secretshield 0.4.2__tar.gz → 0.5.2__tar.gz

{secretshield-0.4.2/secretshield.egg-info → secretshield-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.4.2
+Version: 0.5.2
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
 [Install](#installation) · [Demo](#demo) · [Quick start](#quick-start) · [Features](#what-secretshield-does) · [Docs below](#cli-reference)
@@ -185,6 +185,12 @@ redact("aws_key=AKIAABCDEFGHIJKLMNOP")
 
 *(Every command below also works via the shorter `ss` alias — `ss scan .` is identical to `secretshield scan .`.)*
 
+Output is colored (red `✗` / green `✓`) automatically when running in a
+real terminal, and plain everywhere else — piped output, CI logs, and
+`--json` are never colored, so nothing downstream ever has to deal with
+stray escape codes. Force it either way with the standard `NO_COLOR=1`
+/ `FORCE_COLOR=1` environment variables.
+
 ### `secretshield init` — set a project up in one step
 
 ```bash
@@ -272,6 +278,20 @@ format = "text"
 
 CLI flags always override the file.
 
+Prefer a plain `.gitignore`-style file instead of editing TOML? Drop a
+`.secretshieldignore` in the project root — one glob pattern per line,
+`#` comments and blank lines ignored, same idea as `.gitignore`:
+
+```text
+# .secretshieldignore
+vendor/
+*.min.js
+tests/fixtures/
+```
+
+Both `secretshield.toml`'s `[scan.ignore]` and `.secretshieldignore`
+can be used together — their patterns combine.
+
 ## Runtime configuration
 
 ```python
@@ -304,7 +324,8 @@ secretshield/
 ├── patterns.py, detector.py, redactor.py   # detection & redaction engine
 ├── guardian.py                              # stdout/stderr + logging protection
 ├── config.py, notifications.py               # runtime settings & safe warnings
-├── project_config.py, baseline.py              # secretshield.toml, --baseline
+├── project_config.py, baseline.py, ignorefile.py   # secretshield.toml, --baseline, .secretshieldignore
+├── color.py                                          # dependency-free ANSI colors, TTY-aware
 ├── cli.py                                        # command-line interface
 ├── autofix/                                        # interactive scan --fix
 ├── git/                                              # pre-commit hook
@@ -357,3 +378,4 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+

{secretshield-0.4.2 → secretshield-0.5.2}/README.md

@@ -7,7 +7,7 @@
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
 [Install](#installation) · [Demo](#demo) · [Quick start](#quick-start) · [Features](#what-secretshield-does) · [Docs below](#cli-reference)
@@ -159,6 +159,12 @@ redact("aws_key=AKIAABCDEFGHIJKLMNOP")
 
 *(Every command below also works via the shorter `ss` alias — `ss scan .` is identical to `secretshield scan .`.)*
 
+Output is colored (red `✗` / green `✓`) automatically when running in a
+real terminal, and plain everywhere else — piped output, CI logs, and
+`--json` are never colored, so nothing downstream ever has to deal with
+stray escape codes. Force it either way with the standard `NO_COLOR=1`
+/ `FORCE_COLOR=1` environment variables.
+
 ### `secretshield init` — set a project up in one step
 
 ```bash
@@ -246,6 +252,20 @@ format = "text"
 
 CLI flags always override the file.
 
+Prefer a plain `.gitignore`-style file instead of editing TOML? Drop a
+`.secretshieldignore` in the project root — one glob pattern per line,
+`#` comments and blank lines ignored, same idea as `.gitignore`:
+
+```text
+# .secretshieldignore
+vendor/
+*.min.js
+tests/fixtures/
+```
+
+Both `secretshield.toml`'s `[scan.ignore]` and `.secretshieldignore`
+can be used together — their patterns combine.
+
 ## Runtime configuration
 
 ```python
@@ -278,7 +298,8 @@ secretshield/
 ├── patterns.py, detector.py, redactor.py   # detection & redaction engine
 ├── guardian.py                              # stdout/stderr + logging protection
 ├── config.py, notifications.py               # runtime settings & safe warnings
-├── project_config.py, baseline.py              # secretshield.toml, --baseline
+├── project_config.py, baseline.py, ignorefile.py   # secretshield.toml, --baseline, .secretshieldignore
+├── color.py                                          # dependency-free ANSI colors, TTY-aware
 ├── cli.py                                        # command-line interface
 ├── autofix/                                        # interactive scan --fix
 ├── git/                                              # pre-commit hook
@@ -331,3 +352,4 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+

{secretshield-0.4.2 → secretshield-0.5.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretshield"
-version = "0.4.2"
+version = "0.5.2"
 description = "Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI."
 readme = "README.md"
 license = "MIT"

{secretshield-0.4.2 → secretshield-0.5.2}/secretshield/__init__.py

@@ -23,7 +23,7 @@ from .detector import Match, detect
 from .guardian import disable, enable, is_enabled
 from .redactor import redact
 
-__version__ = "0.4.2"
+__version__ = "0.5.2"
 
 __all__ = [
     "__version__",

{secretshield-0.4.2 → secretshield-0.5.2}/secretshield/cli.py

@@ -27,6 +27,7 @@ import sys
 from pathlib import Path
 
 from . import __version__, disable, enable, is_enabled
+from .color import green, red, supports_color
 from .detector import detect
 
 # --- File type support -----------------------------------------------------
@@ -423,6 +424,9 @@ def _run_scan(args: argparse.Namespace) -> int:
         # A trailing "/" means "this directory and everything in it" --
         # translate that into a glob so it matches nested files too.
         exclude_patterns.append(raw if not raw.endswith("/") else raw + "*")
+    from .ignorefile import load_ignore_patterns
+
+    exclude_patterns.extend(load_ignore_patterns(Path.cwd()))
 
     json_output = bool(args.json) or (project_cfg.output_format == "json")
 
@@ -513,23 +517,27 @@ def _run_scan(args: argparse.Namespace) -> int:
         print(json.dumps(payload, indent=2))
         return 1 if all_findings else 0
 
+    use_color = supports_color(sys.stdout)
     print("SecretShield scan\n")
 
     for finding in all_findings:
         label, category = _kind_display(finding["kind"])
-        print(f"\u2717 {finding['file']}:{finding['line']}")
+        print(f"{red(chr(0x2717), use_color)} {finding['file']}:{finding['line']}")
         print(f"  Potential secret: {label}")
         print(f"  Type: {category}\n")
 
     if ignored_by_baseline:
-        print(f"\u2713 {ignored_by_baseline} existing finding(s) ignored by baseline")
+        print(
+            f"{green(chr(0x2713), use_color)} "
+            f"{ignored_by_baseline} existing finding(s) ignored by baseline"
+        )
 
     if all_findings:
-        print(f"\u2713 {files_scanned} files scanned")
-        print(f"\u2717 {len(all_findings)} potential secret(s) found")
+        print(f"{green(chr(0x2713), use_color)} {files_scanned} files scanned")
+        print(f"{red(chr(0x2717), use_color)} {len(all_findings)} potential secret(s) found")
     else:
-        print(f"\u2713 {files_scanned} files scanned")
-        print("\u2713 No potential secrets found")
+        print(f"{green(chr(0x2713), use_color)} {files_scanned} files scanned")
+        print(f"{green(chr(0x2713), use_color)} No potential secrets found")
 
     exit_code = 1 if all_findings else 0
     print(f"\nExit code: {exit_code}")
@@ -580,12 +588,14 @@ def _run_scan_staged(args: argparse.Namespace) -> int:
                 }
             )
 
+    use_color = supports_color(sys.stdout)
+
     if not findings:
-        print("\u2713 No secrets detected.")
+        print(f"{green(chr(0x2713), use_color)} No secrets detected.")
         return 0
 
     for finding in findings:
-        print("\u2717 Potential secret detected\n")
+        print(f"{red(chr(0x2717), use_color)} Potential secret detected\n")
         print(f"File: {finding['file']}")
         print(f"Line: {finding['line']}")
         print(f"Type: {finding['label']}\n")
@@ -605,7 +615,7 @@ def _cmd_install_hook(args: argparse.Namespace) -> int:
     if result.status == "error":
         print(f"secretshield: error: {result.message}", file=sys.stderr)
         return 1
-    print(f"\u2713 {result.message}")
+    print(f"{green(chr(0x2713), supports_color(sys.stdout))} {result.message}")
     return 0
 
 
@@ -616,7 +626,7 @@ def _cmd_uninstall_hook(args: argparse.Namespace) -> int:
     if result.status == "error":
         print(f"secretshield: error: {result.message}", file=sys.stderr)
         return 1
-    print(f"\u2713 {result.message}")
+    print(f"{green(chr(0x2713), supports_color(sys.stdout))} {result.message}")
     return 0
 
 
@@ -633,7 +643,7 @@ def _cmd_github_action(args: argparse.Namespace) -> int:
             file=sys.stderr,
         )
         return 1
-    print(f"\u2713 Created {path}")
+    print(f"{green(chr(0x2713), supports_color(sys.stdout))} Created {path}")
     return 0
 
 
@@ -670,10 +680,11 @@ def _cmd_init(args: argparse.Namespace) -> int:
     )
     in_git_repo = is_git_repo()
 
+    use_color = supports_color(sys.stdout)
     print("SecretShield project setup\n")
-    print(f"{'\u2713' if is_python_project else '\u2717'} "
+    print(f"{green(chr(0x2713), use_color) if is_python_project else red(chr(0x2717), use_color)} "
           f"{'Detected Python project' if is_python_project else 'No Python project markers found'}")
-    print(f"{'\u2713' if in_git_repo else '\u2717'} "
+    print(f"{green(chr(0x2713), use_color) if in_git_repo else red(chr(0x2717), use_color)} "
           f"{'Detected Git repository' if in_git_repo else 'Not a Git repository'}")
     print()
 
@@ -696,28 +707,28 @@ def _cmd_init(args: argparse.Namespace) -> int:
     if want_config:
         existing = find_config_file(project_root)
         if existing is not None:
-            print(f"\u2713 secretshield.toml already exists, leaving it unchanged")
+            print(f"{green(chr(0x2713), use_color)} secretshield.toml already exists, leaving it unchanged")
         else:
             config_path = project_root / "secretshield.toml"
             config_path.write_text(render_default_toml(), encoding="utf-8")
-            print(f"\u2713 Created {config_path.name}")
+            print(f"{green(chr(0x2713), use_color)} Created {config_path.name}")
             created.append(config_path.name)
 
     if want_hook:
         result = install_hook()
         if result.status == "error":
-            print(f"\u2717 {result.message}")
+            print(f"{red(chr(0x2717), use_color)} {result.message}")
         else:
-            print(f"\u2713 {result.message}")
+            print(f"{green(chr(0x2713), use_color)} {result.message}")
             created.append("Git pre-commit hook")
 
     if want_actions:
         written, path = generate_workflow(project_root)
         if written:
-            print(f"\u2713 Created {path.relative_to(project_root)}")
+            print(f"{green(chr(0x2713), use_color)} Created {path.relative_to(project_root)}")
             created.append(str(path.relative_to(project_root)))
         else:
-            print(f"\u2713 {path.relative_to(project_root)} already exists, leaving it unchanged")
+            print(f"{green(chr(0x2713), use_color)} {path.relative_to(project_root)} already exists, leaving it unchanged")
 
     print("\nSecretShield is ready.")
     return 0

secretshield-0.5.2/secretshield/color.py

@@ -0,0 +1,42 @@
+"""
+Minimal, dependency-free ANSI color support for CLI output.
+
+Colors are only applied when the target stream is a real interactive
+terminal -- never when output is piped, redirected, going into CI logs,
+or serialized as `--json`. Respects the informal-but-widely-followed
+`NO_COLOR` (disable) and `FORCE_COLOR` (force on) environment variable
+conventions.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from typing import TextIO
+
+_RED = "\033[31m"
+_GREEN = "\033[32m"
+_RESET = "\033[0m"
+
+
+def supports_color(stream: TextIO | None = None) -> bool:
+    """Whether ANSI colors should be used when writing to `stream`
+    (default: sys.stdout)."""
+    if os.environ.get("NO_COLOR") is not None:
+        return False
+    if os.environ.get("FORCE_COLOR") is not None:
+        return True
+
+    target = stream if stream is not None else sys.stdout
+    try:
+        return bool(target.isatty())
+    except Exception:
+        return False
+
+
+def red(text: str, enabled: bool) -> str:
+    return f"{_RED}{text}{_RESET}" if enabled else text
+
+
+def green(text: str, enabled: bool) -> str:
+    return f"{_GREEN}{text}{_RESET}" if enabled else text

{secretshield-0.4.2 → secretshield-0.5.2}/secretshield/guardian.py

@@ -17,13 +17,12 @@ from .redactor import redact
 # enable() calls don't stack wrappers on top of each other.
 _WRAPPED_MARKER = "_secretshield_wrapped"
 
-# Module-level state tracking whether protection is currently active and
-# what the original (unwrapped) streams / logging factory were, so
-# disable() can cleanly restore them.
+# Module-level state tracking whether protection has been explicitly
+# enabled (used by is_enabled()). The actual wrap/unwrap decision on
+# each enable()/disable() call is made by inspecting sys.stdout/
+# sys.stderr directly (see below) rather than trusting this flag alone.
 _state: dict[str, Any] = {
     "active": False,
-    "orig_stdout": None,
-    "orig_stderr": None,
 }
 
 # Guard against re-entrant redaction triggered by secretshield's own
@@ -235,13 +234,16 @@ def enable() -> None:
     Enable secretshield protection for ``sys.stdout``, ``sys.stderr``, and
     the standard ``logging`` module. Safe to call multiple times; repeated
     calls do not create duplicate wrappers.
-    """
-    if _state["active"]:
-        return
-
-    _state["orig_stdout"] = sys.stdout
-    _state["orig_stderr"] = sys.stderr
 
+    Always (re)wraps whatever ``sys.stdout``/``sys.stderr`` currently
+    are, rather than relying solely on a single global "already active"
+    flag to skip the work. That matters if something else reassigns
+    those streams between calls -- a test framework's output capture,
+    a user's own redirection, etc. -- so a later ``enable()`` correctly
+    protects the stream actually in use *now*, instead of silently
+    doing nothing because protection was already on for some earlier,
+    now-replaced stream.
+    """
     sys.stdout = _wrap_stream(sys.stdout)
     sys.stderr = _wrap_stream(sys.stderr)
 
@@ -254,29 +256,26 @@ def disable() -> None:
     """
     Disable secretshield protection, restoring the original ``sys.stdout``
     and ``sys.stderr`` streams and removing the logging filter.
-    """
-    if not _state["active"]:
-        return
 
-    # Flush any buffered partial-line content (e.g. output with no
-    # trailing newline yet) before swapping the streams out, so it isn't
-    # silently lost.
-    for stream in (sys.stdout, sys.stderr):
+    Unwraps whatever ``sys.stdout``/``sys.stderr`` currently are (only
+    if they're currently a guarded stream), rather than restoring a
+    reference captured back whenever ``enable()`` first happened to run
+    -- which could be stale if the streams were swapped out since then.
+    """
+    for name in ("stdout", "stderr"):
+        stream = getattr(sys, name)
         if isinstance(stream, _GuardedStream):
+            # Flush any buffered partial-line content (e.g. output with
+            # no trailing newline yet) before unwrapping, so it isn't
+            # silently lost.
             try:
                 stream.flush()
             except Exception:
                 pass
-
-    if _state["orig_stdout"] is not None:
-        sys.stdout = _state["orig_stdout"]
-    if _state["orig_stderr"] is not None:
-        sys.stderr = _state["orig_stderr"]
+            setattr(sys, name, stream._wrapped)
 
     _remove_logging_protection()
 
-    _state["orig_stdout"] = None
-    _state["orig_stderr"] = None
     _state["active"] = False
 
 

secretshield-0.5.2/secretshield/ignorefile.py

@@ -0,0 +1,42 @@
+"""
+`.secretshieldignore` -- a familiar, `.gitignore`-style companion to
+`secretshield.toml`'s `[scan.ignore]` section, for anyone who'd rather
+drop in a plain ignore file than edit TOML.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+IGNORE_FILENAME = ".secretshieldignore"
+
+
+def ignore_file_path(root: Path) -> Path:
+    return root / IGNORE_FILENAME
+
+
+def load_ignore_patterns(root: Path | None = None) -> list[str]:
+    """
+    Read `.secretshieldignore` from `root` (default: current directory)
+    if present. One glob pattern per line; blank lines and lines
+    starting with `#` are skipped, same as `.gitignore`. A trailing
+    `/` means "this directory and everything under it," matching
+    `secretshield.toml`'s `[scan.ignore].paths` convention -- both
+    ultimately feed the same exclude-pattern matching used by
+    `--exclude`.
+    """
+    path = ignore_file_path(root or Path.cwd())
+    if not path.exists():
+        return []
+    try:
+        lines = path.read_text(encoding="utf-8", errors="ignore").splitlines()
+    except Exception:
+        return []
+
+    patterns: list[str] = []
+    for raw_line in lines:
+        line = raw_line.strip()
+        if not line or line.startswith("#"):
+            continue
+        patterns.append(line if not line.endswith("/") else line + "*")
+    return patterns

{secretshield-0.4.2 → secretshield-0.5.2/secretshield.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.4.2
+Version: 0.5.2
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -33,7 +33,7 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
 [Install](#installation) · [Demo](#demo) · [Quick start](#quick-start) · [Features](#what-secretshield-does) · [Docs below](#cli-reference)
@@ -185,6 +185,12 @@ redact("aws_key=AKIAABCDEFGHIJKLMNOP")
 
 *(Every command below also works via the shorter `ss` alias — `ss scan .` is identical to `secretshield scan .`.)*
 
+Output is colored (red `✗` / green `✓`) automatically when running in a
+real terminal, and plain everywhere else — piped output, CI logs, and
+`--json` are never colored, so nothing downstream ever has to deal with
+stray escape codes. Force it either way with the standard `NO_COLOR=1`
+/ `FORCE_COLOR=1` environment variables.
+
 ### `secretshield init` — set a project up in one step
 
 ```bash
@@ -272,6 +278,20 @@ format = "text"
 
 CLI flags always override the file.
 
+Prefer a plain `.gitignore`-style file instead of editing TOML? Drop a
+`.secretshieldignore` in the project root — one glob pattern per line,
+`#` comments and blank lines ignored, same idea as `.gitignore`:
+
+```text
+# .secretshieldignore
+vendor/
+*.min.js
+tests/fixtures/
+```
+
+Both `secretshield.toml`'s `[scan.ignore]` and `.secretshieldignore`
+can be used together — their patterns combine.
+
 ## Runtime configuration
 
 ```python
@@ -304,7 +324,8 @@ secretshield/
 ├── patterns.py, detector.py, redactor.py   # detection & redaction engine
 ├── guardian.py                              # stdout/stderr + logging protection
 ├── config.py, notifications.py               # runtime settings & safe warnings
-├── project_config.py, baseline.py              # secretshield.toml, --baseline
+├── project_config.py, baseline.py, ignorefile.py   # secretshield.toml, --baseline, .secretshieldignore
+├── color.py                                          # dependency-free ANSI colors, TTY-aware
 ├── cli.py                                        # command-line interface
 ├── autofix/                                        # interactive scan --fix
 ├── git/                                              # pre-commit hook
@@ -357,3 +378,4 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+

{secretshield-0.4.2 → secretshield-0.5.2}/secretshield.egg-info/SOURCES.txt

@@ -4,9 +4,11 @@ pyproject.toml
 secretshield/__init__.py
 secretshield/baseline.py
 secretshield/cli.py
+secretshield/color.py
 secretshield/config.py
 secretshield/detector.py
 secretshield/guardian.py
+secretshield/ignorefile.py
 secretshield/notifications.py
 secretshield/patterns.py
 secretshield/project_config.py
@@ -28,9 +30,13 @@ secretshield/github/__init__.py
 secretshield/github/actions.py
 tests/test_autofix.py
 tests/test_baseline.py
+tests/test_color.py
+tests/test_color_cli_integration.py
 tests/test_detector.py
 tests/test_git_hooks.py
 tests/test_github_action.py
+tests/test_ignorefile.py
+tests/test_ignorefile_cli_integration.py
 tests/test_logging.py
 tests/test_project_config.py
 tests/test_redactor.py

secretshield-0.5.2/tests/test_color.py

@@ -0,0 +1,77 @@
+"""Tests for secretshield.color -- dependency-free ANSI color support."""
+
+from __future__ import annotations
+
+import io
+
+from secretshield.color import green, red, supports_color
+
+
+class _FakeTTY(io.StringIO):
+    def isatty(self):
+        return True
+
+
+class _FakeNonTTY(io.StringIO):
+    def isatty(self):
+        return False
+
+
+def test_red_wraps_with_ansi_when_enabled():
+    result = red("X", True)
+    assert result.startswith("\033[31m")
+    assert result.endswith("\033[0m")
+    assert "X" in result
+
+
+def test_red_plain_when_disabled():
+    assert red("X", False) == "X"
+
+
+def test_green_wraps_with_ansi_when_enabled():
+    result = green("Y", True)
+    assert result.startswith("\033[32m")
+    assert result.endswith("\033[0m")
+
+
+def test_green_plain_when_disabled():
+    assert green("Y", False) == "Y"
+
+
+def test_supports_color_true_for_tty(monkeypatch):
+    monkeypatch.delenv("NO_COLOR", raising=False)
+    monkeypatch.delenv("FORCE_COLOR", raising=False)
+    assert supports_color(_FakeTTY()) is True
+
+
+def test_supports_color_false_for_non_tty(monkeypatch):
+    monkeypatch.delenv("NO_COLOR", raising=False)
+    monkeypatch.delenv("FORCE_COLOR", raising=False)
+    assert supports_color(_FakeNonTTY()) is False
+
+
+def test_no_color_env_disables_even_for_tty(monkeypatch):
+    monkeypatch.setenv("NO_COLOR", "1")
+    assert supports_color(_FakeTTY()) is False
+
+
+def test_force_color_env_enables_even_for_non_tty(monkeypatch):
+    monkeypatch.delenv("NO_COLOR", raising=False)
+    monkeypatch.setenv("FORCE_COLOR", "1")
+    assert supports_color(_FakeNonTTY()) is True
+
+
+def test_no_color_takes_precedence_over_force_color(monkeypatch):
+    monkeypatch.setenv("NO_COLOR", "1")
+    monkeypatch.setenv("FORCE_COLOR", "1")
+    assert supports_color(_FakeTTY()) is False
+
+
+def test_supports_color_handles_stream_without_isatty(monkeypatch):
+    monkeypatch.delenv("NO_COLOR", raising=False)
+    monkeypatch.delenv("FORCE_COLOR", raising=False)
+
+    class _Weird:
+        pass
+
+    assert supports_color(_Weird()) is False

secretshield-0.5.2/tests/test_color_cli_integration.py

@@ -0,0 +1,69 @@
+"""
+CLI-level integration tests confirming colored output actually applies
+(or doesn't) in `scan`'s real report, based on TTY status.
+"""
+
+from __future__ import annotations
+
+import io
+
+from secretshield.cli import main
+
+FAKE_SECRET = "colorIntegrationFakeSecret123456789"
+
+
+class _FakeTTY(io.StringIO):
+    def isatty(self):
+        return True
+
+
+def test_scan_output_has_no_ansi_codes_by_default_under_pytest(tmp_path, monkeypatch, capsys):
+    # Under pytest, stdout is never a real TTY -- output must be plain.
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.delenv("FORCE_COLOR", raising=False)
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    main(["scan", "."])
+    out = capsys.readouterr().out
+    assert "\033[" not in out
+
+
+def test_scan_json_output_never_contains_ansi_codes(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("FORCE_COLOR", "1")  # even if forced on, --json must stay clean
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    main(["scan", ".", "--json"])
+    out = capsys.readouterr().out
+    assert "\033[" not in out
+
+
+def test_scan_with_force_color_env_produces_ansi_codes(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("FORCE_COLOR", "1")
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    main(["scan", "."])
+    out = capsys.readouterr().out
+    assert "\033[31m" in out  # red for the finding
+
+
+def test_scan_clean_with_force_color_produces_green(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("FORCE_COLOR", "1")
+    (tmp_path / "app.py").write_text("print('clean')\n")
+
+    main(["scan", "."])
+    out = capsys.readouterr().out
+    assert "\033[32m" in out  # green for "No potential secrets found"
+
+
+def test_no_color_env_suppresses_even_with_force_color_tty(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("FORCE_COLOR", "1")
+    monkeypatch.setenv("NO_COLOR", "1")
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    main(["scan", "."])
+    out = capsys.readouterr().out
+    assert "\033[" not in out

secretshield-0.5.2/tests/test_ignorefile.py

@@ -0,0 +1,44 @@
+"""Tests for secretshield.ignorefile -- .secretshieldignore support."""
+
+from __future__ import annotations
+
+from secretshield.ignorefile import ignore_file_path, load_ignore_patterns
+
+
+def test_no_ignore_file_returns_empty_list(tmp_path):
+    assert load_ignore_patterns(tmp_path) == []
+
+
+def test_loads_simple_patterns(tmp_path):
+    (tmp_path / ".secretshieldignore").write_text("*.min.js\nvendor/\n")
+    patterns = load_ignore_patterns(tmp_path)
+    assert "*.min.js" in patterns
+
+
+def test_trailing_slash_becomes_glob(tmp_path):
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    patterns = load_ignore_patterns(tmp_path)
+    assert "vendor/*" in patterns
+    assert "vendor/" not in patterns
+
+
+def test_comments_and_blank_lines_skipped(tmp_path):
+    (tmp_path / ".secretshieldignore").write_text(
+        "# this is a comment\n\nvendor/\n\n# another comment\n*.log\n"
+    )
+    patterns = load_ignore_patterns(tmp_path)
+    assert patterns == ["vendor/*", "*.log"]
+
+
+def test_ignore_file_path_helper(tmp_path):
+    path = ignore_file_path(tmp_path)
+    assert path.name == ".secretshieldignore"
+    assert path.parent == tmp_path
+
+
+def test_malformed_file_does_not_crash(tmp_path):
+    # Write invalid UTF-8 bytes directly.
+    (tmp_path / ".secretshieldignore").write_bytes(b"\xff\xfe\x00garbage")
+    # Should not raise -- errors="ignore" handles invalid bytes.
+    patterns = load_ignore_patterns(tmp_path)
+    assert isinstance(patterns, list)

secretshield-0.5.2/tests/test_ignorefile_cli_integration.py

@@ -0,0 +1,62 @@
+"""CLI-level integration tests for .secretshieldignore."""
+
+from __future__ import annotations
+
+from secretshield.cli import main
+
+FAKE_SECRET = "ignoreFileIntegrationFakeSecret123456"
+
+
+def test_scan_respects_secretshieldignore(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "vendor" / "lib.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+    (tmp_path / "app.py").write_text("print('clean')\n")
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 0
+
+
+def test_scan_still_catches_non_ignored_secret(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "vendor" / "lib.py").write_text('API_KEY = "not-caught-anyway"\n')
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_no_ignore_file_behaves_as_before(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "app.py").write_text(f'API_KEY = "{FAKE_SECRET}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_secretshieldignore_and_toml_ignore_paths_combine(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "secretshield.toml").write_text('[scan.ignore]\npaths = ["docs/"]\n')
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "docs").mkdir()
+    (tmp_path / "vendor" / "a.py").write_text(f'A = "{FAKE_SECRET}"\n')
+    (tmp_path / "docs" / "b.py").write_text(f'B = "{FAKE_SECRET}"\n')
+    (tmp_path / "app.py").write_text("print('clean')\n")
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 0
+
+
+def test_explicit_exclude_flag_still_works_alongside_ignorefile(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    (tmp_path / "vendor").mkdir()
+    (tmp_path / "vendor" / "a.py").write_text(f'A = "{FAKE_SECRET}"\n')
+    (tmp_path / "other.py").write_text(f'B = "{FAKE_SECRET}"\n')
+
+    exit_code = main(["scan", ".", "--exclude", "other.py"])
+    assert exit_code == 0

{secretshield-0.4.2 → secretshield-0.5.2}/tests/test_stdout.py

@@ -154,3 +154,59 @@ def test_partial_line_without_newline_flushed_on_flush_call():
     output = buffer.getvalue()
     assert "MyDogFluffy99" not in output
     assert "********" in output
+
+
+# --- Regression test for a real bug: enable() was a no-op once already
+# "active", even if sys.stdout/sys.stderr had been swapped out from
+# under it (e.g. by a test framework's own output capture, or a user's
+# own redirection). disable()/enable() must always operate on whatever
+# the CURRENT streams are, not a stale reference from the first call.
+
+def test_enable_rewraps_a_stream_swapped_in_after_first_enable():
+    original_stdout = sys.stdout
+    try:
+        # Protection is already globally active at this point (it was
+        # enabled automatically on package import). Something else now
+        # swaps sys.stdout out -- simulating pytest's capsys, or a
+        # user redirecting output themselves.
+        new_buffer = io.StringIO()
+        sys.stdout = new_buffer
+
+        # Calling enable() again must wrap THIS new stream, not silently
+        # no-op just because protection was "already on" for a
+        # different, now-replaced stream.
+        secretshield.enable()
+        assert hasattr(sys.stdout, "_secretshield_wrapped")
+
+        secret = "sk-regressionTestFakeSecretSwap123456"
+        print("API key:", secret)
+        sys.stdout.flush()
+
+        output = new_buffer.getvalue()
+        assert secret not in output
+        assert "********" in output
+    finally:
+        secretshield.disable()
+        sys.stdout = original_stdout
+
+
+def test_disable_unwraps_whatever_stream_is_current_not_stale_one():
+    original_stdout = sys.stdout
+    try:
+        buffer_a = io.StringIO()
+        sys.stdout = buffer_a
+        secretshield.enable()
+
+        # Swap to a second buffer while still "enabled".
+        buffer_b = io.StringIO()
+        sys.stdout = buffer_b
+        secretshield.enable()  # re-wrap the new current stream
+        assert sys.stdout is not buffer_b  # now wrapped
+
+        secretshield.disable()
+        # Must unwrap back to buffer_b (the current stream), not jump
+        # back to buffer_a (a stale reference from the first enable()).
+        assert sys.stdout is buffer_b
+    finally:
+        secretshield.disable()
+        sys.stdout = original_stdout