logicstamp-context 0.2.6 → 0.3.0

package/dist/utils/codeSanitizer.js

@@ -0,0 +1,234 @@
+/**
+ * Code sanitization utilities
+ * Replaces secret values in code with "PRIVATE_DATA" based on security report
+ */
+import { resolve, isAbsolute, normalize } from 'node:path';
+import { readFile } from 'node:fs/promises';
+/**
+ * Load security report from file
+ */
+export async function loadSecurityReport(projectRoot) {
+    try {
+        const reportPath = resolve(projectRoot, 'stamp_security_report.json');
+        const content = await readFile(reportPath, 'utf8');
+        return JSON.parse(content);
+    }
+    catch (error) {
+        // Report doesn't exist or can't be read - that's okay
+        return null;
+    }
+}
+/**
+ * Normalize a path for comparison (handles Windows case-insensitivity)
+ * Converts to lowercase on Windows and normalizes separators
+ */
+function normalizePathForComparison(path) {
+    const normalized = normalize(resolve(path));
+    // On Windows, paths are case-insensitive, so lowercase for comparison
+    // Also normalize separators to forward slashes for consistency
+    if (process.platform === 'win32') {
+        return normalized.toLowerCase().replace(/\\/g, '/');
+    }
+    return normalized.replace(/\\/g, '/');
+}
+/**
+ * Get secret matches for a specific file
+ */
+function getSecretMatchesForFile(report, filePath, projectRoot) {
+    // Try to match file path - handle both absolute and relative paths
+    const absoluteFilePath = isAbsolute(filePath) ? filePath : resolve(projectRoot, filePath);
+    const normalizedTargetPath = normalizePathForComparison(absoluteFilePath);
+    // Also normalize project roots for comparison
+    const normalizedReportRoot = normalizePathForComparison(report.projectRoot);
+    const normalizedCurrentRoot = normalizePathForComparison(projectRoot);
+    return report.matches.filter(match => {
+        // Normalize match file path - try multiple strategies
+        let matchFilePath;
+        if (isAbsolute(match.file)) {
+            // Match file is already absolute
+            matchFilePath = match.file;
+        }
+        else {
+            // Match file is relative - try resolving from report's projectRoot first
+            matchFilePath = resolve(report.projectRoot, match.file);
+        }
+        const normalizedMatchPath = normalizePathForComparison(matchFilePath);
+        // Direct path match
+        if (normalizedMatchPath === normalizedTargetPath) {
+            return true;
+        }
+        // If project roots differ, try resolving relative to current projectRoot
+        if (normalizedReportRoot !== normalizedCurrentRoot && !isAbsolute(match.file)) {
+            // Try resolving the match file relative to current projectRoot
+            const alternativePath = resolve(projectRoot, match.file);
+            const normalizedAlternative = normalizePathForComparison(alternativePath);
+            if (normalizedAlternative === normalizedTargetPath) {
+                return true;
+            }
+            // Try making both paths relative to their respective roots and comparing
+            // This handles cases where the file structure is the same but roots differ
+            try {
+                const relativeFromReport = match.file.replace(/^\.\//, '');
+                const relativeFromCurrent = filePath.replace(/^\.\//, '');
+                if (normalizePathForComparison(relativeFromReport) === normalizePathForComparison(relativeFromCurrent)) {
+                    return true;
+                }
+            }
+            catch {
+                // Ignore errors in relative path comparison
+            }
+        }
+        return false;
+    });
+}
+/**
+ * Sanitize a line of code by replacing secret values with "PRIVATE_DATA"
+ * Uses the match information to accurately identify and replace the secret value
+ */
+function sanitizeLine(line, matches) {
+    if (matches.length === 0) {
+        return line;
+    }
+    let sanitized = line;
+    // Sort matches by column (right to left) to avoid offset issues when replacing
+    const sortedMatches = [...matches].sort((a, b) => b.column - a.column);
+    for (const match of sortedMatches) {
+        // Extract the secret value from the snippet
+        // The snippet typically shows: "context = 'SECRET_VALUE' context"
+        // We need to extract the actual secret value
+        // For database URLs: postgres://user:password@host (check this FIRST before quoted value matching)
+        // Database URLs are often in quotes, so we need to handle them specially
+        if (match.type === 'Database URL with Credentials') {
+            // Extract the password from the URL pattern: protocol://user:password@host
+            const dbUrlMatch = match.snippet.match(/((?:postgres|mysql|mongodb):\/\/[^:]+:)([^@]+)(@)/i);
+            if (dbUrlMatch) {
+                const password = dbUrlMatch[2];
+                // Also try to find the full URL in the line to replace just the password part
+                const fullUrlMatch = sanitized.match(/(['"`])((?:postgres|mysql|mongodb):\/\/[^:]+:)([^@]+)(@[^'"`]+)\1/i);
+                if (fullUrlMatch) {
+                    const quote = fullUrlMatch[1];
+                    const prefix = fullUrlMatch[2];
+                    const passwordPart = fullUrlMatch[3];
+                    const suffix = fullUrlMatch[4];
+                    // Replace the URL with password sanitized
+                    sanitized = sanitized.replace(fullUrlMatch[0], `${quote}${prefix}PRIVATE_DATA${suffix}${quote}`);
+                }
+                else if (sanitized.includes(password)) {
+                    // Fallback: just replace the password if we can't match the full URL
+                    sanitized = sanitized.replace(password, 'PRIVATE_DATA');
+                }
+            }
+            continue;
+        }
+        // Try to extract quoted values: 'value', "value", or `value`
+        // Handle cases where snippet has extra context (leading/trailing spaces, etc.)
+        const quotedValueMatch = match.snippet.match(/[=:]\s*(['"`])([^'"`]+)\1/);
+        if (quotedValueMatch) {
+            const quote = quotedValueMatch[1];
+            const secretValue = quotedValueMatch[2];
+            // Replace the secret value in the line, preserving quotes
+            // The secretValue might be in the line even if the snippet has different context
+            if (secretValue && secretValue.length > 0) {
+                const escapedValue = secretValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                // Try to find and replace the quoted value in the line
+                // Match: quote + secretValue + quote (with word boundaries to avoid partial matches)
+                const quotePattern = new RegExp(`${quote}${escapedValue}${quote}`, 'g');
+                // Check if pattern matches (don't use test() as it modifies lastIndex)
+                if (quotePattern.exec(sanitized) !== null) {
+                    // Reset regex lastIndex before replace
+                    quotePattern.lastIndex = 0;
+                    sanitized = sanitized.replace(quotePattern, `${quote}PRIVATE_DATA${quote}`);
+                }
+                else if (sanitized.includes(secretValue)) {
+                    // Fallback: if exact quote match fails, try to replace the value itself
+                    // This handles cases where quotes might differ or context is different
+                    sanitized = sanitized.replace(new RegExp(escapedValue, 'g'), 'PRIVATE_DATA');
+                }
+            }
+            continue;
+        }
+        // Try to extract unquoted values after = or :
+        const unquotedValueMatch = match.snippet.match(/[=:]\s+([a-zA-Z0-9_\-]{16,})/);
+        if (unquotedValueMatch) {
+            const secretValue = unquotedValueMatch[1];
+            if (sanitized.includes(secretValue)) {
+                const escapedValue = secretValue.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                sanitized = sanitized.replace(new RegExp(`\\b${escapedValue}\\b`, 'g'), 'PRIVATE_DATA');
+            }
+            continue;
+        }
+        // For private keys, replace the entire key block
+        if (match.type === 'Private Key' && sanitized.includes('BEGIN')) {
+            // Find the private key block and replace content between BEGIN and END
+            sanitized = sanitized.replace(/(-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----)[\s\S]*?(-----END\s+(?:RSA\s+)?PRIVATE\s+KEY-----)/g, '$1\nPRIVATE_DATA\n$2');
+            continue;
+        }
+        // Fallback: try to find and replace long alphanumeric strings that match the pattern
+        // This is less precise but catches edge cases
+        const longStringMatch = match.snippet.match(/([a-zA-Z0-9_\-]{20,})/);
+        if (longStringMatch) {
+            const potentialSecret = longStringMatch[1];
+            // Only replace if it's not already been replaced and it's a reasonable length
+            if (potentialSecret.length >= 16 && sanitized.includes(potentialSecret) && !sanitized.includes('PRIVATE_DATA')) {
+                const escaped = potentialSecret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                sanitized = sanitized.replace(new RegExp(escaped, 'g'), 'PRIVATE_DATA');
+            }
+        }
+    }
+    return sanitized;
+}
+/**
+ * Sanitize code by replacing secret values with "PRIVATE_DATA"
+ * Uses security report to identify which lines contain secrets
+ */
+export function sanitizeCode(code, filePath, report, projectRoot) {
+    if (!report || report.matches.length === 0) {
+        return {
+            sanitized: code,
+            secretsReplaced: false,
+            filePath,
+            matchCount: 0,
+        };
+    }
+    // Get secret matches for this specific file
+    const fileMatches = getSecretMatchesForFile(report, filePath, projectRoot);
+    if (fileMatches.length === 0) {
+        // No matches for this file - return code unchanged
+        return {
+            sanitized: code,
+            secretsReplaced: false,
+            filePath,
+            matchCount: 0,
+        };
+    }
+    // Group matches by line number
+    const matchesByLine = new Map();
+    for (const match of fileMatches) {
+        if (!matchesByLine.has(match.line)) {
+            matchesByLine.set(match.line, []);
+        }
+        matchesByLine.get(match.line).push(match);
+    }
+    // Sanitize each line that has secrets
+    const lines = code.split('\n');
+    let secretsReplaced = false;
+    const sanitizedLines = lines.map((line, index) => {
+        const lineNumber = index + 1; // Line numbers are 1-based
+        const lineMatches = matchesByLine.get(lineNumber);
+        if (lineMatches && lineMatches.length > 0) {
+            const sanitized = sanitizeLine(line, lineMatches);
+            if (sanitized !== line) {
+                secretsReplaced = true;
+            }
+            return sanitized;
+        }
+        return line;
+    });
+    return {
+        sanitized: sanitizedLines.join('\n'),
+        secretsReplaced,
+        filePath,
+        matchCount: fileMatches.length,
+    };
+}
+//# sourceMappingURL=codeSanitizer.js.map

package/dist/utils/codeSanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeSanitizer.js","sourceRoot":"","sources":["../../src/utils/codeSanitizer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sDAAsD;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,sEAAsE;IACtE,+DAA+D;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,MAAsB,EACtB,QAAgB,EAChB,WAAmB;IAEnB,mEAAmE;IACnE,MAAM,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC1F,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,gBAAgB,CAAC,CAAC;IAE1E,8CAA8C;IAC9C,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;IAEtE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACnC,sDAAsD;QACtD,IAAI,aAAqB,CAAC;QAE1B,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,iCAAiC;YACjC,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,mBAAmB,GAAG,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAEtE,oBAAoB;QACpB,IAAI,mBAAmB,KAAK,oBAAoB,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,IAAI,oBAAoB,KAAK,qBAAqB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9E,+DAA+D;YAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,eAAe,CAAC,CAAC;YAC1E,IAAI,qBAAqB,KAAK,oBAAoB,EAAE,CAAC;gBACnD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yEAAyE;YACzE,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC3D,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC1D,IAAI,0BAA0B,CAAC,kBAAkB,CAAC,KAAK,0BAA0B,CAAC,mBAAmB,CAAC,EAAE,CAAC;oBACvG,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,OAAsB;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,+EAA+E;IAC/E,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEvE,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,4CAA4C;QAC5C,kEAAkE;QAClE,6CAA6C;QAE7C,mGAAmG;QACnG,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,KAAK,+BAA+B,EAAE,CAAC;YACnD,2EAA2E;YAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAC7F,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,8EAA8E;gBAC9E,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBAC3G,IAAI,YAAY,EAAE,CAAC;oBACjB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC/B,0CAA0C;oBAC1C,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,YAAY,CAAC,CAAC,CAAC,EACf,GAAG,KAAK,GAAG,MAAM,eAAe,MAAM,GAAG,KAAK,EAAE,CACjD,CAAC;gBACJ,CAAC;qBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxC,qEAAqE;oBACrE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,6DAA6D;QAC7D,+EAA+E;QAC/E,MAAM,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC1E,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAExC,0DAA0D;YAC1D,iFAAiF;YACjF,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;gBACxE,uDAAuD;gBACvD,qFAAqF;gBACrF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,YAAY,GAAG,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;gBACxE,uEAAuE;gBACvE,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC1C,uCAAuC;oBACvC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;oBAC3B,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,KAAK,eAAe,KAAK,EAAE,CAAC,CAAC;gBAC9E,CAAC;qBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3C,wEAAwE;oBACxE,uEAAuE;oBACvE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,8CAA8C;QAC9C,MAAM,kBAAkB,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC/E,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;gBACxE,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,IAAI,MAAM,CAAC,MAAM,YAAY,KAAK,EAAE,GAAG,CAAC,EACxC,cAAc,CACf,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QAED,iDAAiD;QACjD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,uEAAuE;YACvE,SAAS,GAAG,SAAS,CAAC,OAAO,CAC3B,iGAAiG,EACjG,sBAAsB,CACvB,CAAC;YACF,SAAS;QACX,CAAC;QAED,qFAAqF;QACrF,8CAA8C;QAC9C,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACrE,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,eAAe,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAC3C,8EAA8E;YAC9E,IAAI,eAAe,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/G,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;gBACvE,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,QAAgB,EAChB,MAA6B,EAC7B,WAAmB;IAEnB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,KAAK;YACtB,QAAQ;YACR,UAAU,EAAE,CAAC;SACd,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,MAAM,WAAW,GAAG,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAE3E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,mDAAmD;QACnD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,KAAK;YACtB,QAAQ;YACR,UAAU,EAAE,CAAC;SACd,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyB,CAAC;IACvD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED,sCAAsC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,2BAA2B;QACzD,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACpC,eAAe;QACf,QAAQ;QACR,UAAU,EAAE,WAAW,CAAC,MAAM;KAC/B,CAAC;AACJ,CAAC"}

package/dist/utils/gitignore.d.ts

@@ -2,7 +2,7 @@
  * Utilities for managing .gitignore files
  */
 /**
- * Patterns that should be added to .gitignore for LogicStamp context files
+ * Patterns that should be added to .gitignore for LogicStamp context & security files
  */
 export declare const LOGICSTAMP_GITIGNORE_PATTERNS: string[];
 /**
@@ -17,12 +17,27 @@ export declare function readGitignore(targetDir: string): Promise<string>;
  * Check if a pattern exists in .gitignore content
  */
 export declare function hasPattern(content: string, pattern: string): boolean;
+/**
+ * Check if .gitignore has the LogicStamp block header comment
+ */
+export declare function hasLogicStampBlock(content: string): boolean;
 /**
  * Check if .gitignore has LogicStamp patterns
+ * This is a legacy function for backward compatibility - checks for key patterns
  */
 export declare function hasLogicStampPatterns(content: string): boolean;
 /**
- * Add LogicStamp patterns to .gitignore content
+ * Get which LogicStamp patterns are missing from .gitignore content
+ */
+export declare function getMissingPatterns(content: string): string[];
+/**
+ * Add LogicStamp patterns to .gitignore content (idempotent patch mode)
+ *
+ * Behavior:
+ * - If LogicStamp block exists: append only missing patterns to the block
+ * - If LogicStamp block doesn't exist: add full block at the end
+ * - Never duplicates patterns
+ * - Preserves user's manual additions
  */
 export declare function addLogicStampPatterns(content: string): string;
 /**
@@ -32,11 +47,24 @@ export declare function writeGitignore(targetDir: string, content: string): Prom
 /**
  * Add LogicStamp patterns to .gitignore file
  * Creates .gitignore if it doesn't exist
+ * Uses idempotent patch mode - only adds missing patterns if block exists
  */
 export declare function ensureGitignorePatterns(targetDir: string): Promise<{
     added: boolean;
     created: boolean;
 }>;
+/**
+ * Ensure a specific pattern is in .gitignore
+ * Adds the pattern if it doesn't exist, preserves existing content
+ *
+ * @param targetDir - Project root directory
+ * @param pattern - Pattern to ensure (relative to project root, e.g., "reports/security.json")
+ * @returns Result indicating if pattern was added and if .gitignore was created
+ */
+export declare function ensurePatternInGitignore(targetDir: string, pattern: string): Promise<{
+    added: boolean;
+    created: boolean;
+}>;
 /**
  * Smart .gitignore management with config-based behavior (no prompting)
  *

package/dist/utils/gitignore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH;;GAEG;AACH,eAAO,MAAM,6BAA6B,UAOzC,CAAC;AAEF;;GAEG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGpE;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA0B7D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BtF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAY9G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAyBpF"}
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH;;GAEG;AACH,eAAO,MAAM,6BAA6B,UAQzC,CAAC;AAEF;;GAEG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzE;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5D;AA+CD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAkD7D;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BtF;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAiB9G;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA+B/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAyBpF"}

package/dist/utils/gitignore.js

@@ -6,15 +6,16 @@ import { join } from 'node:path';
 import { readConfig } from './config.js';
 import { debugError } from './debug.js';
 /**
- * Patterns that should be added to .gitignore for LogicStamp context files
+ * Patterns that should be added to .gitignore for LogicStamp context & security files
  */
 export const LOGICSTAMP_GITIGNORE_PATTERNS = [
-    '# LogicStamp context files',
+    '# LogicStamp context & security files',
     'context.json',
     'context_*.json',
     '*.uif.json',
     'logicstamp.manifest.json',
     '.logicstamp/',
+    'stamp_security_report.json',
 ];
 /**
  * Check if .gitignore exists in the given directory
@@ -44,11 +45,18 @@ export async function readGitignore(targetDir) {
  * Check if a pattern exists in .gitignore content
  */
 export function hasPattern(content, pattern) {
-    const lines = content.split('\n').map(line => line.trim());
+    const lines = content.split(/\r?\n/).map(line => line.trim());
     return lines.includes(pattern);
 }
+/**
+ * Check if .gitignore has the LogicStamp block header comment
+ */
+export function hasLogicStampBlock(content) {
+    return hasPattern(content, '# LogicStamp context & security files');
+}
 /**
  * Check if .gitignore has LogicStamp patterns
+ * This is a legacy function for backward compatibility - checks for key patterns
  */
 export function hasLogicStampPatterns(content) {
     // Check for the key patterns (ignore the comment line)
@@ -59,26 +67,94 @@ export function hasLogicStampPatterns(content) {
         (hasPattern(content, 'context_*.json') || hasPattern(content, 'context_main.json'));
 }
 /**
- * Add LogicStamp patterns to .gitignore content
+ * Get which LogicStamp patterns are missing from .gitignore content
  */
-export function addLogicStampPatterns(content) {
-    const lines = content.split('\n');
-    // Check which patterns are missing
-    const missingPatterns = LOGICSTAMP_GITIGNORE_PATTERNS.filter(pattern => {
-        if (pattern.startsWith('#'))
-            return false; // Always add the comment
+export function getMissingPatterns(content) {
+    return LOGICSTAMP_GITIGNORE_PATTERNS.filter(pattern => {
         return !hasPattern(content, pattern);
     });
-    if (missingPatterns.length === 0 && hasPattern(content, '# LogicStamp context files')) {
-        return content; // All patterns already exist
+}
+/**
+ * Find the insertion point for LogicStamp patterns in .gitignore content
+ * Returns the index where the LogicStamp block starts, or -1 if not found
+ */
+function findLogicStampBlockIndex(lines) {
+    const headerIndex = lines.findIndex(line => line.trim() === '# LogicStamp context & security files');
+    return headerIndex;
+}
+/**
+ * Find the insertion point for missing LogicStamp patterns
+ * Returns the index after the last existing LogicStamp pattern in the block
+ */
+function findLogicStampInsertionPoint(lines, startIndex) {
+    // Known LogicStamp patterns (excluding the header comment)
+    const knownPatterns = new Set(LOGICSTAMP_GITIGNORE_PATTERNS.filter(p => !p.startsWith('#')).map(p => p.trim()));
+    let lastPatternIndex = startIndex; // Start after the header comment
+    // Find the last LogicStamp pattern in the block
+    for (let i = startIndex + 1; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        // If we hit a blank line, stop here (insert before the blank line)
+        if (trimmed === '') {
+            return i;
+        }
+        // If we hit a non-LogicStamp pattern (not a comment, not a known pattern), stop here
+        if (!trimmed.startsWith('#') && !knownPatterns.has(trimmed)) {
+            return i;
+        }
+        // If this is a LogicStamp pattern (comment or known pattern), update lastPatternIndex
+        if (trimmed.startsWith('#') || knownPatterns.has(trimmed)) {
+            lastPatternIndex = i + 1; // Insert after this line
+        }
     }
-    // Add a blank line before the section if content exists and doesn't end with blank line
-    let newContent = content;
-    if (newContent.length > 0 && !newContent.endsWith('\n\n') && !newContent.endsWith('\n')) {
-        newContent += '\n';
+    // Block extends to end of file - insert at the end
+    return lastPatternIndex;
+}
+/**
+ * Add LogicStamp patterns to .gitignore content (idempotent patch mode)
+ *
+ * Behavior:
+ * - If LogicStamp block exists: append only missing patterns to the block
+ * - If LogicStamp block doesn't exist: add full block at the end
+ * - Never duplicates patterns
+ * - Preserves user's manual additions
+ */
+export function addLogicStampPatterns(content) {
+    const lines = content.split(/\r?\n/);
+    const hasBlock = hasLogicStampBlock(content);
+    const missingPatterns = getMissingPatterns(content);
+    // If block exists and all patterns are present, return unchanged
+    if (hasBlock && missingPatterns.length === 0) {
+        return content;
     }
-    if (newContent.length > 0 && !newContent.endsWith('\n\n')) {
-        newContent += '\n';
+    // If block exists but patterns are missing, append only missing ones
+    if (hasBlock && missingPatterns.length > 0) {
+        const blockStartIndex = findLogicStampBlockIndex(lines);
+        const insertIndex = findLogicStampInsertionPoint(lines, blockStartIndex);
+        // Insert missing patterns right after the last existing LogicStamp pattern
+        const newLines = [...lines];
+        const patternsToAdd = missingPatterns.map(p => p.trim());
+        // Insert patterns at the insertion point
+        newLines.splice(insertIndex, 0, ...patternsToAdd);
+        // Preserve original line ending style
+        const lineEnding = content.includes('\r\n') ? '\r\n' : '\n';
+        return newLines.join(lineEnding) + (content.endsWith(lineEnding) ? '' : lineEnding);
+    }
+    // Block doesn't exist - add full block at the end
+    let newContent = content;
+    // Add blank lines before the section if content exists
+    if (newContent.length > 0) {
+        // Normalize line endings and ensure we end with at least one newline
+        const normalized = newContent.replace(/\r\n/g, '\n');
+        if (!normalized.endsWith('\n')) {
+            newContent = normalized + '\n';
+        }
+        else {
+            newContent = normalized;
+        }
+        // Add one more blank line if content doesn't already end with one
+        if (!newContent.endsWith('\n\n')) {
+            newContent += '\n';
+        }
     }
     // Add all LogicStamp patterns as a group
     newContent += LOGICSTAMP_GITIGNORE_PATTERNS.join('\n') + '\n';
@@ -120,14 +196,50 @@ export async function writeGitignore(targetDir, content) {
 /**
  * Add LogicStamp patterns to .gitignore file
  * Creates .gitignore if it doesn't exist
+ * Uses idempotent patch mode - only adds missing patterns if block exists
  */
 export async function ensureGitignorePatterns(targetDir) {
     const exists = await gitignoreExists(targetDir);
     const content = await readGitignore(targetDir);
-    if (hasLogicStampPatterns(content)) {
+    // Use smart patch mode - will append only missing patterns if block exists
+    const newContent = addLogicStampPatterns(content);
+    // Check if content actually changed
+    const contentChanged = content !== newContent;
+    if (!contentChanged) {
         return { added: false, created: false };
     }
-    const newContent = addLogicStampPatterns(content);
+    await writeGitignore(targetDir, newContent);
+    return { added: true, created: !exists };
+}
+/**
+ * Ensure a specific pattern is in .gitignore
+ * Adds the pattern if it doesn't exist, preserves existing content
+ *
+ * @param targetDir - Project root directory
+ * @param pattern - Pattern to ensure (relative to project root, e.g., "reports/security.json")
+ * @returns Result indicating if pattern was added and if .gitignore was created
+ */
+export async function ensurePatternInGitignore(targetDir, pattern) {
+    const exists = await gitignoreExists(targetDir);
+    const content = await readGitignore(targetDir);
+    // Normalize pattern (forward slashes, no leading slash)
+    const normalizedPattern = pattern.replace(/\\/g, '/').replace(/^\//, '').trim();
+    // Check if pattern already exists
+    if (hasPattern(content, normalizedPattern)) {
+        return { added: false, created: false };
+    }
+    // Add pattern to .gitignore
+    let newContent = content;
+    // Ensure content ends with newline
+    if (newContent.length > 0 && !newContent.endsWith('\n')) {
+        newContent += '\n';
+    }
+    // Add blank line before pattern if content exists
+    if (newContent.length > 0 && !newContent.endsWith('\n\n')) {
+        newContent += '\n';
+    }
+    // Add pattern
+    newContent += normalizedPattern + '\n';
     await writeGitignore(targetDir, newContent);
     return { added: true, created: !exists };
 }

package/dist/utils/gitignore.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,4BAA4B;IAC5B,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,0BAA0B;IAC1B,cAAc;CACf,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAe;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,uDAAuD;IACvD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/E,4CAA4C;IAC5C,+EAA+E;IAC/E,OAAO,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC;QACnC,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,mCAAmC;IACnC,MAAM,eAAe,GAAG,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACrE,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,yBAAyB;QACpE,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,4BAA4B,CAAC,EAAE,CAAC;QACtF,OAAO,OAAO,CAAC,CAAC,6BAA6B;IAC/C,CAAC;IAED,wFAAwF;IACxF,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,yCAAyC;IACzC,UAAU,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE9D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,OAAe;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAA8B,CAAC;QAC3C,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE;YACxC,aAAa;YACb,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;QAEH,IAAI,WAAmB,CAAC;QACxB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,QAAQ;gBACX,WAAW,GAAG,oCAAoC,aAAa,GAAG,CAAC;gBACnE,MAAM;YACR,KAAK,QAAQ;gBACX,WAAW,GAAG,kCAAkC,aAAa,GAAG,CAAC;gBACjE,MAAM;YACR,KAAK,QAAQ;gBACX,WAAW,GAAG,2CAA2C,aAAa,GAAG,CAAC;gBAC1E,MAAM;YACR;gBACE,WAAW,GAAG,oCAAoC,aAAa,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAE/C,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,UAAuC,EAAE;IAEzC,8CAA8C;IAC9C,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3E,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAE3C,6DAA6D;IAC7D,6DAA6D;IAC7D,IAAI,MAAM,CAAC,mBAAmB,KAAK,OAAO,EAAE,CAAC;QAC3C,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,uDAAuD;IACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../../src/utils/gitignore.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,uCAAuC;IACvC,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,0BAA0B;IAC1B,cAAc;IACd,4BAA4B;CAC7B,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,OAAe;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,UAAU,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,uDAAuD;IACvD,MAAM,QAAQ,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/E,4CAA4C;IAC5C,+EAA+E;IAC/E,OAAO,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC;QACnC,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACpD,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,wBAAwB,CAAC,KAAe;IAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,uCAAuC,CAAC,CAAC;IACrG,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CAAC,KAAe,EAAE,UAAkB;IACvE,2DAA2D;IAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CACjF,CAAC;IAEF,IAAI,gBAAgB,GAAG,UAAU,CAAC,CAAC,iCAAiC;IAEpE,gDAAgD;IAChD,KAAK,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEhC,mEAAmE;QACnE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,qFAAqF;QACrF,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC;QACX,CAAC;QAED,sFAAsF;QACtF,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,gBAAgB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,yBAAyB;QACrD,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEpD,iEAAiE;IACjE,IAAI,QAAQ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,IAAI,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,4BAA4B,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAEzE,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC5B,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzD,yCAAyC;QACzC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC;QAElD,sCAAsC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACtF,CAAC;IAED,kDAAkD;IAClD,IAAI,UAAU,GAAG,OAAO,CAAC;IAEzB,uDAAuD;IACvD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,qEAAqE;QACrE,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,UAAU,CAAC;QAC1B,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,IAAI,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,UAAU,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE9D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,OAAe;IACrE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAA8B,CAAC;QAC3C,UAAU,CAAC,WAAW,EAAE,gBAAgB,EAAE;YACxC,aAAa;YACb,SAAS;YACT,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;QAEH,IAAI,WAAmB,CAAC;QACxB,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,QAAQ;gBACX,WAAW,GAAG,oCAAoC,aAAa,GAAG,CAAC;gBACnE,MAAM;YACR,KAAK,QAAQ;gBACX,WAAW,GAAG,kCAAkC,aAAa,GAAG,CAAC;gBACjE,MAAM;YACR,KAAK,QAAQ;gBACX,WAAW,GAAG,2CAA2C,aAAa,GAAG,CAAC;gBAC1E,MAAM;YACR;gBACE,WAAW,GAAG,oCAAoC,aAAa,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IAC7D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAElD,oCAAoC;IACpC,MAAM,cAAc,GAAG,OAAO,KAAK,UAAU,CAAC;IAE9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAE/C,wDAAwD;IACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhF,kCAAkC;IAClC,IAAI,UAAU,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,4BAA4B;IAC5B,IAAI,UAAU,GAAG,OAAO,CAAC;IAEzB,mCAAmC;IACnC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,kDAAkD;IAClD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,cAAc;IACd,UAAU,IAAI,iBAAiB,GAAG,IAAI,CAAC;IAEvC,MAAM,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAE5C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,UAAuC,EAAE;IAEzC,8CAA8C;IAC9C,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3E,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAE3C,6DAA6D;IAC7D,6DAA6D;IAC7D,IAAI,MAAM,CAAC,mBAAmB,KAAK,OAAO,EAAE,CAAC;QAC3C,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxD,CAAC;IAED,uDAAuD;IACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC"}

package/dist/utils/secretDetector.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Simple secret detection utilities
+ * Detects common patterns for API keys, tokens, passwords, etc.
+ */
+export interface SecretMatch {
+    file: string;
+    line: number;
+    column: number;
+    type: string;
+    snippet: string;
+    severity: 'high' | 'medium' | 'low';
+}
+/**
+ * Scan a file for secrets
+ */
+export declare function scanFileForSecrets(filePath: string, content: string): SecretMatch[];
+/**
+ * Filter out false positives (common patterns that look like secrets but aren't)
+ */
+export declare function filterFalsePositives(matches: SecretMatch[]): SecretMatch[];
+//# sourceMappingURL=secretDetector.d.ts.map

package/dist/utils/secretDetector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretDetector.d.ts","sourceRoot":"","sources":["../../src/utils/secretDetector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACrC;AAyFD;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,WAAW,EAAE,CAmCf;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAyB1E"}