hazmat-cli 0.1.0

package/dist/src/scrub.js

@@ -0,0 +1,61 @@
+import { createReadStream, createWriteStream } from "node:fs";
+import { rename, rm } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { hasDetectorHint, redactText } from "./detectors.js";
+export async function dryRunScrubTextFile(filePath) {
+    let linesScanned = 0;
+    let linesChanged = 0;
+    let redactions = 0;
+    const rl = createInterface({ input: createReadStream(filePath, { encoding: "utf8" }), crlfDelay: Infinity });
+    for await (const line of rl) {
+        linesScanned += 1;
+        if (!hasDetectorHint(line))
+            continue;
+        const result = redactText(line);
+        redactions += result.redactions;
+        if (result.text !== line)
+            linesChanged += 1;
+    }
+    return { path: filePath, linesScanned, linesChanged, redactions };
+}
+export async function scrubTextFileInPlace(filePath) {
+    const tempPath = `${filePath}.hazmat-tmp-${process.pid}`;
+    let linesScanned = 0;
+    let linesChanged = 0;
+    let redactions = 0;
+    const rl = createInterface({ input: createReadStream(filePath, { encoding: "utf8" }), crlfDelay: Infinity });
+    const out = createWriteStream(tempPath, { encoding: "utf8", flags: "wx" });
+    try {
+        for await (const line of rl) {
+            linesScanned += 1;
+            let nextLine = line;
+            if (hasDetectorHint(line)) {
+                const result = redactText(line);
+                nextLine = result.text;
+                redactions += result.redactions;
+                if (nextLine !== line)
+                    linesChanged += 1;
+            }
+            if (!out.write(`${nextLine}\n`))
+                await onceDrain(out);
+        }
+        await closeWriteStream(out);
+        await rename(tempPath, filePath);
+        return { path: filePath, linesScanned, linesChanged, redactions };
+    }
+    catch (error) {
+        out.destroy();
+        await rm(tempPath, { force: true });
+        throw error;
+    }
+}
+function onceDrain(stream) {
+    return new Promise((resolve) => stream.once("drain", resolve));
+}
+function closeWriteStream(stream) {
+    return new Promise((resolve, reject) => {
+        stream.end(() => resolve());
+        stream.once("error", reject);
+    });
+}
+//# sourceMappingURL=scrub.js.map

package/dist/src/scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../../src/scrub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAS7D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7G,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;QAChC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,YAAY,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,QAAQ,GAAG,GAAG,QAAQ,eAAe,OAAO,CAAC,GAAG,EAAE,CAAC;IACzD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7G,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3E,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;YAC5B,YAAY,IAAI,CAAC,CAAC;YAClB,IAAI,QAAQ,GAAG,IAAI,CAAC;YACpB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAChC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;gBACvB,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;gBAChC,IAAI,QAAQ,KAAK,IAAI;oBAAE,YAAY,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,IAAI,CAAC;gBAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,MAA6B;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4C;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/sources.d.ts

@@ -0,0 +1,8 @@
+import type { Harness } from "./types.js";
+export type ScanSource = {
+    harness: Harness;
+    kind: "file" | "sqlite";
+    path: string;
+};
+export declare function discoverDefaultSources(): Promise<ScanSource[]>;
+export declare function discoverPathSources(inputPaths: string[]): Promise<ScanSource[]>;

package/dist/src/sources.js

@@ -0,0 +1,101 @@
+import path from "node:path";
+import { homedir } from "node:os";
+import { access, readdir, stat } from "node:fs/promises";
+import { discoverCodexFiles } from "./codex.js";
+import { discoverFiles } from "./jsonl.js";
+export async function discoverDefaultSources() {
+    const sources = [];
+    for (const file of await discoverCodexFiles())
+        sources.push({ harness: "codex", kind: "file", path: file });
+    for (const file of await discoverFiles([
+        path.join(homedir(), ".claude", "projects"),
+        path.join(homedir(), ".claude", "history.jsonl"),
+    ]))
+        sources.push({ harness: "claude", kind: "file", path: file });
+    for (const file of await discoverFiles([path.join(homedir(), ".pi", "agent", "sessions")])) {
+        sources.push({ harness: "pi", kind: "file", path: file });
+    }
+    const opencodeDb = path.join(homedir(), ".local", "share", "opencode", "opencode.db");
+    if (await exists(opencodeDb))
+        sources.push({ harness: "opencode", kind: "sqlite", path: opencodeDb });
+    for (const cursorPath of await cursorDbCandidates())
+        sources.push({ harness: "cursor", kind: "sqlite", path: cursorPath });
+    return sources;
+}
+export async function discoverPathSources(inputPaths) {
+    const sqliteSources = [];
+    const textRoots = [];
+    for (const input of inputPaths) {
+        const expanded = expandTilde(input);
+        if (await exists(expanded)) {
+            const s = await stat(expanded);
+            if (s.isFile() && isSqlitePath(expanded))
+                sqliteSources.push({ harness: inferHarness(expanded), kind: "sqlite", path: expanded });
+            else
+                textRoots.push(input);
+        }
+    }
+    const files = await discoverFiles(textRoots);
+    return [...sqliteSources, ...files.map((file) => ({ harness: inferHarness(file), kind: isSqlitePath(file) ? "sqlite" : "file", path: file }))];
+}
+async function cursorDbCandidates() {
+    const userDir = process.platform === "darwin"
+        ? path.join(homedir(), "Library", "Application Support", "Cursor", "User")
+        : process.platform === "win32"
+            ? path.join(process.env.APPDATA || path.join(homedir(), "AppData", "Roaming"), "Cursor", "User")
+            : path.join(process.env.XDG_CONFIG_HOME || path.join(homedir(), ".config"), "Cursor", "User");
+    const candidates = new Set();
+    const globalState = path.join(userDir, "globalStorage", "state.vscdb");
+    if (await exists(globalState))
+        candidates.add(globalState);
+    const workspaceStorage = path.join(userDir, "workspaceStorage");
+    if (await exists(workspaceStorage)) {
+        for await (const file of walk(workspaceStorage))
+            if (file.endsWith("state.vscdb"))
+                candidates.add(file);
+    }
+    return [...candidates];
+}
+function expandTilde(input) {
+    if (input === "~")
+        return homedir();
+    if (input.startsWith("~/"))
+        return path.join(homedir(), input.slice(2));
+    return path.resolve(input);
+}
+function inferHarness(file) {
+    if (file.includes(`${path.sep}.claude${path.sep}`))
+        return "claude";
+    if (file.includes(`${path.sep}.pi${path.sep}`))
+        return "pi";
+    if (file.includes(`${path.sep}.codex${path.sep}`))
+        return "codex";
+    if (file.includes(`opencode`))
+        return "opencode";
+    if (file.includes(`Cursor`))
+        return "cursor";
+    return "unknown";
+}
+async function* walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory())
+            yield* walk(fullPath);
+        else if (entry.isFile())
+            yield fullPath;
+    }
+}
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isSqlitePath(file) {
+    return file.endsWith(".db") || file.endsWith(".vscdb");
+}
+//# sourceMappingURL=sources.js.map

package/dist/src/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../src/sources.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,kBAAkB,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5G,KAAK,MAAM,IAAI,IAAI,MAAM,aAAa,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC;KACjD,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAElE,KAAK,MAAM,IAAI,IAAI,MAAM,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACtF,IAAI,MAAM,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAEtG,KAAK,MAAM,UAAU,IAAI,MAAM,kBAAkB,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3H,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAoB;IAC5D,MAAM,aAAa,GAAiB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,YAAY,CAAC,QAAQ,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;;gBAC7H,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACnK,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC1E,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC;YAChG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAElG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IACvE,IAAI,MAAM,MAAM,CAAC,WAAW,CAAC;QAAE,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAChE,IAAI,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC;YAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACpC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aAC1C,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,MAAM,QAAQ,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC"}

package/dist/src/sqlite.d.ts

@@ -0,0 +1,2 @@
+import type { Harness, SourceReport } from "./types.js";
+export declare function scanSQLiteSource(filePath: string, harness: Harness): Promise<SourceReport | null>;

package/dist/src/sqlite.js

@@ -0,0 +1,104 @@
+import { access } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { buildSourceReport, createFindingState, scanCandidateText } from "./scanner.js";
+const SQL_HINTS = [
+    ".env", "PRIVATE KEY", "sk-", "sk-ant-", "ghp_", "gho_", "ghu_", "ghs_", "ghr_",
+    "postgres://", "postgresql://", "mysql://", "mongodb://", "mongodb+srv://", "redis://",
+    "eyJ", "webhook", "hooks.slack", "discord.com/api/webhooks", "discordapp.com/api/webhooks",
+    "KEY", "TOKEN", "SECRET", "PASSWORD", "DATABASE_URL", "DB_URL", "AUTH",
+    "id_rsa", "id_ed25519", ".pem", ".p12", ".pfx", "wallet", "keypair",
+];
+export async function scanSQLiteSource(filePath, harness) {
+    if (!(await exists(filePath)))
+        return null;
+    if (harness === "opencode")
+        return scanOpenCodeDb(filePath);
+    if (harness === "cursor")
+        return scanCursorDb(filePath);
+    return null;
+}
+async function scanOpenCodeDb(filePath) {
+    const state = createFindingState();
+    let snippetsScanned = 0;
+    const targets = [
+        { table: "message", column: "data" },
+        { table: "part", column: "data" },
+        { table: "session_message", column: "data" },
+        { table: "session_input", column: "prompt" },
+    ];
+    for (const target of targets) {
+        for (const hint of SQL_HINTS) {
+            const snippets = await sqliteSnippetRows(filePath, target.table, target.column, hint).catch(() => []);
+            for (const snippet of snippets) {
+                snippetsScanned += 1;
+                scanCandidateText(snippet, state);
+            }
+        }
+    }
+    return buildSourceReport({ harness: "opencode", path: filePath, linesScanned: snippetsScanned, state });
+}
+async function scanCursorDb(filePath) {
+    const state = createFindingState();
+    let snippetsScanned = 0;
+    const targets = [
+        { table: "ItemTable", column: "value" },
+        { table: "cursorDiskKV", column: "value" },
+    ];
+    for (const target of targets) {
+        for (const hint of SQL_HINTS) {
+            const snippets = await sqliteSnippetRows(filePath, target.table, target.column, hint).catch(() => []);
+            for (const snippet of snippets) {
+                snippetsScanned += 1;
+                scanCandidateText(snippet, state);
+            }
+        }
+    }
+    return buildSourceReport({ harness: "cursor", path: filePath, linesScanned: snippetsScanned, state });
+}
+function sqliteSnippetRows(dbPath, table, column, hint) {
+    const safeHint = hint.replaceAll("'", "''");
+    const safeTable = quoteIdent(table);
+    const safeColumn = quoteIdent(column);
+    const query = `SELECT substr(${safeColumn}, max(instr(${safeColumn}, '${safeHint}') - 1000, 1), 4000) AS text FROM ${safeTable} WHERE typeof(${safeColumn}) = 'text' AND ${safeColumn} LIKE '%${safeHint}%'`;
+    return new Promise((resolve, reject) => {
+        const child = spawn("sqlite3", ["-readonly", "-json", dbPath, query], { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => { stdout += chunk; });
+        child.stderr.on("data", (chunk) => { stderr += chunk; });
+        child.on("error", reject);
+        child.on("close", (code) => {
+            if (code !== 0) {
+                reject(new Error(stderr.trim() || `sqlite3 exited with ${code}`));
+                return;
+            }
+            const trimmed = stdout.trim();
+            if (!trimmed) {
+                resolve([]);
+                return;
+            }
+            try {
+                const rows = JSON.parse(trimmed);
+                resolve(rows.map((row) => typeof row.text === "string" ? row.text : "").filter(Boolean));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+    });
+}
+function quoteIdent(identifier) {
+    return `"${identifier.replaceAll('"', '""')}"`;
+}
+async function exists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=sqlite.js.map

package/dist/src/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../src/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGxF,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC/E,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU;IACtF,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,0BAA0B,EAAE,6BAA6B;IAC1F,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM;IACtE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;CACpE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAgB;IACvE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;QACpC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QACjC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;QAC5C,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE;KAC7C,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,eAAe,IAAI,CAAC,CAAC;gBACrB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG;QACd,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;QACvC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE;KAC3C,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,eAAe,IAAI,CAAC,CAAC;gBACrB,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,iBAAiB,UAAU,eAAe,UAAU,MAAM,QAAQ,qCAAqC,SAAS,iBAAiB,UAAU,kBAAkB,UAAU,WAAW,QAAQ,IAAI,CAAC;IAE7M,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA8B,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACtE,CAAC"}

package/dist/src/sqliteScrub.d.ts

@@ -0,0 +1,9 @@
+import type { Harness } from "./types.js";
+export type DbScrubResult = {
+    path: string;
+    rowsScanned: number;
+    rowsChanged: number;
+    redactions: number;
+};
+export declare function dryRunSQLiteScrub(filePath: string, harness: Harness): Promise<DbScrubResult | null>;
+export declare function scrubSQLiteInPlace(filePath: string, harness: Harness): Promise<DbScrubResult | null>;

package/dist/src/sqliteScrub.js

@@ -0,0 +1,128 @@
+import { createRequire } from "node:module";
+import { redactText } from "./detectors.js";
+const SQL_HINTS = [
+    ".env", "PRIVATE KEY", "sk-", "sk-ant-", "ghp_", "gho_", "ghu_", "ghs_", "ghr_",
+    "postgres://", "postgresql://", "mysql://", "mongodb://", "mongodb+srv://", "redis://",
+    "eyJ", "webhook", "hooks.slack", "discord.com/api/webhooks", "discordapp.com/api/webhooks",
+    "KEY", "TOKEN", "SECRET", "PASSWORD", "DATABASE_URL", "DB_URL", "AUTH",
+];
+export async function dryRunSQLiteScrub(filePath, harness) {
+    return scrubSQLite(filePath, harness, { dryRun: true });
+}
+export async function scrubSQLiteInPlace(filePath, harness) {
+    return scrubSQLite(filePath, harness, { dryRun: false });
+}
+async function scrubSQLite(filePath, harness, options) {
+    const targets = targetsForHarness(harness);
+    if (targets.length === 0)
+        return null;
+    const db = openDatabase(filePath, !options.dryRun);
+    let rowsScanned = 0;
+    let rowsChanged = 0;
+    let redactions = 0;
+    try {
+        for (const target of targets) {
+            if (!tableHasColumn(db, target.table, target.column) || !tableHasColumn(db, target.table, target.idColumn))
+                continue;
+            const candidateIds = collectCandidateIds(db, target);
+            const select = db.prepare(`SELECT ${quoteIdent(target.idColumn)} AS id, ${quoteIdent(target.column)} AS value FROM ${quoteIdent(target.table)} WHERE ${quoteIdent(target.idColumn)} = ?`);
+            const update = options.dryRun
+                ? null
+                : db.prepare(`UPDATE ${quoteIdent(target.table)} SET ${quoteIdent(target.column)} = ? WHERE ${quoteIdent(target.idColumn)} = ?`);
+            for (const id of candidateIds) {
+                const rows = select.all(id);
+                const row = rows[0];
+                const value = row?.value;
+                if (typeof value !== "string")
+                    continue;
+                rowsScanned += 1;
+                const result = redactText(value);
+                if (result.text === value)
+                    continue;
+                rowsChanged += 1;
+                redactions += result.redactions;
+                update?.run(result.text, id);
+            }
+        }
+        if (!options.dryRun && rowsChanged > 0) {
+            db.exec("PRAGMA wal_checkpoint(TRUNCATE)");
+            db.exec("VACUUM");
+        }
+        return { path: filePath, rowsScanned, rowsChanged, redactions };
+    }
+    finally {
+        db.close();
+    }
+}
+function targetsForHarness(harness) {
+    if (harness === "opencode") {
+        return [
+            { table: "message", column: "data", idColumn: "id" },
+            { table: "part", column: "data", idColumn: "id" },
+            { table: "session_message", column: "data", idColumn: "id" },
+            { table: "session_input", column: "prompt", idColumn: "id" },
+        ];
+    }
+    if (harness === "cursor") {
+        return [
+            { table: "ItemTable", column: "value", idColumn: "key" },
+            { table: "cursorDiskKV", column: "value", idColumn: "key" },
+        ];
+    }
+    return [];
+}
+function collectCandidateIds(db, target) {
+    const ids = new Set();
+    const idCol = quoteIdent(target.idColumn);
+    const valueCol = quoteIdent(target.column);
+    const table = quoteIdent(target.table);
+    for (const hint of SQL_HINTS) {
+        const rows = db.prepare(`SELECT ${idCol} AS id FROM ${table} WHERE typeof(${valueCol}) = 'text' AND ${valueCol} LIKE ?`).all(`%${hint}%`);
+        for (const row of rows)
+            ids.add(row.id);
+    }
+    return [...ids];
+}
+function tableHasColumn(db, table, column) {
+    try {
+        const rows = db.prepare(`PRAGMA table_info(${quoteIdent(table)})`).all();
+        return rows.some((row) => row.name === column);
+    }
+    catch {
+        return false;
+    }
+}
+function openDatabase(filePath, writable) {
+    const sqlite = requireNodeSqlite();
+    return new sqlite.DatabaseSync(filePath, writable ? {} : { readOnly: true });
+}
+function requireNodeSqlite() {
+    if (!supportsStableNodeSqlite()) {
+        throw new Error(`OpenCode/Cursor DB scrub requires Node >= 22.13.0 because it uses node:sqlite. ` +
+            `Your Node: ${process.version}. JSONL/text scrub still works.`);
+    }
+    try {
+        const require = createRequire(import.meta.url);
+        return require("node:sqlite");
+    }
+    catch {
+        throw new Error(`OpenCode/Cursor DB scrub requires Node >= 22.13.0 because it uses node:sqlite. ` +
+            `Your Node: ${process.version}. JSONL/text scrub still works.`);
+    }
+}
+function supportsStableNodeSqlite() {
+    const match = process.versions.node.match(/^(\d+)\.(\d+)\.(\d+)/);
+    if (!match)
+        return false;
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    if (major > 22)
+        return true;
+    if (major < 22)
+        return false;
+    return minor >= 13;
+}
+function quoteIdent(identifier) {
+    return `"${identifier.replaceAll('"', '""')}"`;
+}
+//# sourceMappingURL=sqliteScrub.js.map

package/dist/src/sqliteScrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqliteScrub.js","sourceRoot":"","sources":["../../src/sqliteScrub.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAqB5C,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC/E,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU;IACtF,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,0BAA0B,EAAE,6BAA6B;IAC1F,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM;CACvE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,OAAgB;IACxE,OAAO,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAgB;IACzE,OAAO,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAgB,EAAE,OAA4B;IACzF,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACrH,MAAM,YAAY,GAAG,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1L,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAEnI,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpB,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC;gBACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxC,WAAW,IAAI,CAAC,CAAC;gBACjB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;oBAAE,SAAS;gBACpC,WAAW,IAAI,CAAC,CAAC;gBACjB,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;gBAChC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACvC,EAAE,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAC3C,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACpD,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC5D,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;YACxD,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,mBAAmB,CAAC,EAAkB,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAW,CAAC;IAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,eAAe,KAAK,iBAAiB,QAAQ,kBAAkB,QAAQ,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;QAC1I,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,EAAkB,EAAE,KAAa,EAAE,MAAc;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAiB;IACvD,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAmB,CAAC;AACjG,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,cAAc,OAAO,CAAC,OAAO,iCAAiC,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,aAAa,CAAuF,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,cAAc,OAAO,CAAC,OAAO,iCAAiC,CACjE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,KAAK,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AACjD,CAAC"}

package/dist/src/state.d.ts

@@ -0,0 +1,5 @@
+import type { ScanReport } from "./types.js";
+export declare const stateDir: string;
+export declare const latestScanPath: string;
+export declare function saveLatestScan(report: ScanReport): Promise<void>;
+export declare function loadLatestScan(): Promise<ScanReport | null>;

package/dist/src/state.js

@@ -0,0 +1,21 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+export const stateDir = path.join(homedir(), ".hazmat");
+export const latestScanPath = path.join(stateDir, "latest-scan.json");
+export async function saveLatestScan(report) {
+    await mkdir(stateDir, { recursive: true });
+    await writeFile(latestScanPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+}
+export async function loadLatestScan() {
+    try {
+        const raw = await readFile(latestScanPath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/src/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAkB;IACrD,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,63 @@
+export type Risk = "low" | "medium" | "high";
+export type Harness = "codex" | "claude" | "pi" | "opencode" | "cursor" | "unknown";
+export type SecretFinding = {
+    kind: "secret";
+    label: string;
+    fingerprint: string;
+    count: number;
+};
+export type FileRefFinding = {
+    kind: "file-reference";
+    label: string;
+    value: string;
+    count: number;
+};
+export type SourceReport = {
+    harness: Harness;
+    path: string;
+    linesScanned: number;
+    risk: Risk;
+    secrets: SecretFinding[];
+    fileReferences: FileRefFinding[];
+    projectPath?: string;
+    sessionId?: string;
+};
+export type ScanReport = {
+    version: 1;
+    generatedAt: string;
+    sources: SourceReport[];
+    summary: {
+        filesScanned: number;
+        linesScanned: number;
+        sensitiveFiles: number;
+        highRiskFiles: number;
+        mediumRiskFiles: number;
+        secretFindings: number;
+        fileReferenceFindings: number;
+        score: number;
+    };
+};
+export type SharePayload = {
+    version: 1;
+    generatedAt: string;
+    score: number;
+    sources: string[];
+    totals: {
+        filesScanned: number;
+        sensitiveFiles: number;
+        highRiskFiles: number;
+        mediumRiskFiles: number;
+        secretFindings: number;
+        fileReferenceFindings: number;
+    };
+    secretClasses: Array<{
+        label: string;
+        count: number;
+        unique: number;
+    }>;
+    fileReferenceGroups: Array<{
+        label: string;
+        count: number;
+        unique: number;
+    }>;
+};

package/dist/src/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":""}

package/dist/src/ui.d.ts

@@ -0,0 +1,19 @@
+import type { ScanReport } from "./types.js";
+export declare const c: {
+    title: import("chalk").ChalkInstance;
+    heading: import("chalk").ChalkInstance;
+    muted: import("chalk").ChalkInstance;
+    good: import("chalk").ChalkInstance;
+    warn: import("chalk").ChalkInstance;
+    danger: import("chalk").ChalkInstance;
+    accent: import("chalk").ChalkInstance;
+    value: import("chalk").ChalkInstance;
+};
+export declare function banner(): string;
+export declare function formatScore(score: number): string;
+export declare function riskColor(risk: string): (value: string) => string;
+export declare function printBanner(): void;
+export declare function progressLine(status: "start" | "done", index: number, total: number, harness: string, path: string): string;
+export declare function savedLine(path: string): string;
+export declare function scrubSummary(changedFiles: number, sources: number, redactions: number, changedLines: number, dryRun: boolean, skipped?: number): string;
+export declare function reportHeader(report: ScanReport): string;

package/dist/src/ui.js

@@ -0,0 +1,65 @@
+import chalk from "chalk";
+export const c = {
+    title: chalk.hex("#f2c94c").bold,
+    heading: chalk.bold,
+    muted: chalk.gray,
+    good: chalk.green,
+    warn: chalk.yellow,
+    danger: chalk.red,
+    accent: chalk.cyan,
+    value: chalk.white.bold,
+};
+export function banner() {
+    const art = [
+        "██╗  ██╗ █████╗ ███████╗███╗   ███╗ █████╗ ████████╗",
+        "██║  ██║██╔══██╗╚══███╔╝████╗ ████║██╔══██╗╚══██╔══╝",
+        "███████║███████║  ███╔╝ ██╔████╔██║███████║   ██║   ",
+        "██╔══██║██╔══██║ ███╔╝  ██║╚██╔╝██║██╔══██║   ██║   ",
+        "██║  ██║██║  ██║███████╗██║ ╚═╝ ██║██║  ██║   ██║   ",
+        "╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝     ╚═╝╚═╝  ╚═╝   ╚═╝   ",
+    ];
+    return art.map((line) => c.title(line)).join("\n");
+}
+export function formatScore(score) {
+    const text = `${score}/100`;
+    if (score >= 80)
+        return c.good(text);
+    if (score >= 40)
+        return c.warn(text);
+    return c.danger(text);
+}
+export function riskColor(risk) {
+    if (risk === "high")
+        return c.danger;
+    if (risk === "medium")
+        return c.warn;
+    return c.good;
+}
+export function printBanner() {
+    console.log(banner());
+    console.log(c.muted("Local exposure scanner for AI coding-agent transcripts"));
+    console.log("");
+}
+export function progressLine(status, index, total, harness, path) {
+    const label = status === "start" ? c.warn("start") : c.good("done ");
+    return `${c.muted("[")}${label} ${c.muted(`${index}/${total}`)}${c.muted("]")} ${c.accent(harness)} ${c.muted(path)}`;
+}
+export function savedLine(path) {
+    return `${c.good("✓")} Saved latest scan: ${c.muted(path)}`;
+}
+export function scrubSummary(changedFiles, sources, redactions, changedLines, dryRun, skipped = 0) {
+    const verb = dryRun ? "Would scrub" : "Scrubbed";
+    const redacted = dryRun ? "Would redact" : "Redacted";
+    const lines = [
+        `${c.good("✓")} ${verb} ${c.value(String(changedFiles))}/${sources} sources.`,
+        `${redacted} ${c.value(String(redactions))} secret-like values across ${c.value(String(changedLines))} lines/rows.`,
+    ];
+    if (skipped > 0)
+        lines.push(`${c.warn("!")} Skipped ${c.value(String(skipped))} unreadable/unsupported sources.`);
+    lines.push(c.muted("No raw secret values were printed."));
+    return lines.join("\n");
+}
+export function reportHeader(report) {
+    return `${c.heading("Generated:")} ${c.muted(report.generatedAt)}`;
+}
+//# sourceMappingURL=ui.js.map