whatileaked 0.5.2 → 0.6.0

package/README.md

@@ -4,8 +4,8 @@
 
 Your coding agent saves every conversation to your disk. If you ever pasted an
 API key into a chat, or asked the agent to read a `.env` file, that key is now
-sitting in a log file on your laptop — and it was uploaded to Anthropic or
-OpenAI the moment you sent the message.
+sitting in a log file on your laptop — and it was uploaded to Anthropic,
+OpenAI or Google the moment you sent the message.
 
 Secret scanners point at repositories and CI. You can aim one at `~/.claude` by
 hand, but nobody does — it is not a repo, it is not in CI, and it does not look
@@ -114,7 +114,9 @@ fingerprint — so it is the part you can paste or screenshot anywhere:
 whatileaked: 3 credentials sent to a model provider, across 561 transcripts.
 ```
 
-A clean scan ends the same way, with `no credentials`.
+A clean scan ends the same way, with `no credentials`. If some of it could not
+be scanned, the line says how much, still in counts only — `(7 messages and 1
+file not scanned)` — so a pasted partial scan never reads as a clean one.
 
 ---
 
@@ -209,6 +211,7 @@ npx whatileaked scan || echo "found something"
 | Codex | `~/.codex/sessions/` · `~/.codex/archived_sessions/` · `~/.codex/history.jsonl` · `~/.codex/AGENTS.md` · `~/.codex/AGENTS.override.md` |
 | Cursor | `~/.cursor/projects/*/agent-transcripts/` |
 | opencode | `~/.local/share/opencode/opencode.db` |
+| Gemini CLI | `~/.gemini/tmp/*/chats/` · `~/.gemini/tmp/*/memory/` · `~/.gemini/GEMINI.md` |
 
 opencode keeps its sessions in a SQLite database. Reading it needs Node's
 built-in `node:sqlite`, which loads without a flag from Node 22.13. On an older
@@ -222,6 +225,11 @@ scanned yet. Agent transcripts are covered; Ask history is not.
 
 Claude Code transcripts it set aside (`*.jsonl.superseded-*`) are scanned too.
 
+If you moved Claude Code's folder with `CLAUDE_CONFIG_DIR`, Codex's with
+`CODEX_HOME`, or Gemini CLI's with `GEMINI_CLI_HOME`, the folder it names is
+scanned as well as the default one, which still holds every session from before
+the move.
+
 Transcripts record credentials that were already sent. So does prompt history,
 which keeps every prompt you typed and every long paste after the session itself
 has been cleaned up. Instruction and memory files are worse: they are read again
@@ -229,8 +237,8 @@ at the start of the next session, so a credential in one keeps leaking until the
 file is edited. All of them are scanned, and `wipe` rewrites all of them.
 
 Nowhere else. It does not read your repos, your shell history, or your
-environment. Adding support for another agent is one small file — pull requests
-welcome.
+environment — beyond those three variables, to know where to look. Adding
+support for another agent is one small file — pull requests welcome.
 
 ---
 

package/dist/cli.js

@@ -2,6 +2,7 @@
 
 // src/main.ts
 import { homedir } from "os";
+import { join as join8 } from "path";
 
 // src/commands.ts
 var Command = {
@@ -220,13 +221,19 @@ var TerminalReporter = class {
    * and stays that way. It is last so a screenshot can crop to it, unstyled so
    * a copy carries nothing but the words, and it repeats the headline's
    * transmitted-only count for the same reason the headline keeps memory files
-   * out of it.
+   * out of it. A partial scan says so here in counts, because this is the line
+   * that gets cropped to: without it a pasted "no credentials" overclaims.
    */
   #share(sent, stats) {
     const credentials = sent === 0 ? "no credentials" : plural(sent, "credential");
+    const missed = [
+      ...stats.unscannable > 0 ? [plural(stats.unscannable, "message")] : [],
+      ...stats.unread.length > 0 ? [plural(stats.unread.length, "file")] : []
+    ];
+    const partial = missed.length === 0 ? "" : ` (${missed.join(" and ")} not scanned)`;
     this.#write("");
     this.#write(
-      `whatileaked: ${credentials} sent to a model provider, across ${plural(stats.transcripts, "transcript")}.`
+      `whatileaked: ${credentials} sent to a model provider, across ${plural(stats.transcripts, "transcript")}${partial}.`
     );
   }
 };
@@ -2426,6 +2433,7 @@ async function listDirectories(root) {
 }
 var FileExtension = {
   jsonl: ".jsonl",
+  json: ".json",
   markdown: ".md",
   text: ".txt",
   database: ".db"
@@ -2601,6 +2609,7 @@ var SourceName = {
   "claude-code": "claude-code",
   codex: "codex",
   cursor: "cursor",
+  "gemini-cli": "gemini-cli",
   opencode: "opencode"
 };
 
@@ -2620,20 +2629,22 @@ function objectField(source, key) {
 // src/sources/claude-code-source.ts
 var ClaudeCodeSource = class {
   name = SourceName["claude-code"];
-  #home;
-  constructor(home2) {
-    this.#home = home2;
+  #dir;
+  /** `dir` is where Claude Code keeps its state: `~/.claude`, or wherever
+   *  `CLAUDE_CONFIG_DIR` moved it. */
+  constructor(home2, dir = join2(home2, ".claude")) {
+    this.#dir = dir;
   }
   async *discover() {
-    const instructions = await resolveFile(join2(this.#home, ".claude", "CLAUDE.md"));
+    const instructions = await resolveFile(join2(this.#dir, "CLAUDE.md"));
     if (instructions !== null) {
       yield { source: this.name, kind: FileKind.memory, path: instructions, project: this.name };
     }
-    const history = await resolveFile(join2(this.#home, ".claude", "history.jsonl"));
+    const history = await resolveFile(join2(this.#dir, "history.jsonl"));
     if (history !== null) {
       yield { source: this.name, kind: FileKind.transcript, path: history, project: this.name };
     }
-    const pastes = join2(this.#home, ".claude", "paste-cache");
+    const pastes = join2(this.#dir, "paste-cache");
     for (const file of await listFiles(pastes, FileExtension.text)) {
       yield {
         source: this.name,
@@ -2642,7 +2653,7 @@ var ClaudeCodeSource = class {
         project: this.name
       };
     }
-    const root = join2(this.#home, ".claude", "projects");
+    const root = join2(this.#dir, "projects");
     for (const slug of await listDirectories(root)) {
       const dir = join2(root, slug);
       let project = slug;
@@ -2686,23 +2697,25 @@ async function firstCwd(path) {
 import { basename as basename2, join as join3 } from "path";
 var CodexSource = class {
   name = SourceName.codex;
-  #home;
-  constructor(home2) {
-    this.#home = home2;
+  #dir;
+  /** `dir` is where Codex keeps its state: `~/.codex`, or wherever
+   *  `CODEX_HOME` moved it. */
+  constructor(home2, dir = join3(home2, ".codex")) {
+    this.#dir = dir;
   }
   async *discover() {
     for (const name of ["AGENTS.override.md", "AGENTS.md"]) {
-      const instructions = await resolveFile(join3(this.#home, ".codex", name));
+      const instructions = await resolveFile(join3(this.#dir, name));
       if (instructions !== null) {
         yield { source: this.name, kind: FileKind.memory, path: instructions, project: this.name };
       }
     }
-    const history = await resolveFile(join3(this.#home, ".codex", "history.jsonl"));
+    const history = await resolveFile(join3(this.#dir, "history.jsonl"));
     if (history !== null) {
       yield { source: this.name, kind: FileKind.transcript, path: history, project: this.name };
     }
     for (const root of ["sessions", "archived_sessions"]) {
-      for (const dir of await walkDirectories(join3(this.#home, ".codex", root))) {
+      for (const dir of await walkDirectories(join3(this.#dir, root))) {
         for (const file of await listFiles(dir, FileExtension.jsonl)) {
           const path = join3(dir, file);
           const cwd = await firstCwd2(path);
@@ -2784,8 +2797,42 @@ async function isDirectory(path) {
   }
 }
 
+// src/sources/gemini-cli-source.ts
+import { join as join5 } from "path";
+var GeminiCliSource = class {
+  name = SourceName["gemini-cli"];
+  #dir;
+  /** `dir` is `~/.gemini`, or `$GEMINI_CLI_HOME/.gemini` when that is set. */
+  constructor(home2, dir = join5(home2, ".gemini")) {
+    this.#dir = dir;
+  }
+  async *discover() {
+    const instructions = await resolveFile(join5(this.#dir, "GEMINI.md"));
+    if (instructions !== null) {
+      yield { source: this.name, kind: FileKind.memory, path: instructions, project: this.name };
+    }
+    const root = join5(this.#dir, "tmp");
+    for (const id of await listDirectories(root)) {
+      const project = legacyHash.test(id) ? this.name : id;
+      for (const dir of await walkDirectories(join5(root, id, "chats"))) {
+        for (const extension of [FileExtension.jsonl, FileExtension.json]) {
+          for (const file of await listFiles(dir, extension)) {
+            yield { source: this.name, kind: FileKind.transcript, path: join5(dir, file), project };
+          }
+        }
+      }
+      for (const dir of await walkDirectories(join5(root, id, "memory"))) {
+        for (const file of await listFiles(dir, FileExtension.markdown)) {
+          yield { source: this.name, kind: FileKind.memory, path: join5(dir, file), project };
+        }
+      }
+    }
+  }
+};
+var legacyHash = /^[0-9a-f]{64}$/;
+
 // src/sources/opencode-source.ts
-import { basename as basename4, join as join5 } from "path";
+import { basename as basename4, join as join6 } from "path";
 var OpencodeSource = class {
   name = SourceName.opencode;
   #home;
@@ -2795,9 +2842,9 @@ var OpencodeSource = class {
     this.#load = load;
   }
   async *discover() {
-    const dir = join5(this.#home, ".local", "share", "opencode");
+    const dir = join6(this.#home, ".local", "share", "opencode");
     for (const file of await listFiles(dir, FileExtension.database)) {
-      const path = join5(dir, file);
+      const path = join6(dir, file);
       const sqlite = await this.#load();
       yield {
         source: this.name,
@@ -2851,6 +2898,17 @@ async function importSqlite() {
   }
 }
 
+// src/sources/state-dirs.ts
+import { join as join7, resolve } from "path";
+function stateDirs(home2, folder, moved) {
+  const dirs = [join7(home2, folder)];
+  if (moved !== void 0 && moved !== "") {
+    const dir = resolve(moved);
+    if (!dirs.includes(dir)) dirs.push(dir);
+  }
+  return dirs;
+}
+
 // src/wipe/confirm.ts
 import { createInterface as createInterface3 } from "readline/promises";
 var CONFIRMATION = "wipe";
@@ -3015,9 +3073,19 @@ async function main(argv) {
     return 0;
   }
   const sources = [
-    new ClaudeCodeSource(homedir()),
-    new CodexSource(homedir()),
+    ...stateDirs(homedir(), ".claude", process.env.CLAUDE_CONFIG_DIR).map(
+      (dir) => new ClaudeCodeSource(homedir(), dir)
+    ),
+    ...stateDirs(homedir(), ".codex", process.env.CODEX_HOME).map(
+      (dir) => new CodexSource(homedir(), dir)
+    ),
     new CursorSource(homedir()),
+    // GEMINI_CLI_HOME stands in for the home directory, not for `.gemini`.
+    ...stateDirs(
+      homedir(),
+      ".gemini",
+      process.env.GEMINI_CLI_HOME ? join8(process.env.GEMINI_CLI_HOME, ".gemini") : void 0
+    ).map((dir) => new GeminiCliSource(homedir(), dir)),
     new OpencodeSource(homedir())
   ];
   const scanner = new Scanner(new KeywordIndex(compileRules(SECRET_RULE_SOURCES)));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "whatileaked",
-  "version": "0.5.2",
-  "description": "Scan your local Claude Code, Codex, Cursor and opencode transcripts for credentials you already sent to a model provider.",
+  "version": "0.6.0",
+  "description": "Scan your local Claude Code, Codex, Cursor, opencode and Gemini CLI transcripts for credentials you already sent to a model provider.",
   "type": "module",
   "imports": {
     "#scripts/*": "./scripts/*.ts",