sandstream-kit 1.0.0

package/dist/scan-build.d.ts

@@ -0,0 +1,18 @@
+import { type SecretFinding } from "./utils/redactSecrets.js";
+/**
+ * Walks built-artifact directories looking for leaked credentials. The
+ * typical failure mode this catches is a Next.js `NEXT_PUBLIC_` typo that
+ * silently inlines a server-only secret into the client bundle.
+ *
+ * Intentionally narrow in scope:
+ *   - only known build-output dirs (no full-repo walk — that's what
+ *     scanStagedFiles + checkSecretsInCode do)
+ *   - skips obvious binary extensions
+ *   - bounded per-file read at 5 MiB so a giant minified blob doesn't
+ *     stall the scan
+ */
+export interface BuildHit {
+    file: string;
+    findings: SecretFinding[];
+}
+export declare function scanBuildArtifacts(cwd?: string, customDirs?: string[]): Promise<BuildHit[]>;

package/dist/scan-build.js

@@ -0,0 +1,100 @@
+import { readFile, readdir, stat } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { findSecrets } from "./utils/redactSecrets.js";
+const DEFAULT_BUILD_DIRS = [
+    ".next",
+    "dist",
+    "build",
+    "out",
+    ".vercel/output",
+    ".svelte-kit",
+    ".nuxt",
+    ".output",
+];
+const SCANNABLE_EXTS = new Set([
+    ".js",
+    ".mjs",
+    ".cjs",
+    ".ts",
+    ".tsx",
+    ".jsx",
+    ".html",
+    ".css",
+    ".json",
+    ".map",
+    ".txt",
+    ".env",
+    ".env.local",
+    ".env.production",
+]);
+const SKIP_DIRS = new Set([
+    "node_modules",
+    ".git",
+    ".pnpm-store",
+    "cache",
+]);
+const MAX_BYTES = 5 * 1024 * 1024; // 5 MiB
+async function walk(dir, out, depth = 0, maxDepth = 8) {
+    if (depth > maxDepth)
+        return;
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const ent of entries) {
+        if (SKIP_DIRS.has(ent.name))
+            continue;
+        const full = join(dir, ent.name);
+        if (ent.isDirectory()) {
+            await walk(full, out, depth + 1, maxDepth);
+        }
+        else if (ent.isFile()) {
+            const ext = ent.name.includes(".")
+                ? ent.name.slice(ent.name.lastIndexOf("."))
+                : "";
+            if (!SCANNABLE_EXTS.has(ext) && !ent.name.startsWith(".env"))
+                continue;
+            out.push(full);
+        }
+    }
+}
+export async function scanBuildArtifacts(cwd = process.cwd(), customDirs) {
+    const dirsToScan = customDirs ?? DEFAULT_BUILD_DIRS;
+    const files = [];
+    for (const d of dirsToScan) {
+        const full = resolve(cwd, d);
+        try {
+            const st = await stat(full);
+            if (!st.isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        await walk(full, files);
+    }
+    const hits = [];
+    for (const path of files) {
+        let content;
+        try {
+            const st = await stat(path);
+            if (st.size > MAX_BYTES)
+                continue;
+            content = await readFile(path, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const findings = findSecrets(content);
+        if (findings.length > 0) {
+            // Strip leading cwd from path for readable reporting.
+            const rel = path.startsWith(cwd) ? path.slice(cwd.length + 1) : path;
+            hits.push({ file: rel, findings });
+        }
+    }
+    return hits;
+}
+//# sourceMappingURL=scan-build.js.map

package/dist/scan-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-build.js","sourceRoot":"","sources":["../src/scan-build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAsB,MAAM,0BAA0B,CAAC;AAmB3E,MAAM,kBAAkB,GAAG;IACzB,OAAO;IACP,MAAM;IACN,OAAO;IACP,KAAK;IACL,gBAAgB;IAChB,aAAa;IACb,OAAO;IACP,SAAS;CACV,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,YAAY;IACZ,iBAAiB;CAClB,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,aAAa;IACb,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;AAE3C,KAAK,UAAU,IAAI,CACjB,GAAW,EACX,GAAa,EACb,KAAK,GAAG,CAAC,EACT,QAAQ,GAAG,CAAC;IAEZ,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO;IAC7B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,UAAqB;IAErB,MAAM,UAAU,GAAG,UAAU,IAAI,kBAAkB,CAAC;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;gBAAE,SAAS;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,IAAI,GAAG,SAAS;gBAAE,SAAS;YAClC,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,sDAAsD;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scan-plaintext.d.ts

@@ -0,0 +1,24 @@
+import { type SecretFinding } from "./utils/redactSecrets.js";
+export interface PlaintextHit {
+    file: string;
+    findings: SecretFinding[];
+}
+export interface PlaintextScanOptions {
+    /** Additional file paths (relative to cwd) to scan beyond the defaults. */
+    extraFiles?: string[];
+    /** Additional dirs to walk recursively (depth-limited). Defaults to common config homes. */
+    extraDirs?: string[];
+    /** Max directory recursion depth. Default 3. Walk skips node_modules/.git/dist/build/out. */
+    maxDepth?: number;
+    /** Override the entire default list — useful for `.kit.toml` config. */
+    overrideFiles?: string[];
+    overrideDirs?: string[];
+}
+/**
+ * Scan high-signal locations for plaintext secrets before the user moves
+ * to a vault. Widened in P2: recurses into named config dirs (depth-limited),
+ * skips obvious build artifacts/node_modules, follows symlinks safely
+ * (resolves real path + dedupes), and accepts caller-supplied include lists
+ * so `.kit.toml` can extend the defaults per-project.
+ */
+export declare function scanPlaintextSecrets(cwd?: string, opts?: PlaintextScanOptions): Promise<PlaintextHit[]>;

package/dist/scan-plaintext.js

@@ -0,0 +1,147 @@
+import { readFile, readdir, access, stat, realpath } from "node:fs/promises";
+import { resolve, join, relative } from "node:path";
+import { findSecrets } from "./utils/redactSecrets.js";
+const DEFAULT_FILE_NAMES = [
+    ".env",
+    ".env.local",
+    ".env.development",
+    ".env.production",
+    ".env.staging",
+    ".env.test",
+    ".env.preview",
+    ".envrc",
+    "package.json",
+    "vercel.json",
+    "fly.toml",
+    "railway.toml",
+    "wrangler.toml",
+    "netlify.toml",
+    "render.yaml",
+    "docker-compose.yml",
+    "docker-compose.yaml",
+    "terraform.tfvars",
+    "terraform.tfvars.json",
+];
+const DEFAULT_RECURSIVE_DIRS = ["scripts", "config", "infra", "terraform", ".github"];
+const RECURSIVE_FILE_EXTS = /\.(sh|js|ts|mjs|cjs|json|yml|yaml|toml|tf|tfvars|tfstate|env)$/;
+const SKIP_DIR_NAMES = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    "out",
+    ".next",
+    ".turbo",
+    ".cache",
+    "coverage",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".kit", // own state
+]);
+/**
+ * Scan high-signal locations for plaintext secrets before the user moves
+ * to a vault. Widened in P2: recurses into named config dirs (depth-limited),
+ * skips obvious build artifacts/node_modules, follows symlinks safely
+ * (resolves real path + dedupes), and accepts caller-supplied include lists
+ * so `.kit.toml` can extend the defaults per-project.
+ */
+export async function scanPlaintextSecrets(cwd = process.cwd(), opts = {}) {
+    const hits = [];
+    const seenRealPaths = new Set();
+    const fileTargets = opts.overrideFiles ?? [
+        ...DEFAULT_FILE_NAMES,
+        ...(opts.extraFiles ?? []),
+    ];
+    const dirTargets = opts.overrideDirs ?? [
+        ...DEFAULT_RECURSIVE_DIRS,
+        ...(opts.extraDirs ?? []),
+    ];
+    const maxDepth = opts.maxDepth ?? 3;
+    const scanFile = async (relativePath, absolutePath) => {
+        let realPath;
+        try {
+            realPath = await realpath(absolutePath);
+        }
+        catch {
+            return;
+        }
+        if (seenRealPaths.has(realPath))
+            return;
+        seenRealPaths.add(realPath);
+        try {
+            const info = await stat(realPath);
+            if (!info.isFile())
+                return;
+            // Refuse to slurp anything huge — kit isn't a full secret scanner.
+            if (info.size > 5 * 1024 * 1024)
+                return;
+        }
+        catch {
+            return;
+        }
+        try {
+            const text = await readFile(realPath, "utf-8");
+            const findings = findSecrets(text);
+            if (findings.length > 0) {
+                hits.push({ file: relativePath, findings });
+            }
+        }
+        catch {
+            /* unreadable / binary — skip */
+        }
+    };
+    // Pass 1: named files at repo root.
+    for (const name of fileTargets) {
+        const absolute = resolve(cwd, name);
+        try {
+            await access(absolute);
+        }
+        catch {
+            continue;
+        }
+        await scanFile(name, absolute);
+    }
+    // Pass 2: depth-limited walk of the configured dirs.
+    for (const dirName of dirTargets) {
+        const root = resolve(cwd, dirName);
+        try {
+            await access(root);
+        }
+        catch {
+            continue;
+        }
+        await walk(root, 0);
+    }
+    async function walk(dir, depth) {
+        if (depth > maxDepth)
+            return;
+        let entries;
+        try {
+            entries = (await readdir(dir, { withFileTypes: true }));
+        }
+        catch {
+            return;
+        }
+        for (const ent of entries) {
+            if (SKIP_DIR_NAMES.has(ent.name))
+                continue;
+            const childAbs = join(dir, ent.name);
+            const childRel = relative(cwd, childAbs);
+            if (ent.isDirectory()) {
+                await walk(childAbs, depth + 1);
+                continue;
+            }
+            if (!ent.isFile() && !ent.isSymbolicLink())
+                continue;
+            // Only match the known-noisy extensions to keep the scan fast.
+            // .tfstate is intentionally included even though it's huge in some
+            // repos — the size guard above caps the slurp.
+            if (!RECURSIVE_FILE_EXTS.test(ent.name))
+                continue;
+            await scanFile(childRel, childAbs);
+        }
+    }
+    return hits;
+}
+//# sourceMappingURL=scan-plaintext.js.map

package/dist/scan-plaintext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-plaintext.js","sourceRoot":"","sources":["../src/scan-plaintext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAsB,MAAM,0BAA0B,CAAC;AAmB3E,MAAM,kBAAkB,GAAG;IACzB,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,cAAc;IACd,QAAQ;IACR,cAAc;IACd,aAAa;IACb,UAAU;IACV,cAAc;IACd,eAAe;IACf,cAAc;IACd,aAAa;IACb,oBAAoB;IACpB,qBAAqB;IACrB,kBAAkB;IAClB,uBAAuB;CACxB,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAEtF,MAAM,mBAAmB,GAAG,gEAAgE,CAAC;AAE7F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,KAAK;IACL,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,OAAO;IACP,MAAM;IACN,aAAa;IACb,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAA6B,EAAE;IAE/B,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,IAAI;QACxC,GAAG,kBAAkB;QACrB,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;KAC3B,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI;QACtC,GAAG,sBAAsB;QACzB,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;KAC1B,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;IAEpC,MAAM,QAAQ,GAAG,KAAK,EAAE,YAAoB,EAAE,YAAoB,EAAE,EAAE;QACpE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QACxC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO;YAC3B,mEAAmE;YACnE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,oCAAoC;IACpC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,qDAAqD;IACrD,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAa;QAC5C,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO;QAC7B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAwB,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrD,+DAA+D;YAC/D,mEAAmE;YACnE,+CAA+C;YAC/C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scan-staged.d.ts

@@ -0,0 +1,15 @@
+import { type SecretFinding } from "./utils/redactSecrets.js";
+export interface StagedHit {
+    file: string;
+    findings: SecretFinding[];
+}
+/**
+ * Reads the list of staged file paths from git, then scans each blob for
+ * SECRET_PATTERNS. Returns one entry per file that has at least one match.
+ *
+ * Operates on the staged blob (`git show :file`) rather than the working
+ * copy, so a developer can't bypass the check by un-staging the file after
+ * the hook fires. NUL-delimited path parsing keeps newlines + spaces in
+ * filenames safe.
+ */
+export declare function scanStagedFiles(cwd?: string): Promise<StagedHit[]>;

package/dist/scan-staged.js

@@ -0,0 +1,70 @@
+import { readFile } from "node:fs/promises";
+import { findSecrets } from "./utils/redactSecrets.js";
+import { exec } from "./utils/exec.js";
+/**
+ * Reads the list of staged file paths from git, then scans each blob for
+ * SECRET_PATTERNS. Returns one entry per file that has at least one match.
+ *
+ * Operates on the staged blob (`git show :file`) rather than the working
+ * copy, so a developer can't bypass the check by un-staging the file after
+ * the hook fires. NUL-delimited path parsing keeps newlines + spaces in
+ * filenames safe.
+ */
+export async function scanStagedFiles(cwd = process.cwd()) {
+    let paths;
+    try {
+        // `git diff --cached` compares the index to HEAD; on a fresh repo there
+        // is no HEAD yet, which makes the call exit non-zero. Use the empty-tree
+        // SHA as the comparison base in that case so first-ever-commit hooks
+        // still get scanned.
+        let hasHead = true;
+        try {
+            await exec("git", ["rev-parse", "--verify", "HEAD"], {
+                cwd,
+                timeout: 3_000,
+            });
+        }
+        catch {
+            hasHead = false;
+        }
+        const args = hasHead
+            ? ["diff", "--cached", "--name-only", "--diff-filter=AM", "-z"]
+            : ["diff", "--cached", "--name-only", "--diff-filter=AM", "-z",
+                "4b825dc642cb6eb9a060e54bf8d69288fbee4904"]; // Git's well-known empty tree
+        const { stdout } = await exec("git", args, { cwd, timeout: 5_000 });
+        paths = stdout.split("\0").filter(Boolean);
+    }
+    catch {
+        // not a git repo, or git missing — let hook fall through silently
+        return [];
+    }
+    const { resolve } = await import("node:path");
+    const hits = [];
+    for (const path of paths) {
+        // Read the staged blob (`git show :file`) so a developer can't bypass
+        // by un-staging the change after the hook fires. Cap at 1 MiB.
+        let content;
+        try {
+            const { stdout } = await exec("git", ["show", `:${path}`], {
+                cwd,
+                timeout: 5_000,
+                maxBuffer: 1 * 1024 * 1024,
+            });
+            content = stdout;
+        }
+        catch {
+            try {
+                content = await readFile(resolve(cwd, path), "utf-8");
+            }
+            catch {
+                continue;
+            }
+        }
+        const findings = findSecrets(content);
+        if (findings.length > 0) {
+            hits.push({ file: path, findings });
+        }
+    }
+    return hits;
+}
+//# sourceMappingURL=scan-staged.js.map

package/dist/scan-staged.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-staged.js","sourceRoot":"","sources":["../src/scan-staged.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAsB,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAQvC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC/D,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qBAAqB;QACrB,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;gBACnD,GAAG;gBACH,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO;YAClB,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,IAAI,CAAC;YAC/D,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,IAAI;gBAC3D,0CAA0C,CAAC,CAAC,CAAC,8BAA8B;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE;gBACzD,GAAG;gBACH,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;aAC3B,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/scan-transcripts.d.ts

@@ -0,0 +1,23 @@
+import { type SecretFinding } from "./utils/redactSecrets.js";
+/**
+ * Scans agent transcript and prompt-cache directories for leaked credentials.
+ *
+ * Why this matters: an AI agent receives a real key in conversation history,
+ * the message gets persisted to a transcript file, and that file gets read
+ * back into every future prompt. The key keeps re-leaking until the transcript
+ * is purged.
+ *
+ * Scans:
+ *   - `<repo>/.claude/`           — project-local Claude Code state
+ *   - `<repo>/.opencode/`         — OpenCode local state
+ *   - `~/.claude/projects/<repo>/` — global Claude Code project cache
+ *   - `~/.claude/projects/-<repo-path>/` — same, with normalized slashes
+ *
+ * Files we read: `*.jsonl`, `*.md`, `*.json`, `*.txt` (transcript-shaped).
+ * Skipped: binary, large blobs over 10 MiB, node_modules.
+ */
+export interface TranscriptHit {
+    file: string;
+    findings: SecretFinding[];
+}
+export declare function scanTranscripts(cwd?: string): Promise<TranscriptHit[]>;

package/dist/scan-transcripts.js

@@ -0,0 +1,93 @@
+import { readFile, readdir, stat } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { homedir } from "node:os";
+import { findSecrets } from "./utils/redactSecrets.js";
+const SCANNABLE_EXTS = new Set([".jsonl", ".md", ".json", ".txt", ".log"]);
+const SKIP_DIRS = new Set(["node_modules", ".git", "tool-results"]);
+const MAX_BYTES = 10 * 1024 * 1024; // 10 MiB
+async function dirExists(path) {
+    try {
+        const st = await stat(path);
+        return st.isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function walk(dir, out, depth = 0, maxDepth = 6) {
+    if (depth > maxDepth)
+        return;
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const ent of entries) {
+        if (SKIP_DIRS.has(ent.name))
+            continue;
+        const full = join(dir, ent.name);
+        if (ent.isDirectory()) {
+            await walk(full, out, depth + 1, maxDepth);
+        }
+        else if (ent.isFile()) {
+            const ext = ent.name.includes(".")
+                ? ent.name.slice(ent.name.lastIndexOf("."))
+                : "";
+            if (!SCANNABLE_EXTS.has(ext))
+                continue;
+            out.push(full);
+        }
+    }
+}
+/**
+ * Convert an absolute repo path into the slug Claude Code uses for its
+ * `~/.claude/projects/<slug>/` directory: leading dash, then path with `/`
+ * replaced by `-`. Best-effort — both forms are checked.
+ */
+function repoSlug(cwd) {
+    return cwd.replace(/^\//, "-").replace(/\//g, "-");
+}
+export async function scanTranscripts(cwd = process.cwd()) {
+    const candidates = [];
+    // Project-local agent dirs
+    for (const local of [".claude", ".opencode", ".cursor", ".aider"]) {
+        const full = resolve(cwd, local);
+        if (await dirExists(full))
+            candidates.push(full);
+    }
+    // Global Claude Code project cache (best-effort slug match)
+    const home = homedir();
+    const slug = repoSlug(cwd);
+    for (const global of [
+        join(home, ".claude", "projects", slug),
+        join(home, ".opencode", "projects", slug),
+    ]) {
+        if (await dirExists(global))
+            candidates.push(global);
+    }
+    const files = [];
+    for (const root of candidates) {
+        await walk(root, files);
+    }
+    const hits = [];
+    for (const path of files) {
+        let content;
+        try {
+            const st = await stat(path);
+            if (st.size > MAX_BYTES)
+                continue;
+            content = await readFile(path, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        const findings = findSecrets(content);
+        if (findings.length > 0) {
+            hits.push({ file: path, findings });
+        }
+    }
+    return hits;
+}
+//# sourceMappingURL=scan-transcripts.js.map

package/dist/scan-transcripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-transcripts.js","sourceRoot":"","sources":["../src/scan-transcripts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,WAAW,EAAsB,MAAM,0BAA0B,CAAC;AAwB3E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;AACpE,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAE7C,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,GAAW,EACX,GAAa,EACb,KAAK,GAAG,CAAC,EACT,QAAQ,GAAG,CAAC;IAEZ,IAAI,KAAK,GAAG,QAAQ;QAAE,OAAO;IAC7B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAChC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC3C,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,2BAA2B;IAC3B,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,4DAA4D;IAC5D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI;QACnB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC;KAC1C,EAAE,CAAC;QACF,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,EAAE,CAAC,IAAI,GAAG,SAAS;gBAAE,SAAS;YAClC,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/secret-backends.d.ts

@@ -0,0 +1,50 @@
+import type { SecretKeyConfig, InfisicalConfig } from "./config.js";
+import type { SecretResolveResult } from "./secrets.js";
+/**
+ * Single source of truth for every secret backend kit speaks to.
+ *
+ * Each backend declares how to `resolve` (read) a value and, optionally, how
+ * to `write` one. A backend with no `write` is read-only — migration to it is
+ * unsupported, surfaced uniformly by {@link writeViaBackend}. Keeping read and
+ * write side-by-side in one object is the whole point: the previous design had
+ * two independent `switch (source)` statements (one in secrets.ts, one in
+ * secrets-migrate.ts), so adding a backend to one and forgetting the other
+ * failed silently. Here the omission is visible in a single place — and the
+ * read/write capability matrix is asserted in secret-backends.test.ts.
+ */
+export interface WriteOpts {
+    vault?: string;
+    project?: string;
+    region?: string;
+    vaultPath?: string;
+}
+export interface WriteResult {
+    ok: boolean;
+    ref?: string;
+    detail: string;
+}
+export interface SecretBackend {
+    /** Read a secret value for `name` using its `config`. Never throws — failures
+     *  come back as `{ resolved: false, detail }`. */
+    resolve(name: string, config: SecretKeyConfig, infisicalConfig?: InfisicalConfig): Promise<SecretResolveResult>;
+    /** Write a secret. Absent ⇒ the backend is read-only (migration unsupported).
+     *  May throw; callers wrap it so the error is redacted before surfacing.
+     *
+     *  Value handling: where the CLI supports it, the value is fed via stdin so it
+     *  never lands in argv / the process table (vault `kv put -`, aws/gcp
+     *  `file:///dev/stdin` / `--data-file=-`). The 1Password, Infisical, Doppler and
+     *  Azure CLIs only accept the value as a `key=value` / `--value` argv token for
+     *  these operations, so it is briefly visible in `ps` there — an inherent CLI
+     *  limitation. The error path is covered regardless: writeSecretToBackend redacts
+     *  the held plaintext by exact substring before any failure message is surfaced. */
+    write?(key: string, value: string, opts: WriteOpts): Promise<WriteResult>;
+}
+/** Reset the Infisical cache. Called once per `generateSecrets` run. */
+export declare function resetInfisicalCache(): void;
+export declare const BACKENDS: Record<string, SecretBackend>;
+/** Resolve (read) a secret via the registry. Mirrors the old `resolveSecret`
+ *  switch — unknown sources return a uniform `Unknown source` result. */
+export declare function resolveViaBackend(name: string, config: SecretKeyConfig, infisicalConfig?: InfisicalConfig): Promise<SecretResolveResult>;
+/** Write a secret via the registry. Backends without a `write` are read-only;
+ *  the "not yet supported" message matches the old switch default verbatim. */
+export declare function writeViaBackend(store: string, key: string, value: string, opts: WriteOpts): Promise<WriteResult>;