lcode-cli 0.25.0__tar.gz → 0.26.0__tar.gz

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/CHANGELOG.md

@@ -6,6 +6,19 @@ All notable changes to lcode are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.26.0] - 2026-10-10
+
+### Added
+
+- lcode checks for secrets before the model runs `git commit` or `git push`: passwords, keys and
+  tokens in code or configuration, credentials in URLs (`rtsp://user:pass@…`), private keys,
+  tokens with a known form, and `.env` files, in the lines a commit adds or the commits a push
+  sends. In `ask` mode you decide; in `auto-edit` and `yolo` the command doesn't run, and the model
+  is told to move the secret out of the code. `/commit` and `/pr` show the findings before you
+  confirm, and the GitHub Action doesn't commit at all. `lcode: allow-secret` in a comment allows a
+  line; `secret_check = false` turns the check off. See
+  [Secrets in commits](https://nasser1941.github.io/lcode/usage/#secrets-in-commits).
+
 ## [0.25.0] - 2026-10-10
 
 ### Changed
@@ -540,7 +553,8 @@ First public release.
 - `AGENTS.md` project instructions and `/init` to generate them.
 - One-line installer for Linux and macOS.
 
-[Unreleased]: https://github.com/nasser1941/lcode/compare/v0.25.0...HEAD
+[Unreleased]: https://github.com/nasser1941/lcode/compare/v0.26.0...HEAD
+[0.26.0]: https://github.com/nasser1941/lcode/compare/v0.25.0...v0.26.0
 [0.25.0]: https://github.com/nasser1941/lcode/compare/v0.24.0...v0.25.0
 [0.24.0]: https://github.com/nasser1941/lcode/compare/v0.23.0...v0.24.0
 [0.23.0]: https://github.com/nasser1941/lcode/compare/v0.22.0...v0.23.0

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lcode-cli
-Version: 0.25.0
+Version: 0.26.0
 Summary: A local-first terminal coding agent powered by open-weight models on your own GPU or Mac, via Ollama.
 Project-URL: Homepage, https://nasser1941.github.io/lcode/
 Project-URL: Documentation, https://nasser1941.github.io/lcode/

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/docs/automation.md

@@ -90,6 +90,8 @@ with Session("path/to/repo", permission_mode="auto-edit") as session:
 - **Events while it runs:** `session.stream(prompt)` yields the events above, ending with the result.
 - **Permissions:** pass `approve` to decide permission requests. It gets
   `{"kind": "bash", "title": "…", "target": "pytest -q"}`; without it, every request is refused.
+  A `git commit` or `git push` that would add [what looks like a secret](usage.md#secrets-in-commits)
+  comes as `{"kind": "secret", …}` in `ask` mode, and doesn't run in the other modes.
 - **Options:** `model`, `context`, `permission_mode`, `allowed_tools`, `max_steps`, `think`,
   `web`, `memory`, `mcp` and `sandbox`. Leave one out to use your
   [configuration](configuration.md).

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/docs/configuration.md

@@ -43,6 +43,7 @@ lcode config path                      # print the file location
 | `notify` | `true` | A desktop [notification](usage.md#notifications) when a long request is done or waits for your answer |
 | `notify_after` | `30` | Seconds a request runs before it notifies |
 | `repeat_limit` | `3` | Identical tool calls with identical results before lcode [steps in](how-it-works.md#when-the-model-repeats-itself); `0` turns it off |
+| `secret_check` | `true` | Before `git commit` and `git push`, look for passwords, keys and tokens they'd add ([details](usage.md#secrets-in-commits)) |
 | `checkpoints` | `true` | Save a checkpoint before the model changes files, so [`/undo`](usage.md#undo-and-checkpoints) can restore them |
 
 Besides these settings, `config.toml` can hold [hooks](hooks.md) (`[[hooks]]`) and

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/docs/quickstart.md

@@ -12,7 +12,7 @@ lcode
 
 ```text
 ╭──────────────────────────────────────────────╮
-│ lcode v0.25.0 — local coding agent           │
+│ lcode v0.26.0 — local coding agent           │
 │                                              │
 │ model    lcode-qwen3.6-35b                   │
 │ context  256K tokens                         │

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/docs/usage.md

@@ -213,6 +213,39 @@ deny lists, per user or per repository; deny always wins, even in `yolo`. Text a
 With the [sandbox](sandbox.md) on, `auto-edit` mode runs shell commands without asking too: they can
 only reach the project, and `/undo` can take their changes back.
 
+### Secrets in commits
+
+Before the model runs `git commit` or `git push`, lcode checks what would go into the repository's
+history: the lines a commit adds (including files a `git add` in the same command stages), or every
+commit a push would send. It looks for:
+
+- passwords, keys and tokens written as values in code or configuration, like
+  `"password": "…"` or `API_KEY=…`;
+- credentials in addresses, like `rtsp://admin:…@192.168.1.10`;
+- private keys and tokens with a known form (GitHub, GitLab, AWS, Slack, OpenAI, Anthropic, xAI,
+  Google, Hugging Face, Stripe);
+- `.env` files.
+
+Placeholders such as `CHANGE_ME`, `your_password`, `${PASSWORD}` or `os.environ["PASSWORD"]` don't
+count.
+
+```text
+This commit would add what looks like a secret to the repository's history:
+- camera_wall.py:42: a password or key: "password": "Xk…"
+```
+
+- **In `ask` mode,** you decide: lcode shows the findings and the command.
+- **In `auto-edit` and `yolo`,** the command doesn't run. The model is told to read the secret from
+  an environment variable or a configuration file that git ignores, and to ask you if it isn't one.
+- **`/commit` and `/pr`** show the same findings before you confirm.
+- **The [GitHub Action](automation.md#github-action)** doesn't commit or push at all when it finds
+  one.
+
+If a line only looks like a secret, add `lcode: allow-secret` (or `gitleaks:allow`) in a comment
+on it. `lcode config set secret_check false` turns the check off. It's a safety net, not a full
+scanner: for a public repository, also run a tool such as [gitleaks](https://github.com/gitleaks/gitleaks)
+before you push.
+
 ## Plan mode
 
 Local models are slower than cloud models and make more mistakes, so on a bigger change it pays to

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/__init__.py

@@ -3,7 +3,7 @@
 From a program: `from lcode import Session` (see lcode.api).
 """
 
-__version__ = "0.25.0"
+__version__ = "0.26.0"
 
 API = ("Session", "Result", "Options", "SetupError")
 

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/action.py

@@ -302,7 +302,14 @@ def answer(hub: GitHub, task: Task, inputs: Inputs, cwd: Path) -> None:
         reply = result.text.strip() or "(no answer)"
         changed = git(cwd, "status", "--porcelain").strip()
         if changed:
-            from lcode import gitflow
+            from lcode import gitflow, secretscan
+
+            found = secretscan.in_files(cwd, ["."], staged=False)
+            if found:
+                raise ActionError(
+                    secretscan.report("commit", found, excerpts=False) + "\n\nSo lcode didn't commit or push its "
+                    "changes. Secrets belong in the repository's secrets or in configuration that git ignores."
+                )
 
             data = gitflow.ask(
                 session.agent,

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/agent.py

@@ -233,6 +233,7 @@ class Settings:
     notify: bool = False  # desktop notifications after long requests (lcode.notify)
     notify_after: int = 30  # seconds: a request this long notifies when it's done or waits for an answer
     max_parallel_agents: int = 1
+    secret_check: bool = True  # scan what git commit and git push would add (lcode.secretscan)
     repeat_limit: int = 3  # identical calls with identical results before the model is told (lcode.repeats)
 
 

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/api.py

@@ -194,6 +194,7 @@ def open_agent(cwd: Path, options: Options, console: Console, hw: Hardware | Non
         embed_model=cfg["embed_model"],
         notify=cfg["notify"],
         notify_after=cfg["notify_after"],
+        secret_check=cfg["secret_check"],
         repeat_limit=cfg["repeat_limit"],
     )
     agent = Agent(ollama, settings, cwd, console=console)

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/config.py

@@ -60,6 +60,7 @@ SETTINGS: dict[str, tuple[object, type, str]] = {
     "notify": (True, bool, "desktop notification when a long request is done or waits for you"),
     "notify_after": (30, int, "seconds a request runs before it notifies (with notify on)"),
     "repeat_limit": (3, int, "identical tool calls with identical results before lcode steps in (0: never)"),
+    "secret_check": (True, bool, "before git commit and git push, look for passwords, keys and tokens they'd add"),
     "max_parallel_agents": (1, int, "subagents that may run at the same time (more needs OLLAMA_NUM_PARALLEL)"),
 }
 ENV_OVERRIDES = {

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/gitflow.py

@@ -24,6 +24,7 @@ from typing import TYPE_CHECKING
 
 from rich.markup import escape
 from rich.panel import Panel
+from rich.text import Text
 
 if TYPE_CHECKING:
     from lcode.agent import Agent
@@ -316,6 +317,9 @@ def commit_command(agent: Agent, hint: str = "") -> None:
         chosen = [f for f in answer.get("files") or [] if f in paths]
         files = chosen or paths
     left_out = [p for p in paths if p not in files]
+    from lcode import secretscan
+
+    secrets_found = secretscan.in_files(root, files, bool(staged)) if agent.settings.secret_check else []
     while True:
         c.print(Panel(escape(message), title="Commit message", title_align="left", border_style="cyan"))
         c.print(f"  [bold]Files[/] {escape(', '.join(files))}")
@@ -323,6 +327,9 @@ def commit_command(agent: Agent, hint: str = "") -> None:
             c.print(f"  [dim]Left out (unrelated, the model thinks): {escape(', '.join(left_out))}[/]")
         if risky:
             c.print(f"  [dim]Left out (may hold secrets; stage them yourself if needed): {escape(', '.join(risky))}[/]")
+        if secrets_found:
+            c.print(Text(secretscan.report("commit", secrets_found), style="red"))
+            c.print("  [dim]Commit them only if they aren't secrets; otherwise move them out of the code first.[/]")
         choice = confirm(agent, "  [y] commit · [e] edit the message · [n] cancel: ", message)
         if choice == "e":
             from lcode.planning import edit_text
@@ -552,6 +559,14 @@ def pr_command(agent: Agent, arg: str = "") -> None:
 
 
 def push(agent: Agent, root: Path, remote: str, branch: str) -> bool:
+    from lcode import secretscan
+
+    found = secretscan.outgoing(root, branch) if agent.settings.secret_check else []
+    if found:
+        agent.console.print(Text(secretscan.report("push", found), style="red"))
+        if confirm(agent, "  Push anyway? [y]es / [n]o: ") != "y":
+            agent.console.print("Not pushed.")
+            return False
     try:
         with agent.console.status(f"Pushing {escape(branch)}…", spinner="dots"):
             git(root, "push", "-q", "-u", remote, branch, timeout=300)

lcode_cli-0.26.0/src/lcode/secretscan.py

@@ -0,0 +1,315 @@
+"""Stop secrets before they're committed or pushed.
+
+Before the model runs `git commit` or `git push`, lcode scans what that would add to the repository's
+history: the lines a commit adds (including files a `git add` in the same command stages), or every commit
+a push would send. Passwords and tokens in code, private keys, credentials in URLs (`rtsp://user:pass@…`)
+and `.env` files are reported with their file and line. In `ask` mode the user decides; in the other modes
+the command doesn't run, and the model is told to move the secret out of the code.
+
+A line that holds a value which only looks like a secret can carry `lcode: allow-secret` (or
+`gitleaks:allow`) in a comment, and is skipped.
+"""
+
+from __future__ import annotations
+
+import re
+import shlex
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+
+from lcode.memory import SECRET_PATTERNS
+
+ALLOW = ("lcode: allow-secret", "lcode:allow-secret", "gitleaks:allow")
+MAX_FINDINGS = 10
+GIT_TIMEOUT = 20
+MAX_FILE = 1_000_000  # bytes of an untracked file that are scanned
+
+# Values that only stand in for a secret.
+PLACEHOLDER = re.compile(
+    r"^(?:change[_-]?me\w*|your[_-]?\w*|x+|\*+|\.+|…+|<[^>]*>"
+    r"|(?:dummy|example|placeholder|redacted|secret|password|passwd|pass|pwd|token|test|changeit|none|null"
+    r"|true|false|required|optional|hidden|masked)(?:[_-]?here)?)$",
+    re.I,
+)
+# Words that only appear in made-up values: "change-me-in-production", "test-token", "example-key"…
+FAKE_WORDS = (
+    "example",
+    "sample",
+    "dummy",
+    "fake",
+    "changeme",
+    "change-me",
+    "change_me",
+    "placeholder",
+    "redacted",
+    "test",
+)
+# A password, key or token written in code or configuration as a literal value.
+ASSIGNED = re.compile(
+    r"""(?P<name>\b[\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|private[_-]?key"""
+    r"""|client[_-]?secret)[\w.-]*)['"]?\s*(?::|=|:=|=>)\s*(?P<quote>['"]?)(?P<value>[^\s'"`,;)}\]]{6,})"""
+    r"""(?P=quote)""",
+    re.I,
+)
+# Names that hold something about a secret (where it is, how it looks), not the secret itself.
+ABOUT = re.compile(
+    r"(?:url|uri|endpoint|file|path|dir|env|var|variable|name|field|header|type|label|prompt|hint|length|len|min|"
+    r"max|policy|pattern|regex|format|count|expires?|expiry|ttl|timeout|limit|required|enabled|hash|salt_rounds)$",
+    re.I,
+)
+EXTRA = [
+    ("an xAI API key", re.compile(r"\bxai-[A-Za-z0-9]{20,}")),
+    ("a Hugging Face token", re.compile(r"\bhf_[A-Za-z0-9]{30,}")),
+    ("a Stripe key", re.compile(r"\b(?:sk|rk)_live_[A-Za-z0-9]{20,}")),
+]
+CONFIG_FILES = re.compile(r"(?:\.(?:env|ini|cfg|conf|config|properties|ya?ml|toml)|(?:^|/)\.env[\w.-]*)$", re.I)
+URL_PASSWORD = re.compile(r"\b[a-z][a-z0-9+.\-]*://(?P<user>[^\s/:@'\"]+):(?P<value>[^\s/@'\"]+)@", re.I)
+STRONG = [p for p in SECRET_PATTERNS if p[0] not in ("a password in a URL", "a password or key")] + EXTRA
+ENV_FILE = re.compile(r"(?:^|/)\.env(?:\.[\w-]+)?$")
+ENV_EXAMPLES = re.compile(r"\.(?:example|sample|template|dist|defaults?)$")
+
+
+@dataclass
+class Finding:
+    path: str
+    line: int  # 0: the whole file
+    label: str  # what it looks like, e.g. "a password"
+    excerpt: str  # the line, with the secret masked
+    commit: str = ""  # for a push: the commit that adds it
+
+    def describe(self, excerpt: bool = True) -> str:
+        where = f"{self.path}:{self.line}" if self.line else self.path
+        if self.commit:
+            where += f" (commit {self.commit})"
+        return f"{where}: {self.label}" + (f": {self.excerpt}" if self.excerpt and excerpt else "")
+
+
+def mask(value: str) -> str:
+    return value[:2] + "…" if len(value) > 4 else "…"
+
+
+def placeholder(value: str) -> bool:
+    """A value that stands in for a secret: CHANGE_ME, <token>, ${PASSWORD}, a path, a web address…"""
+    if PLACEHOLDER.match(value) or any(c in value for c in "{}$%<>"):
+        return True
+    if any(word in value.lower() for word in FAKE_WORDS):
+        return True
+    return value.startswith(("/", "./", "~/", "http:", "https:", "os.", "process.env", "env."))
+
+
+def scan_line(text: str, config: bool = False) -> tuple[str, str] | None:
+    """What kind of secret the line holds, and the line with it masked. In configuration files (`config`) a
+    value counts without quotes too, as in `PASSWORD=hunter22` or `password: hunter22`."""
+    if any(marker in text for marker in ALLOW):
+        return None
+    shown = text.strip()[:160]
+    for label, pattern in STRONG:
+        found = pattern.search(text)
+        if found:
+            return label, shown.replace(found.group(0), mask(found.group(0)))
+    found = URL_PASSWORD.search(text)
+    if found and not placeholder(found.group("value")) and not placeholder(found.group("user")):
+        return "a password in a URL", shown.replace(found.group("value"), mask(found.group("value")))
+    for found in ASSIGNED.finditer(text):
+        value = found.group("value")
+        if placeholder(value) or ABOUT.search(found.group("name")):
+            continue
+        if not found.group("quote") and not (config and re.match(r"^\s*(?:export\s+)?[\w.-]+\s*[:=]", text)):
+            continue  # in code, only a quoted literal is a value: `password = args.password` isn't one
+        return "a password or key", shown.replace(value, mask(value))
+    return None
+
+
+def scan_file(path: str, lines: list[tuple[int, str]], commit: str = "") -> list[Finding]:
+    if ENV_FILE.search(path) and not ENV_EXAMPLES.search(path):
+        return [Finding(path, 0, "an environment file (.env), which usually holds secrets", "", commit)]
+    findings = []
+    config = bool(CONFIG_FILES.search(path))
+    for number, text in lines:
+        hit = scan_line(text, config)
+        if hit:
+            findings.append(Finding(path, number, hit[0], hit[1], commit))
+    return findings
+
+
+def scan_diff(diff: str) -> list[Finding]:
+    """The secrets in the lines a unified diff adds (`git diff`, or `git log -p` with commit: lines)."""
+    findings: list[Finding] = []
+    path, number, commit = "", 0, ""
+    added: list[tuple[int, str]] = []
+
+    def flush() -> None:
+        if path and (added or ENV_FILE.search(path)):
+            findings.extend(scan_file(path, added, commit))
+        added.clear()
+
+    for line in diff.splitlines():
+        if line.startswith("commit:"):
+            flush()
+            commit, path = line.split(":", 1)[1].strip(), ""
+        elif line.startswith("+++ "):
+            flush()
+            target = line[4:].strip()
+            path = "" if target == "/dev/null" else target.removeprefix("b/")
+        elif line.startswith("@@"):
+            hunk = re.search(r"\+(\d+)", line)
+            number = int(hunk.group(1)) if hunk else 0
+        elif line.startswith("+") and path:
+            added.append((number, line[1:]))
+            number += 1
+        elif line.startswith(" "):
+            number += 1
+    flush()
+    return findings
+
+
+def git(cwd: Path, *args: str) -> str:
+    try:
+        done = subprocess.run(
+            ["git", *args], cwd=cwd, capture_output=True, text=True, errors="replace", timeout=GIT_TIMEOUT
+        )
+    except (OSError, subprocess.SubprocessError):
+        return ""
+    return done.stdout if done.returncode == 0 else ""
+
+
+GIT_VERB = re.compile(r"\bgit\b(?:\s+-[-\w=.]+(?:\s+[^\s'\"-]\S*)?)*\s+(commit|push)\b")
+
+
+@dataclass
+class GitSteps:
+    adds: list[list[str]]  # the arguments of each `git add`
+    commit: list[str] | None  # the arguments of `git commit`
+    push: list[str] | None  # the arguments of `git push`
+
+
+def git_steps(command: str) -> GitSteps | None:
+    """The git add, commit and push a shell command runs, or None when it commits and pushes nothing."""
+    steps = GitSteps([], None, None)
+    for segment in re.split(r"&&|\|\||;|\n|\|", command):
+        try:
+            words = shlex.split(segment)
+        except ValueError:
+            words = segment.split()
+        while words and re.fullmatch(r"\w+=\S*", words[0]):
+            words = words[1:]  # VAR=value in front
+        if len(words) < 2 or words[0] != "git":
+            continue
+        i = 1
+        while i < len(words) and words[i].startswith("-"):
+            i += 2 if words[i] in ("-C", "-c") else 1  # git -C dir / -c key=value
+        if i >= len(words):
+            continue
+        verb, rest = words[i].strip("'\""), words[i + 1 :]
+        if verb == "add":
+            steps.adds.append(rest)
+        elif verb == "commit":
+            steps.commit = rest
+        elif verb == "push":
+            steps.push = rest
+    # Inside quotes, as in bash -c "git add . && git commit …", sh -c or eval, what gets staged can't be told
+    # from the words: assume everything.
+    nested = [verb for m in re.finditer(r"(['\"])(.*?)\1", command, re.S) for verb in GIT_VERB.findall(m.group(2))]
+    if steps.commit is None and steps.push is None:
+        nested += GIT_VERB.findall(command)
+    if "commit" in nested:
+        steps.commit, steps.adds = ["--all"], [["."]]
+    if "push" in nested and steps.push is None:
+        steps.push = []
+    return steps if steps.commit is not None or steps.push is not None else None
+
+
+def untracked(cwd: Path, paths: list[str]) -> list[Finding]:
+    findings = []
+    for name in git(cwd, "ls-files", "--others", "--exclude-standard", "--", *paths).splitlines():
+        file = cwd / name
+        try:
+            if file.stat().st_size > MAX_FILE:
+                continue
+            text = file.read_text(errors="strict")
+        except (OSError, UnicodeDecodeError):
+            continue  # binary or unreadable
+        findings.extend(scan_file(name, list(enumerate(text.splitlines(), 1))))
+    return findings
+
+
+def to_commit(cwd: Path, steps: GitSteps) -> list[Finding]:
+    """What `git add` and `git commit` in the command would commit: the staged changes, plus what it stages."""
+    args = steps.commit or []
+    everything = any(a in ("-a", "--all") or re.fullmatch(r"-[a-zA-Z]*a[a-zA-Z]*", a) for a in args if a != "--amend")
+    findings = scan_diff(git(cwd, "diff", "--cached", "--no-color", "--no-ext-diff", "-U0"))
+    if everything:
+        findings += scan_diff(git(cwd, "diff", "--no-color", "--no-ext-diff", "-U0"))
+    for add in steps.adds:
+        options = [a for a in add if a.startswith("-")]
+        paths = [a for a in add if not a.startswith("-")] or (["."] if {"-A", "--all"} & set(options) else [])
+        if not paths and "-u" not in options and "--update" not in options:
+            continue
+        paths = paths or ["."]
+        findings += scan_diff(git(cwd, "diff", "--no-color", "--no-ext-diff", "-U0", "--", *paths))
+        if "-u" not in options and "--update" not in options:
+            findings += untracked(cwd, paths)
+    return findings
+
+
+def to_push(cwd: Path, steps: GitSteps) -> list[Finding]:
+    """The secrets in the commits a push would send that no remote has yet."""
+    refs = [a for a in (steps.push or []) if not a.startswith("-")]
+    branches = [r.split(":", 1)[0].lstrip("+") for r in refs[1:]] or ["HEAD"]
+    findings: list[Finding] = []
+    for branch in branches:
+        if not branch or not git(cwd, "rev-parse", "--verify", "--quiet", f"{branch}^{{commit}}").strip():
+            continue
+        log = git(
+            cwd, "log", "-p", "--no-color", "--no-ext-diff", "-U0", "--format=commit:%h", branch, "--not", "--remotes"
+        )
+        findings += scan_diff(log)
+    return findings
+
+
+def check(cwd: Path, command: str) -> tuple[str, list[Finding]]:
+    """('commit' or 'push', the secrets it would add to the history) for a shell command."""
+    steps = git_steps(command)
+    if steps is None or not git(cwd, "rev-parse", "--git-dir").strip():
+        return "", []
+    findings: list[Finding] = []
+    if steps.commit is not None:
+        findings += to_commit(cwd, steps)
+    if steps.push is not None:
+        findings += to_push(cwd, steps)
+    unique = list({(f.path, f.line, f.label): f for f in findings}.values())
+    return ("push" if steps.push is not None and steps.commit is None else "commit"), unique
+
+
+def in_files(cwd: Path, paths: list[str], staged: bool) -> list[Finding]:
+    """For lcode's /commit: the secrets in the staged changes, or in the changes to these files."""
+    if staged:
+        return scan_diff(git(cwd, "diff", "--cached", "--no-color", "--no-ext-diff", "-U0"))
+    if not paths:
+        return []
+    diffs = [
+        git(cwd, "diff", *staged_flag, "--no-color", "--no-ext-diff", "-U0", "--", *paths)
+        for staged_flag in ([], ["--cached"])
+    ]
+    return scan_diff("\n".join(diffs)) + untracked(cwd, paths)
+
+
+def outgoing(cwd: Path, branch: str = "HEAD") -> list[Finding]:
+    """For lcode's /pr: the secrets in the commits of `branch` that no remote has yet."""
+    return to_push(cwd, GitSteps([], None, ["origin", branch]))
+
+
+def report(action: str, findings: list[Finding], excerpts: bool = True) -> str:
+    """The findings, one per line; without `excerpts` for places others read, like a public comment."""
+    lines = [f"- {f.describe(excerpts)}" for f in findings[:MAX_FINDINGS]]
+    if len(findings) > MAX_FINDINGS:
+        lines.append(f"- … and {len(findings) - MAX_FINDINGS} more")
+    return f"This {action} would add what looks like a secret to the repository's history:\n" + "\n".join(lines)
+
+
+ADVICE = (
+    "lcode didn't run the command. Don't commit secrets: read them from an environment variable or from a "
+    "configuration file that git ignores (and commit an example with placeholders instead). If one of these "
+    "isn't a secret, tell the user: they decide."
+)

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/src/lcode/tools.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import difflib
 import fnmatch
+import hashlib
 import inspect
 import json
 import os
@@ -19,11 +20,12 @@ from collections.abc import Callable
 from pathlib import Path
 from typing import TYPE_CHECKING
 
+from rich.console import Group
 from rich.panel import Panel
 from rich.syntax import Syntax
 from rich.text import Text
 
-from lcode import web
+from lcode import secretscan, web
 from lcode.context import shorten
 from lcode.jobs import JobError, describe, stop_leftovers
 from lcode.permissions import bash_key, is_read_only
@@ -823,7 +825,28 @@ class Toolbox:
         verdict = self.agent.perms.rule("bash", command)
         if verdict is not None and not verdict[0]:  # deny rules apply to read-only commands too
             return verdict[1]
-        if not is_read_only(command) and not (sandbox and self.agent.perms.mode == "auto-edit") and verdict is None:
+        approved = False
+        if self.agent.settings.secret_check and not is_read_only(command):
+            action, found = secretscan.check(self.agent.cwd, command)
+            if found:
+                text = secretscan.report(action, found)
+                if self.agent.perms.mode != "ask":  # nobody looks at each command: it doesn't run
+                    self.console.print(Text(f"  ⎿ {text}", style="red"))
+                    return f"Error: lcode's secret check stopped this command. {text}\n\n{secretscan.ADVICE}"
+                body = Group(Text(text + "\n", style="red"), Syntax(command, "bash", theme="monokai", word_wrap=True))
+                key = "secret:" + hashlib.sha256(text.encode()).hexdigest()[:16]
+                ok, feedback = self.agent.perms.request(
+                    key, "secret", f"This {action} looks like it holds a secret", body, command
+                )
+                if not ok:
+                    return f"{feedback}\n\n{text}\n{secretscan.ADVICE}"
+                approved = True
+        if (
+            not approved
+            and not is_read_only(command)
+            and not (sandbox and self.agent.perms.mode == "auto-edit")
+            and verdict is None
+        ):
             body = Syntax(command, "bash", theme="monokai", word_wrap=True)
             where = "in the sandbox" if sandbox else f"in {self.agent.cwd}"
             ok, feedback = self.agent.perms.request(bash_key(command), "bash", f"Run command ({where})", body, command)

{lcode_cli-0.25.0 → lcode_cli-0.26.0}/tests/conftest.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import io
+import os
+import subprocess
 from pathlib import Path
 
 import pytest
@@ -106,3 +108,41 @@ def agent(make_agent) -> Agent:
 
 def output(agent: Agent) -> str:
     return agent.console.file.getvalue()
+
+
+def run(cwd, *args) -> str:
+    return subprocess.run(["git", *args], cwd=cwd, check=True, capture_output=True, text=True).stdout
+
+
+@pytest.fixture
+def git_repo(repo, tmp_path_factory, monkeypatch):
+    """The demo repository under git, with one commit on main and git isolated from the user's settings."""
+    home = tmp_path_factory.mktemp("home")
+    (home / "gitconfig").write_text("[user]\n\tname = Test\n\temail = test@example.com\n")
+    monkeypatch.setenv("GIT_CONFIG_GLOBAL", str(home / "gitconfig"))
+    monkeypatch.setenv("GIT_CONFIG_NOSYSTEM", "1")
+    (repo / ".gitignore").write_text("node_modules/\n")
+    run(repo, "init", "-q", "-b", "main")
+    run(repo, "add", "-A")
+    run(repo, "commit", "-q", "-m", "fix: start the demo")
+    return repo
+
+
+@pytest.fixture
+def github(git_repo, tmp_path_factory, monkeypatch):
+    """A bare repository as origin, and a stand-in gh that logs its arguments."""
+    remote = tmp_path_factory.mktemp("remote") / "demo.git"
+    run(remote.parent, "init", "-q", "--bare", "-b", "main", str(remote))
+    run(git_repo, "remote", "add", "origin", str(remote))
+    run(git_repo, "push", "-q", "-u", "origin", "main")
+    bin_dir = tmp_path_factory.mktemp("bin")
+    log = bin_dir / "gh.log"
+    gh = bin_dir / "gh"
+    gh.write_text(
+        f'#!/bin/sh\nprintf "%s\\n" "$*" >> {log}\n'
+        'if [ "$1 $2" = "pr view" ]; then exit 1; fi\n'
+        'if [ "$1 $2" = "pr create" ]; then echo https://github.com/acme/demo/pull/7; fi\n'
+    )
+    gh.chmod(0o755)
+    monkeypatch.setenv("PATH", f"{bin_dir}:{os.environ['PATH']}")
+    return remote, log