gitsieve 0.1.0

package/dist/secrets.d.ts

@@ -0,0 +1,13 @@
+/**
+ * A deliberately short list of high-signal, prefix-anchored credential
+ * patterns. This is a secondary check. gitleaks and trufflehog carry hundreds
+ * of rules plus live verification, and they are the right tool for depth --
+ * see the README. What is here exists so that an obvious key in history is not
+ * missed by someone who runs only this tool.
+ */
+export interface SecretPattern {
+    id: string;
+    description: string;
+    regex: RegExp;
+}
+export declare const SECRET_PATTERNS: SecretPattern[];

package/dist/secrets.js

@@ -0,0 +1,48 @@
+export const SECRET_PATTERNS = [
+    {
+        id: "aws-access-key-id",
+        description: "AWS access key id",
+        regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA)[0-9A-Z]{16}\b/g,
+    },
+    {
+        id: "github-token",
+        description: "GitHub personal access / OAuth token",
+        regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        id: "github-fine-grained-token",
+        description: "GitHub fine-grained personal access token",
+        regex: /\bgithub_pat_[A-Za-z0-9_]{60,}\b/g,
+    },
+    {
+        id: "private-key-block",
+        description: "PEM private key block",
+        regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g,
+    },
+    {
+        id: "slack-token",
+        description: "Slack token",
+        regex: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g,
+    },
+    {
+        id: "google-api-key",
+        description: "Google API key",
+        regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    },
+    {
+        id: "stripe-secret-key",
+        description: "Stripe secret or restricted key",
+        regex: /\b(?:sk|rk)_(?:live|test)_[0-9A-Za-z]{16,}\b/g,
+    },
+    {
+        id: "npm-token",
+        description: "npm access token",
+        regex: /\bnpm_[A-Za-z0-9]{36}\b/g,
+    },
+    {
+        id: "jwt",
+        description: "JSON Web Token",
+        regex: /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+    },
+];
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,mBAAmB;QAChC,KAAK,EAAE,yDAAyD;KACjE;IACD;QACE,EAAE,EAAE,cAAc;QAClB,WAAW,EAAE,sCAAsC;QACnD,KAAK,EAAE,8CAA8C;KACtD;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,WAAW,EAAE,2CAA2C;QACxD,KAAK,EAAE,mCAAmC;KAC3C;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,uBAAuB;QACpC,KAAK,EACH,yEAAyE;KAC5E;IACD;QACE,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,aAAa;QAC1B,KAAK,EAAE,oCAAoC;KAC5C;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,WAAW,EAAE,gBAAgB;QAC7B,KAAK,EAAE,4BAA4B;KACpC;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,iCAAiC;QAC9C,KAAK,EAAE,+CAA+C;KACvD;IACD;QACE,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,kBAAkB;QAC/B,KAAK,EAAE,0BAA0B;KAClC;IACD;QACE,EAAE,EAAE,KAAK;QACT,WAAW,EAAE,gBAAgB;QAC7B,KAAK,EAAE,oEAAoE;KAC5E;CACF,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,104 @@
+/**
+ * The five places a private repository leaks organisation-owned vocabulary.
+ *
+ * The incident this tool was written for leaked through `paths` (a directory
+ * named after a product) and `identities` (an employer email address in the
+ * author field). A content-only scanner sees neither.
+ */
+export type Channel = "contents" | "paths" | "messages" | "identities" | "refs";
+export declare const CHANNELS: readonly Channel[];
+export declare function isChannel(value: unknown): value is Channel;
+/**
+ * A term is a literal string, never a regular expression. Users supply
+ * organisation, product and client names; asking them for regex would invite
+ * both escaping bugs and terms that quietly match nothing.
+ */
+export interface TermSpec {
+    id: string;
+    value: string;
+    /**
+     * "auto" (default) applies ASCII word boundaries only when the term begins
+     * and ends with an ASCII word character. Korean, Japanese and Chinese terms
+     * therefore match as substrings, because `\b` is defined on [A-Za-z0-9_]
+     * and would never fire next to a Hangul syllable.
+     */
+    wholeWord?: "auto" | "always" | "never";
+    caseSensitive?: boolean;
+    /** Restrict this term to some channels. Defaults to all five. */
+    channels?: Channel[];
+    note?: string;
+}
+/**
+ * Suppressions reference a term by id, never by value. A suppression file that
+ * repeated the sensitive string would be the leak it was written to prevent.
+ */
+export interface SuppressionSpec {
+    termId: string;
+    channel?: Channel;
+    path?: string;
+    pathPrefix?: string;
+    reason: string;
+}
+/** A string the operator asserts is present, used to prove the scanner runs. */
+export interface ControlSpec {
+    value: string;
+    channel: Channel;
+    note?: string;
+}
+export interface Config {
+    terms: TermSpec[];
+    suppress?: SuppressionSpec[];
+    controls?: ControlSpec[];
+    /** Secret patterns are a secondary check; on by default, cheap to disable. */
+    secrets?: boolean;
+    /** Blobs larger than this are not read. Their paths are still scanned. */
+    maxBlobBytes?: number;
+}
+export interface Finding {
+    kind: "term" | "secret";
+    id: string;
+    channel: Channel;
+    location: string;
+    path?: string;
+    line?: number;
+    matches: number;
+    /** Redacted unless --show-matches is passed. */
+    sample?: string;
+}
+export interface Warning {
+    code: string;
+    message: string;
+}
+export interface ControlResult {
+    value: string;
+    channel: Channel;
+    derived: boolean;
+    matches: number;
+    note?: string;
+}
+export interface ScanReport {
+    repo: string;
+    /**
+     * False means: do not read the findings list as an answer. A zero from an
+     * untrusted scan is the failure mode this whole tool exists to prevent.
+     */
+    trusted: boolean;
+    untrustedReasons: string[];
+    controls: ControlResult[];
+    findings: Finding[];
+    suppressed: {
+        id: string;
+        channel: Channel;
+        location: string;
+        reason: string;
+    }[];
+    warnings: Warning[];
+    stats: {
+        commits: number;
+        refs: number;
+        paths: number;
+        objects: number;
+        blobsRead: number;
+        bytesScanned: number;
+    };
+}

package/dist/types.js

@@ -0,0 +1,11 @@
+export const CHANNELS = [
+    "contents",
+    "paths",
+    "messages",
+    "identities",
+    "refs",
+];
+export function isChannel(value) {
+    return typeof value === "string" && CHANNELS.includes(value);
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,QAAQ,GAAuB;IAC1C,UAAU;IACV,OAAO;IACP,UAAU;IACV,YAAY;IACZ,MAAM;CACE,CAAC;AAEX,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,QAA8B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "gitsieve",
+  "version": "0.1.0",
+  "description": "Audit a private repository's entire git history before you open-source it.",
+  "keywords": [
+    "open-source",
+    "audit",
+    "git-history",
+    "secret-scanning",
+    "leak",
+    "pre-publish",
+    "compliance",
+    "cli",
+    "security"
+  ],
+  "author": "John Yoon",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sparkYJO1/gitsieve.git"
+  },
+  "homepage": "https://github.com/sparkYJO1/gitsieve#readme",
+  "bugs": {
+    "url": "https://github.com/sparkYJO1/gitsieve/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "gitsieve": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "selfcheck": "npm run build && node dist/cli.js --repo . --terms gitsieve.selfcheck.json --allow-terms-in-repo",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  }
+}