clckernel 1.2.6

package/tools/scan_secrets.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * Secrets & API Key Scanner
+ * Detects hardcoded secrets, API keys, tokens, and private keys in staged/changed files.
+ * Self-contained: uses only Node.js built-ins.
+ *
+ * @param {string} targetDir - Directory to scan (defaults to cwd)
+ * @returns {{ exitCode: number, skipped: boolean, name: string, data: object }}
+ */
+const check = async function scanSecrets(targetDir) {
+  const fs = require('fs');
+  const path = require('path');
+  const { execSync } = require('child_process');
+
+  const dir = targetDir || process.cwd();
+
+  // Collect changed files via git, fall back to package.json check
+  let files;
+  try {
+    const out = execSync('git diff --name-only HEAD~1', {
+      cwd: dir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe']
+    });
+    files = out.split('\n').filter(f => f.trim());
+  } catch {
+    try {
+      const out = execSync('git diff --name-only --cached', {
+        cwd: dir, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe']
+      });
+      files = out.split('\n').filter(f => f.trim());
+    } catch {
+      // No git history — skip gracefully
+      return { exitCode: 0, skipped: true, name: 'scan_secrets', data: { findings: {}, message: 'No git diff available' } };
+    }
+  }
+
+  if (files.length === 0) {
+    return { exitCode: 0, skipped: false, name: 'scan_secrets', data: { findings: {}, message: 'No changed files to scan' } };
+  }
+
+  const patterns = [
+    { regex: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/, label: 'Private Key' },
+    { regex: /AKIA[0-9A-Z]{16}/, label: 'AWS Access Key' },
+    { regex: /(?:api[_-]?key|apikey|secret[_-]?key|api[_-]?secret)\s*[=:]\s*['"][A-Za-z0-9_\-]{16,}['"]/i, label: 'API Key' },
+    { regex: /(?:password|passwd|pwd)\s*[=:]\s*['"][^'"]{6,}['"]/i, label: 'Hardcoded Password' },
+    { regex: /(?:secret|token|auth[_-]?token|bearer)\s*[=:]\s*['"][A-Za-z0-9_\-\.]{16,}['"]/i, label: 'Secret/Token' },
+    { regex: /ghp_[A-Za-z0-9]{36}/, label: 'GitHub Personal Access Token' },
+    { regex: /sk-[A-Za-z0-9]{20,}/, label: 'OpenAI/Stripe API Key' },
+    { regex: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/, label: 'JWT Token' },
+    { regex: /(?:SUPABASE|NEXT_PUBLIC|VITE)_\w*_KEY\s*=\s*['"][^'"]{8,}['"]/i, label: 'Framework Secret Key' },
+  ];
+
+  // Skip binary/generated files
+  const skipExtensions = ['.png', '.jpg', '.gif', '.svg', '.ico', '.woff', '.woff2', '.ttf', '.lock', '.min.js', '.min.css'];
+
+  const findings = {};
+  for (const file of files) {
+    const ext = path.extname(file);
+    if (skipExtensions.includes(ext)) continue;
+
+    const filePath = path.join(dir, file);
+    if (!fs.existsSync(filePath)) continue;
+
+    let content;
+    try {
+      content = fs.readFileSync(filePath, 'utf-8');
+    } catch {
+      continue;
+    }
+
+    const lines = content.split('\n');
+    const fileFindings = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      for (const { regex, label } of patterns) {
+        if (regex.test(line)) {
+          const col = line.search(regex);
+          fileFindings.push({ lineNo: i + 1, col, label, line: line.trim().substring(0, 120) });
+          break; // One finding per line
+        }
+      }
+    }
+
+    if (fileFindings.length > 0) {
+      findings[file] = fileFindings;
+    }
+  }
+
+  const totalCount = Object.values(findings).flat().length;
+  return {
+    exitCode: totalCount > 0 ? 1 : 0,
+    skipped: false,
+    name: 'scan_secrets',
+    data: {
+      findings,
+      message: totalCount > 0
+        ? `${totalCount} potential secret(s) found in ${Object.keys(findings).length} file(s)`
+        : 'No secrets detected',
+    },
+  };
+};
+module.exports = check;
+
+if (require.main === module) {
+  check(process.argv[2]).then(result => {
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.exitCode);
+  });
+}

package/tools/scan_secrets.py

@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""
+Secrets & API Key Scanner
+Detects hardcoded secrets, API keys, tokens, and private keys in changed files.
+Self-contained: uses only Python stdlib (re, pathlib, subprocess, json).
+"""
+from __future__ import annotations
+
+import json
+import os
+import pathlib
+import re
+import subprocess
+import sys
+
+# One finding per matching line: (line_no, label, matched_snippet)
+PATTERNS: list[tuple[str, str]] = [
+    (r"-----BEGIN (?:RSA |EC )?PRIVATE KEY-----", "Private Key"),
+    (r"AKIA[0-9A-Z]{16}", "AWS Access Key"),
+    (
+        r"(?:api[_-]?key|apikey|secret[_-]?key|api[_-]?secret)\s*[=:]\s*['\"]"
+        r"[A-Za-z0-9_\-]{16,}['\"]",
+        "API Key",
+    ),
+    (
+        r"(?:password|passwd|pwd)\s*[=:]\s*['\"][^'\"]{6,}['\"]",
+        "Hardcoded Password",
+    ),
+    (
+        r"(?:secret|token|auth[_-]?token|bearer)\s*[=:]\s*['\"]"
+        r"[A-Za-z0-9_\-\.]{16,}['\"]",
+        "Secret/Token",
+    ),
+    (r"ghp_[A-Za-z0-9]{36}", "GitHub Personal Access Token"),
+    (r"sk-[A-Za-z0-9]{20,}", "OpenAI/Stripe API Key"),
+    (r"eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+", "JWT Token"),
+    (
+        r"(?:SUPABASE|NEXT_PUBLIC|VITE)_\w*_KEY\s*=\s*['\"][^'\"]{8,}['\"]",
+        "Framework Secret Key",
+    ),
+]
+
+SKIP_EXTENSIONS = frozenset(
+    {
+        ".png", ".jpg", ".gif", ".svg", ".ico",
+        ".woff", ".woff2", ".ttf", ".lock",
+        ".min.js", ".min.css",
+    }
+)
+
+
+def _get_changed_files(target_dir: str) -> list[str] | None:
+    """Return list of changed files from git diff, or None on failure."""
+    for ref in ("HEAD~1", "--cached"):
+        try:
+            args = ["git", "diff", "--name-only"]
+            if ref == "--cached":
+                args.append("--cached")
+            else:
+                args.append(ref)
+            out = subprocess.check_output(
+                args, cwd=target_dir,
+                stderr=subprocess.DEVNULL, text=True,
+            )
+            files = [f.strip() for f in out.splitlines() if f.strip()]
+            if files:
+                return files
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            continue
+    return None
+
+
+def _compile_patterns() -> list[tuple[re.Pattern, str]]:
+    """Compile all secret-detection patterns once."""
+    return [(re.compile(p), label) for p, label in PATTERNS]
+
+
+def check(target_dir: str | None = None) -> dict:
+    """
+    Scan changed files for secrets and API keys.
+
+    Returns:
+        dict with keys: exit_code, skipped, name, data
+        data.findings maps filepath -> list of {lineNo, label, snippet}
+    """
+    dir_path = target_dir or os.getcwd()
+
+    files = _get_changed_files(dir_path)
+    if files is None:
+        return {
+            "exit_code": 0, "skipped": True, "name": "scan_secrets",
+            "data": {"findings": {}, "message": "No git diff available"},
+        }
+
+    if not files:
+        return {
+            "exit_code": 0, "skipped": False, "name": "scan_secrets",
+            "data": {"findings": {}, "message": "No changed files to scan"},
+        }
+
+    compiled = _compile_patterns()
+    findings: dict[str, list[dict]] = {}
+
+    for filepath in files:
+        ext = pathlib.Path(filepath).suffix
+        if ext in SKIP_EXTENSIONS:
+            continue
+
+        full_path = pathlib.Path(dir_path) / filepath
+        if not full_path.exists():
+            continue
+
+        try:
+            content = full_path.read_text(encoding="utf-8", errors="replace")
+        except (OSError, PermissionError):
+            continue
+
+        file_hits: list[dict] = []
+        for line_no, line in enumerate(content.splitlines(), start=1):
+            for regex, label in compiled:
+                m = regex.search(line)
+                if m:
+                    file_hits.append({
+                        "lineNo": line_no,
+                        "label": label,
+                        "snippet": line.strip()[:120],
+                    })
+                    break  # one finding per line
+
+        if file_hits:
+            findings[filepath] = file_hits
+
+    total = sum(len(v) for v in findings.values())
+    if total:
+        msg = (
+            f"{total} potential secret(s) found in "
+            f"{len(findings)} file(s)"
+        )
+    else:
+        msg = "No secrets detected"
+
+    return {
+        "exit_code": 1 if total else 0,
+        "skipped": False,
+        "name": "scan_secrets",
+        "data": {"findings": findings, "message": msg},
+    }
+
+
+if __name__ == "__main__":
+    result = check(sys.argv[1] if len(sys.argv) > 1 else None)
+    print(json.dumps(result, indent=2))
+    sys.exit(result["exit_code"])

package/tools/verify_tdd.py

@@ -0,0 +1,212 @@
+#!/usr/bin/env python3
+"""
+TDD Flow Validator
+Validates that test files exist for changed code, checks for test patterns,
+and reports on test coverage presence (pytest, unittest, manage.py test).
+Self-contained: uses only Python stdlib (pathlib, subprocess, json).
+"""
+from __future__ import annotations
+
+import json
+import os
+import pathlib
+import subprocess
+import sys
+
+
+def _get_changed_files(target_dir: str) -> list[str] | None:
+    """Return list of changed files from git diff, or None on failure."""
+    for ref in ("HEAD~1", "--cached"):
+        try:
+            args = ["git", "diff", "--name-only"]
+            if ref == "--cached":
+                args.append("--cached")
+            else:
+                args.append(ref)
+            out = subprocess.check_output(
+                args, cwd=target_dir,
+                stderr=subprocess.DEVNULL, text=True,
+            )
+            files = [f.strip() for f in out.splitlines() if f.strip()]
+            if files:
+                return files
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            continue
+    return None
+
+
+def _detect_test_framework(target_dir: str) -> str:
+    """Detect which test framework is in use."""
+    root = pathlib.Path(target_dir)
+
+    # Check for pytest.ini or pytest config
+    for name in ("pytest.ini", "setup.cfg", "pyproject.toml"):
+        fpath = root / name
+        if fpath.exists():
+            try:
+                text = fpath.read_text(encoding="utf-8", errors="replace").lower()
+            except OSError:
+                continue
+            if "pytest" in text:
+                return "pytest"
+
+    # Check for Django manage.py test
+    if (root / "manage.py").exists():
+        return "django"
+
+    # Check for unittest patterns
+    for py_file in root.rglob("test_*.py"):
+        try:
+            content = py_file.read_text(encoding="utf-8", errors="replace")
+            if "import unittest" in content or "unittest.TestCase" in content:
+                return "unittest"
+        except OSError:
+            continue
+
+    return "unknown"
+
+
+def _find_test_files(target_dir: str) -> list[str]:
+    """Find all test files in the project."""
+    root = pathlib.Path(target_dir)
+    test_files: list[str] = []
+
+    for py_file in root.rglob("test_*.py"):
+        rel = str(py_file.relative_to(root))
+        if "__pycache__" not in rel:
+            test_files.append(rel)
+
+    for py_file in root.rglob("*_test.py"):
+        rel = str(py_file.relative_to(root))
+        if "__pycache__" not in rel and rel not in test_files:
+            test_files.append(rel)
+
+    # Check tests/ directories
+    for tests_dir in root.rglob("tests"):
+        if tests_dir.is_dir():
+            for py_file in tests_dir.glob("*.py"):
+                rel = str(py_file.relative_to(root))
+                if "__pycache__" not in rel and py_file.name != "__init__.py" and rel not in test_files:
+                    test_files.append(rel)
+
+    return sorted(test_files)
+
+
+def _count_test_methods(target_dir: str, filepath: str) -> int:
+    """Count test methods in a test file."""
+    full_path = pathlib.Path(target_dir) / filepath
+    try:
+        content = full_path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return 0
+
+    import re
+    # Count test_ method definitions and TestCase subclasses
+    test_funcs = len(re.findall(r"def (test_\w+)", content))
+    return test_funcs
+
+
+def check(target_dir: str | None = None) -> dict:
+    """
+    Validate TDD flow: tests exist, test framework detected, coverage signals.
+
+    Returns:
+        dict with keys: exit_code, skipped, name, data
+        data.framework, data.test_files, data.changed_code_files,
+        data.test_count, data.has_test_coverage
+    """
+    dir_path = target_dir or os.getcwd()
+
+    changed = _get_changed_files(dir_path)
+    if changed is None:
+        return {
+            "exit_code": 0, "skipped": True, "name": "verify_tdd",
+            "data": {"message": "No git diff available"},
+        }
+
+    if not changed:
+        return {
+            "exit_code": 0, "skipped": False, "name": "verify_tdd",
+            "data": {
+                "framework": "unknown", "test_files": [],
+                "changed_code_files": [], "test_count": 0,
+                "has_test_coverage": False,
+                "message": "No changed files",
+            },
+        }
+
+    framework = _detect_test_framework(dir_path)
+    test_files = _find_test_files(dir_path)
+
+    # Separate test files from code files in the diff
+    changed_tests = [f for f in changed if f.endswith(".py") and _is_test_file(f)]
+    changed_code = [f for f in changed if f.endswith(".py") and not _is_test_file(f)]
+
+    # Count total test methods
+    total_tests = sum(_count_test_methods(dir_path, tf) for tf in test_files)
+
+    # Determine if there's meaningful test coverage
+    has_tests = len(test_files) > 0
+    has_test_in_diff = len(changed_tests) > 0
+    has_code_in_diff = len(changed_code) > 0
+
+    # TDD indicator: if code changed but no test changed, flag it
+    if has_code_in_diff and not has_test_in_diff and has_tests:
+        msg = (
+            f"Code files changed without corresponding test changes "
+            f"({len(changed_code)} code files, {len(changed_tests)} test files). "
+            f"Framework: {framework}. Total test methods: {total_tests}"
+        )
+        exit_code = 1
+    elif has_code_in_diff and not has_test_in_diff and not has_tests:
+        msg = (
+            f"No test files found in project. "
+            f"{len(changed_code)} code file(s) changed without tests. "
+            f"Framework: {framework}"
+        )
+        exit_code = 1
+    elif has_test_in_diff:
+        msg = (
+            f"TDD flow detected: {len(changed_tests)} test file(s) changed "
+            f"alongside {len(changed_code)} code file(s). "
+            f"Framework: {framework}. Total test methods: {total_tests}"
+        )
+        exit_code = 0
+    else:
+        msg = (
+            f"No Python code changes detected. "
+            f"Framework: {framework}. Total test methods: {total_tests}"
+        )
+        exit_code = 0
+
+    return {
+        "exit_code": exit_code,
+        "skipped": False,
+        "name": "verify_tdd",
+        "data": {
+            "framework": framework,
+            "test_files": test_files[:20],  # Cap at 20 for readability
+            "changed_code_files": changed_code,
+            "changed_test_files": changed_tests,
+            "test_count": total_tests,
+            "has_test_coverage": has_tests,
+            "message": msg,
+        },
+    }
+
+
+def _is_test_file(filepath: str) -> bool:
+    """Check if a filepath is a test file."""
+    basename = pathlib.Path(filepath).name
+    return (
+        basename.startswith("test_")
+        or basename.endswith("_test.py")
+        or "/tests/" in filepath
+        or "/test/" in filepath
+    )
+
+
+if __name__ == "__main__":
+    result = check(sys.argv[1] if len(sys.argv) > 1 else None)
+    print(json.dumps(result, indent=2))
+    sys.exit(result["exit_code"])