gitslip 0.1.0__tar.gz

gitslip-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 gitslip contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

gitslip-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: gitslip
+Version: 0.1.0
+Summary: Find files that slipped past .gitignore but are still tracked by git — and get the exact git rm --cached fix. Zero dependencies.
+Author: yyfjj
+License: MIT
+Project-URL: Homepage, https://github.com/jjdoor/gitslip-py
+Project-URL: Repository, https://github.com/jjdoor/gitslip-py
+Project-URL: Issues, https://github.com/jjdoor/gitslip-py/issues
+Keywords: git,gitignore,tracked,cli,lint,cleanup,repo-hygiene,pre-commit,devops
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# gitslip
+
+**Find files that slipped past `.gitignore` but are still tracked by git.** You
+add `*.log` or `.env` to `.gitignore`, but the file that was committed *before*
+the rule existed keeps getting tracked — git only ignores files it isn't
+already following. `gitslip` finds those leftovers and hands you the exact fix.
+
+```bash
+pipx run gitslip
+#  2 tracked files are ignored by your rules but still committed:
+#
+#    config/secrets.env
+#        ↳ .gitignore:7  *.env
+#    logs/app.log
+#        ↳ .gitignore:2  *.log
+#
+#  Fix — stop tracking them (keeps your local copy):
+#    git rm --cached -- config/secrets.env
+#    git rm --cached -- logs/app.log
+```
+
+Zero dependencies, pure standard library. Also available for Node:
+`npx gitslip` — byte-for-byte identical behaviour.
+
+## Why
+
+Adding a path to `.gitignore` does **nothing** to a file git already tracks.
+That's by design — but it means secrets, build artifacts and logs routinely sit
+in repos long after someone "gitignored" them. The usual `git rm --cached`
+fix-up is only run once someone *notices*, and a raw `grep` over `.gitignore`
+can't tell a still-tracked leftover from a file that's correctly excluded.
+
+`gitslip` answers one question precisely: **which tracked files do my own ignore
+rules say should be excluded?** It then prints the `git rm --cached` commands to
+untrack them (your working copy stays put).
+
+## How it works
+
+It defers all the matching to git, so negation rules (`!keep.log`), directory
+rules (`build/`), nested `.gitignore` files, `.git/info/exclude` and your global
+`core.excludesFile` are all handled correctly:
+
+1. **Detect** — `git ls-files -i -c --exclude-standard` lists files that are
+   both *tracked* and *ignored*. That's the authoritative slipped set.
+2. **Attribute** — for each one, `gitslip` names the rule that catches it
+   (`.gitignore:7  *.env`) by asking `git check-ignore` against an empty index
+   (tracked files are otherwise reported as "not ignored").
+
+No file matching logic of our own = no subtle disagreements with git.
+
+## Usage
+
+```bash
+gitslip                 # audit the whole repo (exit 1 if anything slipped)
+gitslip src/ config/    # limit the audit to pathspecs
+gitslip --json          # machine-readable, for CI
+gitslip --apply         # run the git rm --cached for you (keeps files on disk)
+```
+
+`--apply` only un-tracks; it never deletes your files. Review the diff and
+commit when you're happy:
+
+```bash
+gitslip --apply
+git commit -m "stop tracking ignored files"
+```
+
+### In CI
+
+```yaml
+- run: pipx run gitslip   # fails the job if a tracked file is gitignored
+```
+
+Exit codes: `0` clean · `1` slipped files found · `2` error (not a repo, git
+missing).
+
+## Install
+
+```bash
+pip install gitslip   # or `pipx run gitslip`
+npm i -g gitslip      # Node build, identical behaviour
+```
+
+Requires git on `PATH` and Python ≥ 3.8 (or Node ≥ 18).
+
+## License
+
+MIT

gitslip-0.1.0/README.md

@@ -0,0 +1,88 @@
+# gitslip
+
+**Find files that slipped past `.gitignore` but are still tracked by git.** You
+add `*.log` or `.env` to `.gitignore`, but the file that was committed *before*
+the rule existed keeps getting tracked — git only ignores files it isn't
+already following. `gitslip` finds those leftovers and hands you the exact fix.
+
+```bash
+pipx run gitslip
+#  2 tracked files are ignored by your rules but still committed:
+#
+#    config/secrets.env
+#        ↳ .gitignore:7  *.env
+#    logs/app.log
+#        ↳ .gitignore:2  *.log
+#
+#  Fix — stop tracking them (keeps your local copy):
+#    git rm --cached -- config/secrets.env
+#    git rm --cached -- logs/app.log
+```
+
+Zero dependencies, pure standard library. Also available for Node:
+`npx gitslip` — byte-for-byte identical behaviour.
+
+## Why
+
+Adding a path to `.gitignore` does **nothing** to a file git already tracks.
+That's by design — but it means secrets, build artifacts and logs routinely sit
+in repos long after someone "gitignored" them. The usual `git rm --cached`
+fix-up is only run once someone *notices*, and a raw `grep` over `.gitignore`
+can't tell a still-tracked leftover from a file that's correctly excluded.
+
+`gitslip` answers one question precisely: **which tracked files do my own ignore
+rules say should be excluded?** It then prints the `git rm --cached` commands to
+untrack them (your working copy stays put).
+
+## How it works
+
+It defers all the matching to git, so negation rules (`!keep.log`), directory
+rules (`build/`), nested `.gitignore` files, `.git/info/exclude` and your global
+`core.excludesFile` are all handled correctly:
+
+1. **Detect** — `git ls-files -i -c --exclude-standard` lists files that are
+   both *tracked* and *ignored*. That's the authoritative slipped set.
+2. **Attribute** — for each one, `gitslip` names the rule that catches it
+   (`.gitignore:7  *.env`) by asking `git check-ignore` against an empty index
+   (tracked files are otherwise reported as "not ignored").
+
+No file matching logic of our own = no subtle disagreements with git.
+
+## Usage
+
+```bash
+gitslip                 # audit the whole repo (exit 1 if anything slipped)
+gitslip src/ config/    # limit the audit to pathspecs
+gitslip --json          # machine-readable, for CI
+gitslip --apply         # run the git rm --cached for you (keeps files on disk)
+```
+
+`--apply` only un-tracks; it never deletes your files. Review the diff and
+commit when you're happy:
+
+```bash
+gitslip --apply
+git commit -m "stop tracking ignored files"
+```
+
+### In CI
+
+```yaml
+- run: pipx run gitslip   # fails the job if a tracked file is gitignored
+```
+
+Exit codes: `0` clean · `1` slipped files found · `2` error (not a repo, git
+missing).
+
+## Install
+
+```bash
+pip install gitslip   # or `pipx run gitslip`
+npm i -g gitslip      # Node build, identical behaviour
+```
+
+Requires git on `PATH` and Python ≥ 3.8 (or Node ≥ 18).
+
+## License
+
+MIT

gitslip-0.1.0/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "gitslip"
+version = "0.1.0"
+description = "Find files that slipped past .gitignore but are still tracked by git — and get the exact git rm --cached fix. Zero dependencies."
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "yyfjj" }]
+keywords = ["git", "gitignore", "tracked", "cli", "lint", "cleanup", "repo-hygiene", "pre-commit", "devops"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Topic :: Software Development :: Version Control :: Git",
+    "Topic :: Utilities",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/jjdoor/gitslip-py"
+Repository = "https://github.com/jjdoor/gitslip-py"
+Issues = "https://github.com/jjdoor/gitslip-py/issues"
+
+[project.scripts]
+gitslip = "gitslip.cli:main"
+
+[tool.setuptools]
+package-dir = { "" = "src" }
+
+[tool.setuptools.packages.find]
+where = ["src"]

gitslip-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

gitslip-0.1.0/src/gitslip/__init__.py

@@ -0,0 +1,3 @@
+"""gitslip — find files that slipped past .gitignore but are still tracked. Zero dependencies."""
+
+__version__ = "0.1.0"

gitslip-0.1.0/src/gitslip/__main__.py

@@ -0,0 +1,6 @@
+import sys
+
+from .cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())

gitslip-0.1.0/src/gitslip/cli.py

@@ -0,0 +1,116 @@
+import json
+import os
+import signal
+import sys
+
+from . import __version__
+from . import core
+from . import git as gitio
+
+
+def _paint():
+    use_color = sys.stdout.isatty() and not os.environ.get("NO_COLOR")
+
+    def col(c, s):
+        return f"\x1b[{c}m{s}\x1b[0m" if use_color else s
+
+    return {
+        "red": lambda s: col("31", s), "green": lambda s: col("32", s),
+        "yellow": lambda s: col("33", s), "dim": lambda s: col("2", s),
+        "bold": lambda s: col("1", s),
+    }
+
+
+def _help(p):
+    return (
+        f"{p['bold']('gitslip')} — find files that slipped past .gitignore but are still tracked by git.\n"
+        "\n"
+        "A file is \"slipped\" when git keeps tracking it even though your ignore rules say\n"
+        "to exclude it — usually committed before the rule existed, or force-added. The\n"
+        "classic case: a .env, build artifact or *.log that's quietly still in the repo.\n"
+        "\n"
+        f"{p['bold']('Usage')}\n"
+        "  gitslip [pathspec...]   Audit the repo; list tracked files your rules exclude\n"
+        "  gitslip --json          Machine-readable output (for CI)\n"
+        "  gitslip --apply         Stop tracking the slipped files (git rm --cached; keeps your copy)\n"
+        "  gitslip --help | --version\n"
+        "\n"
+        f"{p['bold']('Exit')}  0 clean · 1 slipped files found · 2 error\n"
+    )
+
+
+def main(argv=None):
+    # Restore default SIGPIPE so piping into `head` doesn't dump a traceback.
+    try:
+        signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+    except (AttributeError, ValueError):
+        pass
+
+    argv = list(sys.argv[1:] if argv is None else argv)
+    p = _paint()
+
+    def die(msg):
+        sys.stderr.write(p["red"](f"gitslip: {msg}\n"))
+        return 2
+
+    if "-h" in argv or "--help" in argv:
+        sys.stdout.write(_help(p))
+        return 0
+    if "-v" in argv or "--version" in argv:
+        sys.stdout.write(__version__ + "\n")
+        return 0
+
+    # Single pass: collect flags + pathspecs, honour a `--` terminator, and reject
+    # unknown options (so a typo'd `--aply` errors instead of silently scanning all).
+    as_json = False
+    apply = False
+    dd_seen = False
+    pathspecs = []
+    for a in argv:
+        if dd_seen:
+            pathspecs.append(a)
+        elif a == "--":
+            dd_seen = True
+        elif a == "--json":
+            as_json = True
+        elif a == "--apply":
+            apply = True
+        elif a in ("-h", "--help", "-v", "--version"):
+            continue
+        elif a.startswith("-"):
+            return die(f"unknown option: {a} (use -- to pass a path that starts with '-')")
+        else:
+            pathspecs.append(a)
+
+    if not gitio.git_available():
+        return die("git is not installed or not on PATH")
+    if not gitio.inside_repo():
+        return die("not inside a git repository")
+
+    try:
+        paths_bytes = gitio.slipped_paths_z(pathspecs)
+        paths = core.parse_nul_list(paths_bytes.decode("utf-8", "replace"))
+        attr = core.attribution_map(core.parse_check_ignore_z(gitio.attribution_z(paths_bytes))) if paths else {}
+        slips = core.build_slips(paths, attr)
+    except RuntimeError as e:
+        return die(str(e))
+
+    if apply:
+        if not slips:
+            sys.stdout.write(p["green"]("✓ nothing to fix\n"))
+            return 0
+        try:
+            gitio.untrack([s["path"] for s in slips])
+        except RuntimeError as e:
+            return die(str(e))
+        sys.stdout.write(p["green"](f"✓ untracked {len(slips)} file(s) — kept on disk. Commit to finish.\n"))
+        for s in slips:
+            sys.stdout.write(p["dim"](f"  - {s['path']}\n"))
+        return 0
+
+    if as_json:
+        sys.stdout.write(json.dumps(core.to_json(slips), indent=2, ensure_ascii=False) + "\n")
+        return 0 if not slips else 1
+
+    sys.stdout.write(core.format_report(slips, p) + "\n")
+    return 0 if not slips else 1

gitslip-0.1.0/src/gitslip/core.py

@@ -0,0 +1,118 @@
+"""gitslip core — pure parsing & reporting. No subprocess, no fs, no clock.
+
+A "slipped" file is one git is *tracking* even though your ignore rules say it
+should be excluded — it slipped into the repo before the rule existed, or was
+force-added. Detection is done by git itself (``git ls-files -i -c
+--exclude-standard``, which honours negations, directory rules and the global
+excludes); this module just parses git's NUL-delimited output, attaches the
+matching rule, and renders the report. All IO lives in git.py.
+
+Output is kept byte-for-byte identical to the Node build.
+"""
+
+import re
+
+# Plain paths that need no shell quoting. Use ``fullmatch`` (not a ``$`` anchor)
+# so a trailing newline can't sneak a match through — matching the JS regex.
+_PLAIN_PATH = re.compile(r"[A-Za-z0-9_./@%+=:,-]+")
+
+
+def parse_nul_list(text):
+    """Split a NUL-delimited blob into entries, dropping the empty tail."""
+    return [s for s in text.split("\0") if s != ""]
+
+
+def parse_check_ignore_z(text):
+    """Parse ``git check-ignore -v -z`` output into attribution records.
+
+    Each match is four NUL-terminated fields: source, linenum, pattern, path.
+    """
+    f = text.split("\0")
+    out = []
+    i = 0
+    while i + 3 < len(f):
+        source, line, pattern, path = f[i], f[i + 1], f[i + 2], f[i + 3]
+        i += 4
+        if path == "":
+            continue
+        out.append({"source": source, "line": (None if line == "" else int(line)),
+                    "pattern": pattern, "path": path})
+    return out
+
+
+def attribution_map(records):
+    """path -> {source, line, pattern}. Negations skipped; later records win."""
+    m = {}
+    for r in records:
+        if not r["pattern"] or r["pattern"].startswith("!"):
+            continue
+        m[r["path"]] = {"source": r["source"], "line": r["line"], "pattern": r["pattern"]}
+    return m
+
+
+def build_slips(paths, attr_map):
+    """Combine the slipped-path list with attribution, sorted by UTF-8 bytes."""
+    seen = set()
+    slips = []
+    for path in paths:
+        if path in seen:
+            continue
+        seen.add(path)
+        a = attr_map.get(path)
+        slips.append({
+            "path": path,
+            "source": a["source"] if a else None,
+            "line": a["line"] if a else None,
+            "pattern": a["pattern"] if a else None,
+        })
+    slips.sort(key=lambda s: s["path"].encode("utf-8"))
+    return slips
+
+
+def shell_quote(p):
+    """Shell-quote a path for a copy-pasteable command (POSIX single-quote)."""
+    if _PLAIN_PATH.fullmatch(p):
+        return p
+    return "'" + p.replace("'", "'\\''") + "'"
+
+
+def fix_commands(slips):
+    """The remediation commands: untrack each file but keep it on disk."""
+    return [f"git rm --cached -- {shell_quote(s['path'])}" for s in slips]
+
+
+def to_json(slips):
+    """Machine-readable result."""
+    return {
+        "slipped": [{"path": s["path"], "source": s["source"], "line": s["line"],
+                     "pattern": s["pattern"]} for s in slips],
+        "count": len(slips),
+    }
+
+
+# Identity palette — used by tests and when color is off. The real ANSI palette
+# is injected from the CLI so report rendering stays unit-testable.
+PLAIN = {"red": lambda s: s, "green": lambda s: s, "yellow": lambda s: s,
+         "dim": lambda s: s, "bold": lambda s: s}
+
+
+def format_report(slips, paint=None):
+    """Render the human report. ``paint`` is a palette of (str)->str colorizers,
+    injected so the exact text can be asserted in tests with PLAIN."""
+    p = paint or PLAIN
+    if not slips:
+        return p["green"]("✓ clean — no tracked file is matched by your ignore rules")
+    n = len(slips)
+    head = f"{n} tracked {'file is' if n == 1 else 'files are'} ignored by your rules but still committed:"
+    lines = [p["bold"](head), ""]
+    for s in slips:
+        lines.append("  " + p["yellow"](s["path"]))
+        if s["pattern"]:
+            lines.append("      " + p["dim"](f"↳ {s['source']}:{s['line']}  {s['pattern']}"))
+    lines.append("")
+    lines.append(p["bold"]("Fix — stop tracking them (keeps your local copy):"))
+    for cmd in fix_commands(slips):
+        lines.append(p["dim"]("  " + cmd))
+    lines.append("")
+    lines.append(p["dim"]("  or let gitslip do it:  gitslip --apply"))
+    return "\n".join(lines)

gitslip-0.1.0/src/gitslip/git.py

@@ -0,0 +1,77 @@
+"""gitslip IO — every call that shells out to git. No business logic here.
+
+Detection leans entirely on git so the gnarly bits (negation rules, directory
+patterns, nested .gitignore, the global excludesFile, .git/info/exclude) are
+git's problem, not ours. Rule attribution uses a throwaway empty index so
+check-ignore will name the matching pattern even for already-tracked paths (git
+otherwise short-circuits tracked files to "not ignored").
+"""
+
+import os
+import shutil
+import subprocess
+import tempfile
+
+
+def _git(args, **kw):
+    return subprocess.run(["git", *args], capture_output=True, **kw)
+
+
+def _err(r):
+    msg = (r.stderr or b"").decode("utf-8", "replace").strip()
+    return msg or f"exit {r.returncode}"
+
+
+def git_available():
+    try:
+        return _git(["--version"]).returncode == 0
+    except FileNotFoundError:
+        return False
+
+
+def inside_repo():
+    r = _git(["rev-parse", "--is-inside-work-tree"])
+    return r.returncode == 0 and r.stdout.decode("utf-8", "replace").strip() == "true"
+
+
+def slipped_paths_z(pathspecs):
+    """Authoritative slipped list: tracked (-c) AND ignored (-i), NUL-separated.
+
+    ``-i`` requires an exclude source, hence ``--exclude-standard``.
+    """
+    args = ["ls-files", "-i", "-c", "--exclude-standard", "-z"]
+    if pathspecs:
+        args += ["--", *pathspecs]
+    r = _git(args)
+    if r.returncode != 0:
+        raise RuntimeError("git ls-files failed: " + _err(r))
+    return r.stdout  # bytes
+
+
+def attribution_z(paths_bytes):
+    """Best-effort rule attribution. Runs check-ignore against an empty index
+    (GIT_INDEX_FILE -> a non-existent path git treats as empty and never writes)
+    so tracked paths aren't short-circuited. Returns '' on any failure."""
+    if not paths_bytes:
+        return ""
+    # A throwaway, guaranteed-fresh empty index — git never writes it (check-ignore
+    # is read-only) but mkdtemp rules out a stale/poisoned file at a fixed path.
+    tmpdir = tempfile.mkdtemp(prefix="gitslip-")
+    try:
+        env = {**os.environ, "GIT_INDEX_FILE": os.path.join(tmpdir, "index")}
+        r = _git(["check-ignore", "-v", "-z", "--stdin"], input=paths_bytes, env=env)
+        if r.returncode not in (0, 1):  # 128 / errors -> best-effort empty
+            return ""
+        return r.stdout.decode("utf-8", "replace")
+    finally:
+        shutil.rmtree(tmpdir, ignore_errors=True)
+
+
+def untrack(paths):
+    """Stop tracking the given paths (keeps the working-tree copy). Batched."""
+    batch = 100
+    for i in range(0, len(paths), batch):
+        chunk = paths[i:i + batch]
+        r = _git(["rm", "--cached", "--quiet", "--", *chunk])
+        if r.returncode != 0:
+            raise RuntimeError("git rm --cached failed: " + _err(r))

gitslip-0.1.0/src/gitslip.egg-info/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: gitslip
+Version: 0.1.0
+Summary: Find files that slipped past .gitignore but are still tracked by git — and get the exact git rm --cached fix. Zero dependencies.
+Author: yyfjj
+License: MIT
+Project-URL: Homepage, https://github.com/jjdoor/gitslip-py
+Project-URL: Repository, https://github.com/jjdoor/gitslip-py
+Project-URL: Issues, https://github.com/jjdoor/gitslip-py/issues
+Keywords: git,gitignore,tracked,cli,lint,cleanup,repo-hygiene,pre-commit,devops
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Topic :: Utilities
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# gitslip
+
+**Find files that slipped past `.gitignore` but are still tracked by git.** You
+add `*.log` or `.env` to `.gitignore`, but the file that was committed *before*
+the rule existed keeps getting tracked — git only ignores files it isn't
+already following. `gitslip` finds those leftovers and hands you the exact fix.
+
+```bash
+pipx run gitslip
+#  2 tracked files are ignored by your rules but still committed:
+#
+#    config/secrets.env
+#        ↳ .gitignore:7  *.env
+#    logs/app.log
+#        ↳ .gitignore:2  *.log
+#
+#  Fix — stop tracking them (keeps your local copy):
+#    git rm --cached -- config/secrets.env
+#    git rm --cached -- logs/app.log
+```
+
+Zero dependencies, pure standard library. Also available for Node:
+`npx gitslip` — byte-for-byte identical behaviour.
+
+## Why
+
+Adding a path to `.gitignore` does **nothing** to a file git already tracks.
+That's by design — but it means secrets, build artifacts and logs routinely sit
+in repos long after someone "gitignored" them. The usual `git rm --cached`
+fix-up is only run once someone *notices*, and a raw `grep` over `.gitignore`
+can't tell a still-tracked leftover from a file that's correctly excluded.
+
+`gitslip` answers one question precisely: **which tracked files do my own ignore
+rules say should be excluded?** It then prints the `git rm --cached` commands to
+untrack them (your working copy stays put).
+
+## How it works
+
+It defers all the matching to git, so negation rules (`!keep.log`), directory
+rules (`build/`), nested `.gitignore` files, `.git/info/exclude` and your global
+`core.excludesFile` are all handled correctly:
+
+1. **Detect** — `git ls-files -i -c --exclude-standard` lists files that are
+   both *tracked* and *ignored*. That's the authoritative slipped set.
+2. **Attribute** — for each one, `gitslip` names the rule that catches it
+   (`.gitignore:7  *.env`) by asking `git check-ignore` against an empty index
+   (tracked files are otherwise reported as "not ignored").
+
+No file matching logic of our own = no subtle disagreements with git.
+
+## Usage
+
+```bash
+gitslip                 # audit the whole repo (exit 1 if anything slipped)
+gitslip src/ config/    # limit the audit to pathspecs
+gitslip --json          # machine-readable, for CI
+gitslip --apply         # run the git rm --cached for you (keeps files on disk)
+```
+
+`--apply` only un-tracks; it never deletes your files. Review the diff and
+commit when you're happy:
+
+```bash
+gitslip --apply
+git commit -m "stop tracking ignored files"
+```
+
+### In CI
+
+```yaml
+- run: pipx run gitslip   # fails the job if a tracked file is gitignored
+```
+
+Exit codes: `0` clean · `1` slipped files found · `2` error (not a repo, git
+missing).
+
+## Install
+
+```bash
+pip install gitslip   # or `pipx run gitslip`
+npm i -g gitslip      # Node build, identical behaviour
+```
+
+Requires git on `PATH` and Python ≥ 3.8 (or Node ≥ 18).
+
+## License
+
+MIT

gitslip-0.1.0/src/gitslip.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+LICENSE
+README.md
+pyproject.toml
+src/gitslip/__init__.py
+src/gitslip/__main__.py
+src/gitslip/cli.py
+src/gitslip/core.py
+src/gitslip/git.py
+src/gitslip.egg-info/PKG-INFO
+src/gitslip.egg-info/SOURCES.txt
+src/gitslip.egg-info/dependency_links.txt
+src/gitslip.egg-info/entry_points.txt
+src/gitslip.egg-info/top_level.txt
+tests/test_core.py

gitslip-0.1.0/src/gitslip.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

gitslip-0.1.0/src/gitslip.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+gitslip = gitslip.cli:main

gitslip-0.1.0/src/gitslip.egg-info/top_level.txt

@@ -0,0 +1 @@
+gitslip

gitslip-0.1.0/tests/test_core.py

@@ -0,0 +1,107 @@
+import pytest
+
+from gitslip.core import (
+    parse_nul_list, parse_check_ignore_z, attribution_map, build_slips,
+    shell_quote, fix_commands, to_json, format_report,
+)
+
+
+def test_parse_nul_list_drops_trailing_empty():
+    assert parse_nul_list("a\0b/c\0d\0") == ["a", "b/c", "d"]
+    assert parse_nul_list("") == []
+    assert parse_nul_list("only\0") == ["only"]
+
+
+def test_parse_check_ignore_z_reads_groups():
+    text = ".gitignore\x001\x00*.log\x00app.log\x00.gitignore\x003\x00build/\x00build/out.o\x00"
+    assert parse_check_ignore_z(text) == [
+        {"source": ".gitignore", "line": 1, "pattern": "*.log", "path": "app.log"},
+        {"source": ".gitignore", "line": 3, "pattern": "build/", "path": "build/out.o"},
+    ]
+
+
+def test_parse_check_ignore_z_empty():
+    assert parse_check_ignore_z("") == []
+
+
+def test_attribution_map_skips_negation_and_last_wins():
+    recs = [
+        {"source": ".gitignore", "line": 1, "pattern": "*.log", "path": "a.log"},
+        {"source": ".gitignore", "line": 2, "pattern": "!keep.log", "path": "keep.log"},
+        {"source": ".gitignore", "line": 1, "pattern": "*.log", "path": "a.log"},
+    ]
+    m = attribution_map(recs)
+    assert m["a.log"] == {"source": ".gitignore", "line": 1, "pattern": "*.log"}
+    assert "keep.log" not in m
+
+
+def test_build_slips_merges_dedups_sorts():
+    paths = ["src/z.log", "a.log", "a.log"]
+    attr = {"a.log": {"source": ".gitignore", "line": 1, "pattern": "*.log"}}
+    slips = build_slips(paths, attr)
+    assert [s["path"] for s in slips] == ["a.log", "src/z.log"]
+    assert slips[0] == {"path": "a.log", "source": ".gitignore", "line": 1, "pattern": "*.log"}
+    assert slips[1] == {"path": "src/z.log", "source": None, "line": None, "pattern": None}
+
+
+def test_byte_order_sort_separators():
+    # 0x2e '.' < 0x2f '/' < 0x62 'b'
+    slips = build_slips(["a/b", "a.b", "ab"], {})
+    assert [s["path"] for s in slips] == ["a.b", "a/b", "ab"]
+
+
+def test_shell_quote():
+    assert shell_quote("src/app.log") == "src/app.log"
+    assert shell_quote("weird name.log") == "'weird name.log'"
+    assert shell_quote("it's.log") == "'it'\\''s.log'"
+
+
+def test_shell_quote_rejects_trailing_newline():
+    # fullmatch (not $) so a newline can't slip through unquoted — Node parity.
+    assert shell_quote("a\n") == "'a\n'"
+
+
+def test_fix_commands():
+    slips = [{"path": "a.log"}, {"path": "a b.log"}]
+    assert fix_commands(slips) == [
+        "git rm --cached -- a.log",
+        "git rm --cached -- 'a b.log'",
+    ]
+
+
+def test_to_json_shape():
+    slips = [{"path": "a.log", "source": ".gitignore", "line": 1, "pattern": "*.log"},
+             {"path": "b", "source": None, "line": None, "pattern": None}]
+    assert to_json(slips) == {
+        "slipped": [
+            {"path": "a.log", "source": ".gitignore", "line": 1, "pattern": "*.log"},
+            {"path": "b", "source": None, "line": None, "pattern": None},
+        ],
+        "count": 2,
+    }
+
+
+def test_format_report_clean():
+    assert format_report([]).startswith("✓ clean")
+
+
+def test_format_report_lists_and_fix():
+    slips = [{"path": "app.log", "source": ".gitignore", "line": 1, "pattern": "*.log"}]
+    out = format_report(slips)
+    assert "1 tracked file is ignored" in out
+    assert "app.log" in out
+    assert "↳ .gitignore:1  *.log" in out
+    assert "git rm --cached -- app.log" in out
+    assert "gitslip --apply" in out
+
+
+def test_format_report_plural_and_unattributed():
+    slips = [
+        {"path": "a.log", "source": None, "line": None, "pattern": None},
+        {"path": "b.log", "source": ".gitignore", "line": 1, "pattern": "*.log"},
+    ]
+    out = format_report(slips)
+    assert "2 tracked files are ignored" in out
+    lines = out.split("\n")
+    ai = next(i for i, l in enumerate(lines) if "a.log" in l)
+    assert "↳" not in lines[ai + 1]