secureflow-cli 1.0.0 → 1.2.0

package/dist/git.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Git access for the pre-commit hook.
+ *
+ * The one thing this module exists to get right: a pre-commit hook must check
+ * **staged content**, not what happens to be on disk. The previous
+ * implementation asked git for the staged *paths* and then read those paths
+ * from the working tree, which is a different thing and lets a secret through:
+ *
+ *     echo 'console.log(process.env.AWS_SECRET_ACCESS_KEY);' >> src/debug.ts
+ *     git add src/debug.ts        # the secret is staged
+ *     sed -i '' '$d' src/debug.ts # tidy the working tree, forget to re-stage
+ *     git commit -m "wip"         # ✅ SecureFlow scan passed.
+ *
+ * The commit contains the logged secret; the scanner read the clean working
+ * tree. "Stage a chunk, keep editing" is the ordinary `git add -p` workflow, so
+ * this is not a corner case, and it fails in the direction that lets secrets
+ * through (#593).
+ *
+ * The inverse is just as bad: unstaged debug code blocks a commit that does not
+ * contain it, which teaches people to reach for `--no-verify`.
+ */
+/** A problem with the repository or the git invocation, not with the content. */
+export declare class GitError extends Error {
+    readonly cause?: unknown;
+    constructor(message: string, cause?: unknown);
+}
+/** Whether the current directory is inside a work tree. */
+export declare function isGitRepository(): boolean;
+/**
+ * Paths staged for commit.
+ *
+ * `-z` is what makes this correct for real repositories. Without it git honours
+ * `core.quotePath`, which defaults to **true**, so a staged `src/café.ts` comes
+ * back as the literal 15 characters `"src/caf\303\251.ts"` — quotes and octal
+ * escapes included. `path.resolve` then built a path that does not exist,
+ * `existsSync` returned false, and the file was skipped with no warning and no
+ * non-zero exit. The same applied to any path containing a space or a `"`.
+ *
+ * `--diff-filter=ACMR` drops deletions, which have no staged content to read,
+ * and keeps renames, which do.
+ */
+export declare function getStagedFiles(): string[];
+/**
+ * The staged content of `path` — the bytes that will actually be committed.
+ *
+ * `git show :<path>` reads the index entry, which is the whole point. Returns
+ * null when the blob cannot be read (a conflicted entry, a submodule pointer,
+ * a symlink), so the caller can report it rather than treat it as clean.
+ */
+export declare function readStagedContent(path: string): string | null;
+//# sourceMappingURL=git.d.ts.map

package/dist/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,qBAAa,QAAS,SAAQ,KAAK;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;IAArD,YAAY,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,EAGpD;CACF;AASD,2DAA2D;AAC3D,wBAAgB,eAAe,IAAI,OAAO,CAMzC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAgBzC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM7D"}

package/dist/git.js

@@ -0,0 +1,96 @@
+/**
+ * Git access for the pre-commit hook.
+ *
+ * The one thing this module exists to get right: a pre-commit hook must check
+ * **staged content**, not what happens to be on disk. The previous
+ * implementation asked git for the staged *paths* and then read those paths
+ * from the working tree, which is a different thing and lets a secret through:
+ *
+ *     echo 'console.log(process.env.AWS_SECRET_ACCESS_KEY);' >> src/debug.ts
+ *     git add src/debug.ts        # the secret is staged
+ *     sed -i '' '$d' src/debug.ts # tidy the working tree, forget to re-stage
+ *     git commit -m "wip"         # ✅ SecureFlow scan passed.
+ *
+ * The commit contains the logged secret; the scanner read the clean working
+ * tree. "Stage a chunk, keep editing" is the ordinary `git add -p` workflow, so
+ * this is not a corner case, and it fails in the direction that lets secrets
+ * through (#593).
+ *
+ * The inverse is just as bad: unstaged debug code blocks a commit that does not
+ * contain it, which teaches people to reach for `--no-verify`.
+ */
+import { execFileSync } from 'child_process';
+/**
+ * Buffer ceiling for git output.
+ *
+ * `execSync` defaults to 1 MB. A commit touching enough files overflowed it,
+ * and the catch block then printed "Are you in a git repository?" — which was
+ * not the problem, and blocked the commit for a reason nobody could act on.
+ */
+const MAX_GIT_BUFFER = 64 * 1024 * 1024;
+/** A problem with the repository or the git invocation, not with the content. */
+export class GitError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'GitError';
+    }
+}
+function git(args) {
+    return execFileSync('git', args, {
+        encoding: 'utf-8',
+        maxBuffer: MAX_GIT_BUFFER,
+    });
+}
+/** Whether the current directory is inside a work tree. */
+export function isGitRepository() {
+    try {
+        return git(['rev-parse', '--is-inside-work-tree']).trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Paths staged for commit.
+ *
+ * `-z` is what makes this correct for real repositories. Without it git honours
+ * `core.quotePath`, which defaults to **true**, so a staged `src/café.ts` comes
+ * back as the literal 15 characters `"src/caf\303\251.ts"` — quotes and octal
+ * escapes included. `path.resolve` then built a path that does not exist,
+ * `existsSync` returned false, and the file was skipped with no warning and no
+ * non-zero exit. The same applied to any path containing a space or a `"`.
+ *
+ * `--diff-filter=ACMR` drops deletions, which have no staged content to read,
+ * and keeps renames, which do.
+ */
+export function getStagedFiles() {
+    let output;
+    try {
+        output = git(['diff', '--cached', '--name-only', '-z', '--diff-filter=ACMR']);
+    }
+    catch (error) {
+        throw new GitError(isGitRepository()
+            ? 'Could not list staged files. `git diff --cached` failed.'
+            : 'Not a git repository (or git is not on PATH).', error);
+    }
+    // NUL-separated, with a trailing separator on a non-empty list.
+    return output.split('\u0000').filter((entry) => entry.length > 0);
+}
+/**
+ * The staged content of `path` — the bytes that will actually be committed.
+ *
+ * `git show :<path>` reads the index entry, which is the whole point. Returns
+ * null when the blob cannot be read (a conflicted entry, a submodule pointer,
+ * a symlink), so the caller can report it rather than treat it as clean.
+ */
+export function readStagedContent(path) {
+    try {
+        return git(['show', `:${path}`]);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,iFAAiF;AACjF,MAAM,OAAO,QAAS,SAAQ,KAAK;IACK,KAAK;IAA3C,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;qBADqB,KAAK;QAEzC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,GAAG,CAAC,IAAc;IACzB,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,eAAe,EAAE;YACf,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,+CAA+C,EACnD,KAAK,CACN,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -1,50 +1,101 @@
 #!/usr/bin/env node
-import { execSync } from 'child_process';
-import * as fs from 'fs';
-import * as path from 'path';
-const LOGGING_SECRET_REGEX = /console\.(log|info|warn|error|debug)\s*\([\s\S]*?(process\.env|password|secret|token|key)[\s\S]*?\)/i;
-function getStagedFiles() {
+import fs from 'fs';
+import { GitError, getStagedFiles, readStagedContent } from './git.js';
+import { scanFile, formatScanResults } from './scanner.js';
+const VERBOSE = process.argv.includes('--verbose');
+function parseFormatArg() {
+    const formatIndex = process.argv.findIndex((arg) => arg === '--format');
+    if (formatIndex !== -1) {
+        const valStr = process.argv[formatIndex + 1];
+        if (valStr) {
+            const val = valStr.toLowerCase();
+            if (val === 'sarif' || val === 'json' || val === 'text') {
+                return val;
+            }
+        }
+    }
+    return 'text';
+}
+function parseOutputArg() {
+    const outIndex = process.argv.findIndex((arg) => arg === '-o' || arg === '--output');
+    if (outIndex !== -1) {
+        const valStr = process.argv[outIndex + 1];
+        if (valStr) {
+            return valStr;
+        }
+    }
+    return null;
+}
+function reportSkipped(result) {
+    if (VERBOSE && result.skipped) {
+        console.log(`  ↷ skipped ${result.path} (${result.skipped})`);
+    }
+}
+function reportViolations(result) {
+    for (const violation of result.violations) {
+        console.error(`🚨 [SecureFlow] Secret logging detected in ${result.path}:${violation.line}`);
+        console.error(`  -> ${violation.text}`);
+        console.error(`  why: ${violation.reason} passed to a console call`);
+    }
+}
+function main() {
+    const format = parseFormatArg();
+    const outputPath = parseOutputArg();
+    let staged;
     try {
-        const output = execSync('git diff --cached --name-only', { encoding: 'utf-8' });
-        return output.split('\n').filter(Boolean);
+        staged = getStagedFiles();
     }
     catch (error) {
-        console.error('Failed to get staged files. Are you in a git repository?');
-        process.exit(1);
+        console.error(`❌ [SecureFlow] ${error instanceof GitError ? error.message : String(error)}`);
+        return 1;
     }
-}
-function scanFiles() {
-    const files = getStagedFiles();
-    let hasViolations = false;
-    files.forEach(file => {
-        const filePath = path.resolve(process.cwd(), file);
-        if (fs.existsSync(filePath)) {
-            const content = fs.readFileSync(filePath, 'utf-8');
-            const lines = content.split(/\r?\n/);
-            lines.forEach((line, index) => {
-                const trimmedLine = line.trim();
-                // 1. Ignore single-line comments
-                if (trimmedLine.startsWith('//')) {
-                    return;
-                }
-                // 2. Strip string literals ('...', "...", `...`) so we only scan actual code/variables
-                const lineWithoutStrings = trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '');
-                if (LOGGING_SECRET_REGEX.test(lineWithoutStrings)) {
-                    console.error(`🚨 [SecureFlow] Secret logging detected in ${file}:${index + 1}`);
-                    console.error(`   -> ${line.trim()}`);
-                    hasViolations = true;
-                }
-            });
+    const fileResults = [];
+    const unreadable = [];
+    let violationCount = 0;
+    if (staged.length > 0) {
+        for (const path of staged) {
+            const content = readStagedContent(path);
+            if (content === null) {
+                unreadable.push(path);
+                continue;
+            }
+            const result = scanFile(path, content);
+            fileResults.push(result);
+            if (format === 'text') {
+                reportSkipped(result);
+                reportViolations(result);
+            }
+            violationCount += result.violations.length;
+        }
+    }
+    if (format === 'sarif' || format === 'json') {
+        const outputString = formatScanResults(fileResults, format);
+        if (outputPath) {
+            fs.writeFileSync(outputPath, outputString, 'utf-8');
+            console.log(`📄 [SecureFlow] Scan report exported in ${format.toUpperCase()} format to ${outputPath}`);
+        }
+        else {
+            console.log(outputString);
+        }
+    }
+    else if (outputPath) {
+        const textOutput = formatScanResults(fileResults, 'text');
+        fs.writeFileSync(outputPath, textOutput, 'utf-8');
+        console.log(`📄 [SecureFlow] Scan report written to ${outputPath}`);
+    }
+    if (unreadable.length > 0 && format === 'text') {
+        console.warn(`⚠️  [SecureFlow] Could not read ${unreadable.length} staged entr${unreadable.length === 1 ? 'y' : 'ies'} (submodule, symlink or conflicted): ${unreadable.join(', ')}`);
+    }
+    if (violationCount > 0) {
+        if (format === 'text') {
+            console.error(`\n❌ SecureFlow blocked this commit: ${violationCount} secret-logging violation${violationCount === 1 ? '' : 's'}. Remove the exposed secrets/env variables, then re-stage.`);
         }
-    });
-    if (hasViolations) {
-        console.error('\n❌ SecureFlow blocked this commit. Please remove the exposed secrets/env variables.');
-        process.exit(1);
+        return 1;
     }
-    else {
-        console.log('✅ SecureFlow scan passed.');
-        process.exit(0);
+    if (format === 'text') {
+        console.log(`✅ SecureFlow scan passed (${staged.length} staged file(s)).`);
     }
+    return 0;
 }
-scanFiles();
+process.exit(main());
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,oBAAoB,GAAG,sGAAsG,CAAC;AAEpI,SAAS,cAAc;IACnB,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,+BAA+B,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,SAAS;IACd,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAEnD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAEhC,iCAAiC;gBACjC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,OAAO;gBACX,CAAC;gBAED,uFAAuF;gBACvF,MAAM,kBAAkB,GAAG,WAAW,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;gBAEnF,IAAI,oBAAoB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,KAAK,CAAC,8CAA8C,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjF,OAAO,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACtC,aAAa,GAAG,IAAI,CAAC;gBACzB,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,SAAS,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAA0C,MAAM,cAAc,CAAC;AAEnG,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEnD,SAAS,cAAc;IACrB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IACxE,IAAI,WAAW,KAAK,CAAC,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxD,OAAO,GAAmB,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,UAAU,CAAC,CAAC;IACrF,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB;IAC3C,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB;IAC9C,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,KAAK,CAAC,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,MAAM,2BAA2B,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,IAAI,MAAgB,CAAC;IAErB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAExC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACvC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,aAAa,CAAC,MAAM,CAAC,CAAC;gBACtB,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC3B,CAAC;YACD,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,2CAA2C,MAAM,CAAC,WAAW,EAAE,cAAc,UAAU,EAAE,CAAC,CAAC;QACzG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/C,OAAO,CAAC,IAAI,CACV,mCAAmC,UAAU,CAAC,MAAM,eAClD,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAClC,wCAAwC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CACX,uCAAuC,cAAc,4BACnD,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC9B,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC"}

package/dist/sarif.d.ts

@@ -0,0 +1,84 @@
+/**
+ * SARIF (Static Analysis Results Interchange Format) Exporter for SecureFlow CLI (#728)
+ *
+ * Converts CLI scan results into standardized OASIS SARIF v2.1.0 schema format
+ * for direct ingestion by GitHub Advanced Security, GitLab Security Dashboards, and enterprise CI/CD systems.
+ */
+import type { FileScanResult } from './scanner.js';
+export interface SarifArtifactLocation {
+    uri: string;
+    uriBaseId?: string;
+}
+export interface SarifRegion {
+    startLine: number;
+    startColumn?: number;
+    endLine?: number;
+    endColumn?: number;
+    snippet?: {
+        text: string;
+    };
+}
+export interface SarifPhysicalLocation {
+    artifactLocation: SarifArtifactLocation;
+    region: SarifRegion;
+}
+export interface SarifLocation {
+    physicalLocation: SarifPhysicalLocation;
+}
+export interface SarifReportingDescriptor {
+    id: string;
+    name: string;
+    shortDescription: {
+        text: string;
+    };
+    fullDescription?: {
+        text: string;
+    };
+    defaultConfiguration?: {
+        level: 'error' | 'warning' | 'note' | 'none';
+    };
+    helpUri?: string;
+    properties?: Record<string, unknown>;
+}
+export interface SarifResult {
+    ruleId: string;
+    ruleIndex?: number;
+    level: 'error' | 'warning' | 'note' | 'none';
+    message: {
+        text: string;
+    };
+    locations: SarifLocation[];
+    properties?: Record<string, unknown>;
+}
+export interface SarifRun {
+    tool: {
+        driver: {
+            name: string;
+            organization?: string;
+            version?: string;
+            semanticVersion?: string;
+            informationUri?: string;
+            rules: SarifReportingDescriptor[];
+        };
+    };
+    results: SarifResult[];
+}
+export interface SarifDocument {
+    $schema: string;
+    version: '2.1.0';
+    runs: SarifRun[];
+}
+/**
+ * Maps CLI scan results into a valid OASIS SARIF v2.1.0 document object.
+ */
+export declare function generateSarifReport(scanResults: FileScanResult[], options?: {
+    toolVersion?: string;
+    repoUri?: string;
+}): SarifDocument;
+/**
+ * Format SARIF report as pretty JSON string.
+ */
+export declare function formatSarifJson(scanResults: FileScanResult[], options?: {
+    toolVersion?: string;
+}): string;
+//# sourceMappingURL=sarif.d.ts.map

package/dist/sarif.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,qBAAqB,CAAC;CACzC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,eAAe,CAAC,EAAE;QAChB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,oBAAoB,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;KAC9C,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC7C,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE;QACJ,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,eAAe,CAAC,EAAE,MAAM,CAAC;YACzB,cAAc,CAAC,EAAE,MAAM,CAAC;YACxB,KAAK,EAAE,wBAAwB,EAAE,CAAC;SACnC,CAAC;KACH,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,QAAQ,EAAE,CAAC;CAClB;AA4CD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,cAAc,EAAE,EAC7B,OAAO,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,aAAa,CAmFf;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGzG"}

package/dist/sarif.js

@@ -0,0 +1,135 @@
+/**
+ * SARIF (Static Analysis Results Interchange Format) Exporter for SecureFlow CLI (#728)
+ *
+ * Converts CLI scan results into standardized OASIS SARIF v2.1.0 schema format
+ * for direct ingestion by GitHub Advanced Security, GitLab Security Dashboards, and enterprise CI/CD systems.
+ */
+const DEFAULT_RULE_DEFINITIONS = {
+    'environment variable': {
+        id: 'SECUREFLOW-001',
+        name: 'ConsoleSecretLoggingEnvironmentVariable',
+        shortDescription: {
+            text: 'Console logging of environment variable containing potential secret',
+        },
+        fullDescription: {
+            text: 'Passing process.env or other environment variable getters into console methods exposes credentials in build logs or standard output.',
+        },
+        defaultConfiguration: {
+            level: 'error',
+        },
+        helpUri: 'https://github.com/GauravKarakoti/SecureFlow#rules',
+    },
+    'secret-named identifier': {
+        id: 'SECUREFLOW-002',
+        name: 'ConsoleSecretLoggingSecretIdentifier',
+        shortDescription: {
+            text: 'Console logging of secret-named identifier or credential parameter',
+        },
+        fullDescription: {
+            text: 'Identifiers containing secret, password, apikey, token, or auth parameters passed directly into console logging statements.',
+        },
+        defaultConfiguration: {
+            level: 'error',
+        },
+        helpUri: 'https://github.com/GauravKarakoti/SecureFlow#rules',
+    },
+    'generic-secret-logging': {
+        id: 'SECUREFLOW-000',
+        name: 'ConsoleSecretLoggingGeneric',
+        shortDescription: {
+            text: 'Potential secret credential logging in console output',
+        },
+        defaultConfiguration: {
+            level: 'error',
+        },
+        helpUri: 'https://github.com/GauravKarakoti/SecureFlow#rules',
+    },
+};
+/**
+ * Maps CLI scan results into a valid OASIS SARIF v2.1.0 document object.
+ */
+export function generateSarifReport(scanResults, options) {
+    const version = options?.toolVersion || '0.1.0';
+    const rulesMap = new Map();
+    const sarifResults = [];
+    for (const fileResult of scanResults) {
+        if (!fileResult.violations || fileResult.violations.length === 0) {
+            continue;
+        }
+        for (const violation of fileResult.violations) {
+            const reasonKey = violation.reason || 'generic-secret-logging';
+            let ruleInfo = rulesMap.get(reasonKey);
+            if (!ruleInfo) {
+                const descriptor = DEFAULT_RULE_DEFINITIONS[reasonKey] || {
+                    id: `SECUREFLOW-${rulesMap.size + 100}`,
+                    name: `ConsoleSecretLoggingCustomRule${rulesMap.size + 1}`,
+                    shortDescription: {
+                        text: `Console logging of ${violation.reason}`,
+                    },
+                    defaultConfiguration: {
+                        level: 'error',
+                    },
+                    helpUri: 'https://github.com/GauravKarakoti/SecureFlow#rules',
+                };
+                ruleInfo = { descriptor, index: rulesMap.size };
+                rulesMap.set(reasonKey, ruleInfo);
+            }
+            sarifResults.push({
+                ruleId: ruleInfo.descriptor.id,
+                ruleIndex: ruleInfo.index,
+                level: ruleInfo.descriptor.defaultConfiguration?.level || 'error',
+                message: {
+                    text: `[SecureFlow] ${violation.reason} passed to console call: "${violation.text}"`,
+                },
+                locations: [
+                    {
+                        physicalLocation: {
+                            artifactLocation: {
+                                uri: fileResult.path.replace(/\\/g, '/'),
+                            },
+                            region: {
+                                startLine: Math.max(1, violation.line),
+                                snippet: {
+                                    text: violation.text,
+                                },
+                            },
+                        },
+                    },
+                ],
+                properties: {
+                    reason: violation.reason,
+                },
+            });
+        }
+    }
+    const rulesArray = Array.from(rulesMap.values()).map((r) => r.descriptor);
+    if (rulesArray.length === 0) {
+        // Appended `!` to override 'undefined' error resulting from Record<string, ...> signature
+        rulesArray.push(DEFAULT_RULE_DEFINITIONS['generic-secret-logging']);
+    }
+    return {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'SecureFlow CLI',
+                        semanticVersion: version,
+                        informationUri: 'https://github.com/GauravKarakoti/SecureFlow',
+                        rules: rulesArray,
+                    },
+                },
+                results: sarifResults,
+            },
+        ],
+    };
+}
+/**
+ * Format SARIF report as pretty JSON string.
+ */
+export function formatSarifJson(scanResults, options) {
+    const sarifDoc = generateSarifReport(scanResults, options);
+    return JSON.stringify(sarifDoc, null, 2);
+}
+//# sourceMappingURL=sarif.js.map

package/dist/sarif.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif.js","sourceRoot":"","sources":["../src/sarif.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4EH,MAAM,wBAAwB,GAA6C;IACzE,sBAAsB,EAAE;QACtB,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,yCAAyC;QAC/C,gBAAgB,EAAE;YAChB,IAAI,EAAE,qEAAqE;SAC5E;QACD,eAAe,EAAE;YACf,IAAI,EAAE,sIAAsI;SAC7I;QACD,oBAAoB,EAAE;YACpB,KAAK,EAAE,OAAO;SACf;QACD,OAAO,EAAE,oDAAoD;KAC9D;IACD,yBAAyB,EAAE;QACzB,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,sCAAsC;QAC5C,gBAAgB,EAAE;YAChB,IAAI,EAAE,oEAAoE;SAC3E;QACD,eAAe,EAAE;YACf,IAAI,EAAE,6HAA6H;SACpI;QACD,oBAAoB,EAAE;YACpB,KAAK,EAAE,OAAO;SACf;QACD,OAAO,EAAE,oDAAoD;KAC9D;IACD,wBAAwB,EAAE;QACxB,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,6BAA6B;QACnC,gBAAgB,EAAE;YAChB,IAAI,EAAE,uDAAuD;SAC9D;QACD,oBAAoB,EAAE;YACpB,KAAK,EAAE,OAAO;SACf;QACD,OAAO,EAAE,oDAAoD;KAC9D;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA6B,EAC7B,OAGC;IAED,MAAM,OAAO,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmE,CAAC;IAC5F,MAAM,YAAY,GAAkB,EAAE,CAAC;IAEvC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,SAAS;QACX,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,IAAI,wBAAwB,CAAC;YAC/D,IAAI,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAEvC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI;oBACxD,EAAE,EAAE,cAAc,QAAQ,CAAC,IAAI,GAAG,GAAG,EAAE;oBACvC,IAAI,EAAE,iCAAiC,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE;oBAC1D,gBAAgB,EAAE;wBAChB,IAAI,EAAE,sBAAsB,SAAS,CAAC,MAAM,EAAE;qBAC/C;oBACD,oBAAoB,EAAE;wBACpB,KAAK,EAAE,OAAO;qBACf;oBACD,OAAO,EAAE,oDAAoD;iBAC9D,CAAC;gBAEF,QAAQ,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAChD,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;YAED,YAAY,CAAC,IAAI,CAAC;gBAChB,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;gBAC9B,SAAS,EAAE,QAAQ,CAAC,KAAK;gBACzB,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,oBAAoB,EAAE,KAAK,IAAI,OAAO;gBACjE,OAAO,EAAE;oBACP,IAAI,EAAE,gBAAgB,SAAS,CAAC,MAAM,6BAA6B,SAAS,CAAC,IAAI,GAAG;iBACrF;gBACD,SAAS,EAAE;oBACT;wBACE,gBAAgB,EAAE;4BAChB,gBAAgB,EAAE;gCAChB,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;6BACzC;4BACD,MAAM,EAAE;gCACN,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC;gCACtC,OAAO,EAAE;oCACP,IAAI,EAAE,SAAS,CAAC,IAAI;iCACrB;6BACF;yBACF;qBACF;iBACF;gBACD,UAAU,EAAE;oBACV,MAAM,EAAE,SAAS,CAAC,MAAM;iBACzB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,0FAA0F;QAC1F,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,wBAAwB,CAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,gBAAgB;wBACtB,eAAe,EAAE,OAAO;wBACxB,cAAc,EAAE,8CAA8C;wBAC9D,KAAK,EAAE,UAAU;qBAClB;iBACF;gBACD,OAAO,EAAE,YAAY;aACtB;SACF;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAA6B,EAAE,OAAkC;IAC/F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,93 @@
+/**
+ * The secret-logging detector, separated from the CLI shell.
+ *
+ * Everything here is pure: it takes text and returns violations. The process
+ * exit, the git calls and the console output live in `./index` and `./git`, so
+ * the part that decides whether a commit is blocked can actually be tested
+ * (#593).
+ */
+/** One flagged call site. */
+export interface Violation {
+    /** 1-based line of the `console.*` call. */
+    line: number;
+    /** The source line as written, for the report. */
+    text: string;
+    /** Which indicator matched, so the message can say why. */
+    reason: string;
+}
+/**
+ * Bytes above which a staged blob is skipped.
+ *
+ * Nothing bounded this before, so a staged fixture or a vendored bundle was
+ * read into memory and scanned line by line.
+ */
+export declare const MAX_SCANNED_BYTES: number;
+/** Whether `path` should be scanned at all. */
+export declare function shouldScanFile(path: string, byteLength?: number): boolean;
+/**
+ * Heuristic for content that is binary despite its name.
+ *
+ * A NUL byte does not occur in text. Checking this beats trusting the
+ * extension, since a staged blob can be anything.
+ */
+export declare function looksBinary(content: string): boolean;
+/**
+ * Blank out the *contents* of string literals, preserving length.
+ *
+ * The previous implementation deleted them outright:
+ *
+ *     trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '')
+ *
+ * which turned `` console.log(`token: ${authToken}`) `` into `console.log()` —
+ * the interpolation went with the quotes, so the single most common way a
+ * secret reaches a log line became invisible. Deleting also shifts every column
+ * after it, which matters now that whole files are scanned rather than
+ * individual lines.
+ *
+ * Interpolations inside a template literal are left intact, because
+ * `${authToken}` is code, not text. Escapes are honoured so a `\"` does not end
+ * a literal, and an unterminated quote stops at the newline rather than eating
+ * the rest of the file.
+ */
+export declare function maskStringLiterals(source: string): string;
+/**
+ * Text of the balanced argument list starting at `openParen`, or null when the
+ * parenthesis is never closed.
+ *
+ * Scanning for the matching parenthesis rather than matching a regex is what
+ * makes a wrapped call detectable. The old detector tested one line at a time,
+ * so the `[\s\S]*?` in its pattern could never span anything and
+ *
+ *     console.log(
+ *       'db password:',
+ *       process.env.DB_PASSWORD
+ *     );
+ *
+ * — the shape Prettier produces at default print width — went unflagged.
+ */
+export declare function readArgumentList(source: string, openParen: number): string | null;
+/** 1-based line number of `offset`. */
+export declare function lineOf(source: string, offset: number): number;
+/**
+ * Find every `console.*` call whose arguments reference a secret.
+ *
+ * Operates on the whole file, not line by line, so a call split across lines is
+ * matched. The reported line is the line the call *starts* on, which is where a
+ * reader will look.
+ */
+export declare function findSecretLogging(source: string): Violation[];
+/** Result of scanning one staged file. */
+export interface FileScanResult {
+    path: string;
+    violations: Violation[];
+    /** Set when the file was not scanned, with the reason. */
+    skipped?: string;
+}
+/** Scan one staged blob. */
+export declare function scanFile(path: string, content: string): FileScanResult;
+export type OutputFormat = 'text' | 'json' | 'sarif';
+/**
+ * Format scan results based on the chosen output format ('text' | 'json' | 'sarif').
+ */
+export declare function formatScanResults(results: FileScanResult[], format?: OutputFormat): string;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,6BAA6B;AAC7B,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AA8CD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAAa,CAAC;AAE5C,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CASzE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA4EzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYjF;AAED,uCAAuC;AACvC,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM7D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CA2B7D;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4BAA4B;AAC5B,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAUtE;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAErD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,cAAc,EAAE,EACzB,MAAM,GAAE,YAAqB,GAC5B,MAAM,CAmBR"}

package/dist/scanner.js

@@ -0,0 +1,266 @@
+/**
+ * The secret-logging detector, separated from the CLI shell.
+ *
+ * Everything here is pure: it takes text and returns violations. The process
+ * exit, the git calls and the console output live in `./index` and `./git`, so
+ * the part that decides whether a commit is blocked can actually be tested
+ * (#593).
+ */
+import { formatSarifJson } from './sarif.js';
+/** Console methods that put their arguments somewhere durable. */
+const CONSOLE_METHODS = ['log', 'info', 'warn', 'error', 'debug', 'trace', 'table', 'dir'];
+/**
+ * Start of a console call. Whitespace is permitted around the dot and the
+ * parenthesis because a formatter will put it there.
+ */
+const CONSOLE_CALL = new RegExp(`console\\s*\\.\\s*(?:${CONSOLE_METHODS.join('|')})\\s*\\(`, 'g');
+/**
+ * What makes an argument list suspicious.
+ *
+ * Checked against the *masked* source, so a string literal that merely contains
+ * the word "password" does not match — only an identifier or a member
+ * expression does.
+ */
+const INDICATORS = [
+    ['environment variable', /\b(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|Deno\s*\.\s*env|os\s*\.\s*environ)\b/],
+    ['secret-named identifier', /\b\w*(?:password|passwd|secret|token|credential|apikey|privatekey)\w*\b/i],
+    // `key` and `auth` on their own are common enough in ordinary code
+    // (`keyof`, `authorised`, `keys`) that they are only flagged when they read
+    // as a whole word or as an obvious compound.
+    ['secret-named identifier', /\b(?:api[_-]?key|access[_-]?key|secret[_-]?key|auth[_-]?token|authorization)\b/i],
+];
+/** Extensions never worth scanning as source text. */
+const BINARY_EXTENSIONS = [
+    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.webp', '.avif', '.bmp', '.tiff',
+    '.pdf', '.zip', '.gz', '.tar', '.bz2', '.7z', '.rar',
+    '.woff', '.woff2', '.ttf', '.otf', '.eot',
+    '.mp3', '.mp4', '.wav', '.mov', '.avi', '.webm',
+    '.so', '.dylib', '.dll', '.exe', '.wasm', '.class', '.jar',
+    '.sqlite', '.db',
+];
+/** Generated files that are large, uninteresting, and full of hashes. */
+const GENERATED_FILES = [
+    'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lockb', 'composer.lock',
+    'Cargo.lock', 'Gemfile.lock', 'poetry.lock',
+];
+/**
+ * Bytes above which a staged blob is skipped.
+ *
+ * Nothing bounded this before, so a staged fixture or a vendored bundle was
+ * read into memory and scanned line by line.
+ */
+export const MAX_SCANNED_BYTES = 512 * 1024;
+/** Whether `path` should be scanned at all. */
+export function shouldScanFile(path, byteLength) {
+    const lower = path.toLowerCase();
+    const basename = lower.split('/').pop() ?? lower;
+    if (GENERATED_FILES.some((name) => basename === name.toLowerCase()))
+        return false;
+    if (BINARY_EXTENSIONS.some((ext) => lower.endsWith(ext)))
+        return false;
+    if (typeof byteLength === 'number' && byteLength > MAX_SCANNED_BYTES)
+        return false;
+    return true;
+}
+/**
+ * Heuristic for content that is binary despite its name.
+ *
+ * A NUL byte does not occur in text. Checking this beats trusting the
+ * extension, since a staged blob can be anything.
+ */
+export function looksBinary(content) {
+    return content.includes('\u0000');
+}
+/** Filler used where a string literal's contents were. */
+const MASK_CHAR = '·';
+/**
+ * Blank out the *contents* of string literals, preserving length.
+ *
+ * The previous implementation deleted them outright:
+ *
+ *     trimmedLine.replace(/(["'`])(?:(?=(\\?))\2.)*?\1/g, '')
+ *
+ * which turned `` console.log(`token: ${authToken}`) `` into `console.log()` —
+ * the interpolation went with the quotes, so the single most common way a
+ * secret reaches a log line became invisible. Deleting also shifts every column
+ * after it, which matters now that whole files are scanned rather than
+ * individual lines.
+ *
+ * Interpolations inside a template literal are left intact, because
+ * `${authToken}` is code, not text. Escapes are honoured so a `\"` does not end
+ * a literal, and an unterminated quote stops at the newline rather than eating
+ * the rest of the file.
+ */
+export function maskStringLiterals(source) {
+    const out = source.split('');
+    let index = 0;
+    while (index < out.length) {
+        const char = out[index];
+        // Line comments are masked, not merely skipped over: skipping advances the
+        // cursor but leaves the text in the output, so the commented-out code was
+        // still scanned. The old detector only handled `//` at the very start of a
+        // trimmed line, so a trailing comment was scanned as code either way.
+        if (char === '/' && out[index + 1] === '/') {
+            while (index < out.length && out[index] !== '\n') {
+                out[index] = MASK_CHAR;
+                index += 1;
+            }
+            continue;
+        }
+        if (char === '/' && out[index + 1] === '*') {
+            index += 2;
+            while (index < out.length && !(out[index] === '*' && out[index + 1] === '/')) {
+                if (out[index] !== '\n')
+                    out[index] = MASK_CHAR;
+                index += 1;
+            }
+            index += 2;
+            continue;
+        }
+        if (char !== '"' && char !== "'" && char !== '`') {
+            index += 1;
+            continue;
+        }
+        const quote = char;
+        index += 1;
+        while (index < out.length) {
+            const current = out[index];
+            if (current === '\\') {
+                // Escaped character: mask both, and never let it terminate the literal.
+                if (out[index] !== '\n')
+                    out[index] = MASK_CHAR;
+                if (index + 1 < out.length && out[index + 1] !== '\n')
+                    out[index + 1] = MASK_CHAR;
+                index += 2;
+                continue;
+            }
+            if (current === quote) {
+                index += 1;
+                break;
+            }
+            // An unterminated quote must not swallow the rest of the file. Only a
+            // template literal legally spans lines.
+            if (current === '\n' && quote !== '`')
+                break;
+            // `${ … }` inside a template literal is code. Leave it visible, tracking
+            // brace depth so a nested object literal does not end it early.
+            if (quote === '`' && current === '$' && out[index + 1] === '{') {
+                let depth = 1;
+                index += 2;
+                while (index < out.length && depth > 0) {
+                    if (out[index] === '{')
+                        depth += 1;
+                    else if (out[index] === '}')
+                        depth -= 1;
+                    index += 1;
+                }
+                continue;
+            }
+            if (current !== '\n')
+                out[index] = MASK_CHAR;
+            index += 1;
+        }
+    }
+    return out.join('');
+}
+/**
+ * Text of the balanced argument list starting at `openParen`, or null when the
+ * parenthesis is never closed.
+ *
+ * Scanning for the matching parenthesis rather than matching a regex is what
+ * makes a wrapped call detectable. The old detector tested one line at a time,
+ * so the `[\s\S]*?` in its pattern could never span anything and
+ *
+ *     console.log(
+ *       'db password:',
+ *       process.env.DB_PASSWORD
+ *     );
+ *
+ * — the shape Prettier produces at default print width — went unflagged.
+ */
+export function readArgumentList(source, openParen) {
+    let depth = 0;
+    for (let i = openParen; i < source.length; i += 1) {
+        if (source[i] === '(')
+            depth += 1;
+        else if (source[i] === ')') {
+            depth -= 1;
+            if (depth === 0)
+                return source.slice(openParen + 1, i);
+        }
+    }
+    return null;
+}
+/** 1-based line number of `offset`. */
+export function lineOf(source, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < source.length; i += 1) {
+        if (source[i] === '\n')
+            line += 1;
+    }
+    return line;
+}
+/**
+ * Find every `console.*` call whose arguments reference a secret.
+ *
+ * Operates on the whole file, not line by line, so a call split across lines is
+ * matched. The reported line is the line the call *starts* on, which is where a
+ * reader will look.
+ */
+export function findSecretLogging(source) {
+    if (!source)
+        return [];
+    const masked = maskStringLiterals(source);
+    const lines = source.split(/\r?\n/);
+    const violations = [];
+    CONSOLE_CALL.lastIndex = 0;
+    let match;
+    while ((match = CONSOLE_CALL.exec(masked)) !== null) {
+        const openParen = match.index + match[0].length - 1;
+        const args = readArgumentList(masked, openParen);
+        if (args === null)
+            continue;
+        const indicator = INDICATORS.find(([, pattern]) => pattern.test(args));
+        if (!indicator)
+            continue;
+        const line = lineOf(masked, match.index);
+        violations.push({
+            line,
+            text: (lines[line - 1] ?? '').trim(),
+            reason: indicator[0],
+        });
+    }
+    return violations;
+}
+/** Scan one staged blob. */
+export function scanFile(path, content) {
+    if (!shouldScanFile(path, Buffer.byteLength(content, 'utf-8'))) {
+        return { path, violations: [], skipped: 'excluded by type or size' };
+    }
+    if (looksBinary(content)) {
+        return { path, violations: [], skipped: 'binary content' };
+    }
+    return { path, violations: findSecretLogging(content) };
+}
+/**
+ * Format scan results based on the chosen output format ('text' | 'json' | 'sarif').
+ */
+export function formatScanResults(results, format = 'text') {
+    if (format === 'json') {
+        return JSON.stringify(results, null, 2);
+    }
+    if (format === 'sarif') {
+        return formatSarifJson(results);
+    }
+    // Default text summary
+    let text = '';
+    for (const r of results) {
+        for (const v of r.violations) {
+            text += `🚨 [SecureFlow] Secret logging detected in ${r.path}:${v.line}\n`;
+            text += `   -> ${v.text}\n`;
+            text += `   why: ${v.reason} passed to a console call\n`;
+        }
+    }
+    return text;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAY7C,kEAAkE;AAClE,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE3F;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,wBAAwB,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAC3D,GAAG,CACJ,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,GAA6C;IAC3D,CAAC,sBAAsB,EAAE,4FAA4F,CAAC;IACtH,CAAC,yBAAyB,EAAE,0EAA0E,CAAC;IACvG,mEAAmE;IACnE,4EAA4E;IAC5E,6CAA6C;IAC7C,CAAC,yBAAyB,EAAE,iFAAiF,CAAC;CAC/G,CAAC;AAEF,sDAAsD;AACtD,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IAC1E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;IACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACzC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAC/C,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IAC1D,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF,yEAAyE;AACzE,MAAM,eAAe,GAAG;IACtB,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe;IAChF,YAAY,EAAE,cAAc,EAAE,aAAa;CAC5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE5C,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,UAAmB;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAEjD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAEnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,0DAA0D;AAC1D,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAExB,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBACjD,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC7E,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBAChD,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC;QACnB,KAAK,IAAI,CAAC,CAAC;QAEX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YAE3B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;gBAChD,IAAI,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;oBAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC;gBAClF,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;gBACtB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YAED,sEAAsE;YACtE,wCAAwC;YACxC,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,MAAM;YAE7C,yEAAyE;YACzE,gEAAgE;YAChE,IAAI,KAAK,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/D,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBACvC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG;wBAAE,KAAK,IAAI,CAAC,CAAC;yBAC9B,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG;wBAAE,KAAK,IAAI,CAAC,CAAC;oBACxC,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,OAAO,KAAK,IAAI;gBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;YAC7C,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,MAAc;IACnD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,UAAU,GAAgB,EAAE,CAAC;IAEnC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3B,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAE5B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,UAAU,CAAC,IAAI,CAAC;YACd,IAAI;YACJ,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACpC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAUD,4BAA4B;AAC5B,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1D,CAAC;AAID;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAyB,EACzB,MAAM,GAAiB,MAAM;IAE7B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,IAAI,IAAI,8CAA8C,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC;YAC3E,IAAI,IAAI,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5B,IAAI,IAAI,WAAW,CAAC,CAAC,MAAM,6BAA6B,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,32 +1,35 @@
-{
-  "name": "secureflow-cli",
-  "version": "1.0.0",
-  "description": "Pre-commit secret logging detector for secure development workflows",
-  "main": "./dist/index.js",
-  "bin": {
-    "secureflow": "./dist/index.js"
-  },
-  "scripts": {
-    "build": "tsc",
-    "prepare": "npm run build",
-    "publish": "npm publish --access public"
-  },
-  "keywords": [
-    "security",
-    "secrets",
-    "scanner",
-    "pre-commit",
-    "husky",
-    "secureflow"
-  ],
-  "author": "Gaurav Karakoti",
-  "license": "ISC",
-  "type": "module",
-  "files": [
-    "dist"
-  ],
-  "devDependencies": {
-    "@types/node": "^26.2.0",
-    "typescript": "^7.0.2"
-  }
-}
+{
+  "name": "secureflow-cli",
+  "version": "1.2.0",
+  "description": "Pre-commit secret logging detector for secure development workflows",
+  "main": "./dist/index.js",
+  "bin": {
+    "secureflow": "./dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepare": "npm run build",
+    "publish": "npm publish --access public",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "keywords": [
+    "security",
+    "secrets",
+    "scanner",
+    "pre-commit",
+    "husky",
+    "secureflow"
+  ],
+  "author": "Gaurav Karakoti",
+  "license": "ISC",
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "^26.4.0",
+    "typescript": "^6",
+    "vitest": "^4.1.11"
+  }
+}