whatileaked 0.5.0 → 0.5.2

package/README.md

@@ -58,7 +58,7 @@ is all — no network connection is made at any point.
 ### When it finds nothing
 
 ```
-  scanned 561 transcripts · 197,016 messages
+  scanned 561 transcripts · 197,016 messages · 3 memory files
 
 No credentials found.
 ```
@@ -68,7 +68,7 @@ Nothing to do. This is the good outcome.
 ### When it finds something
 
 ```
-  scanned 561 transcripts · 196,986 messages
+  scanned 561 transcripts · 196,986 messages · 3 memory files
 
 * aws-access-token  2 secrets
     f0b93847  billing-api            sent 25 times
@@ -206,7 +206,7 @@ npx whatileaked scan || echo "found something"
 | Agent | Folder |
 | --- | --- |
 | Claude Code | `~/.claude/projects/` · `~/.claude/history.jsonl` · `~/.claude/paste-cache/` · `~/.claude/CLAUDE.md` |
-| Codex | `~/.codex/sessions/` · `~/.codex/archived_sessions/` · `~/.codex/history.jsonl` · `~/.codex/AGENTS.md` |
+| Codex | `~/.codex/sessions/` · `~/.codex/archived_sessions/` · `~/.codex/history.jsonl` · `~/.codex/AGENTS.md` · `~/.codex/AGENTS.override.md` |
 | Cursor | `~/.cursor/projects/*/agent-transcripts/` |
 | opencode | `~/.local/share/opencode/opencode.db` |
 
@@ -220,6 +220,8 @@ opencode, and rotate.
 Cursor keeps its older Ask-mode chats in SQLite as well, and those are not
 scanned yet. Agent transcripts are covered; Ask history is not.
 
+Claude Code transcripts it set aside (`*.jsonl.superseded-*`) are scanned too.
+
 Transcripts record credentials that were already sent. So does prompt history,
 which keeps every prompt you typed and every long paste after the session itself
 has been cleaned up. Instruction and memory files are worse: they are read again

package/dist/cli.js

@@ -161,8 +161,7 @@ var TerminalReporter = class {
     if (totals.length === 0) {
       this.#write(green("No credentials found."));
       this.#write("");
-      this.#unread(stats);
-      if (stats.unread.length > 0) this.#write("");
+      if (this.#notScanned(stats)) this.#write("");
       this.#write(dim(DISCLOSURE));
       this.#share(sent, stats);
       return;
@@ -188,12 +187,7 @@ var TerminalReporter = class {
         red("Remove them there as well as rotating, or the next session sends them again.")
       );
     }
-    if (stats.unscannable > 0) {
-      this.#write(
-        yellow(`${plural(stats.unscannable, "message")} could not be scanned and are not counted.`)
-      );
-    }
-    this.#unread(stats);
+    this.#notScanned(stats);
     this.#write("");
     this.#write(dim("The 8-character code is a fingerprint, never the secret: a truncated"));
     this.#write(dim("SHA-256, so one credential shows the same code everywhere it leaked."));
@@ -202,12 +196,23 @@ var TerminalReporter = class {
     this.#write(dim(DISCLOSURE));
     this.#share(sent, stats);
   }
-  /** One plain line per file found and not read. Printed under a clean result
-   *  too, which is exactly where leaving it out would mislead. */
-  #unread(stats) {
+  /**
+   * Everything that was found and not looked at: refused messages, then one
+   * plain line per file not read. Printed under a clean result too, which is
+   * exactly where leaving it out would mislead — a clean scan once returned
+   * before the refused count, so a partial scan read as a clean one. Answers
+   * whether it wrote anything.
+   */
+  #notScanned(stats) {
+    if (stats.unscannable > 0) {
+      this.#write(
+        yellow(`${plural(stats.unscannable, "message")} could not be scanned and are not counted.`)
+      );
+    }
     for (const file of stats.unread) {
       this.#write(yellow(`Found ${shorten(file.path)} but did not scan it: ${file.reason}.`));
     }
+    return stats.unscannable > 0 || stats.unread.length > 0;
   }
   /**
    * The one line meant to be pasted somewhere public. Everything above it names
@@ -2426,7 +2431,16 @@ var FileExtension = {
   database: ".db"
 };
 function isJsonl(path) {
-  return path.endsWith(FileExtension.jsonl);
+  return path.endsWith(FileExtension.jsonl) || supersededJsonl.test(path);
+}
+var supersededJsonl = /\.jsonl\.superseded-[^/\\]+$/;
+async function listJsonl(dir) {
+  try {
+    const entries = await readdir(dir, { withFileTypes: true });
+    return entries.filter((entry) => entry.isFile() && isJsonl(entry.name)).map((entry) => entry.name);
+  } catch {
+    return [];
+  }
 }
 async function listFiles(dir, extension) {
   try {
@@ -2633,7 +2647,7 @@ var ClaudeCodeSource = class {
       const dir = join2(root, slug);
       let project = slug;
       for (const nested of await walkDirectories(dir)) {
-        for (const file of await listFiles(nested, FileExtension.jsonl)) {
+        for (const file of await listJsonl(nested)) {
           const path = join2(nested, file);
           const cwd = await firstCwd(path);
           if (cwd !== null) project = basename(cwd);
@@ -2677,9 +2691,11 @@ var CodexSource = class {
     this.#home = home2;
   }
   async *discover() {
-    const instructions = await resolveFile(join3(this.#home, ".codex", "AGENTS.md"));
-    if (instructions !== null) {
-      yield { source: this.name, kind: FileKind.memory, path: instructions, project: this.name };
+    for (const name of ["AGENTS.override.md", "AGENTS.md"]) {
+      const instructions = await resolveFile(join3(this.#home, ".codex", name));
+      if (instructions !== null) {
+        yield { source: this.name, kind: FileKind.memory, path: instructions, project: this.name };
+      }
     }
     const history = await resolveFile(join3(this.#home, ".codex", "history.jsonl"));
     if (history !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whatileaked",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Scan your local Claude Code, Codex, Cursor and opencode transcripts for credentials you already sent to a model provider.",
   "type": "module",
   "imports": {