bearcli 1.0.1__tar.gz → 1.2.0__tar.gz

{bearcli-1.0.1 → bearcli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bearcli
-Version: 1.0.1
+Version: 1.2.0
 Summary: The missing CLI for Bear notes — read, search, export, and manage your notes from the terminal
 Keywords: bear,notes,cli,markdown,macos
 Author: Michel Tricot
@@ -12,6 +12,7 @@ Classifier: Environment :: Console
 Classifier: Operating System :: MacOS
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Utilities
+Requires-Dist: detect-secrets>=1.5.0
 Requires-Dist: rapidfuzz>=3.14.5
 Requires-Dist: typer>=0.27.0
 Requires-Python: >=3.13
@@ -73,9 +74,10 @@ bearcli note list --only pinned              # or: encrypted, trashed, archived
 bearcli note list --all --trashed --archived
 bearcli note list --ids                      # only identifiers, one per line
 
-bearcli get C44D09DC-7F0E-43BB-BEB8-67E3A389A448
+bearcli get C44D09DC       # a unique id prefix (4+ chars) works everywhere
 bearcli get C44D09DC-... --meta              # with YAML-style frontmatter
 bearcli get C44D09DC-... -r                  # rewrite attachment refs to absolute paths
+bearcli get C44D09DC-... --redact-secrets    # secrets replaced by placeholders
 bearcli open C44D09DC-...                    # open in the Bear app
 ```
 
@@ -117,9 +119,20 @@ Every note becomes a self-contained directory — `<slug>/README.md` plus its
 attachments — with a generated index, so GitHub renders the whole export as a
 browsable tree.
 
+Before anything is written, the notes are scanned for potential secrets
+(token formats, key blocks, credential assignments); findings block the export
+with a list of the affected notes (`--allow-secrets` overrides).
+
 ```sh
 bearcli export ~/bear-backup
 bearcli export ~/bear-backup --sync          # only rewrite notes that changed
+bearcli export ~/bear-backup --redact-secrets  # secrets become [redacted: <rule>]
+
+# Mirror to a git repository (clone it first; use a *private* repo — these are
+# your notes). Bear is the source of truth: remote or manual edits are kept in
+# git history but overwritten in HEAD. Never force-pushes, never gets stuck.
+git clone git@github.com:you/bear-notes.git ~/bear-notes
+bearcli export ~/bear-notes --sync --push
 ```
 
 ## Scripting

{bearcli-1.0.1 → bearcli-1.2.0}/README.md

@@ -51,9 +51,10 @@ bearcli note list --only pinned              # or: encrypted, trashed, archived
 bearcli note list --all --trashed --archived
 bearcli note list --ids                      # only identifiers, one per line
 
-bearcli get C44D09DC-7F0E-43BB-BEB8-67E3A389A448
+bearcli get C44D09DC       # a unique id prefix (4+ chars) works everywhere
 bearcli get C44D09DC-... --meta              # with YAML-style frontmatter
 bearcli get C44D09DC-... -r                  # rewrite attachment refs to absolute paths
+bearcli get C44D09DC-... --redact-secrets    # secrets replaced by placeholders
 bearcli open C44D09DC-...                    # open in the Bear app
 ```
 
@@ -95,9 +96,20 @@ Every note becomes a self-contained directory — `<slug>/README.md` plus its
 attachments — with a generated index, so GitHub renders the whole export as a
 browsable tree.
 
+Before anything is written, the notes are scanned for potential secrets
+(token formats, key blocks, credential assignments); findings block the export
+with a list of the affected notes (`--allow-secrets` overrides).
+
 ```sh
 bearcli export ~/bear-backup
 bearcli export ~/bear-backup --sync          # only rewrite notes that changed
+bearcli export ~/bear-backup --redact-secrets  # secrets become [redacted: <rule>]
+
+# Mirror to a git repository (clone it first; use a *private* repo — these are
+# your notes). Bear is the source of truth: remote or manual edits are kept in
+# git history but overwritten in HEAD. Never force-pushes, never gets stuck.
+git clone git@github.com:you/bear-notes.git ~/bear-notes
+bearcli export ~/bear-notes --sync --push
 ```
 
 ## Scripting

{bearcli-1.0.1 → bearcli-1.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bearcli"
-version = "1.0.1"
+version = "1.2.0"
 description = "The missing CLI for Bear notes — read, search, export, and manage your notes from the terminal"
 readme = "README.md"
 keywords = ["bear", "notes", "cli", "markdown", "macos"]
@@ -18,6 +18,7 @@ license = "MIT"
 license-files = ["LICENSE"]
 requires-python = ">=3.13"
 dependencies = [
+    "detect-secrets>=1.5.0",
     "rapidfuzz>=3.14.5",
     "typer>=0.27.0",
 ]

{bearcli-1.0.1 → bearcli-1.2.0}/src/bearcli/cli.py

@@ -11,7 +11,6 @@ from datetime import UTC, datetime, timedelta
 from enum import StrEnum
 from pathlib import Path
 from typing import Annotated
-from urllib.parse import quote
 
 import typer
 from rich import box
@@ -20,9 +19,12 @@ from rich.markup import escape as rich_escape
 from rich.table import Table
 
 from bearcli import actions
-from bearcli.db import DEFAULT_DB_PATH, BearDB, Note
+from bearcli.db import DEFAULT_DB_PATH, AmbiguousNoteId, BearDB, Note, note_metadata
 from bearcli.export import export_notes
+from bearcli.gitsync import GitError, export_and_push
+from bearcli.markdown import rewrite_attachment_refs
 from bearcli.search import naive_search, search_notes
+from bearcli.secrets import SecretFinding, redact_text, redaction_map, scan_notes
 
 app = typer.Typer(help="Read notes from the Bear note app.", no_args_is_help=True, add_completion=False)
 note_app = typer.Typer(help="Create, read, and modify notes.", no_args_is_help=True)
@@ -46,17 +48,7 @@ class OnlyFilter(StrEnum):
 
 
 def _note_to_dict(note: Note, with_text: bool = False) -> dict:
-    data = {
-        "id": note.id,
-        "title": note.title,
-        "tags": note.tags,
-        "created": note.created.isoformat() if note.created else None,
-        "modified": note.modified.isoformat() if note.modified else None,
-        "pinned": note.pinned,
-        "encrypted": note.encrypted,
-        "archived": note.archived,
-        "trashed": note.trashed,
-    }
+    data = note_metadata(note)
     if with_text:
         data["text"] = note.text
         data["attachments"] = [
@@ -82,17 +74,8 @@ def _note_status(note: Note) -> str:
 
 
 def _resolve_attachments(note: Note) -> str:
-    """Rewrite bare attachment filenames in markdown links to absolute paths.
-
-    Bear percent-encodes filenames in the note text (e.g. spaces as %20), so match
-    both the raw and encoded forms; emit encoded paths to keep the links valid.
-    """
-    text = note.text or ""
-    for att in note.attachments:
-        target = quote(str(att.path))
-        for ref in {att.filename, quote(att.filename)}:
-            text = text.replace(f"]({ref})", f"]({target})")
-    return text
+    """Rewrite attachment links to the files' absolute paths on disk."""
+    return rewrite_attachment_refs(note, lambda att: str(att.path))
 
 
 DbPathOption = Annotated[
@@ -221,6 +204,10 @@ def get(
             help="Rewrite attachment references in the content to absolute file paths.",
         ),
     ] = False,
+    redact_secrets: Annotated[
+        bool,
+        typer.Option("--redact-secrets", help="Replace detected secrets with a [redacted: <rule>] placeholder."),
+    ] = False,
     fmt: Annotated[
         OutputFormat,
         typer.Option(
@@ -234,18 +221,18 @@ def get(
     """Print the content of a note."""
     db = _open_db(db_path)
     try:
-        note = db.get_note(note_id)
+        note = _require_note(db, note_id)
     finally:
         db.close()
 
-    if note is None:
-        console.print(f"[red]Error:[/red] no note with id {note_id!r}")
-        raise typer.Exit(1)
     if note.encrypted or note.text is None:
         console.print(f"[red]Error:[/red] note {note.id} is encrypted; its content is unavailable")
         raise typer.Exit(1)
 
     text = _resolve_attachments(note) if resolve_attachments else note.text
+    if redact_secrets and text is not None:
+        note_secrets = redaction_map(scan_notes([note])).get(note.id, {})
+        text = redact_text(text, note_secrets)
 
     if fmt is OutputFormat.json:
         data = _note_to_dict(note, with_text=True)
@@ -288,6 +275,24 @@ def get(
     print(text)
 
 
+def _report_secrets(findings: list[SecretFinding]) -> None:
+    table = Table(box=box.ROUNDED, header_style="bold")
+    table.add_column("Note", overflow="ellipsis", max_width=30)
+    table.add_column("ID", style="dim", no_wrap=True)
+    table.add_column("Rule", style="yellow")
+    table.add_column("Line", justify="right")
+    table.add_column("Match", style="red")
+    for f in findings:
+        table.add_row(f.note_title, f.note_id, f.rule, str(f.line), f.excerpt)
+    console.print(table)
+    notes = len({f.note_id for f in findings})
+    console.print(
+        f"[red]Export blocked:[/red] {len(findings)} potential secret(s) in {notes} note(s). "
+        "Move them somewhere safe (or into an encrypted note), re-run with --redact-secrets "
+        "to export with placeholders, or with --allow-secrets to export as-is."
+    )
+
+
 @app.command()
 def export(
     dest: Annotated[Path, typer.Argument(help="Destination directory for the markdown files.")],
@@ -298,17 +303,60 @@ def export(
             help="Only rewrite notes that changed since the last export instead of everything.",
         ),
     ] = False,
+    push: Annotated[
+        bool,
+        typer.Option(
+            "--push",
+            help="Treat DEST as a git clone: commit the export and push. Bear is the source of "
+            "truth — remote or manual edits are kept in history but overwritten in HEAD.",
+        ),
+    ] = False,
+    allow_secrets: Annotated[
+        bool,
+        typer.Option("--allow-secrets", help="Export even if the secret scan finds potential credentials."),
+    ] = False,
+    redact_secrets: Annotated[
+        bool,
+        typer.Option(
+            "--redact-secrets",
+            help="Export with detected secrets replaced by a [redacted: <rule>] placeholder "
+            "(notes in Bear are untouched).",
+        ),
+    ] = False,
     db_path: DbPathOption = DEFAULT_DB_PATH,
 ) -> None:
     """Export all notes as markdown files with frontmatter and attachments."""
+    if allow_secrets and redact_secrets:
+        console.print("[red]Error:[/red] --allow-secrets and --redact-secrets are mutually exclusive")
+        raise typer.Exit(2)
     db = _open_db(db_path)
     try:
+        redactions: dict[str, dict[str, str]] | None = None
+        if not allow_secrets:
+            with console.status("Scanning notes for secrets…", spinner="dots"):
+                candidates = db.list_notes(limit=None, include_archived=True, with_text=True)
+                findings = scan_notes(candidates)
+            if findings and not redact_secrets:
+                _report_secrets(findings)
+                raise typer.Exit(1)
+            if findings:
+                redactions = redaction_map(findings)
         with console.status("Exporting…", spinner="dots") as status:
-            result = export_notes(db, dest, sync=sync, progress=lambda msg: status.update(rich_escape(msg)))
+            update = lambda msg: status.update(rich_escape(msg))  # noqa: E731
+            if push:
+                try:
+                    result, outcome = export_and_push(db, dest, sync=sync, progress=update, redactions=redactions)
+                except GitError as exc:
+                    console.print(f"[red]Error:[/red] {exc}")
+                    raise typer.Exit(1) from None
+            else:
+                result = export_notes(db, dest, sync=sync, progress=update, redactions=redactions)
     finally:
         db.close()
 
     parts = [f"{result.written} written"]
+    if push:
+        parts.append(outcome)
     if sync:
         parts.append(f"{result.unchanged} unchanged")
     if result.removed:
@@ -317,9 +365,10 @@ def export(
         parts.append(f"{result.skipped_encrypted} encrypted skipped")
     if result.index_updated:
         parts.append("index updated")
+    if redactions:
+        secrets_count = sum(len(v) for v in redactions.values())
+        parts.append(f"{secrets_count} secret(s) redacted in {len(redactions)} note(s)")
     console.print(f"Exported to {dest}: " + ", ".join(parts))
-    if result.index_skipped:
-        console.print("[yellow]Warning:[/yellow] README.md exists but was not generated by bearcli; left untouched")
 
 
 def _text_or_stdin(text: str | None) -> str | None:
@@ -329,7 +378,13 @@ def _text_or_stdin(text: str | None) -> str | None:
 
 
 def _require_note(db: BearDB, note_id: str) -> Note:
-    note = db.get_note(note_id)
+    try:
+        note = db.get_note(note_id)
+    except AmbiguousNoteId as exc:
+        console.print(f"[red]Error:[/red] note id prefix {exc.prefix!r} matches several notes:")
+        for full_id, title in exc.matches:
+            console.print(f"  {full_id}  {title}")
+        raise typer.Exit(1) from None
     if note is None:
         console.print(f"[red]Error:[/red] no note with id {note_id!r}")
         raise typer.Exit(1)

{bearcli-1.0.1 → bearcli-1.2.0}/src/bearcli/db.py

@@ -52,6 +52,33 @@ class Note:
     attachments: list[Attachment] = field(default_factory=list)
 
 
+def note_metadata(note: Note) -> dict:
+    """The canonical serializable metadata for a note (everything but content)."""
+    return {
+        "id": note.id,
+        "title": note.title,
+        "tags": note.tags,
+        "created": note.created.isoformat() if note.created else None,
+        "modified": note.modified.isoformat() if note.modified else None,
+        "pinned": note.pinned,
+        "encrypted": note.encrypted,
+        "archived": note.archived,
+        "trashed": note.trashed,
+    }
+
+
+class AmbiguousNoteId(Exception):
+    """A note id prefix matched more than one note."""
+
+    def __init__(self, prefix: str, matches: list[tuple[str, str]]):
+        super().__init__(f"note id prefix {prefix!r} is ambiguous")
+        self.prefix = prefix
+        self.matches = matches  # (id, title) pairs
+
+
+MIN_ID_PREFIX = 4
+
+
 class BearDB:
     def __init__(self, path: Path = DEFAULT_DB_PATH):
         if not path.exists():
@@ -215,25 +242,13 @@ class BearDB:
             query += " LIMIT ?"
             params.append(limit)
 
-        notes = []
-        for row in self.conn.execute(query, params):
-            notes.append(
-                Note(
-                    id=row["ZUNIQUEIDENTIFIER"],
-                    title=row["ZTITLE"] or "(untitled)",
-                    created=core_data_to_datetime(row["ZCREATIONDATE"]),
-                    modified=core_data_to_datetime(row["ZMODIFICATIONDATE"]),
-                    pinned=bool(row["ZPINNED"]),
-                    encrypted=bool(row["ZENCRYPTED"]),
-                    archived=bool(row["ZARCHIVED"]),
-                    trashed=bool(row["ZTRASHED"]),
-                    tags=self._tags_for_note(row["Z_PK"]),
-                    text=row["ZTEXT"] if with_text else None,
-                )
-            )
-        return notes
+        return [
+            self._note_from_row(row, text=row["ZTEXT"] if with_text else None)
+            for row in self.conn.execute(query, params)
+        ]
 
     def get_note(self, note_id: str) -> Note | None:
+        """Fetch a note by id; a unique prefix (>= 4 chars) works like a full id."""
         row = self.conn.execute(
             """
             SELECT Z_PK, ZUNIQUEIDENTIFIER, ZTITLE, ZTEXT, ZCREATIONDATE,
@@ -243,8 +258,29 @@ class BearDB:
             """,
             (note_id,),
         ).fetchone()
+        if row is None and len(note_id) >= MIN_ID_PREFIX:
+            escaped = note_id.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+            matches = self.conn.execute(
+                """
+                SELECT Z_PK, ZUNIQUEIDENTIFIER, ZTITLE, ZTEXT, ZCREATIONDATE,
+                       ZMODIFICATIONDATE, ZPINNED, ZENCRYPTED, ZARCHIVED, ZTRASHED
+                FROM ZSFNOTE
+                WHERE ZUNIQUEIDENTIFIER LIKE ? ESCAPE '\\' COLLATE NOCASE AND ZPERMANENTLYDELETED = 0
+                LIMIT 6
+                """,
+                (f"{escaped}%",),
+            ).fetchall()
+            if len(matches) > 1:
+                raise AmbiguousNoteId(note_id, [(r["ZUNIQUEIDENTIFIER"], r["ZTITLE"] or "(untitled)") for r in matches])
+            if matches:
+                row = matches[0]
         if row is None:
             return None
+        return self._note_from_row(row, text=row["ZTEXT"], attachments=self._attachments_for_note(row["Z_PK"]))
+
+    def _note_from_row(
+        self, row: sqlite3.Row, text: str | None = None, attachments: list[Attachment] | None = None
+    ) -> Note:
         return Note(
             id=row["ZUNIQUEIDENTIFIER"],
             title=row["ZTITLE"] or "(untitled)",
@@ -255,6 +291,6 @@ class BearDB:
             archived=bool(row["ZARCHIVED"]),
             trashed=bool(row["ZTRASHED"]),
             tags=self._tags_for_note(row["Z_PK"]),
-            text=row["ZTEXT"],
-            attachments=self._attachments_for_note(row["Z_PK"]),
+            text=text,
+            attachments=attachments or [],
         )

{bearcli-1.0.1 → bearcli-1.2.0}/src/bearcli/export.py

@@ -9,9 +9,10 @@ from collections import Counter
 from collections.abc import Callable
 from dataclasses import dataclass
 from pathlib import Path
-from urllib.parse import quote
 
-from bearcli.db import BearDB, Note
+from bearcli.db import BearDB, Note, note_metadata
+from bearcli.markdown import rewrite_attachment_refs
+from bearcli.secrets import redact_text
 
 NOTE_FILENAME = "README.md"
 ATTACHMENTS_DIRNAME = "attachments"
@@ -24,7 +25,6 @@ class ExportResult:
     removed: int = 0
     skipped_encrypted: int = 0
     index_updated: bool = False
-    index_skipped: bool = False
 
 
 def slugify(title: str, max_length: int = 60) -> str:
@@ -44,7 +44,7 @@ def _dirnames(notes: list[Note]) -> dict[str, str]:
     return {n.id: short[n.id] if counts[short[n.id]] == 1 else f"{slugify(n.title)}-{n.id.lower()}" for n in notes}
 
 
-def _frontmatter(note: Note) -> str:
+def _frontmatter(note: Note, redacted: bool = False) -> str:
     lines = [
         "---",
         f"id: {note.id}",
@@ -55,6 +55,8 @@ def _frontmatter(note: Note) -> str:
         lines.append(f"created: {note.created.isoformat()}")
     if note.modified:
         lines.append(f"modified: {note.modified.isoformat()}")
+    if redacted:
+        lines.append("redacted: true")
     lines.append("---")
     return "\n".join(lines)
 
@@ -90,13 +92,20 @@ def _entry_flags(entry: dict) -> str:
     return flags
 
 
+_INDEX_TITLE_LENGTH = 48
+
+
+def _ellipsize(value: str, length: int) -> str:
+    return value if len(value) <= length else value[: length - 1].rstrip() + "…"
+
+
 def _index_rows(entries: list[dict]) -> list[str]:
-    rows = ["| Note | Tags | Modified | |", "|---|---|---|---|"]
+    rows = ["| ID | Modified | | Note |", "|---|---|---|---|"]
     for e in entries:
-        title = e["title"].replace("|", "\\|")
+        title = _ellipsize(e["title"].replace("|", "\\|"), _INDEX_TITLE_LENGTH)
         link = f"[{title}]({e['path']})" if e["path"] else title
-        modified = (e["modified"] or "")[:10]
-        rows.append(f"| {link} | {', '.join(e['tags'])} | {modified} | {_entry_flags(e)} |")
+        # The short id resolves anywhere a note id is accepted (git-style prefix).
+        rows.append(f"| `{e['id'][:8].lower()}` | {(e['modified'] or '')[:10]} | {_entry_flags(e)} | {link} |")
     return rows
 
 
@@ -112,16 +121,20 @@ def _index_markdown(entries: list[dict]) -> str:
         f"{len(entries)} notes · 📎 attachments · 🔒 encrypted · 🗄 archived",
         "",
     ]
-    pinned = [e for e in entries if e["pinned"]]
+    archived = [e for e in entries if e["archived"]]
+    active = [e for e in entries if not e["archived"]]
+    pinned = [e for e in active if e["pinned"]]
     if pinned:
         lines += ["## 📌 Pinned", ""] + _index_rows(pinned) + [""]
-    rest = [e for e in entries if not e["pinned"]]
+    rest = [e for e in active if not e["pinned"]]
     by_year: dict[str, list[dict]] = {}
     for e in rest:
         year = e["modified"][:4] if e["modified"] else "Undated"
         by_year.setdefault(year, []).append(e)
     for year in sorted(by_year, reverse=True):
         lines += [f"## {year}", ""] + _index_rows(by_year[year]) + [""]
+    if archived:
+        lines += ["## 🗄 Archived", ""] + _index_rows(archived) + [""]
     return "\n".join(lines)
 
 
@@ -136,12 +149,7 @@ def _write_if_changed(path: Path, content: str) -> bool:
 
 
 def _rewrite_refs(note: Note) -> str:
-    text = note.text or ""
-    for att in note.attachments:
-        target = quote(f"{ATTACHMENTS_DIRNAME}/{att.filename}")
-        for ref in {att.filename, quote(att.filename)}:
-            text = text.replace(f"]({ref})", f"]({target})")
-    return text
+    return rewrite_attachment_refs(note, lambda att: f"{ATTACHMENTS_DIRNAME}/{att.filename}")
 
 
 def export_notes(
@@ -149,6 +157,7 @@ def export_notes(
     dest: Path,
     sync: bool = False,
     progress: Callable[[str], None] | None = None,
+    redactions: dict[str, dict[str, str]] | None = None,
 ) -> ExportResult:
     """Write every non-trashed note as dest/<slug>/README.md plus attachments/.
 
@@ -171,20 +180,7 @@ def export_notes(
     entries: list[dict] = []
 
     def add_entry(note: Note, path: str | None, attachments: bool) -> None:
-        entries.append(
-            {
-                "id": note.id,
-                "title": note.title,
-                "path": path,
-                "tags": note.tags,
-                "created": note.created.isoformat() if note.created else None,
-                "modified": note.modified.isoformat() if note.modified else None,
-                "pinned": note.pinned,
-                "encrypted": note.encrypted,
-                "archived": note.archived,
-                "attachments": attachments,
-            }
-        )
+        entries.append({**note_metadata(note), "path": path, "attachments": attachments})
 
     for position, summary in enumerate(summaries, start=1):
         report(f"[{position}/{len(summaries)}] {summary.title}")
@@ -197,10 +193,15 @@ def export_notes(
         note_dir = dest / slug
         note_path = note_dir / NOTE_FILENAME
 
+        note_secrets = (redactions or {}).get(summary.id, {})
         modified_iso = summary.modified.isoformat() if summary.modified else ""
         if sync and note_path.exists():
             existing = _parse_frontmatter(note_path)
-            if existing.get("id") == summary.id and existing.get("modified") == modified_iso:
+            # A change in redaction state must rewrite the file even though the
+            # note itself is unchanged — otherwise a previously exported secret
+            # would survive a later --redact-secrets run (and vice versa).
+            same_redaction = (existing.get("redacted") == "true") == bool(note_secrets)
+            if existing.get("id") == summary.id and existing.get("modified") == modified_iso and same_redaction:
                 result.unchanged += 1
                 add_entry(summary, f"{slug}/", (note_dir / ATTACHMENTS_DIRNAME).exists())
                 continue
@@ -211,8 +212,11 @@ def export_notes(
             add_entry(summary, None, False)
             continue
 
+        text = _rewrite_refs(note)
+        if note_secrets:
+            text = redact_text(text, note_secrets)
         note_dir.mkdir(exist_ok=True)
-        note_path.write_text(f"{_frontmatter(note)}\n{_rewrite_refs(note)}\n")
+        note_path.write_text(f"{_frontmatter(note, redacted=bool(note_secrets))}\n{text}\n")
 
         attach_dir = note_dir / ATTACHMENTS_DIRNAME
         if attach_dir.exists():
@@ -238,10 +242,7 @@ def export_notes(
 
     report("Writing index…")
     index_path = dest / "README.md"
-    if index_path.exists() and _parse_frontmatter(index_path).get("generated-by") != "bearcli":
-        result.index_skipped = True
-    else:
-        result.index_updated = _write_if_changed(index_path, _index_markdown(entries))
+    result.index_updated = _write_if_changed(index_path, _index_markdown(entries))
     result.index_updated |= _write_if_changed(
         dest / "index.json",
         json.dumps(sorted(entries, key=lambda e: e["title"].lower()), indent=2, ensure_ascii=False) + "\n",

bearcli-1.2.0/src/bearcli/gitsync.py

@@ -0,0 +1,106 @@
+"""Export into a git worktree and push, converging without manual intervention.
+
+The repository is a one-way mirror owned by bearcli: Bear is the source of
+truth, and HEAD always converges to Bear's state. Nothing is ever lost —
+local or remote edits are committed/merged before being overwritten, so they
+remain in history — and nothing is ever force-pushed. Every failure mode
+either self-heals (merge preferring local, reset to origin as last resort,
+bounded push retries) or raises a clear error; there is no state that
+requires manual git surgery to resume.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from collections.abc import Callable
+from pathlib import Path
+
+from bearcli.db import BearDB
+from bearcli.export import ExportResult, export_notes
+
+
+class GitError(RuntimeError):
+    pass
+
+
+def _git(dest: Path, *args: str) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(["git", "-C", str(dest), *args], capture_output=True, text=True, check=False)
+
+
+def _run(dest: Path, *args: str) -> str:
+    proc = _git(dest, *args)
+    if proc.returncode != 0:
+        raise GitError(f"git {' '.join(args)} failed: {proc.stderr.strip()}")
+    return proc.stdout.strip()
+
+
+def _ok(dest: Path, *args: str) -> bool:
+    return _git(dest, *args).returncode == 0
+
+
+def _commit_if_dirty(dest: Path, message: str) -> None:
+    _run(dest, "add", "-A")
+    if not _ok(dest, "diff", "--cached", "--quiet"):
+        _run(dest, "commit", "-m", message)
+
+
+def export_and_push(
+    db: BearDB,
+    dest: Path,
+    sync: bool = True,
+    progress: Callable[[str], None] | None = None,
+    redactions: dict[str, dict[str, str]] | None = None,
+    attempts: int = 3,
+) -> tuple[ExportResult, str]:
+    def report(message: str) -> None:
+        if progress is not None:
+            progress(message)
+
+    if not _ok(dest, "rev-parse", "--is-inside-work-tree"):
+        raise GitError(f"{dest} is not a git repository — clone your notes repo (or `git init`) first")
+    branch = _run(dest, "symbolic-ref", "--short", "HEAD")
+    has_remote = _ok(dest, "remote", "get-url", "origin")
+
+    last_error = "unknown"
+    result = ExportResult()
+    for _ in range(attempts):
+        # Anything lying around (manual edits, a previous crashed run) gets
+        # committed first: merges start from a clean tree and nothing is lost.
+        _commit_if_dirty(dest, "bear export: local changes")
+
+        full = not sync
+        if has_remote:
+            report("Fetching origin…")
+            _run(dest, "fetch", "origin")
+            if (
+                _ok(dest, "rev-parse", "--verify", f"origin/{branch}")
+                and _run(dest, "rev-list", "--count", f"HEAD..origin/{branch}") != "0"
+            ):
+                report("Integrating remote changes…")
+                if not (
+                    _ok(dest, "merge", "--ff-only", f"origin/{branch}")
+                    or _ok(dest, "merge", "-X", "ours", "--no-edit", f"origin/{branch}")
+                ):
+                    _git(dest, "merge", "--abort")
+                    _run(dest, "reset", "--hard", f"origin/{branch}")
+                # Whatever was pulled, Bear's state must win in the worktree:
+                # a full export re-asserts every note, not just changed ones.
+                full = True
+
+        result = export_notes(db, dest, sync=not full, progress=progress, redactions=redactions)
+
+        report("Committing…")
+        parts = [f"{result.written} written"]
+        if result.removed:
+            parts.append(f"{result.removed} removed")
+        _commit_if_dirty(dest, "bear export: " + ", ".join(parts))
+
+        if not has_remote:
+            return result, "committed (no remote configured)"
+        report("Pushing…")
+        push = _git(dest, "push", "-u", "origin", branch)
+        if push.returncode == 0:
+            return result, "pushed"
+        last_error = push.stderr.strip()  # racing push; refetch and retry
+
+    raise GitError(f"push failed after {attempts} attempts: {last_error}")

bearcli-1.2.0/src/bearcli/markdown.py

@@ -0,0 +1,25 @@
+"""Helpers for Bear's markdown conventions, shared by get and export."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from urllib.parse import quote
+
+from bearcli.db import Attachment, Note
+
+
+def rewrite_attachment_refs(note: Note, target_for: Callable[[Attachment], str]) -> str:
+    """Rewrite bare attachment filename links to per-attachment targets.
+
+    Bear references attachments by bare filename and percent-encodes it in the
+    note text (spaces as %20), so both the raw and encoded forms must be
+    matched; targets are emitted percent-encoded to keep the links valid.
+    Only filenames known from the attachment records are rewritten — regular
+    URLs in the text are never touched.
+    """
+    text = note.text or ""
+    for att in note.attachments:
+        target = quote(target_for(att))
+        for ref in {att.filename, quote(att.filename)}:
+            text = text.replace(f"]({ref})", f"]({target})")
+    return text

bearcli-1.2.0/src/bearcli/secrets.py

@@ -0,0 +1,203 @@
+"""Secret detection over note text, powered by detect-secrets (Yelp) plus
+note-specific detectors.
+
+A first line of defense before notes leave the machine via export. Everything
+runs offline — note content is never sent anywhere. detect-secrets provides
+the format detectors (AWS, GitHub, Slack, Stripe, private keys, JWTs, keyword
+assignments, …); two gaps matter for prose notes and are covered here:
+
+- detect-secrets' entropy plugins only match *quoted* strings, which pasted
+  keys in notes never are — so unquoted token runs get their own entropy scan.
+- Credentials in notes often sit on the line *below* a label ("Client
+  secret:" then the value, often inside a code fence) — a look-ahead rule
+  catches those.
+
+Secrets written as prose are still undetectable; for deeper auditing run
+gitleaks over an --allow-secrets export.
+"""
+
+from __future__ import annotations
+
+import math
+import re
+from dataclasses import dataclass
+
+from detect_secrets.core.plugins.util import get_mapping_from_secret_type_to_class
+from detect_secrets.filters import heuristic
+from detect_secrets.plugins.base import BasePlugin
+
+from bearcli.db import Note
+
+# IPPublicDetector: an IP address in a note is not a credential.
+# The entropy plugins only match quoted strings — replaced by _scan_entropy.
+_EXCLUDED_PLUGINS = {"IPPublicDetector", "Base64HighEntropyString", "HexHighEntropyString"}
+
+_BASE64_ENTROPY_LIMIT = 4.5  # detect-secrets' default
+_HEX_ENTROPY_LIMIT = 3.5  # above default (3.0): notes are full of UUID/hash fragments
+
+# A contiguous credential-looking run: base64/urlsafe chars plus the '.' that
+# joins JWT segments. 20+ chars keeps ordinary words and short ids out.
+_TOKEN_RUN = re.compile(r"[A-Za-z0-9+/\-_=.]{20,}")
+_HEX_ONLY = re.compile(r"^[0-9a-fA-F]+$")
+
+# "Client secret:" / "Access token" style label with nothing after it — the
+# value is expected on the next content line (code fences skipped).
+_LABEL_ONLY = re.compile(
+    r"(?i)^\s*\**(?:client\s+secret|secret\s+access\s+key|access\s+token|auth\s+token|refresh\s+token"
+    r"|api\s*-?\s*key|access\s+key|private\s+key|secret|password|passwd|pwd|token)\s*\**\s*[:=]?\s*$"
+)
+_FENCE = re.compile(r"^\s*(?:```|~~~)")
+_TRIM_PUNCT = "()[]{}<>«»\"'`,;|"
+
+
+def _build_plugins() -> list[BasePlugin]:
+    return [cls() for cls in get_mapping_from_secret_type_to_class().values() if cls.__name__ not in _EXCLUDED_PLUGINS]
+
+
+def _entropy(value: str) -> float:
+    counts = {char: value.count(char) for char in set(value)}
+    return -sum(n / len(value) * math.log2(n / len(value)) for n in counts.values())
+
+
+def _is_false_positive(value: str, line: str) -> bool:
+    return (
+        heuristic.is_potential_uuid(value)
+        or heuristic.is_sequential_string(value)
+        or heuristic.is_templated_secret(value)
+        or heuristic.is_likely_id_string(value, line)
+        or heuristic.is_not_alphanumeric_string(value)
+    )
+
+
+def _expand_to_token(line: str, value: str) -> str:
+    """Grow a detected value to the full unbroken token around it.
+
+    Format detectors can match only part of a longer credential (a JWT's
+    first two segments, say); redacting the partial match would leave the
+    rest behind.
+    """
+    start = line.find(value)
+    if start < 0:
+        return value
+    end = start + len(value)
+    while start > 0 and not line[start - 1].isspace():
+        start -= 1
+    while end < len(line) and not line[end].isspace():
+        end += 1
+    return line[start:end].strip(_TRIM_PUNCT)
+
+
+def _in_url(line: str, start: int) -> bool:
+    """Whether the token starting at `start` is part of a URL.
+
+    Long ids inside links (Google Docs, Notion, …) are high-entropy but are
+    shareable references, not credentials — flagging them would drown real
+    findings. Token-bearing URLs with known formats (Slack webhooks, …) are
+    still caught by their format detectors.
+    """
+    token_start = start
+    while token_start > 0 and not line[token_start - 1].isspace():
+        token_start -= 1
+    return "://" in line[token_start : start + 3]
+
+
+def _scan_entropy(line: str) -> list[str]:
+    hits = []
+    for match in _TOKEN_RUN.finditer(line):
+        if _in_url(line, match.start()):
+            continue
+        value = match.group().strip(_TRIM_PUNCT + ".=")
+        limit = _HEX_ENTROPY_LIMIT if _HEX_ONLY.fullmatch(value) else _BASE64_ENTROPY_LIMIT
+        if len(value) >= 20 and _entropy(value) >= limit:
+            hits.append(match.group())
+    return hits
+
+
+def _labeled_value(lines: list[str], label_index: int) -> tuple[int, str] | None:
+    """The first content line after a bare credential label, if it looks like a value."""
+    for offset in range(1, 4):
+        index = label_index + offset
+        if index >= len(lines):
+            return None
+        candidate = lines[index].strip()
+        if not candidate or _FENCE.match(candidate):
+            continue
+        candidate = candidate.strip(_TRIM_PUNCT)
+        if " " not in candidate and 8 <= len(candidate) <= 200:
+            return index, candidate
+        return None
+    return None
+
+
+@dataclass
+class SecretFinding:
+    note_id: str
+    note_title: str
+    rule: str
+    line: int
+    excerpt: str
+    secret: str  # raw value, for redaction only — never print this
+
+
+def _redact(value: str) -> str:
+    """Show enough to locate the secret in the note, never the secret itself."""
+    return f"{value[:8]}…" if len(value) > 12 else "…"
+
+
+def _scan_note(note: Note, plugins: list[BasePlugin]) -> list[SecretFinding]:
+    lines = list((note.text or "").splitlines())
+    seen: set[str] = set()
+    findings: list[SecretFinding] = []
+
+    def add(lineno: int, value: str, rule: str) -> None:
+        if value and value not in seen and not _is_false_positive(value, lines[lineno - 1]):
+            seen.add(value)
+            findings.append(
+                SecretFinding(
+                    note_id=note.id,
+                    note_title=note.title,
+                    rule=rule,
+                    line=lineno,
+                    excerpt=_redact(value),
+                    secret=value,
+                )
+            )
+
+    for lineno, line in enumerate(lines, start=1):
+        for plugin in plugins:
+            # The yaml filetype hint makes KeywordDetector accept unquoted
+            # `password: value` assignments, which is how notes write them.
+            for secret in plugin.analyze_line(filename="note.yaml", line=line, line_number=lineno):
+                add(lineno, _expand_to_token(line, secret.secret_value or ""), secret.type)
+        for value in _scan_entropy(line):
+            add(lineno, value, "High Entropy String")
+        if _LABEL_ONLY.match(line):
+            if labeled := _labeled_value(lines, lineno - 1):
+                value_index, value = labeled
+                add(value_index + 1, value, "Labeled Credential")
+    return findings
+
+
+def scan_notes(notes: list[Note]) -> list[SecretFinding]:
+    plugins = _build_plugins()
+    findings = []
+    for note in notes:
+        findings.extend(_scan_note(note, plugins))
+    return findings
+
+
+def redaction_map(findings: list[SecretFinding]) -> dict[str, dict[str, str]]:
+    """Per note id, the secret values to replace and the rule that found them."""
+    by_note: dict[str, dict[str, str]] = {}
+    for finding in findings:
+        if finding.secret:
+            by_note.setdefault(finding.note_id, {}).setdefault(finding.secret, finding.rule)
+    return by_note
+
+
+def redact_text(text: str, secrets: dict[str, str]) -> str:
+    """Replace each secret value with a placeholder naming the rule that found it."""
+    # Longest first, in case one detected value contains another.
+    for value in sorted(secrets, key=len, reverse=True):
+        text = text.replace(value, f"[redacted: {secrets[value]}]")
+    return text