whale-igniter 1.5.3 → 1.5.4

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to Whale Igniter are documented here.
 
+## 1.5.4 - 2026-07-08
+
+### Security
+
+- Added automatic secret redaction before Selene prompts are copied, written, cached, or sent to Anthropic/OpenAI.
+- Added `npm run security:scan` to detect likely committed secrets in source and compiled output.
+- Added the security scan to `prepublishOnly`, after build and before tests, so npm releases fail before publishing if high-confidence secrets are found.
+- Replaced the `gray-matter`/`js-yaml` dependency path with a local frontmatter parser, restoring a zero-vulnerability production audit.
+
 ## 1.5.3 - 2026-07-06
 
 ### Added

package/dist/commands/changes.js

@@ -1,7 +1,7 @@
 import { execFileSync } from "node:child_process";
-import matter from "gray-matter";
 import { resolveTarget } from "../utils/paths.js";
 import { loadComponents } from "../utils/components.js";
+import { parseFrontmatter } from "../utils/frontmatter.js";
 import { ui } from "../ui/index.js";
 const DECISIONS_DIR = "intelligence/decisions";
 const REFINEMENTS_DIR = "intelligence/refinements";
@@ -42,10 +42,10 @@ function mdLabelAtRef(target, ref, file, label) {
     }
 }
 const decisionLabel = (raw) => {
-    const title = matter(raw).data?.title;
+    const title = parseFrontmatter(raw).data.title;
     return title ? String(title) : "";
 };
-const refinementLabel = (raw) => matter(raw).content.trim().split("\n")[0] ?? "";
+const refinementLabel = (raw) => parseFrontmatter(raw).content.trim().split("\n")[0] ?? "";
 function gitDirChanges(target, since, dir, label) {
     const result = { added: [], removed: [], modified: [] };
     let raw = "";

package/dist/commands/selene.js

@@ -14,6 +14,7 @@ import { copyToClipboard } from "../selene/clipboard.js";
 import { resolveProvider, describeProviderState } from "../selene/providers.js";
 import { callProvider, estimateTokens, estimateCostUsd } from "../selene/apiClient.js";
 import { readCache, writeCache, clearCache } from "../selene/cache.js";
+import { redactSecrets } from "../selene/redaction.js";
 import { ui } from "../ui/index.js";
 const PENDING_DIR = ".whale/selene";
 // ---------------------------------------------------------------------------
@@ -83,6 +84,10 @@ async function emitPrompt(target, prompt, kind, options) {
  * prompt mode, etc. Centralising keeps the policy consistent.
  */
 async function runSelene(target, kind, prompt, options) {
+    const safePrompt = redactSecrets(prompt);
+    if (safePrompt !== prompt) {
+        console.log(ui.warning("Potential secrets were redacted before Selene output/API use."));
+    }
     const config = await loadConfig(target);
     const sel = config.selene ?? {};
     // Step 1: figure out the mode.
@@ -103,7 +108,7 @@ async function runSelene(target, kind, prompt, options) {
             process.exitCode = 1;
             return { rawResponse: null };
         }
-        await emitPrompt(target, prompt, kind, options);
+        await emitPrompt(target, safePrompt, kind, options);
         return { rawResponse: null };
     }
     // ---- API mode --------------------------------------------------------------
@@ -111,7 +116,7 @@ async function runSelene(target, kind, prompt, options) {
     // Cache lookup, unless the user opted out.
     const cacheEnabled = !options.noCache && !sel.noCache;
     if (cacheEnabled) {
-        const cached = await readCache(target, resolved.model, prompt);
+        const cached = await readCache(target, resolved.model, safePrompt);
         if (cached) {
             console.log(ui.muted("  cache hit — no API call needed"));
             // Still stash the response so `apply` from disk works if the user wants.
@@ -122,7 +127,7 @@ async function runSelene(target, kind, prompt, options) {
     // Cost confirmation.
     const confirm = options.confirmCost || sel.confirmCost;
     if (confirm) {
-        const inputTokens = estimateTokens(prompt);
+        const inputTokens = estimateTokens(safePrompt);
         const expectedOutput = sel.maxTokens ?? 1500;
         const cost = estimateCostUsd(resolved.model, inputTokens, expectedOutput);
         const costStr = cost === null ? "unknown" : `≈ $${cost.toFixed(4)}`;
@@ -135,13 +140,13 @@ async function runSelene(target, kind, prompt, options) {
         });
         if (!ok) {
             console.log(ui.warning("Aborted — falling back to prompt mode."));
-            await emitPrompt(target, prompt, kind, options);
+            await emitPrompt(target, safePrompt, kind, options);
             return { rawResponse: null };
         }
     }
     const spin = ora({ text: "Calling provider", stream: process.stderr }).start();
     const result = await callProvider(resolved, {
-        prompt,
+        prompt: safePrompt,
         maxTokens: sel.maxTokens ?? 1500,
         temperature: sel.temperature ?? 0.2
     });
@@ -152,7 +157,7 @@ async function runSelene(target, kind, prompt, options) {
         }
         // Graceful fallback: still emit the prompt so the user isn't stuck.
         console.log(ui.warning("\nFalling back to prompt mode so you can run this manually:"));
-        await emitPrompt(target, prompt, kind, options);
+        await emitPrompt(target, safePrompt, kind, options);
         return { rawResponse: null };
     }
     const usage = result.inputTokens !== null && result.outputTokens !== null
@@ -160,7 +165,7 @@ async function runSelene(target, kind, prompt, options) {
         : "";
     spin.succeed(`Response received${usage}`);
     if (cacheEnabled) {
-        await writeCache(target, resolved.model, prompt, result.text);
+        await writeCache(target, resolved.model, safePrompt, result.text);
     }
     await stashResponse(target, kind, result.text);
     return { rawResponse: result.text };

package/dist/selene/redaction.js

@@ -0,0 +1,45 @@
+const REDACTED = "[REDACTED_SECRET]";
+const SECRET_PATTERNS = [
+    {
+        name: "private-key",
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g
+    },
+    { name: "openai-key", pattern: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
+    { name: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g },
+    { name: "slack-token", pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { name: "aws-access-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+    { name: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{30,}\b/g },
+    { name: "anthropic-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g }
+];
+const ASSIGNMENT_PATTERN = /\b(api[_-]?key|token|secret|password|passwd|client[_-]?secret|private[_-]?key)\b(\s*[:=]\s*)(["']?)([^"'\s,;)}\]]{16,})(\3)/gi;
+function redactAssignment(match, key, separator, quote, value) {
+    if (isLikelyPlaceholder(value))
+        return match;
+    return `${key}${separator}${quote}${REDACTED}${quote}`;
+}
+function isLikelyPlaceholder(value) {
+    const normalized = value.toLowerCase();
+    return [
+        "example",
+        "placeholder",
+        "changeme",
+        "dummy",
+        "fake",
+        "mock",
+        "sample",
+        "test",
+        "xxxx",
+        "..."
+    ].some((needle) => normalized.includes(needle));
+}
+export function redactSecrets(input) {
+    let output = input;
+    for (const { pattern } of SECRET_PATTERNS) {
+        output = output.replace(pattern, REDACTED);
+    }
+    output = output.replace(ASSIGNMENT_PATTERN, redactAssignment);
+    return output;
+}
+export function containsRedactedSecret(input) {
+    return redactSecrets(input) !== input;
+}

package/dist/utils/decisions.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import fs from "fs-extra";
-import matter from "gray-matter";
+import { parseFrontmatter, stringifyFrontmatter } from "./frontmatter.js";
 const DIR = "intelligence/decisions";
 const LEGACY_STORE = "intelligence/decisions.json";
 function slugify(title) {
@@ -17,7 +17,7 @@ function section(body, heading) {
     return text && text.length > 0 ? text : undefined;
 }
 function parseFile(raw) {
-    const { data, content } = matter(raw);
+    const { data, content } = parseFrontmatter(raw);
     const decision = section(content, "Decision");
     if (!data.id || !data.title || !decision)
         return null;
@@ -34,7 +34,7 @@ function parseFile(raw) {
     };
 }
 function serialize(d) {
-    const fm = matter.stringify([
+    return stringifyFrontmatter([
         "## Context",
         d.context ?? "",
         "",
@@ -51,7 +51,6 @@ function serialize(d) {
         createdAt: d.timestamp,
         supersedes: d.supersedes ?? null
     });
-    return fm;
 }
 async function loadLegacy(target) {
     const file = path.join(target, LEGACY_STORE);

package/dist/utils/frontmatter.js

@@ -0,0 +1,62 @@
+function parseValue(raw) {
+    const value = raw.trim();
+    if (value === "null")
+        return null;
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    if (/^-?\d+(?:\.\d+)?$/.test(value))
+        return Number(value);
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
+function stringifyValue(value) {
+    if (value === null || value === undefined)
+        return "null";
+    if (typeof value === "boolean" || typeof value === "number")
+        return String(value);
+    const text = String(value);
+    if (text === "" || /[:#\n\r]|^\s|\s$/.test(text))
+        return JSON.stringify(text);
+    return text;
+}
+export function parseFrontmatter(raw) {
+    if (!raw.startsWith("---\n") && !raw.startsWith("---\r\n")) {
+        return { data: {}, content: raw };
+    }
+    const lineEnding = raw.startsWith("---\r\n") ? "\r\n" : "\n";
+    const startLength = 3 + lineEnding.length;
+    const endMarker = `${lineEnding}---${lineEnding}`;
+    const end = raw.indexOf(endMarker, startLength);
+    if (end === -1)
+        return { data: {}, content: raw };
+    const block = raw.slice(startLength, end);
+    const content = raw.slice(end + endMarker.length);
+    const data = {};
+    for (const line of block.split(/\r?\n/)) {
+        if (!line.trim())
+            continue;
+        const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+        if (!match)
+            continue;
+        data[match[1]] = parseValue(match[2]);
+    }
+    return { data, content };
+}
+export function stringifyFrontmatter(content, data) {
+    const lines = ["---"];
+    for (const [key, value] of Object.entries(data)) {
+        lines.push(`${key}: ${stringifyValue(value)}`);
+    }
+    lines.push("---", content);
+    return lines.join("\n");
+}

package/dist/utils/refinements.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import fs from "fs-extra";
-import matter from "gray-matter";
+import { parseFrontmatter, stringifyFrontmatter } from "./frontmatter.js";
 const DIR = "intelligence/refinements";
 const LEGACY_STORE = "intelligence/refinements.json";
 function slugify(text) {
@@ -11,7 +11,7 @@ function slugify(text) {
         .slice(0, 60);
 }
 function parseFile(raw) {
-    const { data, content } = matter(raw);
+    const { data, content } = parseFrontmatter(raw);
     const note = content.trim();
     if (!data.id || !note)
         return null;
@@ -40,7 +40,7 @@ function serialize(r) {
         fm.selector = r.scope.selector;
     if (r.scope?.file)
         fm.file = r.scope.file;
-    return matter.stringify(r.note, fm);
+    return stringifyFrontmatter(r.note, fm);
 }
 async function loadLegacy(target) {
     const file = path.join(target, LEGACY_STORE);

package/dist/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = "1.5.3";
+export const PACKAGE_VERSION = "1.5.4";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whale-igniter",
-  "version": "1.5.3",
+  "version": "1.5.4",
   "description": "CLI-first operational intelligence. Bootstraps and adopts AI-readable project context so agents like Claude Code, Codex and Cursor understand your design system from the first commit. Includes an MCP server, a file watcher, deterministic insights, and an opt-in AI bridge (Selene).",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,8 +23,9 @@
     "build": "tsc",
     "postbuild": "node -e \"require('node:fs').chmodSync('dist/index.js', 0o755)\"",
     "start": "node dist/index.js",
+    "security:scan": "tsx scripts/security-scan.ts",
     "test": "tsx tests/run.ts && tsx tests/mcp-smoke.ts && tsx tests/extractors.ts && tsx tests/driftAnalyzers.ts",
-    "prepublishOnly": "npm run build && npm test"
+    "prepublishOnly": "npm run build && npm run security:scan && npm test"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -66,7 +67,6 @@
     "commander": "^12.1.0",
     "fs-extra": "^11.2.0",
     "glob": "^13.0.6",
-    "gray-matter": "^4.0.3",
     "ora": "^8.1.0",
     "postcss": "^8.4.47",
     "prompts": "^2.4.2",