secretshield 0.4.2__tar.gz → 0.5.0__tar.gz

{secretshield-0.4.2/secretshield.egg-info → secretshield-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.4.2
+Version: 0.5.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
 [Install](#installation) · [Demo](#demo) · [Quick start](#quick-start) · [Features](#what-secretshield-does) · [Docs below](#cli-reference)
@@ -272,6 +272,20 @@ format = "text"
 
 CLI flags always override the file.
 
+Prefer a plain `.gitignore`-style file instead of editing TOML? Drop a
+`.secretshieldignore` in the project root — one glob pattern per line,
+`#` comments and blank lines ignored, same idea as `.gitignore`:
+
+```text
+# .secretshieldignore
+vendor/
+*.min.js
+tests/fixtures/
+```
+
+Both `secretshield.toml`'s `[scan.ignore]` and `.secretshieldignore`
+can be used together — their patterns combine.
+
 ## Runtime configuration
 
 ```python
@@ -304,7 +318,7 @@ secretshield/
 ├── patterns.py, detector.py, redactor.py   # detection & redaction engine
 ├── guardian.py                              # stdout/stderr + logging protection
 ├── config.py, notifications.py               # runtime settings & safe warnings
-├── project_config.py, baseline.py              # secretshield.toml, --baseline
+├── project_config.py, baseline.py, ignorefile.py   # secretshield.toml, --baseline, .secretshieldignore
 ├── cli.py                                        # command-line interface
 ├── autofix/                                        # interactive scan --fix
 ├── git/                                              # pre-commit hook
@@ -357,3 +371,4 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+

{secretshield-0.4.2 → secretshield-0.5.0}/README.md

@@ -7,7 +7,7 @@
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
 [Install](#installation) · [Demo](#demo) · [Quick start](#quick-start) · [Features](#what-secretshield-does) · [Docs below](#cli-reference)
@@ -246,6 +246,20 @@ format = "text"
 
 CLI flags always override the file.
 
+Prefer a plain `.gitignore`-style file instead of editing TOML? Drop a
+`.secretshieldignore` in the project root — one glob pattern per line,
+`#` comments and blank lines ignored, same idea as `.gitignore`:
+
+```text
+# .secretshieldignore
+vendor/
+*.min.js
+tests/fixtures/
+```
+
+Both `secretshield.toml`'s `[scan.ignore]` and `.secretshieldignore`
+can be used together — their patterns combine.
+
 ## Runtime configuration
 
 ```python
@@ -278,7 +292,7 @@ secretshield/
 ├── patterns.py, detector.py, redactor.py   # detection & redaction engine
 ├── guardian.py                              # stdout/stderr + logging protection
 ├── config.py, notifications.py               # runtime settings & safe warnings
-├── project_config.py, baseline.py              # secretshield.toml, --baseline
+├── project_config.py, baseline.py, ignorefile.py   # secretshield.toml, --baseline, .secretshieldignore
 ├── cli.py                                        # command-line interface
 ├── autofix/                                        # interactive scan --fix
 ├── git/                                              # pre-commit hook
@@ -331,3 +345,4 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+

{secretshield-0.4.2 → secretshield-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretshield"
-version = "0.4.2"
+version = "0.5.0"
 description = "Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI."
 readme = "README.md"
 license = "MIT"

{secretshield-0.4.2 → secretshield-0.5.0}/secretshield/__init__.py

@@ -23,7 +23,7 @@ from .detector import Match, detect
 from .guardian import disable, enable, is_enabled
 from .redactor import redact
 
-__version__ = "0.4.2"
+__version__ = "0.5.0"
 
 __all__ = [
     "__version__",

{secretshield-0.4.2 → secretshield-0.5.0}/secretshield/cli.py

@@ -423,6 +423,9 @@ def _run_scan(args: argparse.Namespace) -> int:
         # A trailing "/" means "this directory and everything in it" --
         # translate that into a glob so it matches nested files too.
         exclude_patterns.append(raw if not raw.endswith("/") else raw + "*")
+    from .ignorefile import load_ignore_patterns
+
+    exclude_patterns.extend(load_ignore_patterns(Path.cwd()))
 
     json_output = bool(args.json) or (project_cfg.output_format == "json")
 

{secretshield-0.4.2 → secretshield-0.5.0}/secretshield/guardian.py

@@ -17,13 +17,12 @@ from .redactor import redact
 # enable() calls don't stack wrappers on top of each other.
 _WRAPPED_MARKER = "_secretshield_wrapped"
 
-# Module-level state tracking whether protection is currently active and
-# what the original (unwrapped) streams / logging factory were, so
-# disable() can cleanly restore them.
+# Module-level state tracking whether protection has been explicitly
+# enabled (used by is_enabled()). The actual wrap/unwrap decision on
+# each enable()/disable() call is made by inspecting sys.stdout/
+# sys.stderr directly (see below) rather than trusting this flag alone.
 _state: dict[str, Any] = {
     "active": False,
-    "orig_stdout": None,
-    "orig_stderr": None,
 }
 
 # Guard against re-entrant redaction triggered by secretshield's own
@@ -235,13 +234,16 @@ def enable() -> None:
     Enable secretshield protection for ``sys.stdout``, ``sys.stderr``, and
     the standard ``logging`` module. Safe to call multiple times; repeated
     calls do not create duplicate wrappers.
-    """
-    if _state["active"]:
-        return
-
-    _state["orig_stdout"] = sys.stdout
-    _state["orig_stderr"] = sys.stderr
 
+    Always (re)wraps whatever ``sys.stdout``/``sys.stderr`` currently
+    are, rather than relying solely on a single global "already active"
+    flag to skip the work. That matters if something else reassigns
+    those streams between calls -- a test framework's output capture,
+    a user's own redirection, etc. -- so a later ``enable()`` correctly
+    protects the stream actually in use *now*, instead of silently
+    doing nothing because protection was already on for some earlier,
+    now-replaced stream.
+    """
     sys.stdout = _wrap_stream(sys.stdout)
     sys.stderr = _wrap_stream(sys.stderr)
 
@@ -254,29 +256,26 @@ def disable() -> None:
     """
     Disable secretshield protection, restoring the original ``sys.stdout``
     and ``sys.stderr`` streams and removing the logging filter.
-    """
-    if not _state["active"]:
-        return
 
-    # Flush any buffered partial-line content (e.g. output with no
-    # trailing newline yet) before swapping the streams out, so it isn't
-    # silently lost.
-    for stream in (sys.stdout, sys.stderr):
+    Unwraps whatever ``sys.stdout``/``sys.stderr`` currently are (only
+    if they're currently a guarded stream), rather than restoring a
+    reference captured back whenever ``enable()`` first happened to run
+    -- which could be stale if the streams were swapped out since then.
+    """
+    for name in ("stdout", "stderr"):
+        stream = getattr(sys, name)
         if isinstance(stream, _GuardedStream):
+            # Flush any buffered partial-line content (e.g. output with
+            # no trailing newline yet) before unwrapping, so it isn't
+            # silently lost.
             try:
                 stream.flush()
             except Exception:
                 pass
-
-    if _state["orig_stdout"] is not None:
-        sys.stdout = _state["orig_stdout"]
-    if _state["orig_stderr"] is not None:
-        sys.stderr = _state["orig_stderr"]
+            setattr(sys, name, stream._wrapped)
 
     _remove_logging_protection()
 
-    _state["orig_stdout"] = None
-    _state["orig_stderr"] = None
     _state["active"] = False
 
 

secretshield-0.5.0/secretshield/ignorefile.py

@@ -0,0 +1,42 @@
+"""
+`.secretshieldignore` -- a familiar, `.gitignore`-style companion to
+`secretshield.toml`'s `[scan.ignore]` section, for anyone who'd rather
+drop in a plain ignore file than edit TOML.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+IGNORE_FILENAME = ".secretshieldignore"
+
+
+def ignore_file_path(root: Path) -> Path:
+    return root / IGNORE_FILENAME
+
+
+def load_ignore_patterns(root: Path | None = None) -> list[str]:
+    """
+    Read `.secretshieldignore` from `root` (default: current directory)
+    if present. One glob pattern per line; blank lines and lines
+    starting with `#` are skipped, same as `.gitignore`. A trailing
+    `/` means "this directory and everything under it," matching
+    `secretshield.toml`'s `[scan.ignore].paths` convention -- both
+    ultimately feed the same exclude-pattern matching used by
+    `--exclude`.
+    """
+    path = ignore_file_path(root or Path.cwd())
+    if not path.exists():
+        return []
+    try:
+        lines = path.read_text(encoding="utf-8", errors="ignore").splitlines()
+    except Exception:
+        return []
+
+    patterns: list[str] = []
+    for raw_line in lines:
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            continue
+        patterns.append(line if not line.endswith("/") else line + "*")
+    return patterns

{secretshield-0.4.2 → secretshield-0.5.0/secretshield.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.4.2
+Version: 0.5.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
 [Install](#installation) · [Demo](#demo) · [Quick start](#quick-start) · [Features](#what-secretshield-does) · [Docs below](#cli-reference)
@@ -272,6 +272,20 @@ format = "text"
 
 CLI flags always override the file.
 
+Prefer a plain `.gitignore`-style file instead of editing TOML? Drop a
+`.secretshieldignore` in the project root — one glob pattern per line,
+`#` comments and blank lines ignored, same idea as `.gitignore`:
+
+```text
+# .secretshieldignore
+vendor/
+*.min.js
+tests/fixtures/
+```
+
+Both `secretshield.toml`'s `[scan.ignore]` and `.secretshieldignore`
+can be used together — their patterns combine.
+
 ## Runtime configuration
 
 ```python
@@ -304,7 +318,7 @@ secretshield/
 ├── patterns.py, detector.py, redactor.py   # detection & redaction engine
 ├── guardian.py                              # stdout/stderr + logging protection
 ├── config.py, notifications.py               # runtime settings & safe warnings
-├── project_config.py, baseline.py              # secretshield.toml, --baseline
+├── project_config.py, baseline.py, ignorefile.py   # secretshield.toml, --baseline, .secretshieldignore
 ├── cli.py                                        # command-line interface
 ├── autofix/                                        # interactive scan --fix
 ├── git/                                              # pre-commit hook
@@ -357,3 +371,4 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+

{secretshield-0.4.2 → secretshield-0.5.0}/secretshield.egg-info/SOURCES.txt

@@ -7,6 +7,7 @@ secretshield/cli.py
 secretshield/config.py
 secretshield/detector.py
 secretshield/guardian.py
+secretshield/ignorefile.py
 secretshield/notifications.py
 secretshield/patterns.py
 secretshield/project_config.py
@@ -31,6 +32,8 @@ tests/test_baseline.py
 tests/test_detector.py
 tests/test_git_hooks.py
 tests/test_github_action.py
+tests/test_ignorefile.py
+tests/test_ignorefile_cli_integration.py
 tests/test_logging.py
 tests/test_project_config.py
 tests/test_redactor.py

secretshield-0.5.0/tests/test_ignorefile.py

@@ -0,0 +1,44 @@
+"""Tests for secretshield.ignorefile -- .secretshieldignore support."""
+
+from __future__ import annotations
+
+from secretshield.ignorefile import ignore_file_path, load_ignore_patterns
+
+
+def test_no_ignore_file_returns_empty_list(tmp_path):
+    assert load_ignore_patterns(tmp_path) == []
+
+
+def test_loads_simple_patterns(tmp_path):
+    (tmp_path / ".secretshieldignore").write_text("*.min.js\nvendor/\n")
+    patterns = load_ignore_patterns(tmp_path)
+    assert "*.min.js" in patterns
+
+
+def test_trailing_slash_becomes_glob(tmp_path):
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    patterns = load_ignore_patterns(tmp_path)
+    assert "vendor/*" in patterns
+    assert "vendor/" not in patterns
+
+
+def test_comments_and_blank_lines_skipped(tmp_path):
+    (tmp_path / ".secretshieldignore").write_text(
+        "# this is a comment\n\nvendor/\n\n# another comment\n*.log\n"
+    )
+    patterns = load_ignore_patterns(tmp_path)
+    assert patterns == ["vendor/*", "*.log"]
+
+
+def test_ignore_file_path_helper(tmp_path):
+    path = ignore_file_path(tmp_path)
+    assert path.name == ".secretshieldignore"
+    assert path.parent == tmp_path
+
+
+def test_malformed_file_does_not_crash(tmp_path):
+    # Write invalid UTF-8 bytes directly.
+    (tmp_path / ".secretshieldignore").write_bytes(b"\xff\xfe\x00garbage")
+    # Should not raise -- errors="ignore" handles invalid bytes.
+    patterns = load_ignore_patterns(tmp_path)
+    assert isinstance(patterns, list)

secretshield-0.5.0/tests/test_ignorefile_cli_integration.py

@@ -0,0 +1,62 @@
+"""CLI-level integration tests for .secretshieldignore."""
+
+from __future__ import annotations
+
+from secretshield.cli import main
+
+FAKE_SECRET = "ignoreFileIntegrationFakeSecret123456"
+
+
+def test_scan_respects_secretshieldignore(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "vendor" / "lib.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+    (tmp_path / "app.py").write_text("print('clean')\n")
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 0
+
+
+def test_scan_still_catches_non_ignored_secret(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "vendor" / "lib.py").write_text('API_KEY = "not-caught-anyway"\n')
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_no_ignore_file_behaves_as_before(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_secretshieldignore_and_toml_ignore_paths_combine(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "secretshield.toml").write_text('[scan.ignore]\npaths = ["docs/"]\n')
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "docs").mkdir()
+    (tmp_path / "vendor" / "a.py").write_text(f'A = "{FAKE_SECRET}"\n')
+    (tmp_path / "docs" / "b.py").write_text(f'B = "{FAKE_SECRET}"\n')
+    (tmp_path / "app.py").write_text("print('clean')\n")
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 0
+
+
+def test_explicit_exclude_flag_still_works_alongside_ignorefile(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "vendor" / "a.py").write_text(f'A = "{FAKE_SECRET}"\n')
+    (tmp_path / "other.py").write_text(f'B = "{FAKE_SECRET}"\n')
+
+    exit_code = main(["scan", ".", "--exclude", "other.py"])
+    assert exit_code == 0

{secretshield-0.4.2 → secretshield-0.5.0}/tests/test_stdout.py

@@ -154,3 +154,59 @@ def test_partial_line_without_newline_flushed_on_flush_call():
     output = buffer.getvalue()
     assert "MyDogFluffy99" not in output
     assert "********" in output
+
+
+# --- Regression test for a real bug: enable() was a no-op once already
+# "active", even if sys.stdout/sys.stderr had been swapped out from
+# under it (e.g. by a test framework's own output capture, or a user's
+# own redirection). disable()/enable() must always operate on whatever
+# the CURRENT streams are, not a stale reference from the first call.
+
+def test_enable_rewraps_a_stream_swapped_in_after_first_enable():
+    original_stdout = sys.stdout
+    try:
+        # Protection is already globally active at this point (it was
+        # enabled automatically on package import). Something else now
+        # swaps sys.stdout out -- simulating pytest's capsys, or a
+        # user redirecting output themselves.
+        new_buffer = io.StringIO()
+        sys.stdout = new_buffer
+
+        # Calling enable() again must wrap THIS new stream, not silently
+        # no-op just because protection was "already on" for a
+        # different, now-replaced stream.
+        secretshield.enable()
+        assert hasattr(sys.stdout, "_secretshield_wrapped")
+
+        secret = "sk-regressionTestFakeSecretSwap123456"
+        print("API key:", secret)
+        sys.stdout.flush()
+
+        output = new_buffer.getvalue()
+        assert secret not in output
+        assert "********" in output
+    finally:
+        secretshield.disable()
+        sys.stdout = original_stdout
+
+
+def test_disable_unwraps_whatever_stream_is_current_not_stale_one():
+    original_stdout = sys.stdout
+    try:
+        buffer_a = io.StringIO()
+        sys.stdout = buffer_a
+        secretshield.enable()
+
+        # Swap to a second buffer while still "enabled".
+        buffer_b = io.StringIO()
+        sys.stdout = buffer_b
+        secretshield.enable()  # re-wrap the new current stream
+        assert sys.stdout is not buffer_b  # now wrapped
+
+        secretshield.disable()
+        # Must unwrap back to buffer_b (the current stream), not jump
+        # back to buffer_a (a stale reference from the first enable()).
+        assert sys.stdout is buffer_b
+    finally:
+        secretshield.disable()
+        sys.stdout = original_stdout