gitmole 0.3.0__tar.gz → 0.5.0__tar.gz

gitmole-0.5.0/PKG-INFO

@@ -0,0 +1,159 @@
+Metadata-Version: 2.4
+Name: gitmole
+Version: 0.5.0
+Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
+License: MIT
+Project-URL: Homepage, https://github.com/antvinni/gitmole
+Keywords: git,analysis,hotspots,code-age,repository,metrics
+Classifier: Environment :: Console
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Version Control :: Git
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: rich>=13
+Requires-Dist: lizard>=1.24
+Provides-Extra: plots
+Requires-Dist: git-of-theseus; extra == "plots"
+Dynamic: license-file
+
+<img src="https://raw.githubusercontent.com/antvinni/gitmole/main/docs/banner.svg" width="912" alt="gitmole">
+
+# gitmole
+
+A toolkit for digging into any cloned git repository: who works on it,
+where the risk is, how old the code is, whether the repo itself is healthy,
+and whether anything sensitive was ever committed.
+
+Any stack. Free. Offline. No token. No AI. Light.
+
+- **Free.** MIT licence, no paid tier, no account. The tools it runs are open source too.
+- **Any stack.** It reads what every repository has: the git log, git blame and the files themselves.
+- **Offline.** Everything runs against a clone on your machine. Nothing is uploaded, nothing phones home.
+- **No token.** A local clone needs no credentials. The optional `owner/repo` shortcut uses the `gh` login you already have, and you ask for it.
+- **No AI.** Every finding is a plain rule over counts you can recompute by hand. The same clone gives the same report every time.
+- **Light.** A 4,400-commit repository takes under thirty seconds. A few thousand lines of Python plus two libraries.
+
+## Install
+
+```bash
+# macOS, or Linux with Homebrew: gitmole and the three tools it runs
+brew tap antvinni/gitmole https://github.com/antvinni/gitmole
+brew trust antvinni/gitmole
+brew install gitmole
+
+# anywhere else: scc, git-sizer and betterleaks on your PATH, then
+pipx install gitmole
+```
+
+Linux package names, the release binaries, `--plots` and the pip caveats:
+[docs/install.md](https://github.com/antvinni/gitmole/blob/main/docs/install.md).
+
+## Usage
+
+```bash
+gitmole .                              # the clone you are in
+gitmole /path/to/clone                 # any local clone
+gitmole owner/repo                     # clones with gh into a temp dir first
+gitmole 'owner/*'                      # every non-archived repo of a user or org, one summary table
+
+gitmole . --markdown report.md         # the same report as a Markdown document
+gitmole . --json report.json           # every table, the watch list and the findings
+gitmole . --fail-on warning            # exit 3 if any finding is a warning or worse
+gitmole . --risk main --risk-threshold 5   # exit 3 if the files changed since main are too risky
+gitmole . --since 2y --full            # the current team, every row and column
+```
+
+A CI job that runs `gitmole . --fail-on critical --markdown - >> "$GITHUB_STEP_SUMMARY"`
+blocks on secrets in source files and still posts the report. Every option:
+[docs/cli.md](https://github.com/antvinni/gitmole/blob/main/docs/cli.md).
+
+## What you get
+
+Running `gitmole .` inside this repository:
+
+```text
+╭─ gitmole ────────────────────────────────────────────────────────────────────────────────────────╮
+│ 135 commits  ·  2026-09-15 → 2026-09-16  ·  1 identity  ·  branch main                           │
+│ 7,002 lines in 44 files  ·  Python, Ruby                                                         │
+│ most commits on Wed at 20:00  ·  4% of commits are fixes  ·  100% of surviving code from 2026    │
+│ 3 warnings, 1 note                                                                               │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
+╭─ Findings (4) ───────────────────────────────────────────────────────────────────────────────────╮
+│ ▲ Bus factor of one                                                                              │
+│   vinni wrote 100% of the code that survives today                                               │
+│   ↳ Pair someone with vinni on gitmole/ and build/ first; they are 100% and 100% theirs.         │
+│ ▲ Hotspots getting more complex                                                                  │
+│   4 of the 10 top source hotspots grew by 25% or more in a year: gitmole/render.py (+160%),      │
+│   gitmole/cli.py (+32%), gitmole/findings.py (+266%), gitmole/run.py (+26%)                      │
+│   ↳ Split gitmole/render.py before the next change; its complexity grew 160% in a year.          │
+│ ▲ Knowledge islands                                                                              │
+│   2 area(s) with at least 200 lines were written almost entirely by one person: gitmole/ (vinni  │
+│   100%); build/ (vinni 100%). That is 97% of all lines added                                     │
+│   ↳ Pair someone with vinni on gitmole/ first; it is the largest at 5,371 lines.                 │
+│ ● Bug magnets                                                                                    │
+│   4 file(s) were fixed 3+ times in the last six months: gitmole/cli.py (3 recent, 3 total);      │
+│   gitmole/findings.py (3 recent, 3 total); gitmole/render.py (3 recent, 3 total); gitmole/run.py │
+│   (3 recent, 3 total)                                                                            │
+│   ↳ Review gitmole/cli.py and gitmole/findings.py before the next release; expect the next bug   │
+│   there.                                                                                         │
+│ ✔ No secrets in history                                                                          │
+│   betterleaks scanned every commit on every branch                                               │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
+```
+
+Below that: a watch list of the five files where the next bug is most
+likely, with the reasons in words and a backtest of how the list would have
+done; then tables for people, the knowledge map, the timeline, hotspots with
+their complexity trend, change coupling, complex functions and repo health.
+The full report is in
+[docs/example.md](https://github.com/antvinni/gitmole/blob/main/docs/example.md),
+and every section is explained in
+[docs/output.md](https://github.com/antvinni/gitmole/blob/main/docs/output.md).
+
+## The tool set
+
+One tool per question; together they cover what a single command can tell
+you about a clone.
+
+| Question | Tool | Install |
+|---|---|---|
+| What is this repo, at a glance; who commits, when, how much churn | gitmole itself, from the git log | built in |
+| How big is the codebase, per language | [scc](https://github.com/boyter/scc) | brew |
+| Is the repo itself healthy (huge blobs, deep trees) | [git-sizer](https://github.com/github/git-sizer) | brew |
+| Where is the risk: hotspots, coupling, ownership | gitmole's own change analysis over `git log --numstat` | built in |
+| How old is the surviving code, per year and author | gitmole's own blame pass (one `git blame` per file at HEAD) | built in |
+| Code-age and survival plots over time | [git-of-theseus](https://github.com/erikbern/git-of-theseus) | pip, opt-in with `--plots` |
+| Per-function complexity, length, parameters; duplicated blocks with `--duplicates` | [lizard](https://github.com/terryyin/lizard) | pip, installed with gitmole; tracked code files only |
+| Have secrets ever been committed | [betterleaks](https://github.com/betterleaks/betterleaks) | brew |
+
+Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md).
+
+## Docs
+
+- [Install](https://github.com/antvinni/gitmole/blob/main/docs/install.md): macOS, Linux, pipx, the check, pinned releases.
+- [Command line](https://github.com/antvinni/gitmole/blob/main/docs/cli.md): every option, portfolio mode, exports and CI gates, big repositories.
+- [The report and the output files](https://github.com/antvinni/gitmole/blob/main/docs/output.md): what each section and each file means.
+- [Full example report](https://github.com/antvinni/gitmole/blob/main/docs/example.md): the whole `gitmole .` output for this repository.
+- [Why these tools](https://github.com/antvinni/gitmole/blob/main/docs/tools.md): the rationale, what was left out, licences.
+- [Development](https://github.com/antvinni/gitmole/blob/main/docs/development.md): setup, tests, releases, code layout.
+- [Contributing](https://github.com/antvinni/gitmole/blob/main/CONTRIBUTING.md): bugs, ideas, pull requests, security reports.
+
+## Safety
+
+- Everything is offline except the optional clone step, which uses your
+  existing gh auth. None of the tools send data anywhere.
+- Remote targets are cloned into a fresh temp directory. Local clones are
+  only read, but the log export and the secrets scan touch all branches.
+- Secret values never reach the output directory. betterleaks reports to
+  gitmole in memory, and gitmole stores a short keyed hash in place of the
+  value, the matched text and the commit message. The key is random, made
+  for that one report and never saved.
+
+## License
+
+[MIT](https://github.com/antvinni/gitmole/blob/main/LICENSE). gitmole runs
+the tools it wraps as separate processes and bundles none of them; their
+licences are listed in
+[docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md#licences).

gitmole-0.5.0/README.md

@@ -0,0 +1,139 @@
+<img src="https://raw.githubusercontent.com/antvinni/gitmole/main/docs/banner.svg" width="912" alt="gitmole">
+
+# gitmole
+
+A toolkit for digging into any cloned git repository: who works on it,
+where the risk is, how old the code is, whether the repo itself is healthy,
+and whether anything sensitive was ever committed.
+
+Any stack. Free. Offline. No token. No AI. Light.
+
+- **Free.** MIT licence, no paid tier, no account. The tools it runs are open source too.
+- **Any stack.** It reads what every repository has: the git log, git blame and the files themselves.
+- **Offline.** Everything runs against a clone on your machine. Nothing is uploaded, nothing phones home.
+- **No token.** A local clone needs no credentials. The optional `owner/repo` shortcut uses the `gh` login you already have, and you ask for it.
+- **No AI.** Every finding is a plain rule over counts you can recompute by hand. The same clone gives the same report every time.
+- **Light.** A 4,400-commit repository takes under thirty seconds. A few thousand lines of Python plus two libraries.
+
+## Install
+
+```bash
+# macOS, or Linux with Homebrew: gitmole and the three tools it runs
+brew tap antvinni/gitmole https://github.com/antvinni/gitmole
+brew trust antvinni/gitmole
+brew install gitmole
+
+# anywhere else: scc, git-sizer and betterleaks on your PATH, then
+pipx install gitmole
+```
+
+Linux package names, the release binaries, `--plots` and the pip caveats:
+[docs/install.md](https://github.com/antvinni/gitmole/blob/main/docs/install.md).
+
+## Usage
+
+```bash
+gitmole .                              # the clone you are in
+gitmole /path/to/clone                 # any local clone
+gitmole owner/repo                     # clones with gh into a temp dir first
+gitmole 'owner/*'                      # every non-archived repo of a user or org, one summary table
+
+gitmole . --markdown report.md         # the same report as a Markdown document
+gitmole . --json report.json           # every table, the watch list and the findings
+gitmole . --fail-on warning            # exit 3 if any finding is a warning or worse
+gitmole . --risk main --risk-threshold 5   # exit 3 if the files changed since main are too risky
+gitmole . --since 2y --full            # the current team, every row and column
+```
+
+A CI job that runs `gitmole . --fail-on critical --markdown - >> "$GITHUB_STEP_SUMMARY"`
+blocks on secrets in source files and still posts the report. Every option:
+[docs/cli.md](https://github.com/antvinni/gitmole/blob/main/docs/cli.md).
+
+## What you get
+
+Running `gitmole .` inside this repository:
+
+```text
+╭─ gitmole ────────────────────────────────────────────────────────────────────────────────────────╮
+│ 135 commits  ·  2026-09-15 → 2026-09-16  ·  1 identity  ·  branch main                           │
+│ 7,002 lines in 44 files  ·  Python, Ruby                                                         │
+│ most commits on Wed at 20:00  ·  4% of commits are fixes  ·  100% of surviving code from 2026    │
+│ 3 warnings, 1 note                                                                               │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
+╭─ Findings (4) ───────────────────────────────────────────────────────────────────────────────────╮
+│ ▲ Bus factor of one                                                                              │
+│   vinni wrote 100% of the code that survives today                                               │
+│   ↳ Pair someone with vinni on gitmole/ and build/ first; they are 100% and 100% theirs.         │
+│ ▲ Hotspots getting more complex                                                                  │
+│   4 of the 10 top source hotspots grew by 25% or more in a year: gitmole/render.py (+160%),      │
+│   gitmole/cli.py (+32%), gitmole/findings.py (+266%), gitmole/run.py (+26%)                      │
+│   ↳ Split gitmole/render.py before the next change; its complexity grew 160% in a year.          │
+│ ▲ Knowledge islands                                                                              │
+│   2 area(s) with at least 200 lines were written almost entirely by one person: gitmole/ (vinni  │
+│   100%); build/ (vinni 100%). That is 97% of all lines added                                     │
+│   ↳ Pair someone with vinni on gitmole/ first; it is the largest at 5,371 lines.                 │
+│ ● Bug magnets                                                                                    │
+│   4 file(s) were fixed 3+ times in the last six months: gitmole/cli.py (3 recent, 3 total);      │
+│   gitmole/findings.py (3 recent, 3 total); gitmole/render.py (3 recent, 3 total); gitmole/run.py │
+│   (3 recent, 3 total)                                                                            │
+│   ↳ Review gitmole/cli.py and gitmole/findings.py before the next release; expect the next bug   │
+│   there.                                                                                         │
+│ ✔ No secrets in history                                                                          │
+│   betterleaks scanned every commit on every branch                                               │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
+```
+
+Below that: a watch list of the five files where the next bug is most
+likely, with the reasons in words and a backtest of how the list would have
+done; then tables for people, the knowledge map, the timeline, hotspots with
+their complexity trend, change coupling, complex functions and repo health.
+The full report is in
+[docs/example.md](https://github.com/antvinni/gitmole/blob/main/docs/example.md),
+and every section is explained in
+[docs/output.md](https://github.com/antvinni/gitmole/blob/main/docs/output.md).
+
+## The tool set
+
+One tool per question; together they cover what a single command can tell
+you about a clone.
+
+| Question | Tool | Install |
+|---|---|---|
+| What is this repo, at a glance; who commits, when, how much churn | gitmole itself, from the git log | built in |
+| How big is the codebase, per language | [scc](https://github.com/boyter/scc) | brew |
+| Is the repo itself healthy (huge blobs, deep trees) | [git-sizer](https://github.com/github/git-sizer) | brew |
+| Where is the risk: hotspots, coupling, ownership | gitmole's own change analysis over `git log --numstat` | built in |
+| How old is the surviving code, per year and author | gitmole's own blame pass (one `git blame` per file at HEAD) | built in |
+| Code-age and survival plots over time | [git-of-theseus](https://github.com/erikbern/git-of-theseus) | pip, opt-in with `--plots` |
+| Per-function complexity, length, parameters; duplicated blocks with `--duplicates` | [lizard](https://github.com/terryyin/lizard) | pip, installed with gitmole; tracked code files only |
+| Have secrets ever been committed | [betterleaks](https://github.com/betterleaks/betterleaks) | brew |
+
+Why these and not others: [docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md).
+
+## Docs
+
+- [Install](https://github.com/antvinni/gitmole/blob/main/docs/install.md): macOS, Linux, pipx, the check, pinned releases.
+- [Command line](https://github.com/antvinni/gitmole/blob/main/docs/cli.md): every option, portfolio mode, exports and CI gates, big repositories.
+- [The report and the output files](https://github.com/antvinni/gitmole/blob/main/docs/output.md): what each section and each file means.
+- [Full example report](https://github.com/antvinni/gitmole/blob/main/docs/example.md): the whole `gitmole .` output for this repository.
+- [Why these tools](https://github.com/antvinni/gitmole/blob/main/docs/tools.md): the rationale, what was left out, licences.
+- [Development](https://github.com/antvinni/gitmole/blob/main/docs/development.md): setup, tests, releases, code layout.
+- [Contributing](https://github.com/antvinni/gitmole/blob/main/CONTRIBUTING.md): bugs, ideas, pull requests, security reports.
+
+## Safety
+
+- Everything is offline except the optional clone step, which uses your
+  existing gh auth. None of the tools send data anywhere.
+- Remote targets are cloned into a fresh temp directory. Local clones are
+  only read, but the log export and the secrets scan touch all branches.
+- Secret values never reach the output directory. betterleaks reports to
+  gitmole in memory, and gitmole stores a short keyed hash in place of the
+  value, the matched text and the commit message. The key is random, made
+  for that one report and never saved.
+
+## License
+
+[MIT](https://github.com/antvinni/gitmole/blob/main/LICENSE). gitmole runs
+the tools it wraps as separate processes and bundles none of them; their
+licences are listed in
+[docs/tools.md](https://github.com/antvinni/gitmole/blob/main/docs/tools.md#licences).

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.3.0"
+__version__ = "0.5.0"

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/cli.py

@@ -95,7 +95,7 @@ def main(argv=None, console: Console = None, tool_check=run.missing_tools, plann
     missing = tool_check(plots=args.plots)
     if missing:
         err.print("[red]missing tools:[/red] " + ", ".join(missing))
-        err.print("brew install scc git-sizer gitleaks; see README.md for other ways")
+        err.print("brew install scc git-sizer betterleaks; see README.md for other ways")
         return 2
     args.lizard = lizard_check()   # decided once, for every repository this run analyses
 

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/findings.py

@@ -45,7 +45,7 @@ def secrets_found(report: dict) -> list:
     groups = leaks.group(report.get("secrets") or [])
     source = [g for g in groups if not g["test"]]
     tests = [g for g in groups if g["test"]]
-    ignore = "Add the fingerprint of any false positive from secrets.json to .gitleaksignore in the repository."
+    ignore = "Add the fingerprint of any false positive from secrets.json to .betterleaksignore in the repository."
     out = []
     if source:
         out.append(_f("critical", f"{len(source)} secret(s) in history", _secret_statement(source),

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/leaks.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
-"""gitleaks, with the secret values kept out of the output directory.
+"""betterleaks, with the secret values kept out of the output directory.
 
-gitmole runs this as the gitleaks step: `python3 leaks.py OUT_JSON`, from inside the repository.
-gitleaks writes its JSON report to our stdout, so the raw report is never a file; each value is
+gitmole runs this as the betterleaks step: `python3 leaks.py OUT_JSON`, from inside the repository.
+betterleaks writes its JSON report to our stdout, so the raw report is never a file; each value is
 replaced by a short keyed hash (enough to tell one value repeated in many places from many values)
 and a flag for shapes that cannot be a live secret, and only that is written. The key is random,
 made for one report and never stored, so a hash in secrets.json cannot be checked against a list of
@@ -27,8 +27,9 @@ try:
 except ImportError:  # run as a script: the package directory is sys.path[0]
     import filetypes
 
-ARGV = ["gitleaks", "git", "--no-banner", "--report-format", "json", "--report-path", "-", "--exit-code", "0"]
-RAW_FIELDS = ("Secret", "Match", "Line", "Message")   # the value, the text around it, and the commit message, which can quote it
+ARGV = ["betterleaks", "git", "--no-banner", "--report-format", "json", "--report-path", "-", "--exit-code", "0"]
+# the value, the text around it, and the commit message, which can quote it; Attributes repeats the message
+RAW_FIELDS = ("Secret", "Match", "Line", "Message", "Attributes")
 
 # A version string (5.0.0-1667386184.dfbbb54) and a token shortened with an ellipsis are the only shapes
 # skipped. Nothing is skipped by prefix: a public and a private key of the same service often share one.
@@ -102,13 +103,13 @@ def main(argv=None) -> int:
         print("usage: leaks.py OUT_JSON", file=sys.stderr)
         return 2
     target = args[0]
-    # stderr is inherited, so gitleaks' own log lands in run.log as before
+    # stderr is inherited, so betterleaks' own log lands in run.log as before
     proc = subprocess.run(ARGV, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE)
     if proc.returncode != 0:
-        print(f"leaks.py: gitleaks exited {proc.returncode}; no report written", file=sys.stderr)
+        print(f"leaks.py: betterleaks exited {proc.returncode}; no report written", file=sys.stderr)
         return proc.returncode
     text = proc.stdout.decode("utf-8", "surrogateescape").strip()
-    rows = sanitise(json.loads(text) if text else [])
+    rows = sanitise((json.loads(text) if text else None) or [])   # a clean repository is reported as null
     fd, tmp = tempfile.mkstemp(dir=os.path.dirname(os.path.abspath(target)), prefix=".secrets-", suffix=".json")
     try:
         with os.fdopen(fd, "w", encoding="utf-8") as fh:

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/load.py

@@ -180,7 +180,7 @@ def parse_duplicates(text: str) -> dict:
 
 
 def parse_secrets(text: str) -> list:
-    """gitleaks rows as rule, file, short commit, line, fingerprint, the hashed value and the placeholder
+    """betterleaks rows as rule, file, short commit, line, fingerprint, the hashed value and the placeholder
     flag. A report written before values were hashed still has them: hash them here, keep nothing raw."""
     rows = json.loads(text) if text.strip() else []
     key = leaks.new_key()   # for an older report with raw values: one key per read, as the wrapper does per run
@@ -244,6 +244,9 @@ def load_report(out_dir: str, nested: bool = True) -> dict:
         "cohorts": parse_theseus(cohorts) if cohorts else {},
         "theseus_authors": surviving,
         "secrets": parse_secrets(_read(out_dir, "secrets.json")),
+        # the wrapper writes the file only when the scan finished, so a killed step or an old output
+        # directory leaves it missing, and the report must not claim a clean scan
+        "secrets_scanned": os.path.exists(os.path.join(out_dir, "secrets.json")),
         "activity": _read_json(out_dir, "activity.json", {}),
         "functions": parse_functions(_read(out_dir, "functions.csv")),
         "duplicates": parse_duplicates(_read(out_dir, "duplicates.txt")),

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/render.py

@@ -500,6 +500,19 @@ def secrets_line(report: dict) -> str:
     return line
 
 
+def secrets_pass(report: dict):
+    """The one check worth saying out loud when it passes: (title, detail) when the scan ran and found no
+    secret value, else None. Found values are findings already; a scan that did not run says nothing."""
+    rows = report.get("secrets") or []
+    if not report.get("secrets_scanned") or leaks.group(rows):
+        return None
+    detail = "betterleaks scanned every commit on every branch"
+    skipped = leaks.placeholders(rows)
+    if skipped:
+        detail += f"; {skipped} placeholder-shaped hit{'s' if skipped != 1 else ''} left out"
+    return "No secrets in history", detail
+
+
 # --- rich ------------------------------------------------------------------
 
 def header(report: dict, findings: list = ()) -> Panel:
@@ -519,8 +532,9 @@ def header(report: dict, findings: list = ()) -> Panel:
     return Panel(body, title=f"[bold]{s['name']}[/bold]", title_align="left", border_style="blue")
 
 
-def findings_panel(findings: list) -> Panel:
-    if not findings:
+def findings_panel(findings: list, report: dict = None) -> Panel:
+    passed = secrets_pass(report or {})
+    if not findings and not passed:
         return Panel(Text("Nothing flagged.", style="green"), title="Findings", title_align="left", border_style="green")
     grid = Table.grid(padding=(0, 1))
     grid.add_column(no_wrap=True)
@@ -533,7 +547,12 @@ def findings_panel(findings: list) -> Panel:
         for advice in g["advice"]:
             body.append(f"\n↳ {advice}", style="dim italic")
         grid.add_row(Text(SEVERITY_MARK[g["severity"]], style=style), body)
-    return Panel(grid, title=f"Findings ({len(findings)})", title_align="left", border_style=SEVERITY_STYLE[findings[0]["severity"]])
+    if passed:   # last: problems first, then the check that passed
+        if not findings:
+            grid.add_row(Text(""), Text("Nothing flagged.", style="green"))
+        grid.add_row(Text("✔", style="green"), Text(passed[0], style="green").append(f"\n{passed[1]}", style="dim"))
+    title = f"Findings ({len(findings)})" if findings else "Findings"
+    return Panel(grid, title=title, title_align="left", border_style=SEVERITY_STYLE[findings[0]["severity"]] if findings else "green")
 
 
 def cell_style(column: str, value: str):
@@ -619,7 +638,7 @@ def _partners(secs: list) -> dict:
 
 def report(report: dict, findings: list, console: Console, full: bool = False, risk: dict = None, base: str = None) -> None:
     console.print(header(report, findings))
-    console.print(findings_panel(findings))
+    console.print(findings_panel(findings, report))
     secs = sections(report, full=full, width=console.width)
     by_id = {s["id"]: s for s in secs}
     partners = _partners(secs) if console.width >= SIDE_BY_SIDE_MIN_WIDTH else {}
@@ -650,14 +669,15 @@ def _md_cell(cell: str) -> str:
     return cell.replace("|", "\\|").replace("\n", " ")
 
 
-def _md_findings(findings: list) -> list:
-    if not findings:
-        return ["Nothing flagged."]
-    out = []
+def _md_findings(findings: list, report: dict = None) -> list:
+    out = [] if findings else ["Nothing flagged."]
     for g in textfmt.group_findings(findings):
         line = f"- **{g['severity']}** {g['title']} — " + "; ".join(g["items"])
         line += "".join(f" _{advice}_" for advice in g["advice"])
         out.append(line)
+    passed = secrets_pass(report or {})
+    if passed:
+        out.append(f"- **ok** {passed[0]} — {passed[1]}")
     return out
 
 
@@ -668,7 +688,7 @@ def markdown(report: dict, findings: list, full: bool = False, risk: dict = None
            f"{s['lines']:,} lines in {s['files']} files · {', '.join(s['languages']) or 'unknown'}" + ("  " if s["pulse"] else ""),
            *([" · ".join(s["pulse"])] if s["pulse"] else []), "",
            "## Findings", ""]
-    out += _md_findings(findings)
+    out += _md_findings(findings, report)
     secs = sections(report, full=True if full else "markdown")
     if risk is not None:
         after = next((i for i, sec in enumerate(secs) if sec["id"] == "watch"), len(secs) - 1)
@@ -728,7 +748,7 @@ def portfolio_markdown(owner: str, reports: list) -> str:
         out.append(f"_{sec['note']}_")
     for name, rep, found in reports:
         out += ["", f"## {name}", ""]
-        out += _md_findings(found)
+        out += _md_findings(found, rep)
     return "\n".join(out) + "\n"
 
 

{gitmole-0.3.0 → gitmole-0.5.0}/gitmole/run.py

@@ -109,7 +109,7 @@ def env_path() -> str:
     return os.pathsep.join(parts + [os.environ.get("PATH", "")])
 
 
-REQUIRED_TOOLS = ["scc", "git-sizer", "gitleaks"]
+REQUIRED_TOOLS = ["scc", "git-sizer", "betterleaks"]
 PLOT_TOOLS = ["git-of-theseus-analyze"]
 
 
@@ -168,7 +168,7 @@ def plan(repo_dir: str, out_dir: str, branch: str = "HEAD", age: bool = True, pl
     steps = [
         {"name": "scc", "argv": ["scc", "--by-file", "--format", "json"], "stdout": o("size.json"), "deps": []},
         {"name": "git-sizer", "argv": ["git-sizer", "--verbose"], "stdout": o("repo-health.txt"), "deps": []},
-        {"name": "gitleaks", "argv": [sys.executable, LEAKS_SCRIPT, o("secrets.json")], "stdout": None, "deps": []},   # hashes the values before anything is written
+        {"name": "betterleaks", "argv": [sys.executable, LEAKS_SCRIPT, o("secrets.json")], "stdout": None, "deps": []},   # hashes the values before anything is written
         {"name": "git-log", "argv": [*filetypes.GIT, "log", "--all", "--use-mailmap", "--numstat", "--date=iso-strict", "--pretty=format:--%h--%ad--%aN--%s", "--no-renames"], "stdout": log, "deps": []},
         {"name": "change analysis", "argv": [sys.executable, MAAT_SCRIPT, log, out_dir, *type_args, *(["--now", now] if now else []), *(["--since", since] if since else []), "--aliases", o("meta.json")], "stdout": None, "deps": ["git-log"]},
     ]