secureflow-cli 2.4.0 → 2.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +302 -0
- package/dist/index.js +43 -43
- package/dist/lib/audio-player.d.ts +11 -4
- package/dist/lib/audio-player.d.ts.map +1 -1
- package/dist/lib/audio-player.js +33 -8
- package/dist/lib/audio-player.js.map +1 -1
- package/package.json +2 -2
package/README.md
ADDED
|
@@ -0,0 +1,302 @@
|
|
|
1
|
+
# 🛡️ SecureFlow CLI (`secureflow-cli`)
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/secureflow-cli)
|
|
4
|
+
[](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE)
|
|
5
|
+
[](https://www.typescriptlang.org/)
|
|
6
|
+
[](https://modelcontextprotocol.io/)
|
|
7
|
+
|
|
8
|
+
**Pre-commit secret logging detector, AI vulnerability scanner, and Threat Intelligence MCP Server for modern developer workflows.**
|
|
9
|
+
|
|
10
|
+
The SecureFlow CLI intercepts code vulnerabilities and exposed secrets right at the developer terminal before commits reach remote repositories. It operates in both cloud-assisted and completely offline / air-gapped modes, features audio debriefs, and acts as an MCP server for AI coding assistants.
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## 📋 Table of Contents
|
|
15
|
+
|
|
16
|
+
- [🌟 Features](#-features)
|
|
17
|
+
- [📦 Installation](#-installation)
|
|
18
|
+
- [🚀 Quick Start](#-quick-start)
|
|
19
|
+
- [🪝 Git Hook Setup (Husky)](#-git-hook-setup-husky)
|
|
20
|
+
- [📖 Command Line Reference](#-command-line-reference)
|
|
21
|
+
- [Options & Flags](#options--flags)
|
|
22
|
+
- [Failure Thresholds (`--fail-on`)](#failure-thresholds---fail-on)
|
|
23
|
+
- [Multi-Format Reports (`--format`)](#multi-format-reports---format)
|
|
24
|
+
- [🔒 Air-Gapped & Local Mode (`--local`)](#-air-gapped--local-mode---local)
|
|
25
|
+
- [🎙️ Audio Summary Debriefs (`--voice`)](#️-audio-summary-debriefs---voice)
|
|
26
|
+
- [🤖 Threat Intelligence MCP Server (`mcp`)](#-threat-intelligence-mcp-server-mcp)
|
|
27
|
+
- [Connecting to Cursor / Windsurf / Claude Desktop](#connecting-to-cursor--windsurf--claude-desktop)
|
|
28
|
+
- [Available MCP Tools](#available-mcp-tools)
|
|
29
|
+
- [⚙️ Configuration (`.secureflowignore`)](#️-configuration-secureflowignore)
|
|
30
|
+
- [🔄 CI/CD Pipeline Integration](#-cicd-pipeline-integration)
|
|
31
|
+
- [📄 License](#-license)
|
|
32
|
+
|
|
33
|
+
---
|
|
34
|
+
|
|
35
|
+
## 🌟 Features
|
|
36
|
+
|
|
37
|
+
- **⚡ Instant Pre-Commit Scans**: Evaluates staged git files in milliseconds to prevent accidental secret leaks and credential logging.
|
|
38
|
+
- **🧠 Hybrid AI Security Analysis**: Combines deterministic heuristic pattern matching with LLM-backed vulnerability reasoning.
|
|
39
|
+
- **🔐 Air-Gapped / Zero-Upload Mode**: Run with `--local` to guarantee that code snippets never leave your workstation.
|
|
40
|
+
- **🎙️ Voice Debriefs (`--voice` / `-v`)**: Audio debriefs of scan findings directly in your terminal upon scan completion, with automatic headless CI bypass.
|
|
41
|
+
- **🤖 Built-in MCP Server**: `secureflow mcp` exposes live threat intelligence, CVE lookups, and ArmorIQ cryptographic intent verification over JSON-RPC stdio.
|
|
42
|
+
- **📊 Comprehensive Exporters**: Export audit-grade reports in **SARIF** (GitHub Code Scanning), **HTML**, **CSV** (formula injection hardened), **JSON**, and **Markdown**.
|
|
43
|
+
- **🚦 Configurable Quality Gates**: Strict build-failing control using `--fail-on <low|medium|high|critical>`.
|
|
44
|
+
|
|
45
|
+
---
|
|
46
|
+
|
|
47
|
+
## 📦 Installation
|
|
48
|
+
|
|
49
|
+
### Global Installation (Recommended)
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
npm install -g secureflow-cli
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
### Project Dev Dependency
|
|
56
|
+
|
|
57
|
+
```bash
|
|
58
|
+
npm install --save-dev secureflow-cli
|
|
59
|
+
```
|
|
60
|
+
|
|
61
|
+
### Run Instantly via `npx`
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
npx secureflow --help
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## 🚀 Quick Start
|
|
70
|
+
|
|
71
|
+
1. **Stage your changes in git:**
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
git add src/
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
2. **Run the security scanner:**
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
secureflow
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
3. **Run with an audio summary debrief:**
|
|
84
|
+
|
|
85
|
+
```bash
|
|
86
|
+
secureflow --voice
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
4. **Export a SARIF report for GitHub Code Scanning:**
|
|
90
|
+
```bash
|
|
91
|
+
secureflow --format sarif -o results.sarif
|
|
92
|
+
```
|
|
93
|
+
|
|
94
|
+
---
|
|
95
|
+
|
|
96
|
+
## 🪝 Git Hook Setup (Husky)
|
|
97
|
+
|
|
98
|
+
Prevent sensitive data from ever entering your git history by configuring SecureFlow in your pre-commit hook:
|
|
99
|
+
|
|
100
|
+
```bash
|
|
101
|
+
# Initialize husky in your project
|
|
102
|
+
npx husky init
|
|
103
|
+
|
|
104
|
+
# Add secureflow to your pre-commit hook
|
|
105
|
+
echo "npx secureflow --fail-on high" > .husky/pre-commit
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
Now, every `git commit` automatically triggers a security check on staged files. If a high or critical finding is detected, the commit is safely blocked.
|
|
109
|
+
|
|
110
|
+
---
|
|
111
|
+
|
|
112
|
+
## 📖 Command Line Reference
|
|
113
|
+
|
|
114
|
+
```text
|
|
115
|
+
Usage:
|
|
116
|
+
secureflow [options]
|
|
117
|
+
secureflow mcp [options]
|
|
118
|
+
|
|
119
|
+
Commands:
|
|
120
|
+
mcp Start the Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
121
|
+
```
|
|
122
|
+
|
|
123
|
+
### Options & Flags
|
|
124
|
+
|
|
125
|
+
| Flag | Shorthand | Default | Description |
|
|
126
|
+
| :--------------------- | :-------- | :------------------ | :------------------------------------------------------------------------------------------------- |
|
|
127
|
+
| `--fail-on <level>` | | `medium` | Exit with error code `1` if findings meet or exceed severity (`low`, `medium`, `high`, `critical`) |
|
|
128
|
+
| `--format <format>` | | `text` | Output report format: `text`, `json`, `sarif`, `csv`, `html`, `markdown` |
|
|
129
|
+
| `--output <path>` | `-o` | `stdout` | Write report to the specified file path |
|
|
130
|
+
| `--voice` | `-v` | `false` | Play an audio debrief of findings in your terminal upon completion |
|
|
131
|
+
| `--local` | | `false` | Skip cloud AI upload and run fully local pattern analysis |
|
|
132
|
+
| `--local-model <tag>` | | `llama3` | Specify local model tag when using local AI providers |
|
|
133
|
+
| `--ignore-file <path>` | | `.secureflowignore` | Custom path to ignore configuration file |
|
|
134
|
+
| `--dry-run` | | `false` | Simulate scan execution without writing output files |
|
|
135
|
+
| `--verbose` | | `false` | Enable verbose diagnostic logging |
|
|
136
|
+
| `--help` | `-h` | | Display CLI usage instructions and exit |
|
|
137
|
+
|
|
138
|
+
---
|
|
139
|
+
|
|
140
|
+
### Failure Thresholds (`--fail-on`)
|
|
141
|
+
|
|
142
|
+
Control the sensitivity of the pre-commit gate:
|
|
143
|
+
|
|
144
|
+
```bash
|
|
145
|
+
# Block only on high and critical findings (standard CI recommendation)
|
|
146
|
+
secureflow --fail-on high
|
|
147
|
+
|
|
148
|
+
# Strict zero-tolerance gate (blocks on any finding, including low)
|
|
149
|
+
secureflow --fail-on low
|
|
150
|
+
|
|
151
|
+
# Allow commits while logging warnings
|
|
152
|
+
secureflow --fail-on none
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
---
|
|
156
|
+
|
|
157
|
+
### Multi-Format Reports (`--format`)
|
|
158
|
+
|
|
159
|
+
- **Text (`text`)**: Clean, ANSI-colored terminal overview with source code context snippets.
|
|
160
|
+
- **SARIF (`sarif`)**: Industry-standard OASIS SARIF 2.1.0 format, ready for direct upload to GitHub Security tab.
|
|
161
|
+
- **HTML (`html`)**: Self-contained, responsive HTML report suitable for sharing and compliance reviews.
|
|
162
|
+
- **CSV (`csv`)**: Formatted tabular output hardened against spreadsheet formula injection (CWE-1236).
|
|
163
|
+
- **JSON (`json`)**: Machine-readable JSON object representing findings and metadata.
|
|
164
|
+
- **Markdown (`markdown` / `md`)**: GitHub-Flavored Markdown table with sanitized code fences.
|
|
165
|
+
|
|
166
|
+
```bash
|
|
167
|
+
secureflow --format html -o security-report.html
|
|
168
|
+
secureflow --format sarif -o results.sarif
|
|
169
|
+
secureflow --format markdown -o findings.md
|
|
170
|
+
```
|
|
171
|
+
|
|
172
|
+
---
|
|
173
|
+
|
|
174
|
+
## 🔒 Air-Gapped & Local Mode (`--local`)
|
|
175
|
+
|
|
176
|
+
When handling proprietary or classified source code, use the `--local` flag:
|
|
177
|
+
|
|
178
|
+
```bash
|
|
179
|
+
secureflow --local
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
### Guarantees under `--local`:
|
|
183
|
+
|
|
184
|
+
- **Zero Cloud Uploads**: The hosted AI API pass (`/api/cli/scan`) is completely bypassed.
|
|
185
|
+
- **Staged Code Stays Local**: File contents are parsed and scanned strictly in-memory on your local machine.
|
|
186
|
+
- **Compatible with Local Models**: Seamlessly pairs with local Ollama or vLLM deployments (`--local-model <tag>`).
|
|
187
|
+
|
|
188
|
+
---
|
|
189
|
+
|
|
190
|
+
## 🎙️ Audio Summary Debriefs (`--voice`)
|
|
191
|
+
|
|
192
|
+
Listen to hands-free voice briefings of scan findings right in your terminal:
|
|
193
|
+
|
|
194
|
+
```bash
|
|
195
|
+
secureflow --voice
|
|
196
|
+
# or shorthand
|
|
197
|
+
secureflow -v
|
|
198
|
+
```
|
|
199
|
+
|
|
200
|
+
### Capabilities:
|
|
201
|
+
|
|
202
|
+
- **Native OS Playback**:
|
|
203
|
+
- macOS: `afplay`
|
|
204
|
+
- Windows: PowerShell `System.Media.SoundPlayer` / `Windows.Media.Playback`
|
|
205
|
+
- Linux: `mpg123` or `aplay`
|
|
206
|
+
- **Fallback**: Automatically saves findings to `secureflow-summary.mp3` if no audio player is present.
|
|
207
|
+
- **CI Safe**: Detects non-interactive environments (`CI=true`, `GITHUB_ACTIONS=true`) and silently skips playback without stalling build runners.
|
|
208
|
+
- **ElevenLabs Integration**: Synthesizes natural voice summaries if `ELEVENLABS_API_KEY` is present.
|
|
209
|
+
|
|
210
|
+
---
|
|
211
|
+
|
|
212
|
+
## 🤖 Threat Intelligence MCP Server (`mcp`)
|
|
213
|
+
|
|
214
|
+
SecureFlow CLI doubles as a **Model Context Protocol (MCP)** server, allowing AI agents in **Cursor**, **Windsurf**, **Claude Desktop**, or **Antigravity** to query threat intelligence and verify tool actions against ArmorIQ policy boundaries.
|
|
215
|
+
|
|
216
|
+
```bash
|
|
217
|
+
secureflow mcp
|
|
218
|
+
```
|
|
219
|
+
|
|
220
|
+
### Connecting to Cursor / Windsurf / Claude Desktop
|
|
221
|
+
|
|
222
|
+
Add this configuration to your `claude_desktop_config.json` or Cursor MCP settings:
|
|
223
|
+
|
|
224
|
+
```json
|
|
225
|
+
{
|
|
226
|
+
"mcpServers": {
|
|
227
|
+
"secureflow": {
|
|
228
|
+
"command": "npx",
|
|
229
|
+
"args": ["-y", "secureflow-cli", "mcp"]
|
|
230
|
+
}
|
|
231
|
+
}
|
|
232
|
+
}
|
|
233
|
+
```
|
|
234
|
+
|
|
235
|
+
### Available MCP Tools
|
|
236
|
+
|
|
237
|
+
| Tool | Parameters | Description |
|
|
238
|
+
| :-------------------------- | :-------------------------------------- | :------------------------------------------------------------------------------------------ |
|
|
239
|
+
| `query_threat_intelligence` | `query: string`, `intentToken?: string` | Search CVE and threat intelligence databases for vulnerabilities and remediation guidance. |
|
|
240
|
+
| `lookup_cve` | `cveId: string`, `intentToken?: string` | Look up detailed advisories, severity scores, and fix patterns for a CVE or CWE identifier. |
|
|
241
|
+
|
|
242
|
+
_All MCP tool calls are gated behind ArmorIQ cryptographic intent verification to enforce zero-trust boundary compliance and mitigate Prompt Injection (CWE-94)._
|
|
243
|
+
|
|
244
|
+
---
|
|
245
|
+
|
|
246
|
+
## ⚙️ Configuration (`.secureflowignore`)
|
|
247
|
+
|
|
248
|
+
Define exclusion patterns and placeholder allowances in `.secureflowignore` at the root of your project:
|
|
249
|
+
|
|
250
|
+
```gitignore
|
|
251
|
+
# Ignore specific directories and generated bundles
|
|
252
|
+
dist/
|
|
253
|
+
coverage/
|
|
254
|
+
node_modules/
|
|
255
|
+
*.min.js
|
|
256
|
+
|
|
257
|
+
# Ignore documentation examples
|
|
258
|
+
docs/samples/**
|
|
259
|
+
|
|
260
|
+
# Allow safe mock/test tokens
|
|
261
|
+
[placeholders]
|
|
262
|
+
mock-token-*
|
|
263
|
+
test_api_key_dummy
|
|
264
|
+
EXAMPLE_SECRET
|
|
265
|
+
```
|
|
266
|
+
|
|
267
|
+
---
|
|
268
|
+
|
|
269
|
+
## 🔄 CI/CD Pipeline Integration
|
|
270
|
+
|
|
271
|
+
### GitHub Actions Workflow
|
|
272
|
+
|
|
273
|
+
```yaml
|
|
274
|
+
name: Security Scan
|
|
275
|
+
on: [push, pull_request]
|
|
276
|
+
|
|
277
|
+
jobs:
|
|
278
|
+
secureflow-scan:
|
|
279
|
+
runs-on: ubuntu-latest
|
|
280
|
+
steps:
|
|
281
|
+
- uses: actions/checkout@v4
|
|
282
|
+
|
|
283
|
+
- name: Setup Node.js
|
|
284
|
+
uses: actions/setup-node@v4
|
|
285
|
+
with:
|
|
286
|
+
node-version: 20
|
|
287
|
+
|
|
288
|
+
- name: Run SecureFlow Scanner
|
|
289
|
+
run: npx secureflow-cli --format sarif -o results.sarif --fail-on high
|
|
290
|
+
|
|
291
|
+
- name: Upload SARIF to GitHub Security tab
|
|
292
|
+
if: always()
|
|
293
|
+
uses: github/codeql-action/upload-sarif@v3
|
|
294
|
+
with:
|
|
295
|
+
sarif_file: results.sarif
|
|
296
|
+
```
|
|
297
|
+
|
|
298
|
+
---
|
|
299
|
+
|
|
300
|
+
## 📄 License
|
|
301
|
+
|
|
302
|
+
This package is licensed under the [ISC License](https://github.com/GauravKarakoti/SecureFlow/blob/main/LICENSE). Built with ❤️ by the SecureFlow Team.
|
package/dist/index.js
CHANGED
|
@@ -20,50 +20,50 @@ const AI_SKIP_REASON = hostedAiScanSkipReason(process.argv);
|
|
|
20
20
|
*/
|
|
21
21
|
Object.assign(process.env, localModeEnv(process.argv, process.env));
|
|
22
22
|
function printMcpHelp() {
|
|
23
|
-
console.log(`
|
|
24
|
-
SecureFlow CLI - Threat Intelligence MCP Server
|
|
25
|
-
|
|
26
|
-
Usage:
|
|
27
|
-
secureflow mcp [options]
|
|
28
|
-
|
|
29
|
-
Description:
|
|
30
|
-
Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio.
|
|
31
|
-
Communicates using JSON-RPC protocol over standard input/output.
|
|
32
|
-
|
|
33
|
-
Options:
|
|
34
|
-
-h, --help Show this help message
|
|
23
|
+
console.log(`
|
|
24
|
+
SecureFlow CLI - Threat Intelligence MCP Server
|
|
25
|
+
|
|
26
|
+
Usage:
|
|
27
|
+
secureflow mcp [options]
|
|
28
|
+
|
|
29
|
+
Description:
|
|
30
|
+
Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio.
|
|
31
|
+
Communicates using JSON-RPC protocol over standard input/output.
|
|
32
|
+
|
|
33
|
+
Options:
|
|
34
|
+
-h, --help Show this help message
|
|
35
35
|
`);
|
|
36
36
|
}
|
|
37
37
|
function printHelp() {
|
|
38
|
-
console.log(`
|
|
39
|
-
SecureFlow CLI - Security analysis tool for staged git files
|
|
40
|
-
|
|
41
|
-
Usage:
|
|
42
|
-
secureflow [options]
|
|
43
|
-
secureflow mcp [options]
|
|
44
|
-
|
|
45
|
-
Commands:
|
|
46
|
-
mcp Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
47
|
-
|
|
48
|
-
Options:
|
|
49
|
-
--verbose Enable verbose logging
|
|
50
|
-
--format <format> Output format: text, json, sarif, csv, html, markdown (default: text)
|
|
51
|
-
-o, --output <path> Write output to specified file path
|
|
52
|
-
--ignore-file <path> Path to custom ignore configuration file
|
|
53
|
-
--fail-on <level> Fail scan threshold (low, medium, high, critical)
|
|
54
|
-
--local Run scan locally without uploading files externally
|
|
55
|
-
--local-model <tag> Specify local AI model tag (default: llama3)
|
|
56
|
-
--dry-run Simulate scan execution without writing files
|
|
57
|
-
-v, --voice Play an audio summary debrief of scan findings upon completion
|
|
58
|
-
-h, --help Show this help message
|
|
59
|
-
|
|
60
|
-
Examples:
|
|
61
|
-
$ secureflow # Run standard security scan on staged files
|
|
62
|
-
$ secureflow -v # Run scan and play audio summary debrief
|
|
63
|
-
$ secureflow mcp # Start the Threat Intelligence MCP server over stdio
|
|
64
|
-
$ secureflow --format json -o res.json # Scan and export results to JSON file
|
|
65
|
-
$ secureflow --fail-on high # Fail commit only on high/critical findings
|
|
66
|
-
$ secureflow --local --local-model llama3 # Run completely local scan
|
|
38
|
+
console.log(`
|
|
39
|
+
SecureFlow CLI - Security analysis tool for staged git files
|
|
40
|
+
|
|
41
|
+
Usage:
|
|
42
|
+
secureflow [options]
|
|
43
|
+
secureflow mcp [options]
|
|
44
|
+
|
|
45
|
+
Commands:
|
|
46
|
+
mcp Start the SecureFlow Threat Intelligence Model Context Protocol (MCP) server over stdio
|
|
47
|
+
|
|
48
|
+
Options:
|
|
49
|
+
--verbose Enable verbose logging
|
|
50
|
+
--format <format> Output format: text, json, sarif, csv, html, markdown (default: text)
|
|
51
|
+
-o, --output <path> Write output to specified file path
|
|
52
|
+
--ignore-file <path> Path to custom ignore configuration file
|
|
53
|
+
--fail-on <level> Fail scan threshold (low, medium, high, critical)
|
|
54
|
+
--local Run scan locally without uploading files externally
|
|
55
|
+
--local-model <tag> Specify local AI model tag (default: llama3)
|
|
56
|
+
--dry-run Simulate scan execution without writing files
|
|
57
|
+
-v, --voice Play an audio summary debrief of scan findings upon completion
|
|
58
|
+
-h, --help Show this help message
|
|
59
|
+
|
|
60
|
+
Examples:
|
|
61
|
+
$ secureflow # Run standard security scan on staged files
|
|
62
|
+
$ secureflow -v # Run scan and play audio summary debrief
|
|
63
|
+
$ secureflow mcp # Start the Threat Intelligence MCP server over stdio
|
|
64
|
+
$ secureflow --format json -o res.json # Scan and export results to JSON file
|
|
65
|
+
$ secureflow --fail-on high # Fail commit only on high/critical findings
|
|
66
|
+
$ secureflow --local --local-model llama3 # Run completely local scan
|
|
67
67
|
`);
|
|
68
68
|
}
|
|
69
69
|
function parseFormatArg() {
|
|
@@ -246,7 +246,7 @@ async function main() {
|
|
|
246
246
|
const outputString = formatScanResults(filteredResults, format);
|
|
247
247
|
if (outputPath) {
|
|
248
248
|
if (DRY_RUN) {
|
|
249
|
-
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
249
|
+
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
250
250
|
${outputString}`);
|
|
251
251
|
}
|
|
252
252
|
else {
|
|
@@ -261,7 +261,7 @@ ${outputString}`);
|
|
|
261
261
|
else if (outputPath) {
|
|
262
262
|
const textOutput = formatScanResults(filteredResults, "text");
|
|
263
263
|
if (DRY_RUN) {
|
|
264
|
-
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
264
|
+
console.log(`[DRY RUN] Would write to ${outputPath}:
|
|
265
265
|
${textOutput}`);
|
|
266
266
|
}
|
|
267
267
|
else {
|
|
@@ -5,10 +5,11 @@ export interface AudioPlaybackResult {
|
|
|
5
5
|
savedPath?: string;
|
|
6
6
|
error?: string;
|
|
7
7
|
}
|
|
8
|
+
export type AudioPlayerEnv = NodeJS.ProcessEnv | Record<string, string | undefined>;
|
|
8
9
|
/**
|
|
9
10
|
* Checks if the current process is running in a non-interactive CI/CD environment.
|
|
10
11
|
*/
|
|
11
|
-
export declare function isNonInteractiveCiEnvironment(env?:
|
|
12
|
+
export declare function isNonInteractiveCiEnvironment(env?: AudioPlayerEnv): boolean;
|
|
12
13
|
/**
|
|
13
14
|
* Determines the command and arguments for native OS audio playback.
|
|
14
15
|
*/
|
|
@@ -21,7 +22,7 @@ export declare function getOsAudioCommand(filePath: string, platform?: NodeJS.Pl
|
|
|
21
22
|
*/
|
|
22
23
|
export declare function playAudioFile(filePath: string, options?: {
|
|
23
24
|
platform?: NodeJS.Platform;
|
|
24
|
-
env?:
|
|
25
|
+
env?: AudioPlayerEnv;
|
|
25
26
|
verbose?: boolean;
|
|
26
27
|
fallbackDir?: string;
|
|
27
28
|
}): AudioPlaybackResult;
|
|
@@ -31,16 +32,22 @@ export declare function playAudioFile(filePath: string, options?: {
|
|
|
31
32
|
export declare function fetchAudioSummary(summaryText: string, options?: {
|
|
32
33
|
baseUrl?: string;
|
|
33
34
|
files?: StagedFileForAiScan[];
|
|
34
|
-
env?:
|
|
35
|
+
env?: AudioPlayerEnv;
|
|
35
36
|
}): Promise<Buffer | null>;
|
|
37
|
+
/**
|
|
38
|
+
* Safely removes a temporary file, suppressing any filesystem errors.
|
|
39
|
+
*/
|
|
40
|
+
export declare function cleanupTempFile(filePath: string): boolean;
|
|
36
41
|
/**
|
|
37
42
|
* Coordinates fetching and playing the voice summary debrief.
|
|
38
43
|
*/
|
|
39
44
|
export declare function playVoiceDebrief(summaryText: string, options?: {
|
|
40
45
|
baseUrl?: string;
|
|
41
46
|
files?: StagedFileForAiScan[];
|
|
42
|
-
env?:
|
|
47
|
+
env?: AudioPlayerEnv;
|
|
43
48
|
verbose?: boolean;
|
|
44
49
|
fallbackDir?: string;
|
|
50
|
+
keepTempFile?: boolean;
|
|
51
|
+
platform?: NodeJS.Platform;
|
|
45
52
|
}): Promise<AudioPlaybackResult>;
|
|
46
53
|
//# sourceMappingURL=audio-player.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audio-player.d.ts","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,
|
|
1
|
+
{"version":3,"file":"audio-player.d.ts","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAEpF;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,GAAE,cAA4B,GAAG,OAAO,CAWxF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CA8B5C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,mBAAmB,CAwCrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB,GACA,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA+DxB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAUzD;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,GACA,OAAO,CAAC,mBAAmB,CAAC,CA2B9B"}
|
package/dist/lib/audio-player.js
CHANGED
|
@@ -35,8 +35,13 @@ export function getOsAudioCommand(filePath, platform = process.platform) {
|
|
|
35
35
|
} catch {
|
|
36
36
|
[System.Media.SystemSounds]::Beep.Play();
|
|
37
37
|
}
|
|
38
|
-
|
|
39
|
-
|
|
38
|
+
`
|
|
39
|
+
.replace(/\s+/g, " ")
|
|
40
|
+
.trim();
|
|
41
|
+
return {
|
|
42
|
+
command: "powershell",
|
|
43
|
+
args: ["-NoProfile", "-NonInteractive", "-Command", psScript],
|
|
44
|
+
};
|
|
40
45
|
}
|
|
41
46
|
case "linux":
|
|
42
47
|
// Supports mpg123, aplay, paplay
|
|
@@ -149,6 +154,21 @@ export async function fetchAudioSummary(summaryText, options) {
|
|
|
149
154
|
}
|
|
150
155
|
return null;
|
|
151
156
|
}
|
|
157
|
+
/**
|
|
158
|
+
* Safely removes a temporary file, suppressing any filesystem errors.
|
|
159
|
+
*/
|
|
160
|
+
export function cleanupTempFile(filePath) {
|
|
161
|
+
try {
|
|
162
|
+
if (fs.existsSync(filePath)) {
|
|
163
|
+
fs.unlinkSync(filePath);
|
|
164
|
+
return true;
|
|
165
|
+
}
|
|
166
|
+
}
|
|
167
|
+
catch {
|
|
168
|
+
// Gracefully ignore cleanup errors
|
|
169
|
+
}
|
|
170
|
+
return false;
|
|
171
|
+
}
|
|
152
172
|
/**
|
|
153
173
|
* Coordinates fetching and playing the voice summary debrief.
|
|
154
174
|
*/
|
|
@@ -161,13 +181,18 @@ export async function playVoiceDebrief(summaryText, options) {
|
|
|
161
181
|
return { played: false, bypassed: true };
|
|
162
182
|
}
|
|
163
183
|
const audioBuffer = await fetchAudioSummary(summaryText, options);
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
184
|
+
const tempPath = path.join(os.tmpdir(), `secureflow-summary-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.mp3`);
|
|
185
|
+
const bufferToWrite = !audioBuffer || audioBuffer.length === 0
|
|
186
|
+
? Buffer.from("ID3\x04\x00\x00\x00\x00\x00#TSSE\x00\x00\x00\x0f\x00\x00\x03Lavf58.29.100\x00")
|
|
187
|
+
: audioBuffer;
|
|
188
|
+
try {
|
|
189
|
+
fs.writeFileSync(tempPath, bufferToWrite);
|
|
167
190
|
return playAudioFile(tempPath, options);
|
|
168
191
|
}
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
192
|
+
finally {
|
|
193
|
+
if (!options?.keepTempFile) {
|
|
194
|
+
cleanupTempFile(tempPath);
|
|
195
|
+
}
|
|
196
|
+
}
|
|
172
197
|
}
|
|
173
198
|
//# sourceMappingURL=audio-player.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audio-player.js","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;
|
|
1
|
+
{"version":3,"file":"audio-player.js","sourceRoot":"","sources":["../../src/lib/audio-player.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAW9D;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAsB,OAAO,CAAC,GAAG;IAC7E,OAAO,OAAO,CACZ,GAAG,CAAC,EAAE,KAAK,MAAM;QACjB,GAAG,CAAC,EAAE,KAAK,GAAG;QACd,GAAG,CAAC,cAAc,KAAK,MAAM;QAC7B,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,sBAAsB;QAC1B,GAAG,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,wFAAwF;YACxF,MAAM,QAAQ,GAAG;;;;sCAIe,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;;;;;;OAM3D;iBACE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;iBACpB,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,KAAK,OAAO;YACV,iCAAiC;YACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,OAKC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACvD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAElD,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC9C,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IAEtE,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,8DAA8D,YAAY,EAAE,CAAC,CAAC;QAC1F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,OAIC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAEhD,2DAA2D;IAC3D,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,IAAI,sBAAsB,CAAC,CAAC,gBAAgB;YACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,+CAA+C,OAAO,EAAE,EAAE;gBACrF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,gBAAgB;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,WAAW;oBACjB,QAAQ,EAAE,uBAAuB;oBACjC,cAAc,EAAE;wBACd,SAAS,EAAE,GAAG;wBACd,gBAAgB,EAAE,IAAI;qBACvB;iBACF,CAAC;aACH,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,eAAe,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC3B,KAAK,EAAE,IAAI;gBACX,WAAW;aACZ,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6C,CAAC;YACjF,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAmB,EACnB,OAQC;IAED,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,IAAI,6BAA6B,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,EAAE,CAAC,MAAM,EAAE,EACX,sBAAsB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACjF,CAAC;IACF,MAAM,aAAa,GACjB,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC;QAC9F,CAAC,CAAC,WAAW,CAAC;IAElB,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC1C,OAAO,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC;YAC3B,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "secureflow-cli",
|
|
3
|
-
"version": "2.4.
|
|
3
|
+
"version": "2.4.1",
|
|
4
4
|
"description": "Pre-commit secret logging detector for secure development workflows",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"bin": {
|
|
@@ -38,6 +38,6 @@
|
|
|
38
38
|
"devDependencies": {
|
|
39
39
|
"@types/node": "^26.6.5",
|
|
40
40
|
"typescript": "^6",
|
|
41
|
-
"vitest": "^5.0.
|
|
41
|
+
"vitest": "^5.0.4"
|
|
42
42
|
}
|
|
43
43
|
}
|