bearcli 1.1.0__tar.gz → 1.2.1__tar.gz

{bearcli-1.1.0 → bearcli-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bearcli
-Version: 1.1.0
+Version: 1.2.1
 Summary: The missing CLI for Bear notes — read, search, export, and manage your notes from the terminal
 Keywords: bear,notes,cli,markdown,macos
 Author: Michel Tricot
@@ -74,9 +74,10 @@ bearcli note list --only pinned              # or: encrypted, trashed, archived
 bearcli note list --all --trashed --archived
 bearcli note list --ids                      # only identifiers, one per line
 
-bearcli get C44D09DC-7F0E-43BB-BEB8-67E3A389A448
+bearcli get C44D09DC       # a unique id prefix (4+ chars) works everywhere
 bearcli get C44D09DC-... --meta              # with YAML-style frontmatter
 bearcli get C44D09DC-... -r                  # rewrite attachment refs to absolute paths
+bearcli get C44D09DC-... --redact-secrets    # secrets replaced by placeholders
 bearcli open C44D09DC-...                    # open in the Bear app
 ```
 
@@ -119,12 +120,21 @@ attachments — with a generated index, so GitHub renders the whole export as a
 browsable tree.
 
 Before anything is written, the notes are scanned for potential secrets
-(token formats, key blocks, credential assignments); findings block the export
-with a list of the affected notes (`--allow-secrets` overrides).
+(token formats, key blocks, credential assignments, high-entropy strings);
+findings block the export with a list of the affected notes. Override with
+`--allow-secrets` (export as-is) or `--redact-secrets` (replace each secret
+with a `[redacted: <rule>]` placeholder — notes in Bear are untouched).
+
+> **⚠️ Warning** — detection and redaction are best-effort: a secret that
+> reads like ordinary text (a password written as prose, an account number)
+> will not be caught. Ideally, don't keep secrets in notes at all — use a
+> password manager, or at least Bear's encrypted notes, which never leave
+> the app.
 
 ```sh
 bearcli export ~/bear-backup
 bearcli export ~/bear-backup --sync          # only rewrite notes that changed
+bearcli export ~/bear-backup --redact-secrets  # secrets become [redacted: <rule>]
 
 # Mirror to a git repository (clone it first; use a *private* repo — these are
 # your notes). Bear is the source of truth: remote or manual edits are kept in

{bearcli-1.1.0 → bearcli-1.2.1}/README.md

@@ -51,9 +51,10 @@ bearcli note list --only pinned              # or: encrypted, trashed, archived
 bearcli note list --all --trashed --archived
 bearcli note list --ids                      # only identifiers, one per line
 
-bearcli get C44D09DC-7F0E-43BB-BEB8-67E3A389A448
+bearcli get C44D09DC       # a unique id prefix (4+ chars) works everywhere
 bearcli get C44D09DC-... --meta              # with YAML-style frontmatter
 bearcli get C44D09DC-... -r                  # rewrite attachment refs to absolute paths
+bearcli get C44D09DC-... --redact-secrets    # secrets replaced by placeholders
 bearcli open C44D09DC-...                    # open in the Bear app
 ```
 
@@ -96,12 +97,21 @@ attachments — with a generated index, so GitHub renders the whole export as a
 browsable tree.
 
 Before anything is written, the notes are scanned for potential secrets
-(token formats, key blocks, credential assignments); findings block the export
-with a list of the affected notes (`--allow-secrets` overrides).
+(token formats, key blocks, credential assignments, high-entropy strings);
+findings block the export with a list of the affected notes. Override with
+`--allow-secrets` (export as-is) or `--redact-secrets` (replace each secret
+with a `[redacted: <rule>]` placeholder — notes in Bear are untouched).
+
+> **⚠️ Warning** — detection and redaction are best-effort: a secret that
+> reads like ordinary text (a password written as prose, an account number)
+> will not be caught. Ideally, don't keep secrets in notes at all — use a
+> password manager, or at least Bear's encrypted notes, which never leave
+> the app.
 
 ```sh
 bearcli export ~/bear-backup
 bearcli export ~/bear-backup --sync          # only rewrite notes that changed
+bearcli export ~/bear-backup --redact-secrets  # secrets become [redacted: <rule>]
 
 # Mirror to a git repository (clone it first; use a *private* repo — these are
 # your notes). Bear is the source of truth: remote or manual edits are kept in

{bearcli-1.1.0 → bearcli-1.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bearcli"
-version = "1.1.0"
+version = "1.2.1"
 description = "The missing CLI for Bear notes — read, search, export, and manage your notes from the terminal"
 readme = "README.md"
 keywords = ["bear", "notes", "cli", "markdown", "macos"]

{bearcli-1.1.0 → bearcli-1.2.1}/src/bearcli/cli.py

@@ -11,7 +11,6 @@ from datetime import UTC, datetime, timedelta
 from enum import StrEnum
 from pathlib import Path
 from typing import Annotated
-from urllib.parse import quote
 
 import typer
 from rich import box
@@ -20,11 +19,12 @@ from rich.markup import escape as rich_escape
 from rich.table import Table
 
 from bearcli import actions
-from bearcli.db import DEFAULT_DB_PATH, BearDB, Note
+from bearcli.db import DEFAULT_DB_PATH, AmbiguousNoteId, BearDB, Note, note_metadata
 from bearcli.export import export_notes
 from bearcli.gitsync import GitError, export_and_push
+from bearcli.markdown import rewrite_attachment_refs
 from bearcli.search import naive_search, search_notes
-from bearcli.secrets import SecretFinding, redaction_map, scan_notes
+from bearcli.secrets import SecretFinding, redact_text, redaction_map, scan_notes
 
 app = typer.Typer(help="Read notes from the Bear note app.", no_args_is_help=True, add_completion=False)
 note_app = typer.Typer(help="Create, read, and modify notes.", no_args_is_help=True)
@@ -48,17 +48,7 @@ class OnlyFilter(StrEnum):
 
 
 def _note_to_dict(note: Note, with_text: bool = False) -> dict:
-    data = {
-        "id": note.id,
-        "title": note.title,
-        "tags": note.tags,
-        "created": note.created.isoformat() if note.created else None,
-        "modified": note.modified.isoformat() if note.modified else None,
-        "pinned": note.pinned,
-        "encrypted": note.encrypted,
-        "archived": note.archived,
-        "trashed": note.trashed,
-    }
+    data = note_metadata(note)
     if with_text:
         data["text"] = note.text
         data["attachments"] = [
@@ -84,17 +74,8 @@ def _note_status(note: Note) -> str:
 
 
 def _resolve_attachments(note: Note) -> str:
-    """Rewrite bare attachment filenames in markdown links to absolute paths.
-
-    Bear percent-encodes filenames in the note text (e.g. spaces as %20), so match
-    both the raw and encoded forms; emit encoded paths to keep the links valid.
-    """
-    text = note.text or ""
-    for att in note.attachments:
-        target = quote(str(att.path))
-        for ref in {att.filename, quote(att.filename)}:
-            text = text.replace(f"]({ref})", f"]({target})")
-    return text
+    """Rewrite attachment links to the files' absolute paths on disk."""
+    return rewrite_attachment_refs(note, lambda att: str(att.path))
 
 
 DbPathOption = Annotated[
@@ -223,6 +204,10 @@ def get(
             help="Rewrite attachment references in the content to absolute file paths.",
         ),
     ] = False,
+    redact_secrets: Annotated[
+        bool,
+        typer.Option("--redact-secrets", help="Replace detected secrets with a [redacted: <rule>] placeholder."),
+    ] = False,
     fmt: Annotated[
         OutputFormat,
         typer.Option(
@@ -236,18 +221,18 @@ def get(
     """Print the content of a note."""
     db = _open_db(db_path)
     try:
-        note = db.get_note(note_id)
+        note = _require_note(db, note_id)
     finally:
         db.close()
 
-    if note is None:
-        console.print(f"[red]Error:[/red] no note with id {note_id!r}")
-        raise typer.Exit(1)
     if note.encrypted or note.text is None:
         console.print(f"[red]Error:[/red] note {note.id} is encrypted; its content is unavailable")
         raise typer.Exit(1)
 
     text = _resolve_attachments(note) if resolve_attachments else note.text
+    if redact_secrets and text is not None:
+        note_secrets = redaction_map(scan_notes([note])).get(note.id, {})
+        text = redact_text(text, note_secrets)
 
     if fmt is OutputFormat.json:
         data = _note_to_dict(note, with_text=True)
@@ -303,7 +288,8 @@ def _report_secrets(findings: list[SecretFinding]) -> None:
     notes = len({f.note_id for f in findings})
     console.print(
         f"[red]Export blocked:[/red] {len(findings)} potential secret(s) in {notes} note(s). "
-        "Move them somewhere safe (or into an encrypted note), or re-run with --allow-secrets."
+        "Move them somewhere safe (or into an encrypted note), re-run with --redact-secrets "
+        "to export with placeholders, or with --allow-secrets to export as-is."
     )
 
 
@@ -383,8 +369,6 @@ def export(
         secrets_count = sum(len(v) for v in redactions.values())
         parts.append(f"{secrets_count} secret(s) redacted in {len(redactions)} note(s)")
     console.print(f"Exported to {dest}: " + ", ".join(parts))
-    if result.index_skipped:
-        console.print("[yellow]Warning:[/yellow] README.md exists but was not generated by bearcli; left untouched")
 
 
 def _text_or_stdin(text: str | None) -> str | None:
@@ -394,7 +378,13 @@ def _text_or_stdin(text: str | None) -> str | None:
 
 
 def _require_note(db: BearDB, note_id: str) -> Note:
-    note = db.get_note(note_id)
+    try:
+        note = db.get_note(note_id)
+    except AmbiguousNoteId as exc:
+        console.print(f"[red]Error:[/red] note id prefix {exc.prefix!r} matches several notes:")
+        for full_id, title in exc.matches:
+            console.print(f"  {full_id}  {title}")
+        raise typer.Exit(1) from None
     if note is None:
         console.print(f"[red]Error:[/red] no note with id {note_id!r}")
         raise typer.Exit(1)

{bearcli-1.1.0 → bearcli-1.2.1}/src/bearcli/db.py

@@ -52,6 +52,33 @@ class Note:
     attachments: list[Attachment] = field(default_factory=list)
 
 
+def note_metadata(note: Note) -> dict:
+    """The canonical serializable metadata for a note (everything but content)."""
+    return {
+        "id": note.id,
+        "title": note.title,
+        "tags": note.tags,
+        "created": note.created.isoformat() if note.created else None,
+        "modified": note.modified.isoformat() if note.modified else None,
+        "pinned": note.pinned,
+        "encrypted": note.encrypted,
+        "archived": note.archived,
+        "trashed": note.trashed,
+    }
+
+
+class AmbiguousNoteId(Exception):
+    """A note id prefix matched more than one note."""
+
+    def __init__(self, prefix: str, matches: list[tuple[str, str]]):
+        super().__init__(f"note id prefix {prefix!r} is ambiguous")
+        self.prefix = prefix
+        self.matches = matches  # (id, title) pairs
+
+
+MIN_ID_PREFIX = 4
+
+
 class BearDB:
     def __init__(self, path: Path = DEFAULT_DB_PATH):
         if not path.exists():
@@ -215,25 +242,13 @@ class BearDB:
             query += " LIMIT ?"
             params.append(limit)
 
-        notes = []
-        for row in self.conn.execute(query, params):
-            notes.append(
-                Note(
-                    id=row["ZUNIQUEIDENTIFIER"],
-                    title=row["ZTITLE"] or "(untitled)",
-                    created=core_data_to_datetime(row["ZCREATIONDATE"]),
-                    modified=core_data_to_datetime(row["ZMODIFICATIONDATE"]),
-                    pinned=bool(row["ZPINNED"]),
-                    encrypted=bool(row["ZENCRYPTED"]),
-                    archived=bool(row["ZARCHIVED"]),
-                    trashed=bool(row["ZTRASHED"]),
-                    tags=self._tags_for_note(row["Z_PK"]),
-                    text=row["ZTEXT"] if with_text else None,
-                )
-            )
-        return notes
+        return [
+            self._note_from_row(row, text=row["ZTEXT"] if with_text else None)
+            for row in self.conn.execute(query, params)
+        ]
 
     def get_note(self, note_id: str) -> Note | None:
+        """Fetch a note by id; a unique prefix (>= 4 chars) works like a full id."""
         row = self.conn.execute(
             """
             SELECT Z_PK, ZUNIQUEIDENTIFIER, ZTITLE, ZTEXT, ZCREATIONDATE,
@@ -243,8 +258,29 @@ class BearDB:
             """,
             (note_id,),
         ).fetchone()
+        if row is None and len(note_id) >= MIN_ID_PREFIX:
+            escaped = note_id.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+            matches = self.conn.execute(
+                """
+                SELECT Z_PK, ZUNIQUEIDENTIFIER, ZTITLE, ZTEXT, ZCREATIONDATE,
+                       ZMODIFICATIONDATE, ZPINNED, ZENCRYPTED, ZARCHIVED, ZTRASHED
+                FROM ZSFNOTE
+                WHERE ZUNIQUEIDENTIFIER LIKE ? ESCAPE '\\' COLLATE NOCASE AND ZPERMANENTLYDELETED = 0
+                LIMIT 6
+                """,
+                (f"{escaped}%",),
+            ).fetchall()
+            if len(matches) > 1:
+                raise AmbiguousNoteId(note_id, [(r["ZUNIQUEIDENTIFIER"], r["ZTITLE"] or "(untitled)") for r in matches])
+            if matches:
+                row = matches[0]
         if row is None:
             return None
+        return self._note_from_row(row, text=row["ZTEXT"], attachments=self._attachments_for_note(row["Z_PK"]))
+
+    def _note_from_row(
+        self, row: sqlite3.Row, text: str | None = None, attachments: list[Attachment] | None = None
+    ) -> Note:
         return Note(
             id=row["ZUNIQUEIDENTIFIER"],
             title=row["ZTITLE"] or "(untitled)",
@@ -255,6 +291,6 @@ class BearDB:
             archived=bool(row["ZARCHIVED"]),
             trashed=bool(row["ZTRASHED"]),
             tags=self._tags_for_note(row["Z_PK"]),
-            text=row["ZTEXT"],
-            attachments=self._attachments_for_note(row["Z_PK"]),
+            text=text,
+            attachments=attachments or [],
         )

{bearcli-1.1.0 → bearcli-1.2.1}/src/bearcli/export.py

@@ -9,9 +9,10 @@ from collections import Counter
 from collections.abc import Callable
 from dataclasses import dataclass
 from pathlib import Path
-from urllib.parse import quote
 
-from bearcli.db import BearDB, Note
+from bearcli.db import BearDB, Note, note_metadata
+from bearcli.markdown import rewrite_attachment_refs
+from bearcli.secrets import redact_text
 
 NOTE_FILENAME = "README.md"
 ATTACHMENTS_DIRNAME = "attachments"
@@ -24,7 +25,6 @@ class ExportResult:
     removed: int = 0
     skipped_encrypted: int = 0
     index_updated: bool = False
-    index_skipped: bool = False
 
 
 def slugify(title: str, max_length: int = 60) -> str:
@@ -61,13 +61,6 @@ def _frontmatter(note: Note, redacted: bool = False) -> str:
     return "\n".join(lines)
 
 
-def _apply_redactions(text: str, secrets: dict[str, str]) -> str:
-    # Longest first, in case one detected value contains another.
-    for value in sorted(secrets, key=len, reverse=True):
-        text = text.replace(value, f"[redacted: {secrets[value]}]")
-    return text
-
-
 def _parse_frontmatter(path: Path) -> dict[str, str]:
     fields: dict[str, str] = {}
     try:
@@ -99,13 +92,20 @@ def _entry_flags(entry: dict) -> str:
     return flags
 
 
+_INDEX_TITLE_LENGTH = 48
+
+
+def _ellipsize(value: str, length: int) -> str:
+    return value if len(value) <= length else value[: length - 1].rstrip() + "…"
+
+
 def _index_rows(entries: list[dict]) -> list[str]:
-    rows = ["| Note | Tags | Modified | |", "|---|---|---|---|"]
+    rows = ["| ID | Modified | | Note |", "|---|---|---|---|"]
     for e in entries:
-        title = e["title"].replace("|", "\\|")
+        title = _ellipsize(e["title"].replace("|", "\\|"), _INDEX_TITLE_LENGTH)
         link = f"[{title}]({e['path']})" if e["path"] else title
-        modified = (e["modified"] or "")[:10]
-        rows.append(f"| {link} | {', '.join(e['tags'])} | {modified} | {_entry_flags(e)} |")
+        # The short id resolves anywhere a note id is accepted (git-style prefix).
+        rows.append(f"| `{e['id'][:8].lower()}` | {(e['modified'] or '')[:10]} | {_entry_flags(e)} | {link} |")
     return rows
 
 
@@ -121,16 +121,20 @@ def _index_markdown(entries: list[dict]) -> str:
         f"{len(entries)} notes · 📎 attachments · 🔒 encrypted · 🗄 archived",
         "",
     ]
-    pinned = [e for e in entries if e["pinned"]]
+    archived = [e for e in entries if e["archived"]]
+    active = [e for e in entries if not e["archived"]]
+    pinned = [e for e in active if e["pinned"]]
     if pinned:
         lines += ["## 📌 Pinned", ""] + _index_rows(pinned) + [""]
-    rest = [e for e in entries if not e["pinned"]]
+    rest = [e for e in active if not e["pinned"]]
     by_year: dict[str, list[dict]] = {}
     for e in rest:
         year = e["modified"][:4] if e["modified"] else "Undated"
         by_year.setdefault(year, []).append(e)
     for year in sorted(by_year, reverse=True):
         lines += [f"## {year}", ""] + _index_rows(by_year[year]) + [""]
+    if archived:
+        lines += ["## 🗄 Archived", ""] + _index_rows(archived) + [""]
     return "\n".join(lines)
 
 
@@ -145,12 +149,7 @@ def _write_if_changed(path: Path, content: str) -> bool:
 
 
 def _rewrite_refs(note: Note) -> str:
-    text = note.text or ""
-    for att in note.attachments:
-        target = quote(f"{ATTACHMENTS_DIRNAME}/{att.filename}")
-        for ref in {att.filename, quote(att.filename)}:
-            text = text.replace(f"]({ref})", f"]({target})")
-    return text
+    return rewrite_attachment_refs(note, lambda att: f"{ATTACHMENTS_DIRNAME}/{att.filename}")
 
 
 def export_notes(
@@ -181,20 +180,7 @@ def export_notes(
     entries: list[dict] = []
 
     def add_entry(note: Note, path: str | None, attachments: bool) -> None:
-        entries.append(
-            {
-                "id": note.id,
-                "title": note.title,
-                "path": path,
-                "tags": note.tags,
-                "created": note.created.isoformat() if note.created else None,
-                "modified": note.modified.isoformat() if note.modified else None,
-                "pinned": note.pinned,
-                "encrypted": note.encrypted,
-                "archived": note.archived,
-                "attachments": attachments,
-            }
-        )
+        entries.append({**note_metadata(note), "path": path, "attachments": attachments})
 
     for position, summary in enumerate(summaries, start=1):
         report(f"[{position}/{len(summaries)}] {summary.title}")
@@ -228,7 +214,7 @@ def export_notes(
 
         text = _rewrite_refs(note)
         if note_secrets:
-            text = _apply_redactions(text, note_secrets)
+            text = redact_text(text, note_secrets)
         note_dir.mkdir(exist_ok=True)
         note_path.write_text(f"{_frontmatter(note, redacted=bool(note_secrets))}\n{text}\n")
 
@@ -256,10 +242,7 @@ def export_notes(
 
     report("Writing index…")
     index_path = dest / "README.md"
-    if index_path.exists() and _parse_frontmatter(index_path).get("generated-by") != "bearcli":
-        result.index_skipped = True
-    else:
-        result.index_updated = _write_if_changed(index_path, _index_markdown(entries))
+    result.index_updated = _write_if_changed(index_path, _index_markdown(entries))
     result.index_updated |= _write_if_changed(
         dest / "index.json",
         json.dumps(sorted(entries, key=lambda e: e["title"].lower()), indent=2, ensure_ascii=False) + "\n",

bearcli-1.2.1/src/bearcli/markdown.py

@@ -0,0 +1,25 @@
+"""Helpers for Bear's markdown conventions, shared by get and export."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from urllib.parse import quote
+
+from bearcli.db import Attachment, Note
+
+
+def rewrite_attachment_refs(note: Note, target_for: Callable[[Attachment], str]) -> str:
+    """Rewrite bare attachment filename links to per-attachment targets.
+
+    Bear references attachments by bare filename and percent-encodes it in the
+    note text (spaces as %20), so both the raw and encoded forms must be
+    matched; targets are emitted percent-encoded to keep the links valid.
+    Only filenames known from the attachment records are rewritten — regular
+    URLs in the text are never touched.
+    """
+    text = note.text or ""
+    for att in note.attachments:
+        target = quote(target_for(att))
+        for ref in {att.filename, quote(att.filename)}:
+            text = text.replace(f"]({ref})", f"]({target})")
+    return text

bearcli-1.2.1/src/bearcli/secrets.py

@@ -0,0 +1,203 @@
+"""Secret detection over note text, powered by detect-secrets (Yelp) plus
+note-specific detectors.
+
+A first line of defense before notes leave the machine via export. Everything
+runs offline — note content is never sent anywhere. detect-secrets provides
+the format detectors (AWS, GitHub, Slack, Stripe, private keys, JWTs, keyword
+assignments, …); two gaps matter for prose notes and are covered here:
+
+- detect-secrets' entropy plugins only match *quoted* strings, which pasted
+  keys in notes never are — so unquoted token runs get their own entropy scan.
+- Credentials in notes often sit on the line *below* a label ("Client
+  secret:" then the value, often inside a code fence) — a look-ahead rule
+  catches those.
+
+Secrets written as prose are still undetectable; for deeper auditing run
+gitleaks over an --allow-secrets export.
+"""
+
+from __future__ import annotations
+
+import math
+import re
+from dataclasses import dataclass
+
+from detect_secrets.core.plugins.util import get_mapping_from_secret_type_to_class
+from detect_secrets.filters import heuristic
+from detect_secrets.plugins.base import BasePlugin
+
+from bearcli.db import Note
+
+# IPPublicDetector: an IP address in a note is not a credential.
+# The entropy plugins only match quoted strings — replaced by _scan_entropy.
+_EXCLUDED_PLUGINS = {"IPPublicDetector", "Base64HighEntropyString", "HexHighEntropyString"}
+
+_BASE64_ENTROPY_LIMIT = 4.5  # detect-secrets' default
+_HEX_ENTROPY_LIMIT = 3.5  # above default (3.0): notes are full of UUID/hash fragments
+
+# A contiguous credential-looking run: base64/urlsafe chars plus the '.' that
+# joins JWT segments. 20+ chars keeps ordinary words and short ids out.
+_TOKEN_RUN = re.compile(r"[A-Za-z0-9+/\-_=.]{20,}")
+_HEX_ONLY = re.compile(r"^[0-9a-fA-F]+$")
+
+# "Client secret:" / "Access token" style label with nothing after it — the
+# value is expected on the next content line (code fences skipped).
+_LABEL_ONLY = re.compile(
+    r"(?i)^\s*\**(?:client\s+secret|secret\s+access\s+key|access\s+token|auth\s+token|refresh\s+token"
+    r"|api\s*-?\s*key|access\s+key|private\s+key|secret|password|passwd|pwd|token)\s*\**\s*[:=]?\s*$"
+)
+_FENCE = re.compile(r"^\s*(?:```|~~~)")
+_TRIM_PUNCT = "()[]{}<>«»\"'`,;|"
+
+
+def _build_plugins() -> list[BasePlugin]:
+    return [cls() for cls in get_mapping_from_secret_type_to_class().values() if cls.__name__ not in _EXCLUDED_PLUGINS]
+
+
+def _entropy(value: str) -> float:
+    counts = {char: value.count(char) for char in set(value)}
+    return -sum(n / len(value) * math.log2(n / len(value)) for n in counts.values())
+
+
+def _is_false_positive(value: str, line: str) -> bool:
+    return (
+        heuristic.is_potential_uuid(value)
+        or heuristic.is_sequential_string(value)
+        or heuristic.is_templated_secret(value)
+        or heuristic.is_likely_id_string(value, line)
+        or heuristic.is_not_alphanumeric_string(value)
+    )
+
+
+def _expand_to_token(line: str, value: str) -> str:
+    """Grow a detected value to the full unbroken token around it.
+
+    Format detectors can match only part of a longer credential (a JWT's
+    first two segments, say); redacting the partial match would leave the
+    rest behind.
+    """
+    start = line.find(value)
+    if start < 0:
+        return value
+    end = start + len(value)
+    while start > 0 and not line[start - 1].isspace():
+        start -= 1
+    while end < len(line) and not line[end].isspace():
+        end += 1
+    return line[start:end].strip(_TRIM_PUNCT)
+
+
+def _in_url(line: str, start: int) -> bool:
+    """Whether the token starting at `start` is part of a URL.
+
+    Long ids inside links (Google Docs, Notion, …) are high-entropy but are
+    shareable references, not credentials — flagging them would drown real
+    findings. Token-bearing URLs with known formats (Slack webhooks, …) are
+    still caught by their format detectors.
+    """
+    token_start = start
+    while token_start > 0 and not line[token_start - 1].isspace():
+        token_start -= 1
+    return "://" in line[token_start : start + 3]
+
+
+def _scan_entropy(line: str) -> list[str]:
+    hits = []
+    for match in _TOKEN_RUN.finditer(line):
+        if _in_url(line, match.start()):
+            continue
+        value = match.group().strip(_TRIM_PUNCT + ".=")
+        limit = _HEX_ENTROPY_LIMIT if _HEX_ONLY.fullmatch(value) else _BASE64_ENTROPY_LIMIT
+        if len(value) >= 20 and _entropy(value) >= limit:
+            hits.append(match.group())
+    return hits
+
+
+def _labeled_value(lines: list[str], label_index: int) -> tuple[int, str] | None:
+    """The first content line after a bare credential label, if it looks like a value."""
+    for offset in range(1, 4):
+        index = label_index + offset
+        if index >= len(lines):
+            return None
+        candidate = lines[index].strip()
+        if not candidate or _FENCE.match(candidate):
+            continue
+        candidate = candidate.strip(_TRIM_PUNCT)
+        if " " not in candidate and 8 <= len(candidate) <= 200:
+            return index, candidate
+        return None
+    return None
+
+
+@dataclass
+class SecretFinding:
+    note_id: str
+    note_title: str
+    rule: str
+    line: int
+    excerpt: str
+    secret: str  # raw value, for redaction only — never print this
+
+
+def _redact(value: str) -> str:
+    """Show enough to locate the secret in the note, never the secret itself."""
+    return f"{value[:8]}…" if len(value) > 12 else "…"
+
+
+def _scan_note(note: Note, plugins: list[BasePlugin]) -> list[SecretFinding]:
+    lines = list((note.text or "").splitlines())
+    seen: set[str] = set()
+    findings: list[SecretFinding] = []
+
+    def add(lineno: int, value: str, rule: str) -> None:
+        if value and value not in seen and not _is_false_positive(value, lines[lineno - 1]):
+            seen.add(value)
+            findings.append(
+                SecretFinding(
+                    note_id=note.id,
+                    note_title=note.title,
+                    rule=rule,
+                    line=lineno,
+                    excerpt=_redact(value),
+                    secret=value,
+                )
+            )
+
+    for lineno, line in enumerate(lines, start=1):
+        for plugin in plugins:
+            # The yaml filetype hint makes KeywordDetector accept unquoted
+            # `password: value` assignments, which is how notes write them.
+            for secret in plugin.analyze_line(filename="note.yaml", line=line, line_number=lineno):
+                add(lineno, _expand_to_token(line, secret.secret_value or ""), secret.type)
+        for value in _scan_entropy(line):
+            add(lineno, value, "High Entropy String")
+        if _LABEL_ONLY.match(line):
+            if labeled := _labeled_value(lines, lineno - 1):
+                value_index, value = labeled
+                add(value_index + 1, value, "Labeled Credential")
+    return findings
+
+
+def scan_notes(notes: list[Note]) -> list[SecretFinding]:
+    plugins = _build_plugins()
+    findings = []
+    for note in notes:
+        findings.extend(_scan_note(note, plugins))
+    return findings
+
+
+def redaction_map(findings: list[SecretFinding]) -> dict[str, dict[str, str]]:
+    """Per note id, the secret values to replace and the rule that found them."""
+    by_note: dict[str, dict[str, str]] = {}
+    for finding in findings:
+        if finding.secret:
+            by_note.setdefault(finding.note_id, {}).setdefault(finding.secret, finding.rule)
+    return by_note
+
+
+def redact_text(text: str, secrets: dict[str, str]) -> str:
+    """Replace each secret value with a placeholder naming the rule that found it."""
+    # Longest first, in case one detected value contains another.
+    for value in sorted(secrets, key=len, reverse=True):
+        text = text.replace(value, f"[redacted: {secrets[value]}]")
+    return text

bearcli-1.1.0/src/bearcli/secrets.py

@@ -1,105 +0,0 @@
-"""Secret detection over note text, powered by detect-secrets (Yelp).
-
-A first line of defense before notes leave the machine via export. Everything
-runs offline — note content is never sent anywhere. Format detectors cover
-known token shapes (AWS, GitHub, Slack, Stripe, OpenAI, private keys, JWTs,
-keyword assignments, …) and the entropy detectors catch random-looking
-strings with no known format. Secrets written as prose are undetectable; for
-deeper auditing run gitleaks over an --allow-secrets export.
-
-Implementation note: detect-secrets' `scan_line` helper is unsuitable — it
-enables eager search, which makes entropy plugins report every token — so
-plugins are instantiated and run directly, with the heuristic false-positive
-filters applied by hand.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-
-from detect_secrets.core.plugins.util import get_mapping_from_secret_type_to_class
-from detect_secrets.filters import heuristic
-from detect_secrets.plugins.base import BasePlugin
-
-from bearcli.db import Note
-
-# An IP address in a note is not a credential.
-_EXCLUDED_PLUGINS = {"IPPublicDetector"}
-_BASE64_ENTROPY_LIMIT = 4.5  # detect-secrets' default
-_HEX_ENTROPY_LIMIT = 3.5  # above default (3.0): notes are full of UUID/hash fragments
-
-
-def _build_plugins() -> list[BasePlugin]:
-    plugins: list[BasePlugin] = []
-    for cls in get_mapping_from_secret_type_to_class().values():
-        name = cls.__name__
-        if name in _EXCLUDED_PLUGINS:
-            continue
-        if name == "Base64HighEntropyString":
-            plugins.append(cls(_BASE64_ENTROPY_LIMIT))
-        elif name == "HexHighEntropyString":
-            plugins.append(cls(_HEX_ENTROPY_LIMIT))
-        else:
-            plugins.append(cls())
-    return plugins
-
-
-def _is_false_positive(value: str, line: str) -> bool:
-    return (
-        heuristic.is_potential_uuid(value)
-        or heuristic.is_sequential_string(value)
-        or heuristic.is_templated_secret(value)
-        or heuristic.is_likely_id_string(value, line)
-        or heuristic.is_not_alphanumeric_string(value)
-    )
-
-
-@dataclass
-class SecretFinding:
-    note_id: str
-    note_title: str
-    rule: str
-    line: int
-    excerpt: str
-    secret: str  # raw value, for redaction only — never print this
-
-
-def _redact(value: str) -> str:
-    """Show enough to locate the secret in the note, never the secret itself."""
-    return f"{value[:8]}…" if len(value) > 12 else "…"
-
-
-def scan_notes(notes: list[Note]) -> list[SecretFinding]:
-    plugins = _build_plugins()
-    findings = []
-    for note in notes:
-        seen: set[tuple[int, str]] = set()
-        for lineno, line in enumerate((note.text or "").splitlines(), start=1):
-            for plugin in plugins:
-                # The yaml filetype hint makes KeywordDetector accept unquoted
-                # `password: value` assignments, which is how notes write them.
-                for secret in plugin.analyze_line(filename="note.yaml", line=line, line_number=lineno):
-                    value = secret.secret_value or ""
-                    if _is_false_positive(value, line) or (lineno, value) in seen:
-                        continue
-                    seen.add((lineno, value))
-                    findings.append(
-                        SecretFinding(
-                            note_id=note.id,
-                            note_title=note.title,
-                            rule=secret.type,
-                            line=lineno,
-                            excerpt=_redact(value),
-                            secret=value,
-                        )
-                    )
-    return findings
-
-
-def redaction_map(findings: list[SecretFinding]) -> dict[str, dict[str, str]]:
-    """Per note id, the secret values to replace and the rule that found them."""
-    by_note: dict[str, dict[str, str]] = {}
-    for finding in findings:
-        if finding.secret:
-            by_note.setdefault(finding.note_id, {}).setdefault(finding.secret, finding.rule)
-    return by_note