bearcli 1.0.0__tar.gz → 1.1.0__tar.gz

{bearcli-1.0.0 → bearcli-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bearcli
-Version: 1.0.0
+Version: 1.1.0
 Summary: The missing CLI for Bear notes — read, search, export, and manage your notes from the terminal
 Keywords: bear,notes,cli,markdown,macos
 Author: Michel Tricot
@@ -12,6 +12,7 @@ Classifier: Environment :: Console
 Classifier: Operating System :: MacOS
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Utilities
+Requires-Dist: detect-secrets>=1.5.0
 Requires-Dist: rapidfuzz>=3.14.5
 Requires-Dist: typer>=0.27.0
 Requires-Python: >=3.13
@@ -40,11 +41,6 @@ manage your notes from the terminal.
 
 ---
 
-Bear stores your notes in a local SQLite database. bearcli reads it directly in
-**read-only mode** — Bear doesn't even need to be running — and performs every
-write through Bear's own x-callback-url API, verifying each change against the
-database. Your notes are never touched behind Bear's back.
-
 ## Install
 
 ```sh
@@ -122,9 +118,19 @@ Every note becomes a self-contained directory — `<slug>/README.md` plus its
 attachments — with a generated index, so GitHub renders the whole export as a
 browsable tree.
 
+Before anything is written, the notes are scanned for potential secrets
+(token formats, key blocks, credential assignments); findings block the export
+with a list of the affected notes (`--allow-secrets` overrides).
+
 ```sh
 bearcli export ~/bear-backup
 bearcli export ~/bear-backup --sync          # only rewrite notes that changed
+
+# Mirror to a git repository (clone it first; use a *private* repo — these are
+# your notes). Bear is the source of truth: remote or manual edits are kept in
+# git history but overwritten in HEAD. Never force-pushes, never gets stuck.
+git clone git@github.com:you/bear-notes.git ~/bear-notes
+bearcli export ~/bear-notes --sync --push
 ```
 
 ## Scripting

{bearcli-1.0.0 → bearcli-1.1.0}/README.md

@@ -18,11 +18,6 @@ manage your notes from the terminal.
 
 ---
 
-Bear stores your notes in a local SQLite database. bearcli reads it directly in
-**read-only mode** — Bear doesn't even need to be running — and performs every
-write through Bear's own x-callback-url API, verifying each change against the
-database. Your notes are never touched behind Bear's back.
-
 ## Install
 
 ```sh
@@ -100,9 +95,19 @@ Every note becomes a self-contained directory — `<slug>/README.md` plus its
 attachments — with a generated index, so GitHub renders the whole export as a
 browsable tree.
 
+Before anything is written, the notes are scanned for potential secrets
+(token formats, key blocks, credential assignments); findings block the export
+with a list of the affected notes (`--allow-secrets` overrides).
+
 ```sh
 bearcli export ~/bear-backup
 bearcli export ~/bear-backup --sync          # only rewrite notes that changed
+
+# Mirror to a git repository (clone it first; use a *private* repo — these are
+# your notes). Bear is the source of truth: remote or manual edits are kept in
+# git history but overwritten in HEAD. Never force-pushes, never gets stuck.
+git clone git@github.com:you/bear-notes.git ~/bear-notes
+bearcli export ~/bear-notes --sync --push
 ```
 
 ## Scripting

{bearcli-1.0.0 → bearcli-1.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bearcli"
-version = "1.0.0"
+version = "1.1.0"
 description = "The missing CLI for Bear notes — read, search, export, and manage your notes from the terminal"
 readme = "README.md"
 keywords = ["bear", "notes", "cli", "markdown", "macos"]
@@ -18,6 +18,7 @@ license = "MIT"
 license-files = ["LICENSE"]
 requires-python = ">=3.13"
 dependencies = [
+    "detect-secrets>=1.5.0",
     "rapidfuzz>=3.14.5",
     "typer>=0.27.0",
 ]

{bearcli-1.0.0 → bearcli-1.1.0}/src/bearcli/cli.py

@@ -22,7 +22,9 @@ from rich.table import Table
 from bearcli import actions
 from bearcli.db import DEFAULT_DB_PATH, BearDB, Note
 from bearcli.export import export_notes
+from bearcli.gitsync import GitError, export_and_push
 from bearcli.search import naive_search, search_notes
+from bearcli.secrets import SecretFinding, redaction_map, scan_notes
 
 app = typer.Typer(help="Read notes from the Bear note app.", no_args_is_help=True, add_completion=False)
 note_app = typer.Typer(help="Create, read, and modify notes.", no_args_is_help=True)
@@ -288,6 +290,23 @@ def get(
     print(text)
 
 
+def _report_secrets(findings: list[SecretFinding]) -> None:
+    table = Table(box=box.ROUNDED, header_style="bold")
+    table.add_column("Note", overflow="ellipsis", max_width=30)
+    table.add_column("ID", style="dim", no_wrap=True)
+    table.add_column("Rule", style="yellow")
+    table.add_column("Line", justify="right")
+    table.add_column("Match", style="red")
+    for f in findings:
+        table.add_row(f.note_title, f.note_id, f.rule, str(f.line), f.excerpt)
+    console.print(table)
+    notes = len({f.note_id for f in findings})
+    console.print(
+        f"[red]Export blocked:[/red] {len(findings)} potential secret(s) in {notes} note(s). "
+        "Move them somewhere safe (or into an encrypted note), or re-run with --allow-secrets."
+    )
+
+
 @app.command()
 def export(
     dest: Annotated[Path, typer.Argument(help="Destination directory for the markdown files.")],
@@ -298,17 +317,60 @@ def export(
             help="Only rewrite notes that changed since the last export instead of everything.",
         ),
     ] = False,
+    push: Annotated[
+        bool,
+        typer.Option(
+            "--push",
+            help="Treat DEST as a git clone: commit the export and push. Bear is the source of "
+            "truth — remote or manual edits are kept in history but overwritten in HEAD.",
+        ),
+    ] = False,
+    allow_secrets: Annotated[
+        bool,
+        typer.Option("--allow-secrets", help="Export even if the secret scan finds potential credentials."),
+    ] = False,
+    redact_secrets: Annotated[
+        bool,
+        typer.Option(
+            "--redact-secrets",
+            help="Export with detected secrets replaced by a [redacted: <rule>] placeholder "
+            "(notes in Bear are untouched).",
+        ),
+    ] = False,
     db_path: DbPathOption = DEFAULT_DB_PATH,
 ) -> None:
     """Export all notes as markdown files with frontmatter and attachments."""
+    if allow_secrets and redact_secrets:
+        console.print("[red]Error:[/red] --allow-secrets and --redact-secrets are mutually exclusive")
+        raise typer.Exit(2)
     db = _open_db(db_path)
     try:
+        redactions: dict[str, dict[str, str]] | None = None
+        if not allow_secrets:
+            with console.status("Scanning notes for secrets…", spinner="dots"):
+                candidates = db.list_notes(limit=None, include_archived=True, with_text=True)
+                findings = scan_notes(candidates)
+            if findings and not redact_secrets:
+                _report_secrets(findings)
+                raise typer.Exit(1)
+            if findings:
+                redactions = redaction_map(findings)
         with console.status("Exporting…", spinner="dots") as status:
-            result = export_notes(db, dest, sync=sync, progress=lambda msg: status.update(rich_escape(msg)))
+            update = lambda msg: status.update(rich_escape(msg))  # noqa: E731
+            if push:
+                try:
+                    result, outcome = export_and_push(db, dest, sync=sync, progress=update, redactions=redactions)
+                except GitError as exc:
+                    console.print(f"[red]Error:[/red] {exc}")
+                    raise typer.Exit(1) from None
+            else:
+                result = export_notes(db, dest, sync=sync, progress=update, redactions=redactions)
     finally:
         db.close()
 
     parts = [f"{result.written} written"]
+    if push:
+        parts.append(outcome)
     if sync:
         parts.append(f"{result.unchanged} unchanged")
     if result.removed:
@@ -317,6 +379,9 @@ def export(
         parts.append(f"{result.skipped_encrypted} encrypted skipped")
     if result.index_updated:
         parts.append("index updated")
+    if redactions:
+        secrets_count = sum(len(v) for v in redactions.values())
+        parts.append(f"{secrets_count} secret(s) redacted in {len(redactions)} note(s)")
     console.print(f"Exported to {dest}: " + ", ".join(parts))
     if result.index_skipped:
         console.print("[yellow]Warning:[/yellow] README.md exists but was not generated by bearcli; left untouched")

{bearcli-1.0.0 → bearcli-1.1.0}/src/bearcli/export.py

@@ -44,7 +44,7 @@ def _dirnames(notes: list[Note]) -> dict[str, str]:
     return {n.id: short[n.id] if counts[short[n.id]] == 1 else f"{slugify(n.title)}-{n.id.lower()}" for n in notes}
 
 
-def _frontmatter(note: Note) -> str:
+def _frontmatter(note: Note, redacted: bool = False) -> str:
     lines = [
         "---",
         f"id: {note.id}",
@@ -55,10 +55,19 @@ def _frontmatter(note: Note) -> str:
         lines.append(f"created: {note.created.isoformat()}")
     if note.modified:
         lines.append(f"modified: {note.modified.isoformat()}")
+    if redacted:
+        lines.append("redacted: true")
     lines.append("---")
     return "\n".join(lines)
 
 
+def _apply_redactions(text: str, secrets: dict[str, str]) -> str:
+    # Longest first, in case one detected value contains another.
+    for value in sorted(secrets, key=len, reverse=True):
+        text = text.replace(value, f"[redacted: {secrets[value]}]")
+    return text
+
+
 def _parse_frontmatter(path: Path) -> dict[str, str]:
     fields: dict[str, str] = {}
     try:
@@ -149,6 +158,7 @@ def export_notes(
     dest: Path,
     sync: bool = False,
     progress: Callable[[str], None] | None = None,
+    redactions: dict[str, dict[str, str]] | None = None,
 ) -> ExportResult:
     """Write every non-trashed note as dest/<slug>/README.md plus attachments/.
 
@@ -197,10 +207,15 @@ def export_notes(
         note_dir = dest / slug
         note_path = note_dir / NOTE_FILENAME
 
+        note_secrets = (redactions or {}).get(summary.id, {})
         modified_iso = summary.modified.isoformat() if summary.modified else ""
         if sync and note_path.exists():
             existing = _parse_frontmatter(note_path)
-            if existing.get("id") == summary.id and existing.get("modified") == modified_iso:
+            # A change in redaction state must rewrite the file even though the
+            # note itself is unchanged — otherwise a previously exported secret
+            # would survive a later --redact-secrets run (and vice versa).
+            same_redaction = (existing.get("redacted") == "true") == bool(note_secrets)
+            if existing.get("id") == summary.id and existing.get("modified") == modified_iso and same_redaction:
                 result.unchanged += 1
                 add_entry(summary, f"{slug}/", (note_dir / ATTACHMENTS_DIRNAME).exists())
                 continue
@@ -211,8 +226,11 @@ def export_notes(
             add_entry(summary, None, False)
             continue
 
+        text = _rewrite_refs(note)
+        if note_secrets:
+            text = _apply_redactions(text, note_secrets)
         note_dir.mkdir(exist_ok=True)
-        note_path.write_text(f"{_frontmatter(note)}\n{_rewrite_refs(note)}\n")
+        note_path.write_text(f"{_frontmatter(note, redacted=bool(note_secrets))}\n{text}\n")
 
         attach_dir = note_dir / ATTACHMENTS_DIRNAME
         if attach_dir.exists():

bearcli-1.1.0/src/bearcli/gitsync.py

@@ -0,0 +1,106 @@
+"""Export into a git worktree and push, converging without manual intervention.
+
+The repository is a one-way mirror owned by bearcli: Bear is the source of
+truth, and HEAD always converges to Bear's state. Nothing is ever lost —
+local or remote edits are committed/merged before being overwritten, so they
+remain in history — and nothing is ever force-pushed. Every failure mode
+either self-heals (merge preferring local, reset to origin as last resort,
+bounded push retries) or raises a clear error; there is no state that
+requires manual git surgery to resume.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from collections.abc import Callable
+from pathlib import Path
+
+from bearcli.db import BearDB
+from bearcli.export import ExportResult, export_notes
+
+
+class GitError(RuntimeError):
+    pass
+
+
+def _git(dest: Path, *args: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(["git", "-C", str(dest), *args], capture_output=True, text=True, check=False)
+
+
+def _run(dest: Path, *args: str) -> str:
+    proc = _git(dest, *args)
+    if proc.returncode != 0:
+        raise GitError(f"git {' '.join(args)} failed: {proc.stderr.strip()}")
+    return proc.stdout.strip()
+
+
+def _ok(dest: Path, *args: str) -> bool:
+    return _git(dest, *args).returncode == 0
+
+
+def _commit_if_dirty(dest: Path, message: str) -> None:
+    _run(dest, "add", "-A")
+    if not _ok(dest, "diff", "--cached", "--quiet"):
+        _run(dest, "commit", "-m", message)
+
+
+def export_and_push(
+    db: BearDB,
+    dest: Path,
+    sync: bool = True,
+    progress: Callable[[str], None] | None = None,
+    redactions: dict[str, dict[str, str]] | None = None,
+    attempts: int = 3,
+) -> tuple[ExportResult, str]:
+    def report(message: str) -> None:
+        if progress is not None:
+            progress(message)
+
+    if not _ok(dest, "rev-parse", "--is-inside-work-tree"):
+        raise GitError(f"{dest} is not a git repository — clone your notes repo (or `git init`) first")
+    branch = _run(dest, "symbolic-ref", "--short", "HEAD")
+    has_remote = _ok(dest, "remote", "get-url", "origin")
+
+    last_error = "unknown"
+    result = ExportResult()
+    for _ in range(attempts):
+        # Anything lying around (manual edits, a previous crashed run) gets
+        # committed first: merges start from a clean tree and nothing is lost.
+        _commit_if_dirty(dest, "bear export: local changes")
+
+        full = not sync
+        if has_remote:
+            report("Fetching origin…")
+            _run(dest, "fetch", "origin")
+            if (
+                _ok(dest, "rev-parse", "--verify", f"origin/{branch}")
+                and _run(dest, "rev-list", "--count", f"HEAD..origin/{branch}") != "0"
+            ):
+                report("Integrating remote changes…")
+                if not (
+                    _ok(dest, "merge", "--ff-only", f"origin/{branch}")
+                    or _ok(dest, "merge", "-X", "ours", "--no-edit", f"origin/{branch}")
+                ):
+                    _git(dest, "merge", "--abort")
+                    _run(dest, "reset", "--hard", f"origin/{branch}")
+                # Whatever was pulled, Bear's state must win in the worktree:
+                # a full export re-asserts every note, not just changed ones.
+                full = True
+
+        result = export_notes(db, dest, sync=not full, progress=progress, redactions=redactions)
+
+        report("Committing…")
+        parts = [f"{result.written} written"]
+        if result.removed:
+            parts.append(f"{result.removed} removed")
+        _commit_if_dirty(dest, "bear export: " + ", ".join(parts))
+
+        if not has_remote:
+            return result, "committed (no remote configured)"
+        report("Pushing…")
+        push = _git(dest, "push", "-u", "origin", branch)
+        if push.returncode == 0:
+            return result, "pushed"
+        last_error = push.stderr.strip()  # racing push; refetch and retry
+
+    raise GitError(f"push failed after {attempts} attempts: {last_error}")

bearcli-1.1.0/src/bearcli/secrets.py

@@ -0,0 +1,105 @@
+"""Secret detection over note text, powered by detect-secrets (Yelp).
+
+A first line of defense before notes leave the machine via export. Everything
+runs offline — note content is never sent anywhere. Format detectors cover
+known token shapes (AWS, GitHub, Slack, Stripe, OpenAI, private keys, JWTs,
+keyword assignments, …) and the entropy detectors catch random-looking
+strings with no known format. Secrets written as prose are undetectable; for
+deeper auditing run gitleaks over an --allow-secrets export.
+
+Implementation note: detect-secrets' `scan_line` helper is unsuitable — it
+enables eager search, which makes entropy plugins report every token — so
+plugins are instantiated and run directly, with the heuristic false-positive
+filters applied by hand.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from detect_secrets.core.plugins.util import get_mapping_from_secret_type_to_class
+from detect_secrets.filters import heuristic
+from detect_secrets.plugins.base import BasePlugin
+
+from bearcli.db import Note
+
+# An IP address in a note is not a credential.
+_EXCLUDED_PLUGINS = {"IPPublicDetector"}
+_BASE64_ENTROPY_LIMIT = 4.5  # detect-secrets' default
+_HEX_ENTROPY_LIMIT = 3.5  # above default (3.0): notes are full of UUID/hash fragments
+
+
+def _build_plugins() -> list[BasePlugin]:
+    plugins: list[BasePlugin] = []
+    for cls in get_mapping_from_secret_type_to_class().values():
+        name = cls.__name__
+        if name in _EXCLUDED_PLUGINS:
+            continue
+        if name == "Base64HighEntropyString":
+            plugins.append(cls(_BASE64_ENTROPY_LIMIT))
+        elif name == "HexHighEntropyString":
+            plugins.append(cls(_HEX_ENTROPY_LIMIT))
+        else:
+            plugins.append(cls())
+    return plugins
+
+
+def _is_false_positive(value: str, line: str) -> bool:
+    return (
+        heuristic.is_potential_uuid(value)
+        or heuristic.is_sequential_string(value)
+        or heuristic.is_templated_secret(value)
+        or heuristic.is_likely_id_string(value, line)
+        or heuristic.is_not_alphanumeric_string(value)
+    )
+
+
+@dataclass
+class SecretFinding:
+    note_id: str
+    note_title: str
+    rule: str
+    line: int
+    excerpt: str
+    secret: str  # raw value, for redaction only — never print this
+
+
+def _redact(value: str) -> str:
+    """Show enough to locate the secret in the note, never the secret itself."""
+    return f"{value[:8]}…" if len(value) > 12 else "…"
+
+
+def scan_notes(notes: list[Note]) -> list[SecretFinding]:
+    plugins = _build_plugins()
+    findings = []
+    for note in notes:
+        seen: set[tuple[int, str]] = set()
+        for lineno, line in enumerate((note.text or "").splitlines(), start=1):
+            for plugin in plugins:
+                # The yaml filetype hint makes KeywordDetector accept unquoted
+                # `password: value` assignments, which is how notes write them.
+                for secret in plugin.analyze_line(filename="note.yaml", line=line, line_number=lineno):
+                    value = secret.secret_value or ""
+                    if _is_false_positive(value, line) or (lineno, value) in seen:
+                        continue
+                    seen.add((lineno, value))
+                    findings.append(
+                        SecretFinding(
+                            note_id=note.id,
+                            note_title=note.title,
+                            rule=secret.type,
+                            line=lineno,
+                            excerpt=_redact(value),
+                            secret=value,
+                        )
+                    )
+    return findings
+
+
+def redaction_map(findings: list[SecretFinding]) -> dict[str, dict[str, str]]:
+    """Per note id, the secret values to replace and the rule that found them."""
+    by_note: dict[str, dict[str, str]] = {}
+    for finding in findings:
+        if finding.secret:
+            by_note.setdefault(finding.note_id, {}).setdefault(finding.secret, finding.rule)
+    return by_note