fop-cli 5.3.1 → 5.4.0

package/README.md

@@ -12,7 +12,7 @@ A Rust port of the EasyList FOP tool for sorting and cleaning ad-blocking filter
 - **Git integration**: Commit changes directly to repositories (can be disabled)
 - **easylist_adservers.txt validation**: Ensures rules start with `|` or `/`
 - **:has-text() merging**: Combines rules with same base selector into single regex
-- **Parallel processing**: Uses all CPU cores for faster processing via Rayon
+- **Parallel processing**: Processes files in parallel via Rayon, using up to 8 worker threads. Past that, extra workers cost memory without improving throughput; set `RAYON_NUM_THREADS` to override
 
 ## Extended Syntax Support
 
@@ -111,7 +111,13 @@ fop -n ~/easylist ~/easyprivacy ~/fanboy-addon
 | `--check-banned-list=FILE` | Check for banned domains in git additions |
 | `--auto-banned-remove` | Auto-remove banned domains and commit |
 | `--ci` | CI mode - exit with error code on failures (banned domains) |
-| `--rebase-on-fail` | Auto rebase and retry push if it fails |
+| `--rebase-on-fail` | Auto `git pull --rebase --autostash` and retry when a push fails. **On by default** |
+| `--no-rebase-on-fail` | Don't auto-rebase; print the suggested `git pull --rebase` command and stop |
+| `--commit-mask=N` | Mask URLs in commit messages (1=`[.]`, 2=`(.)`, 3=space, 4=preserve subdomain dot, 5=Unicode lookalike `․`) |
+| `--commit-mask-users=u1,u2` | Restrict `--commit-mask` to these `git config user.name` values (lowercased) |
+| `--commit-mask-bare` | Also mask bare hostnames without `http(s)://`. Risks false positives on filenames |
+| `--commit-mask-exempt-hosts=h1,h2` | Additional apex hosts exempt from masking (e.g. self-hosted Gitea/Forgejo/GitLab) |
+| `--commit-url-template=TMPL` | Override the `Commit successful:` URL template. Placeholders: `{base}`, `{sha}`. Auto-detects Bitbucket (`/commits/`); everything else defaults to `/commit/` |
 | `--ignore-config` | Ignore .fopconfig file, use only CLI args |
 | `--output` | Output changed files with --changed suffix (no overwrite) |
 | `--check-file=FILE` | Process a single file | 
@@ -218,8 +224,32 @@ auto-banned-remove = false
 # CI mode - exit with error code on failures
 ci = false
 
-# Auto rebase and retry if push fails
-rebase-on-fail = false
+# Auto rebase and retry if push fails (default: true).
+# On failure fop runs 'git pull --rebase --autostash' and pushes again, which
+# reapplies your stashed changes and can leave conflicts to resolve. Set false
+# to be told the command to run instead of having it run for you.
+rebase-on-fail = true
+
+# Mask URLs in commit messages: 1=[.], 2=(.), 3=space, 4=preserve subdomain dot, 5=Unicode lookalike
+# github.com, gitlab.com, and codeberg.org (and subdomains) are always exempt so PR/issue links stay clickable.
+commit-mask =
+
+# If non-empty, --commit-mask only applies when git user.name matches one of these (case-insensitive).
+commit-mask-users =
+
+# Also mask bare hostnames (no http/https). Risks FP on filenames like config.toml.
+commit-mask-bare = false
+
+# Additional apex hosts (and subdomains) exempt from masking. Adds to the
+# built-in github.com / gitlab.com / codeberg.org list. Use for self-hosted
+# Gitea, Forgejo, or private GitLab instances.
+commit-mask-exempt-hosts =
+
+# Override the 'Commit successful:' URL template (placeholders: {base}, {sha}).
+# Default is auto-detected per host: bitbucket.org gets {base}/commits/{sha},
+# everything else gets {base}/commit/{sha}. Override here if your platform
+# uses something different (e.g. cgit, trac, custom redirector).
+commit-url-template =
 
 # Suppress most output (for CI)
 quiet = false
@@ -256,6 +286,61 @@ add-timestamp = true
 
 Supported per-file options: `no-sort`, `alt-sort`, `parse-adguard`, `localhost`, `add-checksum`, `add-timestamp`, `no-ubo-convert`, `abp-convert`, `convert-trusted`, `keep-empty-lines`, `ignore-dot-domains`, `fix-typos`.
 
+### Commit Message URL Masking
+
+`--commit-mask=N` defangs URLs in commit messages so they're stored in git history in a non-clickable form. Useful for filter-list maintainers who don't want third-party scrapers, search engines, or auto-linkers to follow URLs cited in commit messages. Masking happens **after** commit-message validation (so `A:`/`P:` prefixes still validate against the real URL) but **before** `git commit -m`, so the masked form is what lands in git.
+
+#### Levels
+
+Using `https://www.example.com/foo/bar.html` and `https://www.example.co.nz/foo` as inputs:
+
+| Level | Style | `www.example.com/...` | `www.example.co.nz/foo` |
+|---|---|---|---|
+| 1 | `[.]` | `https://www[.]example[.]com/foo/bar.html` | `https://www[.]example[.]co[.]nz/foo` |
+| 2 | `(.)` | `https://www(.)example(.)com/foo/bar.html` | `https://www(.)example(.)co(.)nz/foo` |
+| 3 | space | `https://www example com/foo/bar.html` | `https://www example co nz/foo` |
+| 4 | preserve subdomain dot | `https://www.example[.]com/foo/bar.html` | `https://www.example[.]co[.]nz/foo` |
+| 5 | Unicode `․` (U+2024) | `https://www․example․com/foo/bar.html` | `https://www․example․co․nz/foo` |
+
+Notes:
+- **Path/query/fragment dots are never masked** (only host dots), so file extensions like `bar.html` and query values like `?t=1.2` stay readable.
+- **Level 4** masks only the registrable domain plus eTLD ("eTLD+1"). Compound TLDs (`co.uk`, `co.nz`, `com.au`, `co.jp`, `com.ng`, `com.hk`, `co.il`, `com.vn`, etc. — ~25 country codes) are recognised so `example.co.uk` is treated as a 2-label TLD. Apex-only inputs (`example.com`, no subdomain) still defang the only dot.
+- **Level 5** is the strongest defang: U+2024 is visually nearly identical to `.` but is not in IDNA UTS #46 normalization tables, so URLs containing it won't resolve in browsers, `curl`, or most parsers — even after copy/paste. Reviewers won't realise the link is dead until they try to click it.
+- **Unknown levels** (0, 6, 99…) silently fall through to level 1.
+- **Exempt hosts:** `github.com`, `gitlab.com`, `codeberg.org`, and any of their subdomains (`gist.github.com`, `docs.gitlab.com`, etc.) are never masked, so PR/issue links remain clickable on the hosting platform. Lookalike hosts like `notgitlab.com` or `evil.gitlab.com.attacker.com` still get masked. For self-hosted Gitea/Forgejo/GitLab, add your host with `--commit-mask-exempt-hosts=git.company.internal,...`.
+
+#### Choosing a level
+
+| When to use | Level |
+|---|---|
+| Maximum visibility ("clearly defanged") | 1, 2, or 3 |
+| Want the host structure to remain readable, only break TLD | 4 |
+| Want the URL to look real but stay broken (anti-scraper) | 5 |
+
+#### Restricting masking by user
+
+`--commit-mask-users=name1,name2,...` (or `commit-mask-users = ...` in config) gates masking on the current `git config user.name`. If the list is empty, masking applies to whoever runs fop. If the list is non-empty, only matching users (case-insensitive) get masking; everyone else commits with the original URL.
+
+```ini
+commit-mask = 4
+commit-mask-users = fanboynz, ryanbr
+```
+
+#### Bare hostnames (`--commit-mask-bare`)
+
+Off by default. When enabled, also matches hostnames without an `http(s)://` prefix (e.g. `forums.lanik.us` or `www.example.com.ng`). The matcher requires at least one dot and a 2+ letter final label, so version numbers like `1.2.3` are not matched. Filenames like `config.toml` **will** match — that's the documented false-positive cost of opting in. Scheme URLs still take priority where both forms appear, and the host-exempt list (`github.com`, `gitlab.com`) applies to bare matches too.
+
+#### Display label
+
+After a successful commit, fop prints `Commit message:` followed by what landed in git. If masking actually changed the message, the label becomes `Commit message (masked):` instead, so it's obvious the displayed text is the masked form.
+
+```
+Commit message (masked):  A: https://www.example[.]com/foo
+Commit successful:        https://github.com/easylist/easylist/commit/abc1234
+```
+
+If `commit-mask` is unset, or every URL was github/gitlab (a no-op mask), the plain `Commit message:` label is shown.
+
 ## Platform Support
 
 ### Pre-built Binaries

package/install.js

@@ -7,7 +7,7 @@ const path = require('path');
 const { execSync } = require('child_process');
 
 // Configuration - UPDATE THESE FOR YOUR RELEASE
-const VERSION = '5.3.1';
+const VERSION = '5.4.0';
 const GITHUB_REPO = 'ryanbr/fop-rs'; // Change to your repo
 const BINARY_NAME = 'fop';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fop-cli",
-  "version": "5.3.1",
+  "version": "5.4.0",
   "description": "Filter Orderer and Preener - A tool for sorting and cleaning ad-blocking filter lists",
   "keywords": [
     "adblock",