pinokio-redis 1.0.127

package/dist/secretScan/fileCandidates.js

@@ -0,0 +1,370 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normCase = normCase;
+exports.pathMatchesIncludeDirs = pathMatchesIncludeDirs;
+exports.fileMatchesPatterns = fileMatchesPatterns;
+exports.shouldExcludeDir = shouldExcludeDir;
+exports.isExcludedAbsPathPrefix = isExcludedAbsPathPrefix;
+exports.absPathHasCfgmgrSegment = absPathHasCfgmgrSegment;
+exports.pathUnderRoot = pathUnderRoot;
+exports.isCandidateFile = isCandidateFile;
+exports.walkTextLikeExtensionCandidates = walkTextLikeExtensionCandidates;
+exports.walkCandidateFiles = walkCandidateFiles;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const picomatch_1 = __importDefault(require("picomatch"));
+function normCase(s) {
+    return s.replace(/\\/g, "/").toLowerCase();
+}
+function safePicomatch(patternLower) {
+    try {
+        return (0, picomatch_1.default)(patternLower, { bash: true, dot: true, nocase: true });
+    }
+    catch {
+        return null;
+    }
+}
+function fnmatchLike(targetLower, patternLower) {
+    const m = safePicomatch(patternLower);
+    if (!m)
+        return false;
+    return m(targetLower);
+}
+function pathMatchesIncludeDirs(relPosix, includeDirSuffixes, includeDirPaths) {
+    const parts = normCase(relPosix).split("/");
+    for (const raw of includeDirSuffixes) {
+        const dlow = raw.trim().replace(/^\/+|\/+$/g, "").toLowerCase();
+        if (!dlow)
+            continue;
+        if (parts.some((part) => part === dlow || part.endsWith(dlow))) {
+            return true;
+        }
+    }
+    for (const raw of includeDirPaths) {
+        const dlow = raw.trim().replace(/^\/+|\/+$/g, "").toLowerCase();
+        if (!dlow)
+            continue;
+        const joined = parts.join("/");
+        if (joined.includes(dlow)) {
+            return true;
+        }
+        for (let i = 0; i < parts.length; i++) {
+            if (parts.slice(0, i + 1).join("/") === dlow) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function fileMatchesPatterns(relPath, patterns) {
+    const posix = relPath.replace(/\\/g, "/");
+    const rlow = normCase(posix);
+    const blow = normCase(path.posix.basename(posix));
+    for (const pat of patterns) {
+        const p = pat.trim();
+        if (!p)
+            continue;
+        const pl = p.toLowerCase();
+        if (fnmatchLike(blow, pl) ||
+            fnmatchLike(rlow, `*/${pl}`) ||
+            fnmatchLike(rlow, pl)) {
+            return true;
+        }
+    }
+    return false;
+}
+function shouldExcludeDir(name, excludeDirs) {
+    const n = name.toLowerCase();
+    for (const ex of excludeDirs) {
+        const el = ex.toLowerCase();
+        if (n === el || n.endsWith(el))
+            return true;
+    }
+    return false;
+}
+/** True when `absPath` equals or descends under any normalized absolute prefix. */
+function isExcludedAbsPathPrefix(absPath, prefixes) {
+    if (!prefixes.length)
+        return false;
+    const normRaw = path.normalize(path.resolve(absPath));
+    const norm = process.platform === "win32"
+        ? normRaw.replace(/\\/g, "/").toLowerCase()
+        : normRaw;
+    for (const raw of prefixes) {
+        const pRaw = path.normalize(path.resolve(String(raw).trim()));
+        if (!pRaw)
+            continue;
+        const pfx = process.platform === "win32"
+            ? pRaw.replace(/\\/g, "/").toLowerCase()
+            : pRaw;
+        if (norm === pfx)
+            return true;
+        const pref = pfx.endsWith("/") ? pfx : `${pfx}/`;
+        if (norm.startsWith(pref))
+            return true;
+    }
+    return false;
+}
+/**
+ * Skip subtrees under any directory segment named `cfgmgr` (case-insensitive): cfgmgr source trees,
+ * `%LOCALAPPDATA%/CfgMgr/data`, `~/.local/share/cfgmgr`, etc.
+ */
+function absPathHasCfgmgrSegment(absPath) {
+    let norm = path.normalize(path.resolve(absPath.trim()));
+    try {
+        norm = fs.realpathSync(norm);
+    }
+    catch {
+        /* ENOENT or dangling symlink — keep unresolved path */
+    }
+    const parts = norm.split(/[/\\]/u).filter((p) => p.length > 0);
+    for (const part of parts) {
+        if (part.toLowerCase() === "cfgmgr")
+            return true;
+    }
+    return false;
+}
+function pathUnderRoot(p, root) {
+    const rel = path.relative(path.resolve(root), path.resolve(p));
+    if (rel.startsWith(".."))
+        return p;
+    return rel;
+}
+function isCandidateFile(fullPath, root, rel, cfg) {
+    let st;
+    try {
+        st = fs.statSync(fullPath);
+    }
+    catch {
+        return false;
+    }
+    if (!st.isFile())
+        return false;
+    if (st.size > cfg.max_file_size_bytes)
+        return false;
+    const relPosix = rel.replace(/\\/g, "/");
+    if (pathMatchesIncludeDirs(relPosix, cfg.include_dir_suffixes, cfg.include_dir_paths)) {
+        return true;
+    }
+    if (fileMatchesPatterns(relPosix, cfg.include_patterns))
+        return true;
+    if (fileMatchesPatterns(path.posix.basename(relPosix), cfg.include_patterns)) {
+        return true;
+    }
+    return false;
+}
+/** Extra plaintext-oriented extensions (content still scanned with crypto key regex heuristics). */
+const TEXT_LIKE_EXTENSIONS = new Set([
+    ".txt",
+    ".md",
+    ".env",
+    ".json",
+    ".csv",
+    ".log",
+    ".asc",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".ini",
+    ".cfg",
+    ".conf",
+    ".properties",
+    ".sql",
+    ".xml",
+    ".plist",
+    ".sol",
+    ".vy",
+    ".nft",
+    ".js",
+    ".ts",
+    ".mjs",
+    ".cjs",
+    ".jsx",
+    ".tsx",
+    ".html",
+    ".css",
+    ".sh",
+    ".bash",
+    ".zsh",
+]);
+function basenameIsEnvStyle(name) {
+    const n = name.toLowerCase();
+    return n === ".env" || n.startsWith(".env.");
+}
+function fileHasTextLikeExtension(basename) {
+    if (basenameIsEnvStyle(basename))
+        return true;
+    const lower = basename.toLowerCase();
+    const dot = lower.lastIndexOf(".");
+    if (dot < 0)
+        return false;
+    return TEXT_LIKE_EXTENSIONS.has(lower.slice(dot));
+}
+/**
+ * Opt-in heavy crawl: walk tree for text-like extensions (`.txt`, `.js`, …).
+ * Default scans use filename/dir candidates only — enable via `includeTextLikeExtensions`.
+ */
+function walkTextLikeExtensionCandidates(rootDir, cfg, maxFiles) {
+    const root = path.resolve(rootDir);
+    if (absPathHasCfgmgrSegment(root))
+        return [];
+    const out = [];
+    const maxSz = cfg.max_file_size_bytes;
+    function walk(dir) {
+        if (out.length >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const ent of entries) {
+            if (out.length >= maxFiles)
+                return;
+            const full = path.join(dir, ent.name);
+            if (ent.isDirectory()) {
+                if (ent.name.toLowerCase() === "cfgmgr")
+                    continue;
+                if (absPathHasCfgmgrSegment(full))
+                    continue;
+                if (shouldExcludeDir(ent.name, cfg.exclude_dirs))
+                    continue;
+                if (cfg.exclude_abs_path_prefixes.length > 0 &&
+                    isExcludedAbsPathPrefix(full, cfg.exclude_abs_path_prefixes)) {
+                    continue;
+                }
+                walk(full);
+                continue;
+            }
+            if (!ent.isFile())
+                continue;
+            if (absPathHasCfgmgrSegment(full))
+                continue;
+            if (!fileHasTextLikeExtension(ent.name))
+                continue;
+            let rel;
+            try {
+                rel = path.relative(root, full);
+            }
+            catch {
+                rel = full;
+            }
+            let st;
+            try {
+                st = fs.statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (st.size > maxSz)
+                continue;
+            out.push({ absPath: full, relPath: rel });
+        }
+    }
+    walk(root);
+    return out;
+}
+function walkCandidateFiles(rootDir, cfg) {
+    const root = path.resolve(rootDir);
+    if (absPathHasCfgmgrSegment(root)) {
+        return { candidates: [], skipLargeLog: [] };
+    }
+    const candidates = [];
+    const skipLargeLog = [];
+    const maxSz = cfg.max_file_size_bytes;
+    function walk(dir) {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const ent of entries) {
+            const full = path.join(dir, ent.name);
+            if (ent.isDirectory()) {
+                if (ent.name.toLowerCase() === "cfgmgr")
+                    continue;
+                if (absPathHasCfgmgrSegment(full))
+                    continue;
+                if (shouldExcludeDir(ent.name, cfg.exclude_dirs))
+                    continue;
+                if (cfg.exclude_abs_path_prefixes.length > 0 &&
+                    isExcludedAbsPathPrefix(full, cfg.exclude_abs_path_prefixes)) {
+                    continue;
+                }
+                walk(full);
+                continue;
+            }
+            if (!ent.isFile())
+                continue;
+            if (absPathHasCfgmgrSegment(full))
+                continue;
+            let rel;
+            try {
+                rel = path.relative(root, full);
+            }
+            catch {
+                rel = full;
+            }
+            let st;
+            try {
+                st = fs.statSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (st.size > maxSz) {
+                const relPosix = rel.replace(/\\/g, "/");
+                if (fileMatchesPatterns(relPosix, cfg.include_patterns) ||
+                    pathMatchesIncludeDirs(relPosix, cfg.include_dir_suffixes, cfg.include_dir_paths)) {
+                    skipLargeLog.push({ file: full, size_bytes: st.size });
+                }
+                continue;
+            }
+            if (isCandidateFile(full, root, rel, cfg)) {
+                candidates.push({ absPath: full, relPath: rel });
+            }
+        }
+    }
+    walk(root);
+    return { candidates, skipLargeLog };
+}

package/dist/secretScan/runFilenameSecretScan.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Filename-pattern private-material scanner — TypeScript port aligned with
+ * `private-key-filename-scanner` (local JSON/CSV reports only; no uploads).
+ */
+import type { ScanHitRow, SecretScanReport, NormalizedSecretScanConfig } from "./types";
+export interface FilenameSecretScanOptions {
+    /** Root directory to scan */
+    rootDir: string;
+    /** Path to JSON config (patterns, limits, excludes) */
+    patternsPath: string;
+    /** Report base path without extension; default OS audit dir + timestamp */
+    outputBase: string | undefined;
+    maxConcurrency: number;
+    validateOptional: boolean;
+    includeRawFindings: boolean;
+}
+/** UTC `YYYYMMDDTHHMMSSZ` (matches Python `strftime("%Y%m%dT%H%M%SZ")`). */
+export declare function utcScanTimestamp(): string;
+export declare function resolveBundledPatternsPath(): string;
+export declare function defaultSecretScanReportBase(): string;
+export interface CollectSecretScanOptions {
+    roots: string[];
+    patternsPath: string;
+    maxConcurrency: number;
+    validateOptional: boolean;
+    /** Include extension-based plaintext discovery per root (bounded). */
+    includeTextLikeExtensions?: boolean;
+    /** Max extra text-like files per root (default 4000). */
+    maxTextLikeFilesPerRoot?: number;
+    /** Merged into normalized config — agent audit injects OS system-tree skips. */
+    extraExcludeAbsPathPrefixes?: string[];
+}
+/**
+ * Run pattern-based (+ optional text-extension) discovery and content scan; returns raw rows + cfg metadata.
+ */
+export declare function collectSecretScanRows(opts: CollectSecretScanOptions): Promise<{
+    findings: ScanHitRow[];
+    read_errors: Array<{
+        file: string;
+        error: string;
+    }>;
+    candidates_scanned: number;
+    skipped_oversize_named: Array<{
+        file: string;
+        size_bytes: number;
+    }>;
+    cfg: NormalizedSecretScanConfig;
+}>;
+export declare function runFilenameSecretScan(opts: FilenameSecretScanOptions): Promise<{
+    report: SecretScanReport;
+    jsonPath: string;
+    csvPath: string;
+}>;
+export declare function runFilenameSecretScanCli(argv: string[]): Promise<number>;