safeey-cli 0.2.1 → 0.6.1

package/bin/safeey.js

@@ -1,9 +1,15 @@
 #!/usr/bin/env node
 // bin/safeey.js — Safeey CLI entry point.
-const { scan, SEV_ORDER } = require("../src/scan");
+const { scan, grade, SEV_ORDER } = require("../src/scan");
 const { printReport } = require("../src/report");
+const { toSarif } = require("../src/report-sarif");
 const { getConfig, setConfig, CONFIG_PATH } = require("../src/config");
 const { syncResults } = require("../src/sync");
+const { loadBaseline, writeBaseline, filterNew } = require("../src/baseline");
+const auth = require("../src/auth");
+const { Spinner, attachProgress } = require("../src/spinner");
+const { planFixes, planEdits, applyEdits } = require("../src/fix");
+const readline = require("readline");
 
 const pkg = require("../package.json");
 
@@ -12,32 +18,66 @@ Safeey CLI ${pkg.version} — scan your source code for security issues.
 
 Usage
   safeey scan [path]            Scan a directory or file (default: current dir)
-  safeey login <api-key>        Save your Safeey API key (for --sync)
-  safeey logout                 Remove the saved API key
+  safeey fix [path]             Scan, then apply safe fixes (paid plan)
+  safeey login                  Sign in / sign up in your browser
+  safeey logout                 Sign out (removes the key from this machine)
+  safeey whoami                 Show the signed-in account
+
+Account
+  Safeey is free but requires a one-time registration so we know who's using it.
+  Register once, then you're signed in on this machine until you log out.
 
 Options
-  --sync                        Send results to your Safeey dashboard (code stays local)
-  --json                        Output findings as JSON
   --fail-on <severity>          Exit non-zero if any finding >= severity
                                 (critical|high|medium|low|off; default: high)
+  --confidence <level>          Only show findings at/above confidence
+                                (low|medium|high; default: low)
+  --osv                         Check dependencies against known CVEs (OSV.dev; network)
+  --history                     Scan git history for committed secrets
   --no-secrets                  Skip secret detection
+  --json                        Output findings as JSON
+  --sarif                       Output findings as SARIF 2.1.0 (for GitHub code scanning)
+  --baseline <file>            Only report findings not present in <file>
+  --update-baseline <file>     Write the current findings to <file> as the baseline
+  --no-fix                      Don't offer to auto-fix after a scan
+  --dry-run                     With fix: preview changes without writing
+  -y, --yes                     With fix: apply without the confirm prompt
+  --sync                        Send results to your Safeey dashboard (code stays local)
   -h, --help                    Show this help
   -v, --version                 Show version
 
+Suppress a finding inline:
+  riskyCall()   // safeey-ignore <rule-id>
+  // safeey-ignore-next-line <rule-id>
+
 Examples
-  safeey scan ./
-  safeey scan ./src --fail-on critical
-  safeey login sk_safeey_xxx && safeey scan . --sync
+  safeey register
+  safeey scan ./ --osv
+  safeey scan ./src --fail-on critical --confidence high
+  safeey scan . --sarif > safeey.sarif
+  safeey fix . --dry-run
 `;
 
 function parseArgs(argv) {
-  const args = { _: [], failOn: "high", json: false, secrets: true, sync: false };
+  const args = { _: [], failOn: "high", json: false, sarif: false, secrets: true, sync: false, osv: false, history: false, confidence: null, baseline: null, updateBaseline: null };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--json") args.json = true;
+    else if (a === "--sarif") args.sarif = true;
     else if (a === "--sync") args.sync = true;
+    else if (a === "--osv") args.osv = true;
+    else if (a === "--history") args.history = true;
     else if (a === "--no-secrets") args.secrets = false;
     else if (a === "--fail-on") args.failOn = (argv[++i] || "high").toLowerCase();
+    else if (a === "--confidence") args.confidence = (argv[++i] || "low").toLowerCase();
+    else if (a === "--baseline") args.baseline = argv[++i];
+    else if (a === "--update-baseline") args.updateBaseline = argv[++i];
+    else if (a === "--email") args.email = argv[++i];
+    else if (a === "--name") args.name = argv[++i];
+    else if (a === "--key") args.key = argv[++i];
+    else if (a === "--no-fix") args.noFix = true;
+    else if (a === "--yes" || a === "-y") args.yes = true;
+    else if (a === "--dry-run") args.dryRun = true;
     else if (a === "-h" || a === "--help") args.help = true;
     else if (a === "-v" || a === "--version") args.version = true;
     else args._.push(a);
@@ -52,33 +92,101 @@ async function main() {
 
   const command = args._[0];
 
+  // ---- account commands --------------------------------------------------
+  if (command === "register" || command === "signup") {
+    const r = await auth.register({ email: args.email, name: args.name });
+    console.log((r.ok ? "\n  " : "\n  \u2717 ") + r.message + "\n");
+    process.exit(r.ok ? 0 : 1);
+  }
   if (command === "login") {
-    const key = args._[1];
-    if (!key) { console.error("Usage: safeey login <api-key>"); process.exit(2); }
-    setConfig({ apiKey: key });
-    console.log(`Saved. API key stored in ${CONFIG_PATH}`);
-    return;
+    const r = await auth.login({ keyArg: args._[1], email: args.email, key: args.key });
+    console.log((r.ok ? "\n  \u2714 " : "\n  \u2717 ") + r.message + "\n");
+    process.exit(r.ok ? 0 : 1);
   }
   if (command === "logout") {
-    setConfig({ apiKey: null });
-    console.log("Logged out. API key removed.");
-    return;
+    const r = auth.logout();
+    console.log("\n  " + r.message + "\n");
+    process.exit(0);
   }
+  if (command === "whoami") {
+    const r = await auth.whoami();
+    console.log((r.ok ? "\n  " : "\n  \u2717 ") + r.message + "\n");
+    process.exit(r.ok ? 0 : 1);
+  }
+
+  const isFixCmd = command === "fix";
+  const target = ((command === "scan" || isFixCmd) ? args._[1] : command) || ".";
+
+  // Account gate: Safeey is free but requires registration + login.
+  const gate = await auth.requireAuth();
+  if (!gate.allowed) {
+    console.error("\n  " + gate.message + "\n");
+    process.exit(3);
+  }
+  if (gate.warn) console.error(`\n  \u26a0 ${gate.warn}\n`);
 
-  const target = (command === "scan" ? args._[1] : command) || ".";
+  // Progress UX — only for human-facing runs (skip for --json/--sarif so piped
+  // output isn't accompanied by spinner chatter).
+  const quiet = args.json || args.sarif;
+  const spinner = quiet ? null : new Spinner();
+  if (spinner) spinner.begin("Starting scan\u2026");
 
   let result;
   try {
-    result = scan(target, { secrets: args.secrets });
+    result = await scan(target, {
+      secrets: args.secrets,
+      osv: args.osv || isFixCmd, // fixing needs OSV to know which deps to bump
+      history: args.history,
+      confidence: args.confidence,
+      onProgress: spinner ? attachProgress(spinner) : undefined,
+    });
   } catch (e) {
+    if (spinner) spinner.stop();
     console.error("Error:", e.message);
     process.exit(2);
   }
+  if (spinner) spinner.done(`Scanned ${result.filesScanned} file${result.filesScanned === 1 ? "" : "s"}`);
+
+  // Baseline: write mode, or filter mode.
+  if (args.updateBaseline) {
+    const n = writeBaseline(args.updateBaseline, result.findings);
+    console.log(`Baseline written to ${args.updateBaseline} (${n} findings snapshotted).`);
+    return;
+  }
+  if (args.baseline) {
+    const base = loadBaseline(args.baseline);
+    if (!base) {
+      console.error(`Baseline not found or invalid: ${args.baseline} (run --update-baseline first)`);
+      process.exit(2);
+    }
+    result.findings = filterNew(result.findings, base);
+    result.grade = grade(result.findings);
+  }
 
-  if (args.json) {
+  if (args.sarif) {
+    console.log(toSarif(result, target));
+  } else if (args.json) {
     console.log(JSON.stringify({ target, ...result, SEV_ORDER: undefined }, null, 2));
   } else {
     printReport(result, target);
+    if (result.meta && result.meta.osv && result.meta.osv.error) console.log(`  \u26a0 OSV check skipped: ${result.meta.osv.error}\n`);
+    if (result.meta && result.meta.history && result.meta.history.error) console.log(`  \u26a0 History scan skipped: ${result.meta.history.error}\n`);
+  }
+
+  // ---- offer to auto-fix (paid) ------------------------------------------
+  // On a human-facing run with findings, ask whether Safeey should fix them.
+  // Saying no just leaves the results as-is. The `fix` command skips the ask
+  // and goes straight to the (plan-gated) fix flow.
+  if (!quiet && result.findings.length) {
+    const { fixable } = planFixes(result.findings);
+    let proceed = false;
+    if (isFixCmd) {
+      proceed = true;
+    } else if (process.stdin.isTTY && !args.noFix && fixable.length) {
+      const ans = await ask(`  Safeey can auto-fix ${fixable.length} of ${result.findings.length} issue${result.findings.length === 1 ? "" : "s"} for you. Fix them now? (paid plan)  [y/N] `);
+      proceed = /^y(es)?$/i.test(ans.trim());
+    }
+    if (proceed) await runFix(result, target, args, fixable);
   }
 
   if (args.sync) {
@@ -95,4 +203,50 @@ async function main() {
   process.exit(0);
 }
 
+// Interactive yes/no (and free-text) prompt on stdin.
+function ask(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question("\n" + question, (a) => { rl.close(); resolve(a || ""); });
+  });
+}
+
+// Plan-gated fix flow: verify the plan, preview the mechanical changes, confirm,
+// apply. Free users get an upgrade nudge; the scan results stay theirs either way.
+async function runFix(result, target, args, fixable) {
+  const plan = await auth.currentPlan({ refresh: true });
+  if (!auth.isPaid(plan)) {
+    const url = getConfig().apiUrl.replace(/\/$/, "") + "/upgrade";
+    console.log([
+      "",
+      "  \u2728 Auto-fix is part of the paid plan.",
+      `     Upgrade to let Safeey apply these fixes for you: ${url}`,
+      "     The scanner stays free — the results above are yours to keep.",
+      "",
+    ].join("\n"));
+    return;
+  }
+
+  const root = require("path").resolve(target);
+  const edits = planEdits(fixable, root);
+  if (!edits.length) {
+    console.log("\n  Nothing to auto-apply — the fixable issues need no file change (or are already resolved).\n");
+    return;
+  }
+
+  console.log("\n  Planned changes:");
+  for (const e of edits) console.log(`    \u2022 ${e.file}: ${e.summary}${e.note ? `  (${e.note})` : ""}`);
+
+  if (args.dryRun) { console.log("\n  Dry run \u2014 no files written.\n"); return; }
+
+  if (!args.yes) {
+    if (!process.stdin.isTTY) { console.log("\n  Re-run with --yes to apply these changes.\n"); return; }
+    const c = await ask("  Apply these changes? [y/N] ");
+    if (!/^y(es)?$/i.test(c.trim())) { console.log("  Skipped. No files changed.\n"); return; }
+  }
+
+  const done = applyEdits(edits);
+  console.log(`\n  \u2714 Applied ${done.length} fix${done.length === 1 ? "" : "es"}. Re-run \`safeey scan\` to confirm.\n`);
+}
+
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "safeey-cli",
-  "version": "0.2.1",
+  "version": "0.6.1",
   "description": "Scan your source code for security vulnerabilities — a Safeey product by Noohra Innovate Ltd.",
   "bin": {
     "safeey": "bin/safeey.js"
@@ -36,7 +36,7 @@
     "url": "https://github.com/davolu/safeey-cli/issues"
   },
   "scripts": {
-    "test": "node bin/safeey.js scan ./test-fixtures --fail-on off",
+    "test": "node test/run.js",
     "prepublishOnly": "node -e \"require('./src/scan')\""
   }
 }

package/src/auth.js

@@ -0,0 +1,232 @@
+// src/auth.js — account gate for the CLI.
+//
+// Safeey is free, but requires a one-time registration + login so there's a
+// record of who's using it. The flow mirrors the existing /api/cli/* + Bearer
+// convention used by sync.js:
+//   POST /api/cli/register { email, name } -> { apiKey }   (backend also emails it)
+//   POST /api/cli/login    { email, apiKey } -> { apiKey, email, plan }
+//   GET  /api/cli/me       (Bearer apiKey)  -> { email, plan }
+//
+// Storage: ~/.safeey/config.json (0600), same as config.js. We cache a
+// verifiedAt so we only hit the network on fresh installs / periodically,
+// keeping normal scans fast and usable offline once verified.
+
+const readline = require("readline");
+const { spawn } = require("child_process");
+const { getConfig, setConfig, CONFIG_PATH } = require("./config");
+
+const REVERIFY_MS = 30 * 24 * 60 * 60 * 1000; // re-check with the server monthly
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// Best-effort "open this URL in the user's browser". Never throws; if it can't
+// open (headless, no opener), we've already printed the URL for manual use.
+function openBrowser(url) {
+  if (process.env.SAFEEY_NO_BROWSER) return false;
+  const p = process.platform;
+  const cmd = p === "darwin" ? "open" : p === "win32" ? "cmd" : "xdg-open";
+  const args = p === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+    return true;
+  } catch { return false; }
+}
+
+function apiBase() { return getConfig().apiUrl; }
+
+async function api(pathname, { method = "GET", token, body } = {}) {
+  const headers = { "Content-Type": "application/json" };
+  if (token) headers.Authorization = `Bearer ${token}`;
+  const res = await fetch(`${apiBase()}${pathname}`, {
+    method, headers, body: body ? JSON.stringify(body) : undefined,
+  });
+  let data = {};
+  try { data = await res.json(); } catch { /* non-JSON */ }
+  return { status: res.status, ok: res.ok, data };
+}
+
+// --- interactive prompts ----------------------------------------------------
+
+function prompt(question, { mask = false } = {}) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    if (mask) {
+      // Replace echoed characters with '*'.
+      const orig = rl._writeToOutput.bind(rl);
+      rl._writeToOutput = (str) => {
+        if (str.includes(question)) return orig(str);
+        orig("*".repeat(str.length > 0 ? 1 : 0));
+      };
+    }
+    rl.question(question, (answer) => { rl.close(); if (mask) process.stdout.write("\n"); resolve(answer.trim()); });
+  });
+}
+
+function isTTY() { return process.stdin.isTTY && process.stdout.isTTY; }
+
+// --- commands ---------------------------------------------------------------
+
+// Browser/device flow (like `gh auth login`): we ask the server to start a
+// device authorization, show the user a short code + URL, they sign in / sign
+// up on the web (that's where the email/lead is captured), and we poll until
+// the server hands back an API key. Both `register` and `login` use this — the
+// web page decides whether it's a new signup or a returning user.
+async function deviceLogin() {
+  if (!isTTY() && !process.env.SAFEEY_NO_BROWSER) {
+    return fail("Interactive sign-in needs a terminal.\n  In CI, set SAFEEY_API_KEY to a key from your Safeey dashboard instead.");
+  }
+
+  let start;
+  try {
+    start = await api("/api/cli/device/start", {
+      method: "POST",
+      body: { client: "safeey-cli", version: require("../package.json").version },
+    });
+  } catch (e) { return fail(`Couldn't reach ${apiBase()}: ${e.message}`); }
+  if (!start.ok) return fail(start.data.message || `Couldn't start sign-in (HTTP ${start.status}).`);
+
+  const d = start.data;
+  const deviceCode = d.device_code || d.deviceCode;
+  const userCode = d.user_code || d.userCode;
+  const verifyUri = d.verification_uri || d.verificationUri;
+  const verifyComplete = d.verification_uri_complete || d.verificationUriComplete || verifyUri;
+  let interval = Math.max(1, d.interval || 5) * 1000;
+  const expiresAt = Date.now() + (d.expires_in || d.expiresIn || 900) * 1000;
+  if (!deviceCode || !userCode || !verifyUri) return fail("The server's sign-in response was incomplete.");
+
+  console.log("\n  Sign in to Safeey to continue.\n");
+  console.log(`    1. Open:  ${verifyComplete}`);
+  console.log(`    2. Enter code:  ${userCode}\n`);
+  if (openBrowser(verifyComplete)) console.log("  (opened your browser)\n");
+  process.stdout.write("  Waiting for you to finish in the browser\u2026");
+
+  while (Date.now() < expiresAt) {
+    await sleep(interval);
+    let r;
+    try { r = await api("/api/cli/device/poll", { method: "POST", body: { device_code: deviceCode } }); }
+    catch { continue; } // transient network blip — keep polling
+    const status = (r.data && (r.data.status || r.data.error)) || (r.ok && r.data.apiKey ? "complete" : "pending");
+
+    if (status === "complete" || (r.ok && r.data.apiKey)) {
+      process.stdout.write("\n");
+      setConfig({ apiKey: r.data.apiKey, email: r.data.email || null, plan: r.data.plan || "free", verifiedAt: Date.now() });
+      return ok(`Signed in${r.data.email ? ` as ${r.data.email}` : ""}. You're all set — run \`safeey scan .\`.`);
+    }
+    if (status === "slow_down") { interval += 2000; process.stdout.write("."); continue; }
+    if (status === "denied" || status === "access_denied") { process.stdout.write("\n"); return fail("Sign-in was denied in the browser."); }
+    if (status === "expired" || status === "expired_token") break;
+    process.stdout.write("."); // pending
+  }
+  process.stdout.write("\n");
+  return fail("Sign-in timed out. Run `safeey login` to try again.");
+}
+
+function register() { return deviceLogin(); }
+
+async function login({ keyArg, key } = {}) {
+  // Scriptable/CI fallback: `safeey login <api-key>` or --key stores a key
+  // directly (also available via the SAFEEY_API_KEY env var).
+  const directKey = keyArg || key;
+  if (directKey) {
+    const v = await verifyToken(directKey);
+    if (v.status === 401) return fail("That key is invalid. Run `safeey login` to sign in via your browser.");
+    if (v.networkError) {
+      setConfig({ apiKey: directKey, verifiedAt: null });
+      return ok("Key saved (couldn't reach the server to verify right now — it'll verify on your next scan).");
+    }
+    setConfig({ apiKey: directKey, email: v.email || undefined, plan: v.plan || "free", verifiedAt: Date.now() });
+    return ok(`Logged in${v.email ? ` as ${v.email}` : ""}.`);
+  }
+  return deviceLogin();
+}
+
+function logout() {
+  setConfig({ apiKey: null, email: null, verifiedAt: null });
+  return ok("Logged out. Your CLI key was removed from this machine.");
+}
+
+async function whoami() {
+  const { apiKey, email } = getConfig();
+  if (!apiKey) return fail("Not logged in. Run `safeey login` (or `safeey register` for a free account).");
+  const v = await verifyToken(apiKey);
+  if (v.status === 401) return fail("Your saved key is no longer valid. Run `safeey login` again.");
+  if (v.networkError) return ok(`${email || "logged in"} (offline — couldn't reach the server to confirm).`);
+  return ok(`${v.email || email || "logged in"}${v.plan ? ` · plan: ${v.plan}` : ""}`);
+}
+
+// --- verification + gate ----------------------------------------------------
+
+async function verifyToken(token) {
+  try {
+    const r = await api("/api/cli/me", { token });
+    return { status: r.status, ok: r.ok, email: r.data.email, plan: r.data.plan, networkError: false };
+  } catch {
+    return { status: 0, ok: false, networkError: true };
+  }
+}
+
+// Returns { allowed: true } or { allowed: false, message }.
+// Enforces: a key must exist; on a fresh install (or monthly) it's verified
+// with the server. Invalid keys are blocked; transient network failures are
+// tolerated once a key has previously verified (so offline use still works).
+async function requireAuth() {
+  const cfg = getConfig();
+  if (!cfg.apiKey) {
+    return { allowed: false, message: authWall() };
+  }
+
+  const fresh = !cfg.verifiedAt;
+  const stale = cfg.verifiedAt && (Date.now() - cfg.verifiedAt) > REVERIFY_MS;
+  if (!fresh && !stale) return { allowed: true }; // fast path
+
+  const v = await verifyToken(cfg.apiKey);
+  if (v.status === 401) {
+    return { allowed: false, message: "Your Safeey key is invalid or expired.\n  Run `safeey login` to sign in again." };
+  }
+  if (v.networkError) {
+    if (fresh) {
+      // Never verified and offline: allow, but let them know.
+      return { allowed: true, warn: "Couldn't reach Safeey to verify your account — continuing offline. It'll verify on your next online scan." };
+    }
+    return { allowed: true }; // previously verified, just offline now
+  }
+  setConfig({ verifiedAt: Date.now(), email: v.email || cfg.email, plan: v.plan || cfg.plan || "free" });
+  return { allowed: true };
+}
+
+// Is this plan a paid tier? Anything that isn't null/"free"/"none".
+function isPaid(plan) { return !!plan && !/^(free|none)$/i.test(plan); }
+
+// Current plan for gating paid features. With refresh, re-checks the server
+// (so a just-purchased upgrade is picked up); otherwise uses the cached value.
+async function currentPlan({ refresh = false } = {}) {
+  const cfg = getConfig();
+  if (refresh && cfg.apiKey) {
+    const v = await verifyToken(cfg.apiKey);
+    if (!v.networkError && v.status !== 401) {
+      setConfig({ plan: v.plan || "free", verifiedAt: Date.now() });
+      return v.plan || "free";
+    }
+  }
+  return cfg.plan || "free";
+}
+
+function authWall() {
+  return [
+    "You need a (free) Safeey account to use the scanner.",
+    "",
+    "  Run  safeey login   to sign in or sign up in your browser.",
+    "",
+    "Safeey stays free; signing in just lets us know who's using it.",
+  ].join("\n");
+}
+
+// --- helpers ----------------------------------------------------------------
+
+function validEmail(e) { return /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(e); }
+function ok(message) { return { ok: true, message }; }
+function fail(message) { return { ok: false, message }; }
+
+module.exports = { register, login, logout, whoami, requireAuth, verifyToken, currentPlan, isPaid };

package/src/baseline.js

@@ -0,0 +1,42 @@
+// src/baseline.js — "show only findings that are new since a snapshot".
+// On a large existing codebase you don't want the first scan to dump 500
+// findings; you want to accept today's state as the baseline and be alerted only
+// to *new* problems. `--update-baseline` writes the snapshot; `--baseline`
+// filters against it.
+//
+// Fingerprint note: we key on ruleId + file + a normalized line. Line numbers do
+// shift as code moves, so a moved-but-unchanged finding can re-surface as "new".
+// That's the standard limitation of line-based baselines; a content-hash
+// fingerprint would be more stable and is a fair future improvement.
+
+const fs = require("fs");
+
+function fingerprint(f) {
+  return `${f.ruleId}|${f.file}|${f.line}|${f.column || 0}`;
+}
+
+function loadBaseline(path) {
+  try {
+    const data = JSON.parse(fs.readFileSync(path, "utf8"));
+    return new Set(Array.isArray(data.fingerprints) ? data.fingerprints : []);
+  } catch {
+    return null; // missing/invalid — caller decides what to do
+  }
+}
+
+function writeBaseline(path, findings) {
+  const payload = {
+    version: 1,
+    generatedAt: new Date().toISOString(),
+    fingerprints: [...new Set(findings.map(fingerprint))].sort(),
+  };
+  fs.writeFileSync(path, JSON.stringify(payload, null, 2) + "\n");
+  return payload.fingerprints.length;
+}
+
+// Keep only findings not present in the baseline set.
+function filterNew(findings, baselineSet) {
+  return findings.filter((f) => !baselineSet.has(fingerprint(f)));
+}
+
+module.exports = { fingerprint, loadBaseline, writeBaseline, filterNew };

package/src/config.js

@@ -14,6 +14,7 @@ function read() {
 function getConfig() {
   const file = read();
   return {
+    ...file,
     apiKey: process.env.SAFEEY_API_KEY || file.apiKey || null,
     apiUrl: process.env.SAFEEY_API_URL || file.apiUrl || DEFAULT_API_URL,
   };

package/src/engine/githistory.js

@@ -0,0 +1,84 @@
+// src/engine/githistory.js — scan a repo's git history for secrets.
+//
+// A secret deleted from the current tree is still sitting in history and is
+// still compromised — anyone with the repo can recover it. The normal scan only
+// sees the working tree; this walks every historical blob. Opt-in (`--history`)
+// because it's slower and only meaningful inside a git repo.
+
+const { execFileSync } = require("child_process");
+const { analyzeSecrets } = require("./secrets");
+
+function git(root, args, opts = {}) {
+  return execFileSync("git", ["-C", root, ...args], {
+    encoding: opts.encoding ?? "utf8",
+    maxBuffer: opts.maxBuffer ?? 128 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+}
+
+const TEXTISH = /\.(js|jsx|ts|tsx|mjs|cjs|json|env|ya?ml|py|rb|go|php|java|txt|sh|config|ini|properties|xml|tf)$/i;
+const ENVISH = /(^|\/)\.env(\.|$)/i;
+
+function analyzeGitHistory(root, { maxBlobs = 3000 } = {}) {
+  try {
+    if (git(root, ["rev-parse", "--is-inside-work-tree"]).trim() !== "true") {
+      return { findings: [], scannedBlobs: 0, error: "not a git repository" };
+    }
+  } catch {
+    return { findings: [], scannedBlobs: 0, error: "git unavailable" };
+  }
+
+  let listing;
+  try { listing = git(root, ["rev-list", "--all", "--objects"]); }
+  catch (e) { return { findings: [], scannedBlobs: 0, error: e.message }; }
+
+  // "<sha> <path>" lines; entries without a path are commits/trees — skip.
+  const blobs = new Map(); // sha -> path (first seen)
+  for (const line of listing.split("\n")) {
+    const sp = line.indexOf(" ");
+    if (sp === -1) continue;
+    const sha = line.slice(0, sp);
+    const p = line.slice(sp + 1).trim();
+    if (!p) continue;
+    if (!TEXTISH.test(p) && !ENVISH.test(p) && !/(^|\/)Dockerfile$/i.test(p)) continue;
+    if (!blobs.has(sha)) blobs.set(sha, p);
+  }
+
+  // Which blobs are still in HEAD? (best-effort; older git may lack --format)
+  const currentShas = new Set();
+  try {
+    for (const s of git(root, ["ls-tree", "-r", "HEAD", "--format=%(objectname)"]).split("\n")) {
+      if (s.trim()) currentShas.add(s.trim());
+    }
+  } catch { /* skip */ }
+
+  const findings = [];
+  const seen = new Set();
+  let scanned = 0;
+  for (const [sha, p] of blobs) {
+    if (scanned >= maxBlobs) break;
+    let content;
+    try { content = git(root, ["cat-file", "blob", sha]); } catch { continue; }
+    if (content.length > 1_000_000) continue;
+    scanned++;
+    for (const h of analyzeSecrets(content, p)) {
+      const key = `${p}|${h.ruleId}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      const inCurrent = currentShas.has(sha);
+      findings.push({
+        ...h,
+        ruleId: `history/${h.ruleId}`,
+        title: `${h.title} in git history`,
+        line: 0,
+        column: 0,
+        confidence: "high",
+        message: `${h.title} found in git history at ${p} (blob ${sha.slice(0, 10)})${inCurrent ? "" : " — no longer in the current tree, but still recoverable from history"}. A committed secret stays compromised even after it's deleted.`,
+        fix: "Rotate this credential now. Then purge it from history with git filter-repo or BFG and force-push — deleting the file in a later commit does not remove it from history.",
+      });
+    }
+  }
+  return { findings, scannedBlobs: scanned, error: null };
+}
+
+module.exports = { analyzeGitHistory };