secureflow-cli 1.0.0 → 1.1.0

package/dist/git.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Git access for the pre-commit hook.
+ *
+ * The one thing this module exists to get right: a pre-commit hook must check
+ * **staged content**, not what happens to be on disk. The previous
+ * implementation asked git for the staged *paths* and then read those paths
+ * from the working tree, which is a different thing and lets a secret through:
+ *
+ *     echo 'console.log(process.env.AWS_SECRET_ACCESS_KEY);' >> src/debug.ts
+ *     git add src/debug.ts        # the secret is staged
+ *     sed -i '' '$d' src/debug.ts # tidy the working tree, forget to re-stage
+ *     git commit -m "wip"         # ✅ SecureFlow scan passed.
+ *
+ * The commit contains the logged secret; the scanner read the clean working
+ * tree. "Stage a chunk, keep editing" is the ordinary `git add -p` workflow, so
+ * this is not a corner case, and it fails in the direction that lets secrets
+ * through (#593).
+ *
+ * The inverse is just as bad: unstaged debug code blocks a commit that does not
+ * contain it, which teaches people to reach for `--no-verify`.
+ */
+/** A problem with the repository or the git invocation, not with the content. */
+export declare class GitError extends Error {
+    readonly cause?: unknown;
+    constructor(message: string, cause?: unknown);
+}
+/** Whether the current directory is inside a work tree. */
+export declare function isGitRepository(): boolean;
+/**
+ * Paths staged for commit.
+ *
+ * `-z` is what makes this correct for real repositories. Without it git honours
+ * `core.quotePath`, which defaults to **true**, so a staged `src/café.ts` comes
+ * back as the literal 15 characters `"src/caf\303\251.ts"` — quotes and octal
+ * escapes included. `path.resolve` then built a path that does not exist,
+ * `existsSync` returned false, and the file was skipped with no warning and no
+ * non-zero exit. The same applied to any path containing a space or a `"`.
+ *
+ * `--diff-filter=ACMR` drops deletions, which have no staged content to read,
+ * and keeps renames, which do.
+ */
+export declare function getStagedFiles(): string[];
+/**
+ * The staged content of `path` — the bytes that will actually be committed.
+ *
+ * `git show :<path>` reads the index entry, which is the whole point. Returns
+ * null when the blob cannot be read (a conflicted entry, a submodule pointer,
+ * a symlink), so the caller can report it rather than treat it as clean.
+ */
+export declare function readStagedContent(path: string): string | null;
+//# sourceMappingURL=git.d.ts.map

package/dist/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,qBAAa,QAAS,SAAQ,KAAK;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;IAArD,YAAY,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,EAGpD;CACF;AASD,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAgBzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D"}

package/dist/git.js

@@ -0,0 +1,96 @@
+/**
+ * Git access for the pre-commit hook.
+ *
+ * The one thing this module exists to get right: a pre-commit hook must check
+ * **staged content**, not what happens to be on disk. The previous
+ * implementation asked git for the staged *paths* and then read those paths
+ * from the working tree, which is a different thing and lets a secret through:
+ *
+ *     echo 'console.log(process.env.AWS_SECRET_ACCESS_KEY);' >> src/debug.ts
+ *     git add src/debug.ts        # the secret is staged
+ *     sed -i '' '$d' src/debug.ts # tidy the working tree, forget to re-stage
+ *     git commit -m "wip"         # ✅ SecureFlow scan passed.
+ *
+ * The commit contains the logged secret; the scanner read the clean working
+ * tree. "Stage a chunk, keep editing" is the ordinary `git add -p` workflow, so
+ * this is not a corner case, and it fails in the direction that lets secrets
+ * through (#593).
+ *
+ * The inverse is just as bad: unstaged debug code blocks a commit that does not
+ * contain it, which teaches people to reach for `--no-verify`.
+ */
+import { execFileSync } from 'child_process';
+/**
+ * Buffer ceiling for git output.
+ *
+ * `execSync` defaults to 1 MB. A commit touching enough files overflowed it,
+ * and the catch block then printed "Are you in a git repository?" — which was
+ * not the problem, and blocked the commit for a reason nobody could act on.
+ */
+const MAX_GIT_BUFFER = 64 * 1024 * 1024;
+/** A problem with the repository or the git invocation, not with the content. */
+export class GitError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'GitError';
+    }
+}
+function git(args) {
+    return execFileSync('git', args, {
+        encoding: 'utf-8',
+        maxBuffer: MAX_GIT_BUFFER,
+    });
+}
+/** Whether the current directory is inside a work tree. */
+export function isGitRepository() {
+    try {
+        return git(['rev-parse', '--is-inside-work-tree']).trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Paths staged for commit.
+ *
+ * `-z` is what makes this correct for real repositories. Without it git honours
+ * `core.quotePath`, which defaults to **true**, so a staged `src/café.ts` comes
+ * back as the literal 15 characters `"src/caf\303\251.ts"` — quotes and octal
+ * escapes included. `path.resolve` then built a path that does not exist,
+ * `existsSync` returned false, and the file was skipped with no warning and no
+ * non-zero exit. The same applied to any path containing a space or a `"`.
+ *
+ * `--diff-filter=ACMR` drops deletions, which have no staged content to read,
+ * and keeps renames, which do.
+ */
+export function getStagedFiles() {
+    let output;
+    try {
+        output = git(['diff', '--cached', '--name-only', '-z', '--diff-filter=ACMR']);
+    }
+    catch (error) {
+        throw new GitError(isGitRepository()
+            ? 'Could not list staged files. `git diff --cached` failed.'
+            : 'Not a git repository (or git is not on PATH).', error);
+    }
+    // NUL-separated, with a trailing separator on a non-empty list.
+    return output.split('\u0000').filter((entry) => entry.length > 0);
+}
+/**
+ * The staged content of `path` — the bytes that will actually be committed.
+ *
+ * `git show :<path>` reads the index entry, which is the whole point. Returns
+ * null when the blob cannot be read (a conflicted entry, a submodule pointer,
+ * a symlink), so the caller can report it rather than treat it as clean.
+ */
+export function readStagedContent(path) {
+    try {
+        return git(['show', `:${path}`]);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,iFAAiF;AACjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IACK,KAAK;IAA3C,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;qBADqB,KAAK;QAEzC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,eAAe,EAAE;YACf,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,+CAA+C,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -1,50 +1,69 @@
 #!/usr/bin/env node
-import { execSync } from 'child_process';
-import * as fs from 'fs';
-import * as path from 'path';
-const LOGGING_SECRET_REGEX = /console\.(log|info|warn|error|debug)\s*\([\s\S]*?(process\.env|password|secret|token|key)[\s\S]*?\)/i;
-function getStagedFiles() {
+/**
+ * SecureFlow pre-commit hook.
+ *
+ * The shell only: read the staged set, scan each blob, report, exit. The
+ * detection logic lives in `./scanner` and the git access in `./git`, so both
+ * can be tested without a process exit or a repository (#593).
+ */
+import { GitError, getStagedFiles, readStagedContent } from './git.js';
+import { scanFile } from './scanner.js';
+const VERBOSE = process.argv.includes('--verbose');
+function reportSkipped(result) {
+    if (VERBOSE && result.skipped) {
+        console.log(`   ↷ skipped ${result.path} (${result.skipped})`);
+    }
+}
+function reportViolations(result) {
+    for (const violation of result.violations) {
+        console.error(`🚨 [SecureFlow] Secret logging detected in ${result.path}:${violation.line}`);
+        console.error(`   -> ${violation.text}`);
+        console.error(`   why: ${violation.reason} passed to a console call`);
+    }
+}
+function main() {
+    let staged;
     try {
-        const output = execSync('git diff --cached --name-only', { encoding: 'utf-8' });
-        return output.split('\n').filter(Boolean);
+        staged = getStagedFiles();
     }
     catch (error) {
-        console.error('Failed to get staged files. Are you in a git repository?');
-        process.exit(1);
+        // Distinguished rather than collapsed into "Are you in a git repository?",
+        // which was previously printed for a buffer overflow, a missing git binary
+        // and a genuine non-repository alike.
+        console.error(`❌ [SecureFlow] ${error instanceof GitError ? error.message : String(error)}`);
+        return 1;
     }
-}
-function scanFiles() {
-    const files = getStagedFiles();
-    let hasViolations = false;
-    files.forEach(file => {
-        const filePath = path.resolve(process.cwd(), file);
-        if (fs.existsSync(filePath)) {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const lines = content.split(/\r?\n/);
-            lines.forEach((line, index) => {
-                const trimmedLine = line.trim();
-                // 1. Ignore single-line comments
-                if (trimmedLine.startsWith('//')) {
-                    return;
-                }
-                // 2. Strip string literals ('...', "...", `...`) so we only scan actual code/variables
-                const lineWithoutStrings = trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '');
-                if (LOGGING_SECRET_REGEX.test(lineWithoutStrings)) {
-                    console.error(`🚨 [SecureFlow] Secret logging detected in ${file}:${index + 1}`);
-                    console.error(`   -> ${line.trim()}`);
-                    hasViolations = true;
-                }
-            });
+    if (staged.length === 0) {
+        console.log('✅ SecureFlow scan passed (nothing staged).');
+        return 0;
+    }
+    const unreadable = [];
+    let violationCount = 0;
+    for (const path of staged) {
+        // The staged blob, not the working-tree file. This is the whole fix: the
+        // hook now checks the content that is about to be committed rather than
+        // whatever happens to be on disk when it runs.
+        const content = readStagedContent(path);
+        if (content === null) {
+            unreadable.push(path);
+            continue;
         }
-    });
-    if (hasViolations) {
-        console.error('\n❌ SecureFlow blocked this commit. Please remove the exposed secrets/env variables.');
-        process.exit(1);
+        const result = scanFile(path, content);
+        reportSkipped(result);
+        reportViolations(result);
+        violationCount += result.violations.length;
+    }
+    if (unreadable.length > 0) {
+        // Named rather than silently passed. A file we could not read is a file we
+        // did not check, and saying so is the difference between a gap and a lie.
+        console.warn(`⚠️  [SecureFlow] Could not read ${unreadable.length} staged entr${unreadable.length === 1 ? 'y' : 'ies'} (submodule, symlink or conflicted): ${unreadable.join(', ')}`);
     }
-    else {
-        console.log('✅ SecureFlow scan passed.');
-        process.exit(0);
+    if (violationCount > 0) {
+        console.error(`\n❌ SecureFlow blocked this commit: ${violationCount} secret-logging violation${violationCount === 1 ? '' : 's'}. Remove the exposed secrets/env variables, then re-stage.`);
+        return 1;
     }
+    console.log(`✅ SecureFlow scan passed (${staged.length} staged file(s)).`);
+    return 0;
 }
-scanFiles();
+process.exit(main());
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,oBAAoB,GAAG,sGAAsG,CAAC;AAEpI,SAAS,cAAc;IACnB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IACd,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAEnD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAEhC,iCAAiC;gBACjC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,uFAAuF;gBACvF,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBAEnF,IAAI,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,KAAK,CAAC,8CAA8C,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjF,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtC,aAAa,GAAG,IAAI,CAAC;gBACzB,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;GAMG;AACH,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAuB,MAAM,cAAc,CAAC;AAE7D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEnD,SAAS,aAAa,CAAC,MAAsB;IAC3C,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,KAAK,CAAC,SAAS,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,WAAW,SAAS,CAAC,MAAM,2BAA2B,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,IAAI,MAAgB,CAAC;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,2EAA2E;QAC3E,2EAA2E;QAC3E,sCAAsC;QACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,yEAAyE;QACzE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,0EAA0E;QAC1E,OAAO,CAAC,IAAI,CACV,mCAAmC,UAAU,CAAC,MAAM,eAClD,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAClC,wCAAwC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,uCAAuC,cAAc,4BACnD,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC9B,4DAA4D,CAC7D,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The secret-logging detector, separated from the CLI shell.
+ *
+ * Everything here is pure: it takes text and returns violations. The process
+ * exit, the git calls and the console output live in `./index` and `./git`, so
+ * the part that decides whether a commit is blocked can actually be tested
+ * (#593).
+ */
+/** One flagged call site. */
+export interface Violation {
+    /** 1-based line of the `console.*` call. */
+    line: number;
+    /** The source line as written, for the report. */
+    text: string;
+    /** Which indicator matched, so the message can say why. */
+    reason: string;
+}
+/**
+ * Bytes above which a staged blob is skipped.
+ *
+ * Nothing bounded this before, so a staged fixture or a vendored bundle was
+ * read into memory and scanned line by line.
+ */
+export declare const MAX_SCANNED_BYTES: number;
+/** Whether `path` should be scanned at all. */
+export declare function shouldScanFile(path: string, byteLength?: number): boolean;
+/**
+ * Heuristic for content that is binary despite its name.
+ *
+ * A NUL byte does not occur in text. Checking this beats trusting the
+ * extension, since a staged blob can be anything.
+ */
+export declare function looksBinary(content: string): boolean;
+/**
+ * Blank out the *contents* of string literals, preserving length.
+ *
+ * The previous implementation deleted them outright:
+ *
+ *     trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '')
+ *
+ * which turned `` console.log(`token: ${authToken}`) `` into `console.log()` —
+ * the interpolation went with the quotes, so the single most common way a
+ * secret reaches a log line became invisible. Deleting also shifts every column
+ * after it, which matters now that whole files are scanned rather than
+ * individual lines.
+ *
+ * Interpolations inside a template literal are left intact, because
+ * `${authToken}` is code, not text. Escapes are honoured so a `\"` does not end
+ * a literal, and an unterminated quote stops at the newline rather than eating
+ * the rest of the file.
+ */
+export declare function maskStringLiterals(source: string): string;
+/**
+ * Text of the balanced argument list starting at `openParen`, or null when the
+ * parenthesis is never closed.
+ *
+ * Scanning for the matching parenthesis rather than matching a regex is what
+ * makes a wrapped call detectable. The old detector tested one line at a time,
+ * so the `[\s\S]*?` in its pattern could never span anything and
+ *
+ *     console.log(
+ *       'db password:',
+ *       process.env.DB_PASSWORD
+ *     );
+ *
+ * — the shape Prettier produces at default print width — went unflagged.
+ */
+export declare function readArgumentList(source: string, openParen: number): string | null;
+/** 1-based line number of `offset`. */
+export declare function lineOf(source: string, offset: number): number;
+/**
+ * Find every `console.*` call whose arguments reference a secret.
+ *
+ * Operates on the whole file, not line by line, so a call split across lines is
+ * matched. The reported line is the line the call *starts* on, which is where a
+ * reader will look.
+ */
+export declare function findSecretLogging(source: string): Violation[];
+/** Result of scanning one staged file. */
+export interface FileScanResult {
+    path: string;
+    violations: Violation[];
+    /** Set when the file was not scanned, with the reason. */
+    skipped?: string;
+}
+/** Scan one staged blob. */
+export declare function scanFile(path: string, content: string): FileScanResult;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6BAA6B;AAC7B,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AA8CD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAE5C,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CASzE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA4EzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED,uCAAuC;AACvC,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CA2B7D;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAUtE"}

package/dist/scanner.js

@@ -0,0 +1,244 @@
+/**
+ * The secret-logging detector, separated from the CLI shell.
+ *
+ * Everything here is pure: it takes text and returns violations. The process
+ * exit, the git calls and the console output live in `./index` and `./git`, so
+ * the part that decides whether a commit is blocked can actually be tested
+ * (#593).
+ */
+/** Console methods that put their arguments somewhere durable. */
+const CONSOLE_METHODS = ['log', 'info', 'warn', 'error', 'debug', 'trace', 'table', 'dir'];
+/**
+ * Start of a console call. Whitespace is permitted around the dot and the
+ * parenthesis because a formatter will put it there.
+ */
+const CONSOLE_CALL = new RegExp(`console\\s*\\.\\s*(?:${CONSOLE_METHODS.join('|')})\\s*\\(`, 'g');
+/**
+ * What makes an argument list suspicious.
+ *
+ * Checked against the *masked* source, so a string literal that merely contains
+ * the word "password" does not match — only an identifier or a member
+ * expression does.
+ */
+const INDICATORS = [
+    ['environment variable', /\b(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|Deno\s*\.\s*env|os\s*\.\s*environ)\b/],
+    ['secret-named identifier', /\b\w*(?:password|passwd|secret|token|credential|apikey|privatekey)\w*\b/i],
+    // `key` and `auth` on their own are common enough in ordinary code
+    // (`keyof`, `authorised`, `keys`) that they are only flagged when they read
+    // as a whole word or as an obvious compound.
+    ['secret-named identifier', /\b(?:api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|authorization)\b/i],
+];
+/** Extensions never worth scanning as source text. */
+const BINARY_EXTENSIONS = [
+    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.webp', '.avif', '.bmp', '.tiff',
+    '.pdf', '.zip', '.gz', '.tar', '.bz2', '.7z', '.rar',
+    '.woff', '.woff2', '.ttf', '.otf', '.eot',
+    '.mp3', '.mp4', '.wav', '.mov', '.avi', '.webm',
+    '.so', '.dylib', '.dll', '.exe', '.wasm', '.class', '.jar',
+    '.sqlite', '.db',
+];
+/** Generated files that are large, uninteresting, and full of hashes. */
+const GENERATED_FILES = [
+    'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lockb', 'composer.lock',
+    'Cargo.lock', 'Gemfile.lock', 'poetry.lock',
+];
+/**
+ * Bytes above which a staged blob is skipped.
+ *
+ * Nothing bounded this before, so a staged fixture or a vendored bundle was
+ * read into memory and scanned line by line.
+ */
+export const MAX_SCANNED_BYTES = 512 * 1024;
+/** Whether `path` should be scanned at all. */
+export function shouldScanFile(path, byteLength) {
+    const lower = path.toLowerCase();
+    const basename = lower.split('/').pop() ?? lower;
+    if (GENERATED_FILES.some((name) => basename === name.toLowerCase()))
+        return false;
+    if (BINARY_EXTENSIONS.some((ext) => lower.endsWith(ext)))
+        return false;
+    if (typeof byteLength === 'number' && byteLength > MAX_SCANNED_BYTES)
+        return false;
+    return true;
+}
+/**
+ * Heuristic for content that is binary despite its name.
+ *
+ * A NUL byte does not occur in text. Checking this beats trusting the
+ * extension, since a staged blob can be anything.
+ */
+export function looksBinary(content) {
+    return content.includes('\u0000');
+}
+/** Filler used where a string literal's contents were. */
+const MASK_CHAR = '·';
+/**
+ * Blank out the *contents* of string literals, preserving length.
+ *
+ * The previous implementation deleted them outright:
+ *
+ *     trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '')
+ *
+ * which turned `` console.log(`token: ${authToken}`) `` into `console.log()` —
+ * the interpolation went with the quotes, so the single most common way a
+ * secret reaches a log line became invisible. Deleting also shifts every column
+ * after it, which matters now that whole files are scanned rather than
+ * individual lines.
+ *
+ * Interpolations inside a template literal are left intact, because
+ * `${authToken}` is code, not text. Escapes are honoured so a `\"` does not end
+ * a literal, and an unterminated quote stops at the newline rather than eating
+ * the rest of the file.
+ */
+export function maskStringLiterals(source) {
+    const out = source.split('');
+    let index = 0;
+    while (index < out.length) {
+        const char = out[index];
+        // Line comments are masked, not merely skipped over: skipping advances the
+        // cursor but leaves the text in the output, so the commented-out code was
+        // still scanned. The old detector only handled `//` at the very start of a
+        // trimmed line, so a trailing comment was scanned as code either way.
+        if (char === '/' && out[index + 1] === '/') {
+            while (index < out.length && out[index] !== '\n') {
+                out[index] = MASK_CHAR;
+                index += 1;
+            }
+            continue;
+        }
+        if (char === '/' && out[index + 1] === '*') {
+            index += 2;
+            while (index < out.length && !(out[index] === '*' && out[index + 1] === '/')) {
+                if (out[index] !== '\n')
+                    out[index] = MASK_CHAR;
+                index += 1;
+            }
+            index += 2;
+            continue;
+        }
+        if (char !== '"' && char !== "'" && char !== '`') {
+            index += 1;
+            continue;
+        }
+        const quote = char;
+        index += 1;
+        while (index < out.length) {
+            const current = out[index];
+            if (current === '\\') {
+                // Escaped character: mask both, and never let it terminate the literal.
+                if (out[index] !== '\n')
+                    out[index] = MASK_CHAR;
+                if (index + 1 < out.length && out[index + 1] !== '\n')
+                    out[index + 1] = MASK_CHAR;
+                index += 2;
+                continue;
+            }
+            if (current === quote) {
+                index += 1;
+                break;
+            }
+            // An unterminated quote must not swallow the rest of the file. Only a
+            // template literal legally spans lines.
+            if (current === '\n' && quote !== '`')
+                break;
+            // `${ … }` inside a template literal is code. Leave it visible, tracking
+            // brace depth so a nested object literal does not end it early.
+            if (quote === '`' && current === '$' && out[index + 1] === '{') {
+                let depth = 1;
+                index += 2;
+                while (index < out.length && depth > 0) {
+                    if (out[index] === '{')
+                        depth += 1;
+                    else if (out[index] === '}')
+                        depth -= 1;
+                    index += 1;
+                }
+                continue;
+            }
+            if (current !== '\n')
+                out[index] = MASK_CHAR;
+            index += 1;
+        }
+    }
+    return out.join('');
+}
+/**
+ * Text of the balanced argument list starting at `openParen`, or null when the
+ * parenthesis is never closed.
+ *
+ * Scanning for the matching parenthesis rather than matching a regex is what
+ * makes a wrapped call detectable. The old detector tested one line at a time,
+ * so the `[\s\S]*?` in its pattern could never span anything and
+ *
+ *     console.log(
+ *       'db password:',
+ *       process.env.DB_PASSWORD
+ *     );
+ *
+ * — the shape Prettier produces at default print width — went unflagged.
+ */
+export function readArgumentList(source, openParen) {
+    let depth = 0;
+    for (let i = openParen; i < source.length; i += 1) {
+        if (source[i] === '(')
+            depth += 1;
+        else if (source[i] === ')') {
+            depth -= 1;
+            if (depth === 0)
+                return source.slice(openParen + 1, i);
+        }
+    }
+    return null;
+}
+/** 1-based line number of `offset`. */
+export function lineOf(source, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < source.length; i += 1) {
+        if (source[i] === '\n')
+            line += 1;
+    }
+    return line;
+}
+/**
+ * Find every `console.*` call whose arguments reference a secret.
+ *
+ * Operates on the whole file, not line by line, so a call split across lines is
+ * matched. The reported line is the line the call *starts* on, which is where a
+ * reader will look.
+ */
+export function findSecretLogging(source) {
+    if (!source)
+        return [];
+    const masked = maskStringLiterals(source);
+    const lines = source.split(/\r?\n/);
+    const violations = [];
+    CONSOLE_CALL.lastIndex = 0;
+    let match;
+    while ((match = CONSOLE_CALL.exec(masked)) !== null) {
+        const openParen = match.index + match[0].length - 1;
+        const args = readArgumentList(masked, openParen);
+        if (args === null)
+            continue;
+        const indicator = INDICATORS.find(([, pattern]) => pattern.test(args));
+        if (!indicator)
+            continue;
+        const line = lineOf(masked, match.index);
+        violations.push({
+            line,
+            text: (lines[line - 1] ?? '').trim(),
+            reason: indicator[0],
+        });
+    }
+    return violations;
+}
+/** Scan one staged blob. */
+export function scanFile(path, content) {
+    if (!shouldScanFile(path, Buffer.byteLength(content, 'utf-8'))) {
+        return { path, violations: [], skipped: 'excluded by type or size' };
+    }
+    if (looksBinary(content)) {
+        return { path, violations: [], skipped: 'binary content' };
+    }
+    return { path, violations: findSecretLogging(content) };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3F;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,wBAAwB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAC3D,GAAG,CACJ,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,GAA6C;IAC3D,CAAC,sBAAsB,EAAE,4FAA4F,CAAC;IACtH,CAAC,yBAAyB,EAAE,0EAA0E,CAAC;IACvG,mEAAmE;IACnE,4EAA4E;IAC5E,6CAA6C;IAC7C,CAAC,yBAAyB,EAAE,iFAAiF,CAAC;CAC/G,CAAC;AAEF,sDAAsD;AACtD,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IAC1E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACzC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAC/C,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IAC1D,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF,yEAAyE;AACzE,MAAM,eAAe,GAAG;IACtB,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe;IAChF,YAAY,EAAE,cAAc,EAAE,aAAa;CAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAmB;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAEjD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAEnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,0DAA0D;AAC1D,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAExB,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBAChD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC;QACnB,KAAK,IAAI,CAAC,CAAC;QAEX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAE3B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBAChD,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC;gBAClF,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YAED,sEAAsE;YACtE,wCAAwC;YACxC,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,MAAM;YAE7C,yEAAyE;YACzE,gEAAgE;YAChE,IAAI,KAAK,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/D,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACvC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG;wBAAE,KAAK,IAAI,CAAC,CAAC;yBAC9B,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG;wBAAE,KAAK,IAAI,CAAC,CAAC;oBACxC,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,KAAK,IAAI;gBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;YAC7C,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,MAAc;IACnD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3B,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAE5B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACpC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAUD,4BAA4B;AAC5B,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secureflow-cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Pre-commit secret logging detector for secure development workflows",
   "main": "./dist/index.js",
   "bin": {
@@ -29,4 +29,4 @@
     "@types/node": "^26.2.0",
     "typescript": "^7.0.2"
   }
-}
+}