etymd 0.2.2 → 0.3.0

package/dist/{init-4CQOLFQG.js → init-OVLO4OBZ.js}

@@ -1,9 +1,12 @@
 #!/usr/bin/env node
-import { planWorkflow, applyFiles } from './chunk-MWIK6ML3.js';
-import { scanProject, PACK_VERSION } from './chunk-BH37LELV.js';
-import { VERSION } from './chunk-LVLZLCND.js';
-import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-FZSIOCOZ.js';
-import { theme, renderFacts, print, renderPlan, git, section, glyph, readText } from './chunk-LBRNZZZF.js';
+import { applyFiles } from './chunk-EF6BPBG6.js';
+import { planWorkflow } from './chunk-3NYDVB4Z.js';
+import { theme, renderFacts, print, renderPlan, section, glyph } from './chunk-TADKOW6P.js';
+import { writeCachedFacts, deriveProfile, writeBaseline, CACHE_DIR } from './chunk-R74SJ7HS.js';
+import { scanProject } from './chunk-MKYPLNLH.js';
+import { VERSION } from './chunk-NFENQ3IK.js';
+import { PACK_VERSION } from './chunk-CRJHIXJH.js';
+import { git, readText } from './chunk-YLNQQZ5F.js';
 import { promises } from 'node:fs';
 import path from 'node:path';
 import { intro, spinner, select, confirm, outro, isCancel, cancel } from '@clack/prompts';

package/dist/ledger-TMIV45AA.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { accept, dismiss, list } from './chunk-MMPV67FW.js';
+import './chunk-WWBF4Y7K.js';
+import './chunk-TADKOW6P.js';
+import './chunk-YLNQQZ5F.js';

package/dist/{scan-CYOOGJFG.js → scan-RAJUFTQR.js}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
-import { scanProject } from './chunk-BH37LELV.js';
-import './chunk-LVLZLCND.js';
-import { writeCachedFacts } from './chunk-FZSIOCOZ.js';
-import { print, renderFacts, theme } from './chunk-LBRNZZZF.js';
+import { print, renderFacts, theme } from './chunk-TADKOW6P.js';
+import { writeCachedFacts } from './chunk-R74SJ7HS.js';
+import { scanProject } from './chunk-MKYPLNLH.js';
+import './chunk-NFENQ3IK.js';
+import './chunk-CRJHIXJH.js';
+import './chunk-YLNQQZ5F.js';
 
 // src/commands/scan.ts
 async function run(opts) {

package/dist/scan-ZYZ7XDSJ.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+export { scanProject } from './chunk-MKYPLNLH.js';
+import './chunk-NFENQ3IK.js';
+import './chunk-CRJHIXJH.js';
+import './chunk-YLNQQZ5F.js';

package/dist/screen-U7JMWZPS.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+import { print, glyph, theme, section } from './chunk-TADKOW6P.js';
+import { readText, git, pathExists } from './chunk-YLNQQZ5F.js';
+import { promises } from 'node:fs';
+import path from 'node:path';
+
+var MACHINE_PATH_RE = /\/(?:Users|home)\/[A-Za-z0-9._-]+\//;
+var ALLOW_MARKER = "allow-published-string";
+var ALLOW_FILE = ".etymd-screen-allow";
+var LEGACY_ALLOW_FILE = ".artifact-check-allow";
+function compile(raw) {
+  return raw.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).map((l) => {
+    try {
+      return new RegExp(l, "i");
+    } catch {
+      return new RegExp(l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i");
+    }
+  });
+}
+function isSelfName(pattern, self) {
+  return pattern.source.toLowerCase() === self.toLowerCase();
+}
+function screenText(text, file, patterns, allow = []) {
+  const hits = [];
+  const lines = text.split("\n");
+  for (const [i, line] of lines.entries()) {
+    if (line.includes(ALLOW_MARKER)) continue;
+    if (allow.some((re) => re.test(line))) continue;
+    for (const re of patterns) {
+      if (re.test(line)) {
+        hits.push({ file, line: i + 1, text: line.trim().slice(0, 160), reason: String(re) });
+        break;
+      }
+    }
+    if (MACHINE_PATH_RE.test(line)) {
+      hits.push({
+        file,
+        line: i + 1,
+        text: line.trim().slice(0, 160),
+        reason: "absolute home path"
+      });
+    }
+  }
+  return hits;
+}
+async function walk(dir, out, depth = 0) {
+  if (depth > 12) return;
+  let entries;
+  try {
+    entries = await promises.readdir(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries) {
+    if (e.name === ".git" || e.name === "node_modules") continue;
+    const abs = path.join(dir, e.name);
+    if (e.isDirectory()) await walk(abs, out, depth + 1);
+    else out.push(abs);
+  }
+}
+async function run(opts) {
+  const patternPath = opts.patterns ?? process.env.ETYMD_SCREEN_PATTERNS ?? process.env.PUBLIC_REPO_PATTERNS ?? path.join(process.env.HOME ?? "", ".config", "etymd", "screen-patterns");
+  const rawPatterns = await readText(patternPath);
+  if (rawPatterns === null) {
+    print(
+      `  ${glyph.partial} ${theme.dim(`no pattern file at ${patternPath} \u2014 nothing to screen against.`)}`
+    );
+    print(
+      `  ${theme.dim("Etymd ships no patterns by design: the strings worth screening for are themselves sensitive. Write one line per pattern (regex or literal, # for comments).")}`
+    );
+    return;
+  }
+  const patterns = compile(rawPatterns);
+  if (!patterns.length) {
+    print(`  ${glyph.partial} ${theme.dim(`${patternPath} has no active patterns \u2014 skipping.`)}`);
+    return;
+  }
+  const allowRaw = await readText(path.join(opts.cwd, ALLOW_FILE)) ?? await readText(path.join(opts.cwd, LEGACY_ALLOW_FILE));
+  const allow = allowRaw ? compile(allowRaw) : [];
+  const self = path.basename(
+    await git(opts.cwd, ["rev-parse", "--show-toplevel"]) || path.resolve(opts.cwd)
+  );
+  const active = self ? patterns.filter((re) => !isSelfName(re, self)) : patterns;
+  const hits = [];
+  let scanned = 0;
+  if (opts.scope === "message") {
+    const file = opts.target;
+    if (!file) throw new Error("--message needs the message file path (the commit-msg hook's $1)");
+    const raw = await readText(file);
+    if (raw === null) return;
+    const body = raw.split("\n").filter((l) => !l.startsWith("#")).join("\n");
+    scanned = 1;
+    hits.push(...screenText(body, "commit message", active, allow));
+  } else if (opts.scope === "dir") {
+    const dir = opts.target;
+    if (!dir) throw new Error("--dir needs a directory");
+    const files = [];
+    await walk(dir, files);
+    for (const f of files) {
+      const raw = await readText(f);
+      if (raw === null) continue;
+      scanned++;
+      hits.push(...screenText(raw, path.relative(dir, f), active, allow));
+    }
+  } else {
+    const listing = opts.scope === "tree" ? await git(opts.cwd, ["ls-files"]) : await git(opts.cwd, ["diff", "--cached", "--name-only", "--diff-filter=ACM"]);
+    const files = (listing ?? "").split("\n").filter(Boolean);
+    for (const rel of files) {
+      if (rel === ALLOW_FILE || rel === LEGACY_ALLOW_FILE) continue;
+      const abs = path.join(opts.cwd, rel);
+      if (!await pathExists(abs)) continue;
+      const raw = await readText(abs);
+      if (raw === null) continue;
+      scanned++;
+      hits.push(...screenText(raw, rel, active, allow));
+    }
+  }
+  if (!hits.length) return;
+  section(`Content screen ${theme.dim(`\xB7 ${opts.scope} \xB7 ${scanned} file(s)`)}`);
+  for (const h of hits) {
+    print(`  ${theme.warn(h.file)}${theme.dim(`:${h.line}`)}  ${theme.dim(`(${h.reason})`)}`);
+    print(`    ${h.text}`);
+  }
+  print("");
+  print(
+    `  ${theme.dim("Publishing exposes ALL history, so this content would be permanent the moment it is committed.")}`
+  );
+  print(
+    `  ${theme.dim(`Rewrite the line, mark a deliberate one with \`${ALLOW_MARKER}\`, or bypass with --no-verify.`)}`
+  );
+  if (!opts.advisory) process.exitCode = 1;
+}
+
+export { isSelfName, run, screenText };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "etymd",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Keep your agent instructions true — verify AGENTS.md, CLAUDE.md, rules & skills against the actual repo, with drift caught over time and a regression ledger.",
   "keywords": [
     "cli",
@@ -58,7 +58,7 @@
     "format:check": "prettier --check . && npm run guard:md",
     "guard:md": "! grep -rnF --include=*.md --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git '\\*\\*' .",
     "prepare": "npm run build",
-    "prepublishOnly": "npm run build",
+    "prepublishOnly": "npm run build && artifact-check",
     "changeset": "changeset",
     "version:packages": "changeset version",
     "release": "npm run build && changeset publish"

package/dist/audit-LZJRJS5V.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-export { run } from './chunk-IW6K5HLV.js';
-import './chunk-KMAJIQHC.js';
-import './chunk-KBF3SW3N.js';
-import './chunk-ANCCGYSH.js';
-import './chunk-BH37LELV.js';
-import './chunk-LVLZLCND.js';
-import './chunk-FZSIOCOZ.js';
-import './chunk-LBRNZZZF.js';

package/dist/doctor-6JDAHGDT.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-import { run } from './chunk-IW6K5HLV.js';
-import './chunk-KMAJIQHC.js';
-import './chunk-KBF3SW3N.js';
-import './chunk-ANCCGYSH.js';
-import './chunk-BH37LELV.js';
-import './chunk-LVLZLCND.js';
-import './chunk-FZSIOCOZ.js';
-import './chunk-LBRNZZZF.js';
-
-// src/commands/doctor.ts
-async function run2(opts) {
-  await run({ cwd: opts.cwd, json: opts.json, truth: true });
-}
-
-export { run2 as run };

package/dist/gates-G5BCMRRV.js

@@ -1,71 +0,0 @@
-#!/usr/bin/env node
-import { planWorkflow, applyFiles } from './chunk-MWIK6ML3.js';
-import { scanProject } from './chunk-BH37LELV.js';
-import './chunk-LVLZLCND.js';
-import { section, print, glyph, theme, renderPlan, git } from './chunk-LBRNZZZF.js';
-import { confirm, isCancel, cancel } from '@clack/prompts';
-
-async function run(opts) {
-  const facts = await scanProject(opts.cwd);
-  if (opts.ci) {
-    section("CI review gate");
-    print(
-      `  ${glyph.partial} ${theme.dim("The advisory AI-review CI job (bring-your-own-key) ships in a later release \u2014 installing the free local gates below.")}`
-    );
-  }
-  if (!facts.git.isRepo) {
-    print(
-      `  ${glyph.bad} ${theme.dim("Not a git repository \u2014 local hooks need git. Run `git init` first.")}`
-    );
-    return;
-  }
-  if (facts.hooks.source === "husky" || facts.hooks.source === "husky-legacy" || facts.hooks.source === "custom") {
-    print(
-      `  ${glyph.partial} ${theme.warn(`${facts.hooks.source} already manages hooks here.`)} ${theme.dim("git runs ONE hook path \u2014 installing .githooks + core.hooksPath takes over. Fold the existing hook logic in first.")}`
-    );
-    if (!opts.yes) {
-      const go = await confirm({ message: "Proceed with .githooks anyway?", initialValue: false });
-      if (isCancel(go) || !go) {
-        cancel("No changes made.");
-        return;
-      }
-    }
-  }
-  const files = await planWorkflow(opts.cwd, facts, { agents: false, gates: true });
-  const gateFiles = files.filter((f) => f.executable);
-  renderPlan(gateFiles);
-  const overwrite = /* @__PURE__ */ new Set();
-  for (const f of gateFiles) {
-    if (!f.exists) continue;
-    if (!f.differs) {
-      overwrite.add(f.path);
-      continue;
-    }
-    if (opts.yes) continue;
-    const ow = await confirm({
-      message: `${f.path} exists with different content (hand-edited?). Overwrite with the pack version?`,
-      initialValue: false
-    });
-    if (isCancel(ow)) {
-      cancel("No changes made.");
-      return;
-    }
-    if (ow) overwrite.add(f.path);
-  }
-  if (!opts.yes) {
-    const ok = await confirm({ message: "Install these git hooks and point git at .githooks?" });
-    if (isCancel(ok) || !ok) {
-      cancel("No changes made.");
-      return;
-    }
-  }
-  const result = await applyFiles(opts.cwd, gateFiles, overwrite);
-  await git(opts.cwd, ["config", "core.hooksPath", ".githooks"]);
-  section("Done");
-  for (const w of result.written) print(`  ${glyph.ok} ${theme.dim("wrote")} ${theme.info(w)}`);
-  for (const sk of result.skipped)
-    print(`  ${glyph.bullet} ${theme.dim("kept (hand-edited)")} ${theme.dim(sk)}`);
-  print(`  ${glyph.ok} ${theme.dim("set")} ${theme.code("core.hooksPath = .githooks")}`);
-}
-
-export { run };

package/dist/ledger-RHQJH5EA.js

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-export { accept, dismiss, list } from './chunk-EUIHYD6F.js';
-import './chunk-KBF3SW3N.js';
-import './chunk-LBRNZZZF.js';