git-cli-scanner 1.0.0

package/dist/cli.js

@@ -0,0 +1,829 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/git.ts
+async function getStagedDiff() {
+  try {
+    const { stdout: filesOutput } = await execAsync("git diff --cached --name-only");
+    const files = filesOutput.trim().split("\n").filter(Boolean);
+    if (files.length === 0) {
+      return [];
+    }
+    const diffs = [];
+    for (const file of files) {
+      const { stdout: diffContent } = await execAsync(`git diff --cached -- "${file}"`);
+      diffs.push({ file, content: diffContent });
+    }
+    return diffs;
+  } catch (error2) {
+    console.warn("Could not get git diff. Are you in a git repository?");
+    return [];
+  }
+}
+var import_child_process, import_util, execAsync;
+var init_git = __esm({
+  "src/utils/git.ts"() {
+    "use strict";
+    import_child_process = require("child_process");
+    import_util = require("util");
+    execAsync = (0, import_util.promisify)(import_child_process.exec);
+  }
+});
+
+// src/scans/apiKeys.ts
+var rules, apiKeyScanner;
+var init_apiKeys = __esm({
+  "src/scans/apiKeys.ts"() {
+    "use strict";
+    rules = [
+      {
+        id: "stripe-key",
+        description: "Stripe Secret/Restricted Key",
+        pattern: /(?:sk|rk)_(?:test|live)_[0-9a-zA-Z]{24}/
+      },
+      {
+        id: "sendgrid-key",
+        description: "SendGrid API Key",
+        pattern: /SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43}/
+      },
+      {
+        id: "mailgun-key",
+        description: "Mailgun API Key",
+        pattern: /key-[0-9a-zA-Z]{32}/
+      },
+      {
+        id: "twilio-key",
+        description: "Twilio API Key",
+        pattern: /SK[0-9a-fA-F]{32}/
+      },
+      {
+        id: "generic-api-key",
+        description: "Generic API Key / Secret / Password / Passphrase",
+        pattern: /(?:api[_\-]?key|secret|token|password|pwd|passphrase)[\s:=]+["'][a-zA-Z0-9\-_!@#$%^&*()=+]{8,}["']/i
+      },
+      {
+        id: "generic-bearer-token",
+        description: "Generic Bearer Token",
+        pattern: /bearer\s+[a-zA-Z0-9\-_.]{20,}/i
+      }
+    ];
+    apiKeyScanner = {
+      id: "api-keys",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: "Store this key in a secret manager or environment variable. Never hardcode it."
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/cloudProviders.ts
+var rules2, cloudProviderScanner;
+var init_cloudProviders = __esm({
+  "src/scans/cloudProviders.ts"() {
+    "use strict";
+    rules2 = [
+      {
+        id: "aws-access-key",
+        description: "AWS Access Key ID",
+        pattern: /(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}/
+      },
+      {
+        id: "aws-secret-key",
+        description: "AWS Secret Access Key (heuristics)",
+        pattern: /aws_?(?:secret)?_?(?:access)?_?key[\s:=]+["'][a-zA-Z0-9\/+]{40}["']/i
+      },
+      {
+        id: "gcp-api-key",
+        description: "Google Cloud API Key",
+        pattern: /AIza[0-9A-Za-z\-_]{35}/
+      }
+    ];
+    cloudProviderScanner = {
+      id: "cloud-providers",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules2) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: "Move this cloud credential to IAM roles, Vault, or environment variables."
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/collaboration.ts
+var rules3, collaborationScanner;
+var init_collaboration = __esm({
+  "src/scans/collaboration.ts"() {
+    "use strict";
+    rules3 = [
+      {
+        id: "github-pat",
+        description: "GitHub Personal Access Token",
+        pattern: /ghp_[a-zA-Z0-9]{36}/
+      },
+      {
+        id: "github-oauth",
+        description: "GitHub OAuth Access Token",
+        pattern: /gho_[a-zA-Z0-9]{36}/
+      },
+      {
+        id: "slack-token",
+        description: "Slack Token",
+        pattern: /xox[pboar]-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{10,13}-[a-zA-Z0-9]{32}/
+      },
+      {
+        id: "slack-webhook",
+        description: "Slack Webhook",
+        pattern: /https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8,10}\/B[a-zA-Z0-9_]{8,10}\/[a-zA-Z0-9_]{24}/
+      }
+    ];
+    collaborationScanner = {
+      id: "collaboration",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules3) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: "Use OAuth tokens or environment variables. Do not commit team tokens."
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/privateKeys.ts
+var rules4, privateKeyScanner;
+var init_privateKeys = __esm({
+  "src/scans/privateKeys.ts"() {
+    "use strict";
+    rules4 = [
+      {
+        id: "rsa-private-key",
+        description: "RSA Private Key",
+        pattern: /-----BEGIN RSA PRIVATE KEY-----/
+      },
+      {
+        id: "openssh-private-key",
+        description: "OpenSSH Private Key",
+        pattern: /-----BEGIN OPENSSH PRIVATE KEY-----/
+      },
+      {
+        id: "pgp-private-key",
+        description: "PGP Private Key",
+        pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----/
+      }
+    ];
+    privateKeyScanner = {
+      id: "private-keys",
+      scan(diff) {
+        const issues = [];
+        const lines = diff.content.split("\n");
+        let lineNumber = 1;
+        for (const line of lines) {
+          if (line.startsWith("+")) {
+            const cleanLine = line.substring(1);
+            for (const rule of rules4) {
+              if (rule.pattern.test(cleanLine)) {
+                issues.push({
+                  type: rule.id,
+                  file: diff.file,
+                  line: lineNumber,
+                  match: cleanLine.trim().substring(0, 50) + "...",
+                  severity: "high",
+                  solution: "Never commit private keys. Revoke this key immediately if it was ever public, and use a secure key manager."
+                });
+              }
+            }
+          }
+          lineNumber++;
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/envFiles.ts
+var envFileScanner;
+var init_envFiles = __esm({
+  "src/scans/envFiles.ts"() {
+    "use strict";
+    envFileScanner = {
+      id: "banned-files",
+      scan(diff) {
+        const issues = [];
+        const filename = diff.file.split("/").pop() || "";
+        const bannedExtensions = [".pem", ".key", ".sqlite", ".db", ".log", ".p12", ".pfx"];
+        const isEnvFile = /(^|\/)\.env(\..+)?$/.test(diff.file);
+        const isNodeModules = diff.file.startsWith("node_modules/");
+        if (isEnvFile || isNodeModules || bannedExtensions.some((ext) => diff.file.endsWith(ext))) {
+          let isIgnored = false;
+          const fs4 = require("fs");
+          const path4 = require("path");
+          try {
+            const gitIgnorePath = path4.join(process.cwd(), ".gitignore");
+            if (fs4.existsSync(gitIgnorePath)) {
+              const gitIgnore = fs4.readFileSync(gitIgnorePath, "utf8");
+              if (gitIgnore.includes(".env") || gitIgnore.includes(filename) || gitIgnore.includes(diff.file)) {
+                isIgnored = true;
+              }
+            }
+            const npmIgnorePath = path4.join(process.cwd(), ".npmignore");
+            if (fs4.existsSync(npmIgnorePath)) {
+              const npmIgnore = fs4.readFileSync(npmIgnorePath, "utf8");
+              if (npmIgnore.includes(".env") || npmIgnore.includes(filename) || npmIgnore.includes(diff.file)) {
+                isIgnored = true;
+              }
+            }
+          } catch (e) {
+          }
+          const matchMsg = isIgnored ? `File extension/name matched banned list (but is currently in .gitignore)` : `DANGER: ${filename} is NOT in .gitignore or .npmignore!`;
+          const severity = isIgnored ? "dummy" : "medium";
+          issues.push({
+            type: "banned-file-type",
+            file: diff.file,
+            line: 0,
+            match: matchMsg,
+            severity,
+            solution: "Add this file to .gitignore. If it is a template, rename it to .env.example."
+          });
+        }
+        return issues;
+      }
+    };
+  }
+});
+
+// src/scans/index.ts
+var allScanners;
+var init_scans = __esm({
+  "src/scans/index.ts"() {
+    "use strict";
+    init_apiKeys();
+    init_cloudProviders();
+    init_collaboration();
+    init_privateKeys();
+    init_envFiles();
+    allScanners = [
+      apiKeyScanner,
+      cloudProviderScanner,
+      collaborationScanner,
+      privateKeyScanner,
+      envFileScanner
+    ];
+  }
+});
+
+// src/utils/fs.ts
+function walkDirectory(dir, baseDir = dir) {
+  let results = [];
+  const list = fs.readdirSync(dir);
+  for (const file of list) {
+    const fullPath = path.join(dir, file);
+    if (file === ".git" || file === "node_modules" || file === "dist" || file === "build") {
+      continue;
+    }
+    const stat = fs.statSync(fullPath);
+    if (stat && stat.isDirectory()) {
+      results = results.concat(walkDirectory(fullPath, baseDir));
+    } else {
+      try {
+        const content = fs.readFileSync(fullPath, "utf8");
+        const relativePath = path.relative(baseDir, fullPath).replace(/\\/g, "/");
+        results.push({ file: relativePath, content });
+      } catch (err) {
+      }
+    }
+  }
+  return results;
+}
+var fs, path;
+var init_fs = __esm({
+  "src/utils/fs.ts"() {
+    "use strict";
+    fs = __toESM(require("fs"));
+    path = __toESM(require("path"));
+  }
+});
+
+// src/utils/dummy.ts
+function isDummySecret(match) {
+  const lowerMatch = match.toLowerCase();
+  const dummyWords = [
+    "example",
+    "dummy",
+    "test",
+    "fake",
+    "demo",
+    "sample",
+    "your_",
+    "insert_",
+    "replace_",
+    "placeholder",
+    "my-secret",
+    "SOME_LONG_TOKEN"
+  ];
+  for (const word of dummyWords) {
+    if (lowerMatch.includes(word)) {
+      return true;
+    }
+  }
+  const knownDummies = [
+    "AKIAIOSFODNN7EXAMPLE",
+    // AWS Test Key
+    "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+    // AWS Test Secret
+  ];
+  for (const known of knownDummies) {
+    if (match.includes(known)) {
+      return true;
+    }
+  }
+  const lowEntropyRegex = /(123456789|abcdef|000000|111111|xxxxxx)/i;
+  if (lowEntropyRegex.test(lowerMatch)) {
+    return true;
+  }
+  return false;
+}
+var init_dummy = __esm({
+  "src/utils/dummy.ts"() {
+    "use strict";
+  }
+});
+
+// src/scanner/index.ts
+var scanner_exports = {};
+__export(scanner_exports, {
+  scanDiff: () => scanDiff,
+  scanDirectory: () => scanDirectory
+});
+async function scanDiff() {
+  const diffs = await getStagedDiff();
+  const issues = [];
+  for (const diff of diffs) {
+    for (const scanner of allScanners) {
+      issues.push(...scanner.scan(diff));
+    }
+  }
+  return issues;
+}
+async function scanDirectory(dirPath) {
+  const files = walkDirectory(dirPath);
+  const issues = [];
+  for (const fileData of files) {
+    const mockContent = fileData.content.split("\n").map((line) => "+" + line).join("\n");
+    const mockDiff = {
+      file: fileData.file,
+      content: mockContent
+    };
+    for (const scanner of allScanners) {
+      issues.push(...scanner.scan(mockDiff));
+    }
+  }
+  for (const issue of issues) {
+    if (isDummySecret(issue.match)) {
+      issue.severity = "dummy";
+    }
+  }
+  return issues;
+}
+var init_scanner = __esm({
+  "src/scanner/index.ts"() {
+    "use strict";
+    init_git();
+    init_scans();
+    init_fs();
+    init_dummy();
+  }
+});
+
+// src/utils/logger.ts
+var logger_exports = {};
+__export(logger_exports, {
+  error: () => error,
+  info: () => info,
+  printIssues: () => printIssues,
+  success: () => success
+});
+function info(message) {
+  console.log(import_picocolors.default.blue("\u2139 info ") + message);
+}
+function success(message) {
+  console.log(import_picocolors.default.green("\u2714 success ") + message);
+}
+function error(message) {
+  console.error(import_picocolors.default.red("\u2716 error ") + message);
+}
+function printIssues(issues, showSolution = false) {
+  console.error("\n" + import_picocolors.default.bold("Scan Results:"));
+  issues.forEach((issue) => {
+    let indicator = "\u25CF";
+    let label = "HIGH";
+    let colorFn = import_picocolors.default.red;
+    if (issue.severity === "medium") {
+      label = "MEDIUM";
+      colorFn = import_picocolors.default.yellow;
+    } else if (issue.severity === "dummy") {
+      indicator = "\u25CB";
+      label = "IGNORED (DUMMY)";
+      colorFn = import_picocolors.default.dim;
+    }
+    let displayMatch = issue.match.replace(/\n/g, " ").trim();
+    if (displayMatch.length > 60) {
+      displayMatch = displayMatch.substring(0, 57) + "...";
+    }
+    console.error(`
+  ${colorFn(indicator)} ${colorFn(import_picocolors.default.bold(label))} ${import_picocolors.default.dim("\xB7")} ${issue.type}`);
+    console.error(`    ${import_picocolors.default.dim("File:")}  ${issue.file}:${issue.line || "?"}`);
+    console.error(`    ${import_picocolors.default.dim("Match:")} ${displayMatch}`);
+    if (showSolution && issue.solution) {
+      console.error(`    ${import_picocolors.default.dim("Fix:")}   ${import_picocolors.default.green(issue.solution)}`);
+    }
+  });
+  console.error();
+}
+var import_picocolors;
+var init_logger = __esm({
+  "src/utils/logger.ts"() {
+    "use strict";
+    import_picocolors = __toESM(require("picocolors"));
+  }
+});
+
+// src/utils/explorer.ts
+var explorer_exports = {};
+__export(explorer_exports, {
+  explorePrompt: () => explorePrompt
+});
+var import_core, import_picocolors3, fs2, path2, explorePrompt;
+var init_explorer = __esm({
+  "src/utils/explorer.ts"() {
+    "use strict";
+    import_core = require("@inquirer/core");
+    import_picocolors3 = __toESM(require("picocolors"));
+    fs2 = __toESM(require("fs"));
+    path2 = __toESM(require("path"));
+    init_scanner();
+    explorePrompt = (0, import_core.createPrompt)(
+      (config, done) => {
+        const [currentPath, setCurrentPath] = (0, import_core.useState)(config.currentDir);
+        const [selectedIndex, setSelectedIndex] = (0, import_core.useState)(0);
+        const [scanResult, setScanResult] = (0, import_core.useState)(null);
+        const [scanningFile, setScanningFile] = (0, import_core.useState)(null);
+        const prefix = (0, import_core.usePrefix)({ status: "idle" });
+        let items = [];
+        try {
+          items = fs2.readdirSync(currentPath, { withFileTypes: true });
+        } catch (err) {
+        }
+        items.sort((a, b) => {
+          if (a.isDirectory() && !b.isDirectory()) return -1;
+          if (!a.isDirectory() && b.isDirectory()) return 1;
+          return a.name.localeCompare(b.name);
+        });
+        const choices = [
+          { name: "\u{1F519} Go Back (or press Left Arrow)", type: "back" },
+          ...items.map((i) => ({
+            name: i.isDirectory() ? `\u{1F4C1} ${i.name}` : `\u{1F4C4} ${i.name}`,
+            type: i.isDirectory() ? "dir" : "file",
+            nameRaw: i.name
+          }))
+        ];
+        (0, import_core.useKeypress)(async (key, rl) => {
+          if ((0, import_core.isEnterKey)(key) || key.name === "right") {
+            const selected = choices[selectedIndex];
+            if (selected.type === "back") {
+              setCurrentPath(path2.dirname(currentPath));
+              setSelectedIndex(0);
+              setScanResult(null);
+            } else if (selected.type === "dir") {
+              setCurrentPath(path2.join(currentPath, selected.nameRaw));
+              setSelectedIndex(0);
+              setScanResult(null);
+            } else if (selected.type === "file") {
+              const fullPath = path2.join(currentPath, selected.nameRaw);
+              setScanningFile(fullPath);
+              const issues = await scanDirectory(currentPath);
+              const fileIssues = issues.filter((i) => i.file === path2.relative(process.cwd(), fullPath).replace(/\\/g, "/"));
+              setScanResult(fileIssues);
+              setScanningFile(null);
+            }
+          } else if (key.name === "left") {
+            setCurrentPath(path2.dirname(currentPath));
+            setSelectedIndex(0);
+            setScanResult(null);
+          } else if ((0, import_core.isUpKey)(key)) {
+            setSelectedIndex((prev) => prev > 0 ? prev - 1 : choices.length - 1);
+          } else if ((0, import_core.isDownKey)(key)) {
+            setSelectedIndex((prev) => prev < choices.length - 1 ? prev + 1 : 0);
+          } else if (key.name === "c" && key.ctrl) {
+            done("");
+          }
+        });
+        let message = `${prefix} ${import_picocolors3.default.bold("Exploring:")} ${import_picocolors3.default.cyan(currentPath)}
+
+`;
+        const startIndex = Math.max(0, selectedIndex - 10);
+        const endIndex = Math.min(choices.length, startIndex + 20);
+        for (let i = startIndex; i < endIndex; i++) {
+          const choice = choices[i];
+          if (i === selectedIndex) {
+            message += import_picocolors3.default.cyan(`\u276F ${choice.name}
+`);
+          } else {
+            message += `  ${choice.name}
+`;
+          }
+        }
+        if (scanResult) {
+          message += `
+${import_picocolors3.default.bold("Scan Results for " + choices[selectedIndex].nameRaw + ":")}
+`;
+          if (scanResult.length === 0) {
+            message += import_picocolors3.default.green("\u2714 No vulnerabilities found in this file.\n");
+          } else {
+            scanResult.forEach((issue) => {
+              message += `  ${issue.severity === "high" ? import_picocolors3.default.red("\u25CF HIGH") : issue.severity === "medium" ? import_picocolors3.default.yellow("\u25CF MEDIUM") : import_picocolors3.default.dim("\u25CB DUMMY")} \xB7 ${issue.type}
+`;
+              message += `    Fix: ${import_picocolors3.default.green(issue.solution || "No solution provided")}
+`;
+            });
+          }
+        } else if (scanningFile) {
+          message += `
+${import_picocolors3.default.yellow("Scanning...")} (Press Right Arrow to scan)
+`;
+        }
+        return message;
+      }
+    );
+  }
+});
+
+// src/cli.ts
+var import_commander = require("commander");
+init_scanner();
+init_logger();
+
+// src/utils/prompts.ts
+var import_prompts = require("@inquirer/prompts");
+async function askToScan() {
+  return await (0, import_prompts.confirm)({
+    message: "Do you want to scan for vulnerabilities before committing?",
+    default: true
+  });
+}
+async function askToContinue() {
+  return await (0, import_prompts.confirm)({
+    message: "Vulnerabilities were found! Do you still want to continue with the commit?",
+    default: false
+  });
+}
+
+// src/utils/spinner.ts
+var import_picocolors2 = __toESM(require("picocolors"));
+var Spinner = class {
+  timer = null;
+  messages;
+  currentMessageIndex = 0;
+  // Cute orange flower animation frames
+  frames = ["\u273F", "\u2740", "\u2741", "\u2742", "\u2743", "\u{1F3F5}"];
+  currentFrame = 0;
+  ticks = 0;
+  constructor(messages) {
+    this.messages = Array.isArray(messages) ? messages : [messages];
+  }
+  start() {
+    process.stdout.write("\x1B[?25l");
+    this.timer = setInterval(() => {
+      if (this.ticks > 0 && this.ticks % 15 === 0) {
+        this.currentMessageIndex = (this.currentMessageIndex + 1) % this.messages.length;
+      }
+      const currentMessage = this.messages[this.currentMessageIndex];
+      process.stdout.write(`\r\x1B[K${import_picocolors2.default.yellow(this.frames[this.currentFrame])} ${currentMessage}`);
+      this.currentFrame = (this.currentFrame + 1) % this.frames.length;
+      this.ticks++;
+    }, 120);
+  }
+  stop(successMessage) {
+    if (this.timer) clearInterval(this.timer);
+    process.stdout.write("\r\x1B[K");
+    process.stdout.write("\x1B[?25h");
+    if (successMessage) {
+      console.log(`${import_picocolors2.default.green("\u2714")} ${successMessage}`);
+    }
+  }
+  fail(failMessage) {
+    if (this.timer) clearInterval(this.timer);
+    process.stdout.write("\r\x1B[K");
+    process.stdout.write("\x1B[?25h");
+    if (failMessage) {
+      console.log(`${import_picocolors2.default.red("\u2716")} ${failMessage}`);
+    }
+  }
+};
+
+// src/cli.ts
+var import_child_process2 = require("child_process");
+var fs3 = __toESM(require("fs"));
+var path3 = __toESM(require("path"));
+var program = new import_commander.Command();
+program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.0.0");
+program.command("init").description("Initialize husky and add the pre-commit hook automatically").action(() => {
+  info("Setting up git hooks with husky...");
+  try {
+    (0, import_child_process2.execSync)("npx husky init", { stdio: "inherit" });
+    const hookPath = path3.join(process.cwd(), ".husky", "pre-commit");
+    const hookContent = `
+# exec < /dev/tty is required to allow interactive prompts in git hooks
+exec < /dev/tty
+npx git-cli-scanner scan
+`.trim();
+    fs3.writeFileSync(hookPath, hookContent, "utf-8");
+    success("Successfully installed pre-commit hook!");
+    info("Next time you run `git commit`, the scanner will prompt you.");
+  } catch (err) {
+    error(`Failed to initialize: ${err.message}`);
+  }
+});
+program.command("scan").description("Interactive vulnerability scan for staged files").option("--show-sol", "Show solutions for vulnerabilities").action(async (options) => {
+  info("GitHub CLI Scanner triggered by Git Hook.");
+  try {
+    const shouldScan = await askToScan();
+    if (!shouldScan) {
+      info("Skipping scan as requested. Proceeding with commit...");
+      process.exit(0);
+    }
+    const spinner = new Spinner([
+      "Scanning staged files for vulnerabilities...",
+      "Analyzing code patterns...",
+      "Checking for exposed API keys...",
+      "Inspecting hidden files and directories...",
+      "Thinking..."
+    ]);
+    spinner.start();
+    await new Promise((resolve) => setTimeout(resolve, 3e3));
+    const issues = await scanDiff();
+    if (issues.length > 0) {
+      const blockerIssues = issues.filter((i) => i.severity !== "dummy");
+      spinner.fail(`Found ${issues.length} potential vulnerabilities! (${blockerIssues.length} blockers)`);
+      const { printIssues: printIssues2 } = (init_logger(), __toCommonJS(logger_exports));
+      printIssues2(issues, options.showSol);
+      if (blockerIssues.length === 0) {
+        info("No high or medium vulnerabilities found. Safe to commit!");
+        process.exit(0);
+      }
+      const shouldContinue = await askToContinue();
+      if (shouldContinue) {
+        info("Proceeding with commit despite vulnerabilities.");
+        process.exit(0);
+      } else {
+        error("Commit aborted. Please edit your files and try again.");
+        process.exit(1);
+      }
+    } else {
+      spinner.stop("No vulnerabilities found. Safe to commit!");
+      process.exit(0);
+    }
+  } catch (err) {
+    if (err.name === "ExitPromptError" || err.message?.includes("closed")) {
+      error("Scan aborted by user.");
+      process.exit(1);
+    }
+    error(`Scanner failed: ${err.message}`);
+    process.exit(1);
+  }
+});
+program.command("scan-all [dir]").description("Scan an entire directory or codebase for vulnerabilities").option("--show-sol", "Show solutions for vulnerabilities").action(async (dir, options) => {
+  const scanDir = dir || process.cwd();
+  info(`Scanning directory: ${scanDir}`);
+  try {
+    const spinner = new Spinner([
+      "Walking directory and reading files...",
+      "Analyzing code patterns...",
+      "Checking for exposed API keys...",
+      "Inspecting hidden files and directories...",
+      "Thinking..."
+    ]);
+    spinner.start();
+    const { scanDirectory: scanDirectory2 } = await Promise.resolve().then(() => (init_scanner(), scanner_exports));
+    await new Promise((resolve) => setTimeout(resolve, 2e3));
+    const issues = await scanDirectory2(scanDir);
+    if (issues.length > 0) {
+      const blockerIssues = issues.filter((i) => i.severity !== "dummy");
+      spinner.fail(`Found ${issues.length} potential vulnerabilities! (${blockerIssues.length} blockers)`);
+      const { printIssues: printIssues2 } = (init_logger(), __toCommonJS(logger_exports));
+      printIssues2(issues, options.showSol);
+      if (blockerIssues.length > 0) {
+        process.exit(1);
+      } else {
+        process.exit(0);
+      }
+    } else {
+      spinner.stop("No vulnerabilities found. Directory is safe!");
+      process.exit(0);
+    }
+  } catch (err) {
+    error(`Scanner failed: ${err.message}`);
+    process.exit(1);
+  }
+});
+program.command("explore").description("Launch an interactive Terminal UI to browse and scan files").action(async () => {
+  try {
+    const { explorePrompt: explorePrompt2 } = (init_explorer(), __toCommonJS(explorer_exports));
+    await explorePrompt2({ currentDir: process.cwd() });
+    process.exit(0);
+  } catch (err) {
+    if (err.name === "ExitPromptError" || err.message?.includes("closed")) {
+      process.exit(0);
+    }
+    error(`Explorer failed: ${err.message}`);
+    process.exit(1);
+  }
+});
+program.parse();

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "git-cli-scanner",
+  "version": "1.0.0",
+  "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
+  "main": "dist/cli.js",
+  "scripts": {
+    "test": "vitest run",
+    "build": "tsup src/cli.ts --format cjs",
+    "prepare": "husky"
+  },
+  "keywords": ["security", "scanner", "git", "secrets", "api-keys", "cli", "pre-commit", "vulnerability"],
+  "author": "riskchips",
+  "license": "ISC",
+  "dependencies": {
+    "@inquirer/core": "^10.3.2",
+    "@inquirer/prompts": "^7.10.1",
+    "commander": "^15.0.0",
+    "husky": "^9.1.7",
+    "picocolors": "^1.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^26.4.1",
+    "tsup": "^8.5.1",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.0"
+  },
+  "bin": {
+    "git-cli-scanner": "dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ]
+}

package/readme.md

@@ -0,0 +1,131 @@
+# Git CLI Scanner
+
+A powerful, interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, private keys, and other vulnerabilities before they ever reach your Git history.
+
+---
+
+## Installation
+
+```bash
+npm install -g git-cli-scanner
+```
+
+## Quick Start
+
+```bash
+# Set up the pre-commit hook (one-time)
+npx git-cli-scanner init
+
+# Now every time you run `git commit`, the scanner will automatically prompt you.
+```
+
+---
+
+## Commands
+
+### `init` — Set up Git hooks
+
+Installs a Husky pre-commit hook that triggers the scanner automatically before every commit.
+
+```bash
+npx git-cli-scanner init
+```
+
+### `scan` — Scan staged files (Git hook mode)
+
+Interactively scans only the files you have staged (`git add`) for vulnerabilities. This is what the pre-commit hook runs.
+
+```bash
+npx git-cli-scanner scan
+npx git-cli-scanner scan --show-sol   # Also show suggested fixes
+```
+
+### `scan-all` — Scan an entire directory
+
+Recursively walks through a directory and scans every file for vulnerabilities. Skips `.git`, `node_modules`, `dist`, and `build` directories automatically.
+
+```bash
+npx git-cli-scanner scan-all .              # Scan current directory
+npx git-cli-scanner scan-all ./src           # Scan only src/
+npx git-cli-scanner scan-all tests --show-sol  # Scan tests/ with solutions
+```
+
+### `explore` — Interactive file explorer TUI
+
+Launch a fully interactive Terminal UI to browse your project and scan files on the fly.
+
+```bash
+npx git-cli-scanner explore
+```
+
+**Controls:**
+| Key | Action |
+|-----|--------|
+| `Up / Down` | Move cursor through files and folders |
+| `Right / Enter` | Open a folder or scan a file |
+| `Left` | Go back to parent directory |
+| `Ctrl+C` | Exit the explorer |
+
+---
+
+## Flags
+
+| Flag | Available On | Description |
+|------|-------------|-------------|
+| `--show-sol` | `scan`, `scan-all` | Show actionable fix suggestions for each vulnerability |
+
+---
+
+## What It Detects
+
+### HIGH Severity (Red)
+- AWS Access Keys & Secret Keys
+- Google Cloud API Keys
+- Slack Tokens & Webhooks
+- GitHub Personal Access Tokens & OAuth Tokens
+- Stripe API Keys
+- SendGrid, Mailgun, and Twilio Tokens
+- RSA, OpenSSH, and PGP Private Keys
+- Generic API keys, passwords, and passphrases (any format like `api_key`, `api-key`, `API_KEY`, etc.)
+
+### MEDIUM Severity (Yellow)
+- `.env` files not listed in `.gitignore`
+- Banned file types: `.pem`, `.key`, `.sqlite`, `.db`, `.log`, `.p12`, `.pfx`
+- `node_modules/` committed to the repo
+
+### Dummy Detection (Dimmed)
+The scanner has a strict dummy detection engine that automatically identifies obvious test/example secrets (like `AKIAIOSFODNN7EXAMPLE` or values containing `test`, `dummy`, `sample`, etc.) and downgrades them so they don't block your workflow.
+
+---
+
+## Gitignore Awareness
+
+The scanner checks if banned files (like `.env`, `.sqlite`, `.pem`) are listed in your `.gitignore` or `.npmignore`. If they are, the issue is downgraded to a safe "IGNORED" status. If they are NOT, you get a loud warning:
+
+```
+DANGER: .env is NOT in .gitignore or .npmignore!
+```
+
+---
+
+## Severity Levels
+
+| Indicator | Level | Color | Meaning |
+|-----------|-------|-------|---------|
+| `●` | HIGH | Red | Hardcoded secrets that must be removed |
+| `●` | MEDIUM | Yellow | Risky files that should be in .gitignore |
+| `○` | IGNORED (DUMMY) | Dim | Detected but identified as a test/example value |
+
+---
+
+## Running Tests
+
+```bash
+npm test
+```
+
+---
+
+## License
+
+ISC