rafter-cli 0.8.0__tar.gz → 0.8.2__tar.gz

{rafter_cli-0.8.0 → rafter_cli-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.8.0
+Version: 0.8.2
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team

{rafter_cli-0.8.0 → rafter_cli-0.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.8.0"
+version = "0.8.2"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.8.0 → rafter_cli-0.8.2}/rafter_cli/commands/agent.py

@@ -1424,7 +1424,14 @@ def _scan_file(file_path: str, engine: str, custom_patterns=None) -> list[ScanRe
         return [r] if r.matches else []
 
 
-def _scan_directory(dir_path: str, engine: str, scan_cfg=None, *, history: bool = False) -> list[ScanResult]:
+def _scan_directory(
+    dir_path: str,
+    engine: str,
+    scan_cfg=None,
+    *,
+    history: bool = False,
+    respect_gitignore: bool = True,
+) -> list[ScanResult]:
     custom = None
     exclude = None
     if scan_cfg:
@@ -1438,10 +1445,10 @@ def _scan_directory(dir_path: str, engine: str, scan_cfg=None, *, history: bool
             return [ScanResult(file=r.file, matches=r.matches) for r in results]
         except Exception:
             scanner = RegexScanner(custom)
-            return scanner.scan_directory(dir_path, exclude_paths=exclude)
+            return scanner.scan_directory(dir_path, exclude_paths=exclude, respect_gitignore=respect_gitignore)
     else:
         scanner = RegexScanner(custom)
-        return scanner.scan_directory(dir_path, exclude_paths=exclude)
+        return scanner.scan_directory(dir_path, exclude_paths=exclude, respect_gitignore=respect_gitignore)
 
 
 def _output_scan_results(
@@ -1674,6 +1681,7 @@ def scan(
     baseline: bool = typer.Option(False, "--baseline", help="Filter findings present in the saved baseline"),
     watch: bool = typer.Option(False, "--watch", help="Watch for file changes and re-scan on change"),
     history: bool = typer.Option(False, "--history", help="Scan git history for secrets (requires betterleaks engine)"),
+    gitignore: bool = typer.Option(True, "--gitignore/--no-gitignore", help="Respect .gitignore when walking the scan target (default: on)"),
 ):
     """Scan files or directories for secrets. [deprecated: use 'rafter secrets' instead]"""
     print(
@@ -1771,7 +1779,7 @@ def scan(
     if os.path.isdir(resolved_path):
         if not quiet:
             print(f"Scanning directory: {resolved_path} ({eng})", file=sys.stderr)
-        results = _scan_directory(resolved_path, eng, scan_cfg, history=history)
+        results = _scan_directory(resolved_path, eng, scan_cfg, history=history, respect_gitignore=gitignore)
     else:
         if not quiet:
             print(f"Scanning file: {resolved_path} ({eng})", file=sys.stderr)

{rafter_cli-0.8.0 → rafter_cli-0.8.2}/rafter_cli/commands/scan.py

@@ -96,6 +96,7 @@ def scan_local(
     baseline: bool = typer.Option(False, "--baseline", help="Filter findings present in the saved baseline"),
     watch: bool = typer.Option(False, "--watch", help="Watch for file changes and re-scan on change"),
     history: bool = typer.Option(False, "--history", help="Scan git history for secrets (requires betterleaks engine)"),
+    gitignore: bool = typer.Option(True, "--gitignore/--no-gitignore", help="Respect .gitignore when walking the scan target (default: on)"),
 ):
     """(deprecated alias for 'rafter secrets')."""
     from .agent import (
@@ -220,7 +221,7 @@ def scan_local(
     if os.path.isdir(resolved_path):
         if not quiet:
             print(f"Scanning directory: {resolved_path} ({eng})", file=sys.stderr)
-        results = _scan_directory(resolved_path, eng, scan_cfg, history=history)
+        results = _scan_directory(resolved_path, eng, scan_cfg, history=history, respect_gitignore=gitignore)
     else:
         if not quiet:
             print(f"Scanning file: {resolved_path} ({eng})", file=sys.stderr)
@@ -256,6 +257,7 @@ def secrets(
     baseline: bool = typer.Option(False, "--baseline", help="Filter findings present in the saved baseline"),
     watch: bool = typer.Option(False, "--watch", help="Watch for file changes and re-scan on change"),
     history: bool = typer.Option(False, "--history", help="Scan git history for secrets (requires betterleaks engine)"),
+    gitignore: bool = typer.Option(True, "--gitignore/--no-gitignore", help="Respect .gitignore when walking the scan target (default: on)"),
 ):
     """Scan files/directories for hardcoded secrets."""
     return scan_local(
@@ -269,4 +271,5 @@ def secrets(
         baseline=baseline,
         watch=watch,
         history=history,
+        gitignore=gitignore,
     )

{rafter_cli-0.8.0 → rafter_cli-0.8.2}/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.8.0
+version: 0.8.2
 homepage: https://rafter.so
 metadata:
   openclaw:
@@ -15,7 +15,7 @@ metadata:
       - name: RAFTER_API_KEY
         required: false
         description: API key for `rafter run` (remote SAST + SCA + agentic deep-dive). Without it, `rafter secrets` (local secrets scan) still works.
-last_updated: 2026-05-07
+last_updated: 2026-05-12
 ---
 
 # Rafter Security

{rafter_cli-0.8.0 → rafter_cli-0.8.2}/rafter_cli/scanners/regex_scanner.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import os
+import subprocess
 from dataclasses import dataclass, field
 from pathlib import Path
 
@@ -67,6 +68,7 @@ class RegexScanner:
         dir_path: str,
         exclude_paths: list[str] | None = None,
         max_depth: int = 10,
+        respect_gitignore: bool = True,
     ) -> list[ScanResult]:
         exclude = list(DEFAULT_EXCLUDE)
         if exclude_paths:
@@ -76,6 +78,8 @@ class RegexScanner:
                     exclude.append(cleaned)
 
         files = self._walk(dir_path, exclude, max_depth)
+        if respect_gitignore:
+            files = _filter_gitignored(files, dir_path)
         return self.scan_files(files)
 
     def scan_text(self, text: str) -> list[PatternMatch]:
@@ -110,3 +114,53 @@ class RegexScanner:
         except PermissionError:
             pass
         return files
+
+
+def _filter_gitignored(files: list[str], scan_root: str) -> list[str]:
+    """Drop files git would ignore relative to ``scan_root``.
+
+    Shells out to ``git check-ignore --stdin --no-index -z`` inside the scan
+    root's work tree so every gitignore semantic git supports (nested
+    .gitignores, negations, .git/info/exclude, the configured global excludes
+    file, the full pattern grammar) is honored exactly. Zero new
+    dependencies. Bails out silently — returning the input unchanged — when
+    git is missing or the scan root sits outside a work tree.
+    """
+    if not files:
+        return files
+    # Locate the work tree that owns scan_root.
+    try:
+        probe = subprocess.run(
+            ["git", "-C", scan_root, "rev-parse", "--show-toplevel"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return files
+    if probe.returncode != 0:
+        return files
+    work_tree = probe.stdout.strip()
+    if not work_tree:
+        return files
+
+    # Batch every candidate through one `git check-ignore --stdin` call.
+    # Null-delimited I/O preserves paths containing newlines / spaces.
+    stdin = ("\0".join(files) + "\0").encode("utf-8")
+    try:
+        result = subprocess.run(
+            ["git", "-C", work_tree, "check-ignore", "--stdin", "--no-index", "-z"],
+            input=stdin,
+            capture_output=True,
+            timeout=30,
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        return files
+    # Exit codes: 0 = at least one path ignored; 1 = none; 128 = error.
+    # Anything else => abandon the filter rather than break the scan.
+    if result.returncode not in (0, 1):
+        return files
+    ignored = {p.decode("utf-8") for p in result.stdout.split(b"\0") if p}
+    if not ignored:
+        return files
+    return [f for f in files if f not in ignored]