codeant-cli 0.4.4 → 0.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {

package/src/reviewHeadless.js

@@ -82,6 +82,7 @@ export async function runReviewHeadless(options = {}) {
     lastNCommits = 1,
     baseBranch = null,
     baseCommit = null,
+    selectedCommits = [],
     onProgress = () => {},
     onFilesReady = () => {},
   } = options;
@@ -108,7 +109,7 @@ export async function runReviewHeadless(options = {}) {
     const helper = new ReviewApiHelper(workspacePath);
     await helper.init();
     const gitRoot = helper.getGitRoot() || workspacePath;
-    const requestBody = await helper.buildReviewApiRequest(scanType, include, exclude, { lastNCommits, baseBranch, baseCommit });
+    const requestBody = await helper.buildReviewApiRequest(scanType, include, exclude, { lastNCommits, baseBranch, baseCommit, selectedCommits });
 
     const meta = requestBody?._meta || null;
     delete requestBody._meta;

package/src/rules/secrets.toml

@@ -1173,6 +1173,11 @@ id = "generic-api-key"
 description = "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."
 regex = '''(?i)[\w.-]{0,50}?(?:access|auth|(?-i:[Aa]pi|API)|credential|creds|key|passw(?:or)?d|secret|token)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([\w.=-]{10,150}|[a-z0-9][a-z0-9+/]{11,}={0,3})(?:\\?['"\x60]|[\s;]|\\[nr]|$)'''
 entropy = 3.5
+# secretGroup = 1: the regex captures the actual secret value in group 1.
+# Without this, the full match (including variable names, commas, spaces) is
+# treated as the "secret", causing allowlist checks like ^[a-zA-Z_.-]+$ to fail
+# on import/destructuring lines (e.g. "from config import STRIPE_API_KEY, SECRET").
+secretGroup = 1
 keywords = [
     "access",
     "api",

package/src/utils/commonApiHelper.js

@@ -60,6 +60,19 @@ class CommonApiHelper {
     return this._transformDiffsToApiFormat(diffs);
   }
 
+  /**
+   * Get specific selected commits formatted for the API
+   * @param {string[]} commits - Array of commit hashes to include
+   */
+  async getSelectCommitsFilesForApi(commits = []) {
+    const diffs = await this.gitHelper.getDiffBasedOnReviewConfig({
+      type: 'select-commits',
+      commits,
+    });
+
+    return this._transformDiffsToApiFormat(diffs);
+  }
+
   /**
    * Transform diff info array to API format
    * Must be implemented by subclasses
@@ -126,6 +139,8 @@ class CommonApiHelper {
         return await this.getLastCommitFilesForApi();
       case 'last-n-commits':
         return await this.getLastNCommitsFilesForApi(options.lastNCommits || 1);
+      case 'select-commits':
+        return await this.getSelectCommitsFilesForApi(options.selectedCommits || []);
       case 'base-branch':
         return await this.getBaseBranchDiffForApi(options.baseBranch);
       case 'base-commit':