git diff --cached --name-only', {
+            encoding: 'utf-8'
+        }).split('\n').filter((f)=>f.trim() && !f.includes('.env') && !f.includes('node_modules') && !f.endsWith('.map'));
+        const placeholderPatterns = [
+            /API_KEY=\(paste/i,
+            /API_KEY=\(your/i,
+            /API_KEY=\.\.\./i,
+            /API_KEY="\.\.\."/i,
+            /API_KEY="\(paste/i,
+            /API_KEY="\(your/i,
+            /API_KEY=sk-ant-\.\.\./i,
+            /API_KEY=sk-or-v1-\.\.\./i,
+            /API_KEY="sk-ant-\.\.\."/i,
+            /API_KEY="sk-or-v1-\.\.\."/i,
+            /API_KEY=sk-ant-xxxxx/i,
+            /API_KEY=sk-or-v1-xxxxx/i,
+            /TOKEN=\(paste/i,
+            /TOKEN=\(your/i,
+            /SECRET=\(paste/i,
+            /SECRET=\(your/i
+        ];
+        for (const file of stagedFiles){
+            try {
+                if (file.startsWith('docs/') || file.includes('/docs/')) {
+                    const content = readFileSync(file, 'utf-8');
+                    const hasOnlyPlaceholders = placeholderPatterns.some((pattern)=>pattern.test(content));
+                    if (hasOnlyPlaceholders) {
+                        continue;
+                    }
+                }
+                const content = readFileSync(file, 'utf-8');
+                const hasPlaceholders = placeholderPatterns.some((pattern)=>pattern.test(content));
+                if (hasPlaceholders && (file.includes('example') || file.includes('template') || file.includes('/docs/'))) {
+                    continue;
+                }
+                const validation = KeyRedactor.validate(content);
+                if (!validation.safe) {
+                    const warningsText = validation.warnings.join(' ');
+                    if (hasPlaceholders && !warningsText.includes('sk-ant-a') && !warningsText.includes('sk-or-v')) {
+                        continue;
+                    }
+                    issues.push(`⚠️  ${file}: ${validation.warnings.join(', ')}`);
+                }
+            } catch (error) {
+                continue;
+            }
+        }
+        return {
+            safe: issues.length === 0,
+            issues
+        };
+    } catch (error) {
+        console.error('Error validating sensitive data:', error);
+        return {
+            safe: false,
+            issues: [
+                'Failed to validate files'
+            ]
+        };
+    }
+}
+export async function runRedactionCheck() {
+    console.log('🔒 Running API key redaction check...\n');
+    const result = await validateNoSensitiveData();
+    if (!result.safe) {
+        console.error('❌ COMMIT BLOCKED - Sensitive data detected:\n');
+        result.issues.forEach((issue)=>console.error(issue));
+        console.error('\n⚠️  Please remove sensitive data before committing.');
+        console.error('💡 Tip: Use environment variables instead of hardcoding keys.\n');
+        return 1;
+    }
+    console.log('✅ No sensitive data detected - safe to commit\n');
+    return 0;
+}
+const isMainModule = import.meta.url === `file://${process.argv[1]}`;
+if (isMainModule) {
+    runRedactionCheck().then((code)=>process.exit(code)).catch((error)=>{
+        console.error('Error:', error);
+        process.exit(1);
+    });
+}
+
+//# sourceMappingURL=redaction-hook.js.map

package/dist/src/hooks/redaction-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/hooks/redaction-hook.ts"],"sourcesContent":["/**\n * Git Pre-commit Hook for API Key Redaction\n * Prevents sensitive data from being committed\n */\n\nimport { KeyRedactor } from '../utils/key-redactor.js';\nimport { readFileSync } from 'fs';\nimport { execSync } from 'child_process';\n\nexport async function validateNoSensitiveData(): Promise<{ safe: boolean; issues: string[] }> {\n  const issues: string[] = [];\n\n  try {\n    // Get staged files\n    const stagedFiles = execSync('git diff --cached --name-only', { encoding: 'utf-8' })\n      .split('\\n')\n      .filter(f => f.trim() && !f.includes('.env') && !f.includes('node_modules') && !f.endsWith('.map'));\n\n    // Common documentation placeholder patterns (these are safe)\n    const placeholderPatterns = [\n      /API_KEY=\\(paste/i,\n      /API_KEY=\\(your/i,\n      /API_KEY=\\.\\.\\./i,\n      /API_KEY=\"\\.\\.\\.\"/i,\n      /API_KEY=\"\\(paste/i,\n      /API_KEY=\"\\(your/i,\n      /API_KEY=sk-ant-\\.\\.\\./i,       // Truncated example keys\n      /API_KEY=sk-or-v1-\\.\\.\\./i,     // Truncated example keys\n      /API_KEY=\"sk-ant-\\.\\.\\.\"/i,     // Quoted truncated keys\n      /API_KEY=\"sk-or-v1-\\.\\.\\.\"/i,   // Quoted truncated keys\n      /API_KEY=sk-ant-xxxxx/i,        // xxxxx format examples\n      /API_KEY=sk-or-v1-xxxxx/i,      // xxxxx format examples\n      /TOKEN=\\(paste/i,\n      /TOKEN=\\(your/i,\n      /SECRET=\\(paste/i,\n      /SECRET=\\(your/i,\n    ];\n\n    // Check each staged file\n    for (const file of stagedFiles) {\n      try {\n        // Skip documentation files with obvious placeholders\n        if (file.startsWith('docs/') || file.includes('/docs/')) {\n          const content = readFileSync(file, 'utf-8');\n          // Check if file only contains placeholder patterns\n          const hasOnlyPlaceholders = placeholderPatterns.some(pattern => pattern.test(content));\n          if (hasOnlyPlaceholders) {\n            continue; // Skip - these are documentation examples\n          }\n        }\n\n        const content = readFileSync(file, 'utf-8');\n\n        // Check for placeholder patterns in the content\n        const hasPlaceholders = placeholderPatterns.some(pattern => pattern.test(content));\n        if (hasPlaceholders && (file.includes('example') || file.includes('template') || file.includes('/docs/'))) {\n          continue; // Skip - these are examples/templates with placeholders\n        }\n\n        const validation = KeyRedactor.validate(content);\n\n        if (!validation.safe) {\n          // Double-check: if warnings are only about placeholder patterns, skip\n          const warningsText = validation.warnings.join(' ');\n          if (hasPlaceholders && !warningsText.includes('sk-ant-a') && !warningsText.includes('sk-or-v')) {\n            continue; // Likely a false positive from documentation\n          }\n          issues.push(`⚠️  ${file}: ${validation.warnings.join(', ')}`);\n        }\n      } catch (error) {\n        // File might be deleted or binary\n        continue;\n      }\n    }\n\n    return {\n      safe: issues.length === 0,\n      issues,\n    };\n  } catch (error) {\n    console.error('Error validating sensitive data:', error);\n    return {\n      safe: false,\n      issues: ['Failed to validate files'],\n    };\n  }\n}\n\nexport async function runRedactionCheck(): Promise<number> {\n  console.log('🔒 Running API key redaction check...\\n');\n\n  const result = await validateNoSensitiveData();\n\n  if (!result.safe) {\n    console.error('❌ COMMIT BLOCKED - Sensitive data detected:\\n');\n    result.issues.forEach(issue => console.error(issue));\n    console.error('\\n⚠️  Please remove sensitive data before committing.');\n    console.error('💡 Tip: Use environment variables instead of hardcoding keys.\\n');\n    return 1;\n  }\n\n  console.log('✅ No sensitive data detected - safe to commit\\n');\n  return 0;\n}\n\n// CLI execution (ES module compatible)\nconst isMainModule = import.meta.url === `file://${process.argv[1]}`;\nif (isMainModule) {\n  runRedactionCheck()\n    .then(code => process.exit(code))\n    .catch(error => {\n      console.error('Error:', error);\n      process.exit(1);\n    });\n}\n"],"names":["KeyRedactor","readFileSync","execSync","validateNoSensitiveData","issues","stagedFiles","encoding","split","filter","f","trim","includes","endsWith","placeholderPatterns","file","startsWith","content","hasOnlyPlaceholders","some","pattern","test","hasPlaceholders","validation","validate","safe","warningsText","warnings","join","push","error","length","console","runRedactionCheck","log","result","forEach","issue","isMainModule","url","process","argv","then","code","exit","catch"],"mappings":"AAKA,SAASA,WAAW,QAAQ,2BAA2B;AACvD,SAASC,YAAY,QAAQ,KAAK;AAClC,SAASC,QAAQ,QAAQ,gBAAgB;AAEzC,OAAO,eAAeC;IACpB,MAAMC,SAAmB,EAAE;IAE3B,IAAI;QAEF,MAAMC,cAAcH,SAAS,iCAAiC;YAAEI,UAAU;QAAQ,GAC/EC,KAAK,CAAC,MACNC,MAAM,CAACC,CAAAA,IAAKA,EAAEC,IAAI,MAAM,CAACD,EAAEE,QAAQ,CAAC,WAAW,CAACF,EAAEE,QAAQ,CAAC,mBAAmB,CAACF,EAAEG,QAAQ,CAAC;QAG7F,MAAMC,sBAAsB;YAC1B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAGD,KAAK,MAAMC,QAAQT,YAAa;YAC9B,IAAI;gBAEF,IAAIS,KAAKC,UAAU,CAAC,YAAYD,KAAKH,QAAQ,CAAC,WAAW;oBACvD,MAAMK,UAAUf,aAAaa,MAAM;oBAEnC,MAAMG,sBAAsBJ,oBAAoBK,IAAI,CAACC,CAAAA,UAAWA,QAAQC,IAAI,CAACJ;oBAC7E,IAAIC,qBAAqB;wBACvB;oBACF;gBACF;gBAEA,MAAMD,UAAUf,aAAaa,MAAM;gBAGnC,MAAMO,kBAAkBR,oBAAoBK,IAAI,CAACC,CAAAA,UAAWA,QAAQC,IAAI,CAACJ;gBACzE,IAAIK,mBAAoBP,CAAAA,KAAKH,QAAQ,CAAC,cAAcG,KAAKH,QAAQ,CAAC,eAAeG,KAAKH,QAAQ,CAAC,SAAQ,GAAI;oBACzG;gBACF;gBAEA,MAAMW,aAAatB,YAAYuB,QAAQ,CAACP;gBAExC,IAAI,CAACM,WAAWE,IAAI,EAAE;oBAEpB,MAAMC,eAAeH,WAAWI,QAAQ,CAACC,IAAI,CAAC;oBAC9C,IAAIN,mBAAmB,CAACI,aAAad,QAAQ,CAAC,eAAe,CAACc,aAAad,QAAQ,CAAC,YAAY;wBAC9F;oBACF;oBACAP,OAAOwB,IAAI,CAAC,CAAC,IAAI,EAAEd,KAAK,EAAE,EAAEQ,WAAWI,QAAQ,CAACC,IAAI,CAAC,OAAO;gBAC9D;YACF,EAAE,OAAOE,OAAO;gBAEd;YACF;QACF;QAEA,OAAO;YACLL,MAAMpB,OAAO0B,MAAM,KAAK;YACxB1B;QACF;IACF,EAAE,OAAOyB,OAAO;QACdE,QAAQF,KAAK,CAAC,oCAAoCA;QAClD,OAAO;YACLL,MAAM;YACNpB,QAAQ;gBAAC;aAA2B;QACtC;IACF;AACF;AAEA,OAAO,eAAe4B;IACpBD,QAAQE,GAAG,CAAC;IAEZ,MAAMC,SAAS,MAAM/B;IAErB,IAAI,CAAC+B,OAAOV,IAAI,EAAE;QAChBO,QAAQF,KAAK,CAAC;QACdK,OAAO9B,MAAM,CAAC+B,OAAO,CAACC,CAAAA,QAASL,QAAQF,KAAK,CAACO;QAC7CL,QAAQF,KAAK,CAAC;QACdE,QAAQF,KAAK,CAAC;QACd,OAAO;IACT;IAEAE,QAAQE,GAAG,CAAC;IACZ,OAAO;AACT;AAGA,MAAMI,eAAe,YAAYC,GAAG,KAAK,CAAC,OAAO,EAAEC,QAAQC,IAAI,CAAC,EAAE,EAAE;AACpE,IAAIH,cAAc;IAChBL,oBACGS,IAAI,CAACC,CAAAA,OAAQH,QAAQI,IAAI,CAACD,OAC1BE,KAAK,CAACf,CAAAA;QACLE,QAAQF,KAAK,CAAC,UAAUA;QACxBU,QAAQI,IAAI,CAAC;IACf;AACJ"}