whatileaked 0.3.0 → 0.4.0

package/README.md

@@ -1,5 +1,7 @@
 # whatileaked
 
+[![ci](https://github.com/selan-ai/whatileaked/actions/workflows/ci.yml/badge.svg)](https://github.com/selan-ai/whatileaked/actions/workflows/ci.yml)
+
 Your coding agent saves every conversation to your disk. If you ever pasted an
 API key into a chat, or asked the agent to read a `.env` file, that key is now
 sitting in a log file on your laptop — and it was uploaded to Anthropic or
@@ -103,6 +105,17 @@ same credential always produces the same code, so two rows sharing a code are
 one key you reused in two places, and two different codes are two different
 keys.
 
+### Sharing it
+
+The last line of every scan is made only of counts — no project, path, rule or
+fingerprint — so it is the part you can paste or screenshot anywhere:
+
+```
+whatileaked: 3 credentials sent to a model provider, across 561 transcripts.
+```
+
+A clean scan ends the same way, with `no credentials`.
+
 ---
 
 ## Is it a real key, or just a test fixture?
@@ -193,7 +206,7 @@ npx whatileaked scan || echo "found something"
 | Agent | Folder |
 | --- | --- |
 | Claude Code | `~/.claude/projects/` · `~/.claude/CLAUDE.md` |
-| Codex | `~/.codex/sessions/` · `~/.codex/AGENTS.md` |
+| Codex | `~/.codex/sessions/` · `~/.codex/archived_sessions/` · `~/.codex/AGENTS.md` |
 | Cursor | `~/.cursor/projects/*/agent-transcripts/` |
 
 Cursor keeps its older Ask-mode chats in SQLite rather than jsonl, and those are

package/dist/cli.js

@@ -162,6 +162,7 @@ var TerminalReporter = class {
       this.#write(green("No credentials found."));
       this.#write("");
       this.#write(dim(DISCLOSURE));
+      this.#share(sent, stats);
       return;
     }
     for (const total of totals) {
@@ -196,6 +197,22 @@ var TerminalReporter = class {
     this.#write(dim("Some findings will be test fixtures \u2014 open the file to tell."));
     this.#write("");
     this.#write(dim(DISCLOSURE));
+    this.#share(sent, stats);
+  }
+  /**
+   * The one line meant to be pasted somewhere public. Everything above it names
+   * projects, paths and fingerprints, so nobody shares it; this is counts only,
+   * and stays that way. It is last so a screenshot can crop to it, unstyled so
+   * a copy carries nothing but the words, and it repeats the headline's
+   * transmitted-only count for the same reason the headline keeps memory files
+   * out of it.
+   */
+  #share(sent, stats) {
+    const credentials = sent === 0 ? "no credentials" : plural(sent, "credential");
+    this.#write("");
+    this.#write(
+      `whatileaked: ${credentials} sent to a model provider, across ${plural(stats.transcripts, "transcript")}.`
+    );
   }
 };
 function count(value) {
@@ -2606,17 +2623,18 @@ var CodexSource = class {
     if (instructions !== null) {
       yield { source: this.name, kind: FileKind.memory, path: instructions, project: this.name };
     }
-    const root = join3(this.#home, ".codex", "sessions");
-    for (const dir of await walkDirectories(root)) {
-      for (const file of await listFiles(dir, FileExtension.jsonl)) {
-        const path = join3(dir, file);
-        const cwd = await firstCwd2(path);
-        yield {
-          source: this.name,
-          kind: FileKind.transcript,
-          path,
-          project: cwd === null ? basename2(dir) : basename2(cwd)
-        };
+    for (const root of ["sessions", "archived_sessions"]) {
+      for (const dir of await walkDirectories(join3(this.#home, ".codex", root))) {
+        for (const file of await listFiles(dir, FileExtension.jsonl)) {
+          const path = join3(dir, file);
+          const cwd = await firstCwd2(path);
+          yield {
+            source: this.name,
+            kind: FileKind.transcript,
+            path,
+            project: cwd === null ? basename2(dir) : basename2(cwd)
+          };
+        }
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whatileaked",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Scan your local Claude Code, Codex and Cursor transcripts for credentials you already sent to a model provider.",
   "type": "module",
   "imports": {