seamshield 0.1.2 → 0.1.3

package/dist/index.js

@@ -99,7 +99,7 @@ var require_picocolors = __commonJS({
 });
 
 // src/index.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 import { existsSync as existsSync2, mkdirSync, mkdtempSync, readFileSync as readFileSync6, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { dirname as dirname3, join as join7, resolve as resolve2 } from "path";
@@ -141,6 +141,7 @@ import { dirname as dirname2, join as join4 } from "path";
 import { existsSync } from "fs";
 import { dirname as dirname22, join as join5 } from "path";
 import { readdirSync as readdirSync2, readFileSync as readFileSync4, statSync } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
 import { join as join6, relative as relative2 } from "path";
 import { z as z3 } from "zod";
 var ConfigSchema = z.object({
@@ -713,6 +714,8 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
 ]);
 var MAX_FILE_BYTES = 1e6;
 function walk(root) {
+  const gitFiles = gitTrackedAndUnignoredFiles(root);
+  if (gitFiles) return gitFiles;
   const files = [];
   const visit = (dir) => {
     let entries;
@@ -743,6 +746,15 @@ function walk(root) {
   visit(root);
   return files;
 }
+function gitTrackedAndUnignoredFiles(root) {
+  const result = spawnSync2(
+    "git",
+    ["-C", root, "ls-files", "--cached", "--others", "--exclude-standard"],
+    { encoding: "utf8", timeout: 1500 }
+  );
+  if (result.error || result.status !== 0 || typeof result.stdout !== "string") return null;
+  return result.stdout.split("\n").filter(Boolean).filter((rel) => !rel.split("/").some((part) => SKIP_DIRS.has(part))).filter((rel) => rel !== ".claude/worktrees" && !rel.includes("/.claude/worktrees/")).filter((rel) => rel !== ".worktrees" && !rel.startsWith(".worktrees/")).map((rel) => ({ abs: join6(root, rel), rel }));
+}
 var FileCache = class {
   cache = /* @__PURE__ */ new Map();
   read(abs) {
@@ -1013,7 +1025,7 @@ function bashDecision(command) {
     const name = command.match(/npm\s+(?:i|install|add)\s+(@?[\w.-]+\/?[\w.-]*)/)?.[1];
     if (name) {
       const encoded = name.startsWith("@") ? name.replace("/", "%2F") : name;
-      const res = spawnSync2("curl", ["-fsSI", `https://registry.npmjs.org/${encoded}`], {
+      const res = spawnSync3("curl", ["-fsSI", `https://registry.npmjs.org/${encoded}`], {
         encoding: "utf8",
         timeout: 750
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "seamshield",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Security scanner for AI-generated apps: finds the flaws vibecoded projects predictably ship",
   "type": "module",
   "license": "MIT",

package/rules/ss-client-next-public-secret.yaml

@@ -19,9 +19,15 @@ check:
       - ".cjs"
     basenames:
       - ".env*"
+  exclude:
+    dirs:
+      - "scripts"
+      - "test"
+      - "tests"
+      - "__tests__"
   patterns:
     - name: next-public-secret-name
-      regex: "NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|SERVICE_ROLE|PRIVATE|PASSWORD|ADMIN)[A-Z0-9_]*"
+      regex: "(?:^\\s*|process\\.env\\.|import\\.meta\\.env\\.)(NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|SERVICE_ROLE|PRIVATE|PASSWORD|ADMIN)[A-Z0-9_]*)"
 fix:
   summary: Rename the variable to drop the NEXT_PUBLIC_ prefix and read it only on the server.
   agent_prompt: >