git-cli-scanner 1.2.1 → 1.3.1

package/dist/cli.js

@@ -32,6 +32,11 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/utils/git.ts
+var git_exports = {};
+__export(git_exports, {
+  getHistoryDiffs: () => getHistoryDiffs,
+  getStagedDiff: () => getStagedDiff
+});
 async function getStagedDiff() {
   try {
     const { stdout: filesOutput } = await execAsync("git diff --cached --name-only");
@@ -50,6 +55,64 @@ async function getStagedDiff() {
     return [];
   }
 }
+async function getHistoryDiffs(options) {
+  try {
+    let cmd = 'git log -p --pretty=format:"---COMMIT:%H---"';
+    if (options.id) {
+      cmd += ` -1 ${options.id}`;
+    } else {
+      if (options.all) cmd += " --all";
+      if (options.since) cmd += ` --since="${options.since}"`;
+      if (!options.all && !options.since) {
+        cmd += " -1";
+      }
+    }
+    const { stdout } = await execAsync(cmd, { maxBuffer: 1024 * 1024 * 50 });
+    if (!stdout.trim()) {
+      return [];
+    }
+    const commits = [];
+    let currentCommit = null;
+    let currentFile = null;
+    let currentDiff = "";
+    const lines = stdout.split("\n");
+    for (const line of lines) {
+      if (line.startsWith("---COMMIT:")) {
+        if (currentFile && currentCommit) {
+          currentCommit.diffs.push({ file: currentFile, content: currentDiff });
+        }
+        currentFile = null;
+        currentDiff = "";
+        const match = line.match(/---COMMIT:([a-f0-9]+)---/);
+        if (match) {
+          currentCommit = { commitHash: match[1], diffs: [] };
+          commits.push(currentCommit);
+        }
+      } else if (line.startsWith("diff --git a/")) {
+        if (currentFile && currentCommit) {
+          currentCommit.diffs.push({ file: currentFile, content: currentDiff });
+        }
+        const parts = line.substring(13).split(" b/");
+        if (parts.length > 0) {
+          currentFile = parts[0];
+        }
+        currentDiff = "";
+      } else if (currentFile) {
+        currentDiff += line + "\n";
+      }
+    }
+    if (currentFile && currentCommit) {
+      currentCommit.diffs.push({ file: currentFile, content: currentDiff });
+    }
+    return commits;
+  } catch (error2) {
+    if (error2.message && error2.message.includes("unknown revision")) {
+      throw new Error(`Invalid commit hash: ${options.id}`);
+    }
+    console.warn("Could not retrieve git history diffs. Are you in a git repository?");
+    return [];
+  }
+}
 var import_child_process, import_util, execAsync;
 var init_git = __esm({
   "src/utils/git.ts"() {
@@ -477,7 +540,8 @@ var init_dummy = __esm({
 var scanner_exports = {};
 __export(scanner_exports, {
   scanDiff: () => scanDiff,
-  scanDirectory: () => scanDirectory
+  scanDirectory: () => scanDirectory,
+  scanHistoryDiffs: () => scanHistoryDiffs
 });
 async function scanDiff() {
   const diffs = await getStagedDiff();
@@ -509,6 +573,28 @@ async function scanDirectory(dirPath) {
   }
   return issues;
 }
+async function scanHistoryDiffs(options) {
+  const { getHistoryDiffs: getHistoryDiffs2 } = await Promise.resolve().then(() => (init_git(), git_exports));
+  const commitDiffs = await getHistoryDiffs2(options);
+  const issues = [];
+  for (const commitDiff of commitDiffs) {
+    for (const diff of commitDiff.diffs) {
+      for (const scanner of allScanners) {
+        const scannerIssues = scanner.scan(diff);
+        for (const issue of scannerIssues) {
+          issue.commitHash = commitDiff.commitHash;
+          issues.push(issue);
+        }
+      }
+    }
+  }
+  for (const issue of issues) {
+    if (isDummySecret(issue.match)) {
+      issue.severity = "dummy";
+    }
+  }
+  return issues;
+}
 var init_scanner = __esm({
   "src/scanner/index.ts"() {
     "use strict";
@@ -573,6 +659,9 @@ function printIssues(issues, showSolution = false) {
       console.error(`
   ${colorFn(indicator)} ${colorFn(import_picocolors.default.bold(label))} ${import_picocolors.default.dim("\xB7")} ${issue.type}`);
       console.error(`    ${import_picocolors.default.dim("File:")}  ${issue.file}:${issue.line || "?"}`);
+      if (issue.commitHash) {
+        console.error(`    ${import_picocolors.default.dim("Commit:")} ${import_picocolors.default.cyan(issue.commitHash)}`);
+      }
       console.error(`    ${import_picocolors.default.dim("Match:")} ${displayMatch}`);
       if (issue.risk) {
         console.error(`    ${import_picocolors.default.dim("Risk:")}  ${import_picocolors.default.yellow(issue.risk)}`);
@@ -812,7 +901,7 @@ var import_child_process2 = require("child_process");
 var fs3 = __toESM(require("fs"));
 var path3 = __toESM(require("path"));
 var program = new import_commander.Command();
-program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.2.1");
+program.name("git-cli-scanner").description("Interactive Git hooks vulnerability scanner").version("1.3.1");
 program.command("init").description("Install pre-commit hook for automatic scanning").action(() => {
   info("Setting up pre-commit hook...");
   try {
@@ -948,6 +1037,37 @@ program.command("scan-all [dir]").description("Scan an entire directory or codeb
     process.exit(1);
   }
 });
+program.command("scan-history").description("Scan Git commit history for exposed secrets (defaults to last commit)").option("--show-sol", "Show solutions for vulnerabilities").option("--since <date>", 'Scan commits since a specific date (e.g. "30 days ago")').option("--id <hash>", "Scan a specific commit hash").option("--all", "Scan all branches and history").action(async (options) => {
+  info("Git CLI Scanner (History Mode) running...");
+  try {
+    const spinnerMsgs = [
+      "Rewinding Git history...",
+      "Extracting historical diffs...",
+      "Scanning temporal anomalies...",
+      "Looking for buried secrets...",
+      "Thinking..."
+    ];
+    const spinner = new Spinner(spinnerMsgs);
+    spinner.start();
+    await new Promise((resolve2) => setTimeout(resolve2, 3e3));
+    const issues = await scanHistoryDiffs({
+      since: options.since,
+      id: options.id,
+      all: options.all
+    });
+    if (issues.length > 0) {
+      const blockerIssues = issues.filter((i) => i.severity !== "dummy");
+      spinner.fail(`Found ${issues.length} historical vulnerabilities! (${blockerIssues.length} blockers)`);
+      const { printIssues: printIssues2 } = (init_logger(), __toCommonJS(logger_exports));
+      printIssues2(issues, options.showSol);
+    } else {
+      spinner.stop("No vulnerabilities found in the scanned history!");
+    }
+  } catch (err) {
+    error(`History scan failed: ${err.message}`);
+    process.exit(1);
+  }
+});
 program.command("explore").description("Launch an interactive Terminal UI to browse and scan files").action(async () => {
   try {
     const { runExplorer: runExplorer2 } = (init_explorer(), __toCommonJS(explorer_exports));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-cli-scanner",
-  "version": "1.2.1",
+  "version": "1.3.1",
   "description": "A powerful interactive CLI tool that scans your codebase for hardcoded secrets, API keys, passwords, and private keys before they reach your Git history.",
   "main": "dist/cli.js",
   "scripts": {

package/readme.md

@@ -39,7 +39,7 @@ After running `init`, every time you run `git commit`, the scanner will automati
 | `scan` | Manually scan staged files |
 | `scan --show-sol` | Scan staged files and show suggested fixes |
 | `scan-all [dir]` | Scan an entire directory recursively |
-| `scan-all [dir] --show-sol` | Scan a directory and show suggested fixes |
+| `scan-history` | Scan Git commit history for leaked secrets |
 | `explore` | Launch interactive file explorer TUI |
 
 ### Enable automatic scanning
@@ -73,6 +73,22 @@ npx git-cli-scanner scan-all ./src
 npx git-cli-scanner scan-all tests --show-sol
 ```
 
+### Scan Git history (Time Travel)
+
+```bash
+# Scan the very last commit (default)
+npx git-cli-scanner scan-history
+
+# Scan a specific commit by hash
+npx git-cli-scanner scan-history --id <hash>
+
+# Scan all commits in the last 30 days
+npx git-cli-scanner scan-history --since="30 days ago"
+
+# Scan the entire Git history across all branches!
+npx git-cli-scanner scan-history --all
+```
+
 ### Interactive file explorer
 
 ```bash