secretshield 0.7.0__tar.gz → 0.8.0__tar.gz

{secretshield-0.7.0/secretshield.egg-info → secretshield-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.7.0
+Version: 0.8.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -32,10 +32,10 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
-[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
+[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Homepage 🌐](https://therealsecretshield.freebuff.app/) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
 
 </div>
 
@@ -115,9 +115,12 @@ name = "My API Key"
 pattern = "MYAPP_[A-Za-z0-9]{32}"
 ```
 
-`secretshield scan .` picks it up automatically — no flag needed.
-Validate the file with `secretshield rules check`, or create a rule
-interactively with `secretshield rule create`.
+`secretshield scan .` picks it up automatically — no flag needed. The
+rules file itself is never treated as project content to scan, so a
+pattern that resembles a real secret won't flag its own definition.
+Validate rules with `secretshield rules check`, create one
+interactively with `secretshield rule create`, or try a pattern against
+sample text with `secretshield rule test` before committing to it.
 
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
@@ -145,3 +148,11 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+
+
+## Homepage
+
+Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
+
+**🌐 [therealsecretshield.freebuff.app](https://therealsecretshield.freebuff.app/)**

{secretshield-0.7.0 → secretshield-0.8.0}/README.md

@@ -6,10 +6,10 @@
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
-[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
+[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Homepage 🌐](https://therealsecretshield.freebuff.app/) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
 
 </div>
 
@@ -89,9 +89,12 @@ name = "My API Key"
 pattern = "MYAPP_[A-Za-z0-9]{32}"
 ```
 
-`secretshield scan .` picks it up automatically — no flag needed.
-Validate the file with `secretshield rules check`, or create a rule
-interactively with `secretshield rule create`.
+`secretshield scan .` picks it up automatically — no flag needed. The
+rules file itself is never treated as project content to scan, so a
+pattern that resembles a real secret won't flag its own definition.
+Validate rules with `secretshield rules check`, create one
+interactively with `secretshield rule create`, or try a pattern against
+sample text with `secretshield rule test` before committing to it.
 
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
@@ -119,3 +122,11 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+
+
+## Homepage
+
+Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
+
+**🌐 [therealsecretshield.freebuff.app](https://therealsecretshield.freebuff.app/)**

{secretshield-0.7.0 → secretshield-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretshield"
-version = "0.7.0"
+version = "0.8.0"
 description = "Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI."
 readme = "README.md"
 license = "MIT"

{secretshield-0.7.0 → secretshield-0.8.0}/secretshield/__init__.py

@@ -23,7 +23,7 @@ from .detector import Match, detect
 from .guardian import disable, enable, is_enabled
 from .redactor import redact
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"
 
 __all__ = [
     "__version__",

{secretshield-0.7.0 → secretshield-0.8.0}/secretshield/cli.py

@@ -60,6 +60,32 @@ _SKIP_DIR_NAMES = {
     ".tox", "egg-info",
 }
 
+# SecretShield's own meta-files, skipped by default during a directory
+# scan -- not because of their extension (a targeted, narrow exclusion
+# by exact name, not "skip all .toml/.json files"), but because their
+# job is to *configure* detection, not to hold project source that
+# might leak a secret. A custom rule's pattern necessarily resembles
+# the very thing it's meant to catch (that's the whole point of it),
+# so without this, .secretshield-rules.toml ends up reporting itself
+# as a finding the moment a rule's pattern looks enough like a real
+# secret -- which defeats the purpose of writing the rule in the first
+# place. secretshield.toml and .secretshieldignore are excluded for
+# the same reason (settings/ignore globs aren't project secrets
+# either), and the baseline file is excluded as a defensive measure:
+# its SHA-256 hex hashes sit safely below the *default* entropy
+# threshold, but a project that lowers entropy_threshold via
+# secretshield.toml could otherwise start flagging its own baseline.
+# --no-ignore re-includes all of these, same as it does for
+# _SKIP_DIR_NAMES; explicitly scanning one of them by path (e.g.
+# `secretshield scan .secretshield-rules.toml`) is unaffected -- this
+# only changes what a directory *walk* picks up by default.
+_SKIP_FILE_NAMES = {
+    ".secretshield-rules.toml",
+    "secretshield.toml",
+    ".secretshieldignore",
+    ".secretshield-baseline.json",
+}
+
 # Bytes read from the start of a file to decide whether it looks binary.
 _BINARY_SNIFF_SIZE = 1024
 
@@ -91,6 +117,10 @@ def _looks_binary(path: Path) -> bool:
     return False
 
 
+def _is_secretshield_meta_file(name: str) -> bool:
+    return name in _SKIP_FILE_NAMES
+
+
 def _should_scan_file(
     path: Path,
     include_patterns: list[str],
@@ -140,6 +170,8 @@ def _iter_scan_files(
             continue
         if not no_ignore and any(part in _SKIP_DIR_NAMES for part in path.parts):
             continue
+        if not no_ignore and _is_secretshield_meta_file(path.name):
+            continue
         if not _should_scan_file(path, include_patterns, exclude_patterns):
             continue
         if _looks_binary(path):
@@ -168,6 +200,12 @@ _KIND_DISPLAY: dict[str, tuple[str, str]] = {
 }
 
 
+def _plural(count: int, word: str) -> str:
+    """`f"{count} {word}"`, pluralized properly -- "1 rule" / "2 rules" --
+    instead of the awkward literal "rule(s)" regardless of count."""
+    return f"{count} {word}" if count == 1 else f"{count} {word}s"
+
+
 def _kind_display(kind: str) -> tuple[str, str]:
     return _KIND_DISPLAY.get(kind, (kind, "possible secret"))
 
@@ -372,8 +410,11 @@ def _iter_scan_sources(args: argparse.Namespace, target: Path, include_patterns:
         if not is_git_repo():
             print("secretshield: error: not inside a Git repository", file=sys.stderr)
             return
+        no_ignore = getattr(args, "no_ignore", False)
         for relpath in get_staged_files():
             path = Path(relpath)
+            if not no_ignore and _is_secretshield_meta_file(path.name):
+                continue
             if not _should_scan_file(path, include_patterns, exclude_patterns):
                 continue
             content = get_staged_content(relpath)
@@ -389,8 +430,11 @@ def _iter_scan_sources(args: argparse.Namespace, target: Path, include_patterns:
         if not is_git_repo():
             print("secretshield: error: not inside a Git repository", file=sys.stderr)
             return
+        no_ignore = getattr(args, "no_ignore", False)
         for relpath in get_diff_files(diff_ref):
             path = Path(relpath)
+            if not no_ignore and _is_secretshield_meta_file(path.name):
+                continue
             if not _should_scan_file(path, include_patterns, exclude_patterns):
                 continue
             if not path.exists() or _looks_binary(path):
@@ -437,8 +481,8 @@ def _run_scan(args: argparse.Namespace) -> int:
     custom_rules, custom_rule_errors = load_custom_rules(Path.cwd())
     if custom_rule_errors:
         print(
-            f"secretshield: warning: {len(custom_rule_errors)} invalid custom "
-            f"rule(s) in .secretshield-rules.toml -- run `secretshield rules "
+            f"secretshield: warning: {_plural(len(custom_rule_errors), 'invalid custom rule')} "
+            f"in .secretshield-rules.toml -- run `secretshield rules "
             f"check` for details.",
             file=sys.stderr,
         )
@@ -592,6 +636,8 @@ def _run_scan_staged(args: argparse.Namespace) -> int:
     findings: list[dict] = []
     for relpath in get_staged_files():
         path = Path(relpath)
+        if _is_secretshield_meta_file(path.name):
+            continue
         if not _should_scan_file(path, [], []):
             continue
         content = get_staged_content(relpath)
@@ -787,7 +833,7 @@ def _cmd_rules_check(args: argparse.Namespace) -> int:
         return 1
 
     print(f"{green(chr(0x2713), use_color)} {path.name}")
-    print(f"{green(chr(0x2713), use_color)} {len(rules)} rule(s) loaded")
+    print(f"{green(chr(0x2713), use_color)} {_plural(len(rules), 'rule')} loaded")
     print(f"{green(chr(0x2713), use_color)} All patterns are valid")
     return 0
 
@@ -815,7 +861,7 @@ def _cmd_rules_list(args: argparse.Namespace) -> int:
     if errors:
         use_color = supports_color(sys.stdout)
         print(
-            f"\n{red(chr(0x2717), use_color)} {len(errors)} rule(s) failed to load "
+            f"\n{red(chr(0x2717), use_color)} {_plural(len(errors), 'rule')} failed to load "
             f"-- run `secretshield rules check` for details."
         )
     return 0
@@ -877,6 +923,56 @@ def _cmd_rule_create(args: argparse.Namespace) -> int:
     return 0
 
 
+def _cmd_rule_test(args: argparse.Namespace) -> int:
+    from .custom_rules import load_custom_rules, rules_file_path
+
+    try:
+        interactive = sys.stdin.isatty()
+    except Exception:
+        interactive = False
+
+    if not interactive:
+        print("secretshield rule test requires an interactive terminal.")
+        return 1
+
+    path = rules_file_path(Path.cwd())
+    if not path.exists():
+        print(f"No {path.name} found. Create one with `secretshield rule create`.")
+        return 0
+
+    rules, errors = load_custom_rules(Path.cwd())
+    if errors:
+        print(
+            f"secretshield: warning: {_plural(len(errors), 'invalid custom rule')} "
+            f"skipped -- run `secretshield rules check` for details.",
+            file=sys.stderr,
+        )
+    if not rules:
+        print("No valid custom rules to test.")
+        return 0
+
+    use_color = supports_color(sys.stdout)
+    print("SecretShield \u2014 Test custom rules\n")
+    print(f"Loaded {_plural(len(rules), 'rule')}: {', '.join(r.name for r in rules)}\n")
+
+    sample = input("Text to test: ")
+    if not sample:
+        print("No text entered.")
+        return 0
+
+    print()
+    for rule in rules:
+        m = rule.regex.search(sample)
+        if m:
+            span = m.end() - m.start()
+            print(f"{green(chr(0x2713), use_color)} Matched: {rule.name}")
+            print(f"  at position {m.start()}-{m.end()} ({span} character(s), value masked)")
+        else:
+            print(f"{red(chr(0x2717), use_color)} No match: {rule.name}")
+
+    return 0
+
+
 # --- argparse wiring -----------------------------------------------------
 
 
@@ -1088,6 +1184,11 @@ def build_parser() -> argparse.ArgumentParser:
         "create", help="Interactively create a new rule in .secretshield-rules.toml."
     )
     rule_create_parser.set_defaults(func=_cmd_rule_create)
+    rule_test_parser = rule_subparsers.add_parser(
+        "test",
+        help="Interactively test sample text against your custom rules without scanning any file.",
+    )
+    rule_test_parser.set_defaults(func=_cmd_rule_test)
 
     return parser
 

{secretshield-0.7.0 → secretshield-0.8.0/secretshield.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.7.0
+Version: 0.8.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -32,10 +32,10 @@ Dynamic: license-file
 
 [![PyPI version](https://img.shields.io/pypi/v/secretshield?color=blue)](https://pypi.org/project/secretshield/)
 [![Python versions](https://img.shields.io/pypi/pyversions/secretshield)](https://pypi.org/project/secretshield/)
-[![PyPI downloads](https://img.shields.io/pypi/dm/secretshield)](https://pypi.org/project/secretshield/)
+[![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
-[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
+[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Homepage 🌐](https://therealsecretshield.freebuff.app/) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
 
 </div>
 
@@ -115,9 +115,12 @@ name = "My API Key"
 pattern = "MYAPP_[A-Za-z0-9]{32}"
 ```
 
-`secretshield scan .` picks it up automatically — no flag needed.
-Validate the file with `secretshield rules check`, or create a rule
-interactively with `secretshield rule create`.
+`secretshield scan .` picks it up automatically — no flag needed. The
+rules file itself is never treated as project content to scan, so a
+pattern that resembles a real secret won't flag its own definition.
+Validate rules with `secretshield rules check`, create one
+interactively with `secretshield rule create`, or try a pattern against
+sample text with `secretshield rule test` before committing to it.
 
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
@@ -145,3 +148,11 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+
+
+## Homepage
+
+Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
+
+**🌐 [therealsecretshield.freebuff.app](https://therealsecretshield.freebuff.app/)**

{secretshield-0.7.0 → secretshield-0.8.0}/secretshield.egg-info/SOURCES.txt

@@ -49,4 +49,5 @@ tests/test_scan.py
 tests/test_ss_alias_and_creator.py
 tests/test_stdout.py
 tests/test_v030_cli_integration.py
-tests/test_v040_cli_integration.py
+tests/test_v040_cli_integration.py
+tests/test_v080_self_detection_fix.py

{secretshield-0.7.0 → secretshield-0.8.0}/tests/test_custom_rules_cli_integration.py

@@ -129,10 +129,63 @@ def test_rules_check_success(tmp_path, monkeypatch, capsys):
     exit_code = main(["rules", "check"])
     assert exit_code == 0
     out = capsys.readouterr().out
-    assert "2 rule(s) loaded" in out
+    assert "2 rules loaded" in out
     assert "All patterns are valid" in out
 
 
+# --- Regression tests: singular/plural grammar in rule-count output --------
+# (0.7.1: these counts used to always print the literal "rule(s)"
+# regardless of count, e.g. "1 rule(s) loaded" -- fixed to pluralize
+# properly.)
+
+
+def test_rules_check_singular_grammar(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Only One"\npattern = "ONE_[0-9]{4}"\n'
+    )
+    main(["rules", "check"])
+    out = capsys.readouterr().out
+    assert "1 rule loaded" in out
+    assert "rule(s)" not in out
+
+
+def test_rules_check_plural_grammar(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "A"\npattern = "AAA_[0-9]{4}"\n'
+        '[[rules]]\nname = "B"\npattern = "BBB_[0-9]{4}"\n'
+        '[[rules]]\nname = "C"\npattern = "CCC_[0-9]{4}"\n'
+    )
+    main(["rules", "check"])
+    out = capsys.readouterr().out
+    assert "3 rules loaded" in out
+    assert "rule(s)" not in out
+
+
+def test_rules_list_singular_error_grammar(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Broken"\npattern = "["\n'
+    )
+    main(["rules"])
+    out = capsys.readouterr().out
+    assert "1 rule failed to load" in out
+    assert "rule(s)" not in out
+
+
+def test_scan_warning_singular_grammar(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Broken"\npattern = "["\n'
+    )
+    (tmp_path / "clean.py").write_text("print('hello')\n")
+    main(["scan", "."])
+    err = capsys.readouterr().err
+    assert "1 invalid custom rule in" in err
+    assert "rule(s)" not in err
+
+
 def test_rules_check_reports_errors(tmp_path, monkeypatch, capsys):
     monkeypatch.chdir(tmp_path)
     (tmp_path / ".secretshield-rules.toml").write_text(

secretshield-0.8.0/tests/test_v080_self_detection_fix.py

@@ -0,0 +1,341 @@
+"""
+v0.8.0: regression tests for the custom-rule self-detection bug fix,
+plus tests for the new `secretshield rule test` command.
+
+Root cause (confirmed by direct reproduction before the fix): a custom
+rule's `pattern` field, by design, resembles the very secret shape
+it's meant to catch. `.secretshield-rules.toml` is an ordinary `.toml`
+file, so a plain directory scan swept it in as regular project
+content -- meaning a rule whose pattern looked enough like a real
+secret (or whose example value happened to trip built-in entropy
+detection) caused the rules file to report itself as a finding.
+
+The fix: SecretShield's own meta-files (.secretshield-rules.toml,
+secretshield.toml, .secretshieldignore, .secretshield-baseline.json)
+are now skipped by name during a default directory scan, the same way
+_SKIP_DIR_NAMES already skips well-known directories -- not a broad
+"skip all .toml files" exclusion. --no-ignore re-includes them;
+explicitly scanning one by path is unaffected.
+"""
+
+from __future__ import annotations
+
+import subprocess
+
+from secretshield.cli import main
+
+SELF_RESEMBLING_PATTERN = "MYAPP_abc123def456ghi789jkl012mno345"
+
+
+def _init_repo(path):
+    subprocess.run(["git", "init", "-q"], cwd=path, check=True)
+    subprocess.run(["git", "config", "user.email", "t@t.com"], cwd=path, check=True)
+    subprocess.run(["git", "config", "user.name", "T"], cwd=path, check=True)
+
+
+# --- 1 & 2: reproduce, then confirm fixed -----------------------------------
+
+
+def test_custom_rule_pattern_in_source_file_is_still_detected(tmp_path, monkeypatch):
+    """A custom rule must still catch its intended pattern in real
+    project files -- the fix must not weaken detection."""
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Test Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    (tmp_path / "app.py").write_text(f'API_KEY = "{SELF_RESEMBLING_PATTERN}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_rules_file_does_not_self_detect(tmp_path, monkeypatch, capsys):
+    """The core bug: a rule whose pattern resembles a real secret must
+    not cause .secretshield-rules.toml to report itself."""
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Test Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    # No other files -- if anything is reported, it can only be the
+    # rules file self-matching.
+    exit_code = main(["scan", ".", "--json"])
+    assert exit_code == 0
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["secrets_found"] == 0
+    assert payload["files_scanned"] == 0
+
+
+def test_rules_file_excluded_even_from_files_scanned_count(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "X"\npattern = "AAA_[0-9]{6}"\n'
+    )
+    (tmp_path / "clean.py").write_text("print('hello')\n")
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 1  # only clean.py, not the rules file
+
+
+# --- 4 & 5: multiple custom rules + real detection ---------------------------
+
+
+def test_multiple_custom_rules_no_self_detection_any_of_them(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Rule A"\npattern = "AAA_bbbbbbbbbbbbbbbbbbbbbbbb"\n'
+        '[[rules]]\nname = "Rule B"\npattern = "BBB_cccccccccccccccccccccc"\n'
+    )
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["secrets_found"] == 0
+
+
+def test_multiple_custom_rules_still_detect_real_matches(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Rule A"\npattern = "AAA_[0-9]{6}"\n'
+        '[[rules]]\nname = "Rule B"\npattern = "BBB_[0-9]{6}"\n'
+    )
+    (tmp_path / "app.py").write_text('a = "AAA_123456"\nb = "BBB_654321"\n')
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    kinds = {m["kind"] for m in payload["matches"]}
+    assert {"Rule A", "Rule B"}.issubset(kinds)
+
+
+# --- 6: built-in rules unaffected --------------------------------------------
+
+
+def test_built_in_detection_still_works(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    aws_key = "AKIAABCDEFGHIJKLMNOP"
+    (tmp_path / "app.py").write_text(f'x = "{aws_key}"\n')
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["matches"][0]["kind"] == "aws_access_key_id"
+
+
+# --- 7: broken custom rules behave as before ---------------------------------
+
+
+def test_broken_custom_rule_still_reported_via_rules_check(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text('[[rules]]\nname = "Bad"\npattern = "["\n')
+    exit_code = main(["rules", "check"])
+    assert exit_code == 1
+
+
+def test_broken_custom_rule_does_not_block_scan(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text('[[rules]]\nname = "Bad"\npattern = "["\n')
+    (tmp_path / "clean.py").write_text("print('hello')\n")
+    assert main(["scan", "."]) == 0
+
+
+# --- --no-ignore re-includes meta-files --------------------------------------
+
+
+def test_no_ignore_flag_allows_scanning_meta_files_again(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    main(["scan", ".", "--no-ignore", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    # With --no-ignore, the rules file IS scanned again, and since its
+    # own pattern text resembles a real secret it's expected to
+    # self-match -- this proves --no-ignore genuinely re-includes it,
+    # rather than the exclusion being silently unconditional.
+    assert payload["files_scanned"] == 1
+
+
+def test_explicit_direct_scan_of_rules_file_still_works(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    rules_file = tmp_path / ".secretshield-rules.toml"
+    rules_file.write_text(f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n')
+    # Explicitly naming the file as the scan target still works --
+    # only the default directory *walk* excludes it.
+    exit_code = main(["scan", str(rules_file)])
+    assert exit_code == 1
+
+
+# --- secretshield.toml / .secretshieldignore / baseline also excluded -------
+
+
+def test_secretshield_toml_not_scanned_by_default(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "secretshield.toml").write_text("[scan]\nentropy_threshold = 4.2\n")
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 0
+
+
+def test_secretshieldignore_not_scanned_by_default(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 0
+
+
+def test_baseline_file_not_scanned_by_default(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    from secretshield.baseline import write_baseline
+
+    write_baseline(tmp_path, [{"id": "a" * 64, "file": "app.py", "kind": "x", "line": 1}])
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 0
+
+
+# --- --staged / scan-staged (the pre-commit hook path) -----------------------
+
+
+def test_staged_rules_file_does_not_self_block(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    subprocess.run(["git", "add", ".secretshield-rules.toml"], cwd=tmp_path, check=True)
+
+    exit_code = main(["scan", "--staged"])
+    assert exit_code == 0
+
+
+def test_scan_staged_command_does_not_self_block(tmp_path, monkeypatch):
+    # This is the exact path the installed pre-commit hook invokes.
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    subprocess.run(["git", "add", ".secretshield-rules.toml"], cwd=tmp_path, check=True)
+
+    exit_code = main(["scan-staged"])
+    assert exit_code == 0
+
+
+def test_real_commit_of_rules_file_succeeds(tmp_path, monkeypatch):
+    """The exact real-world scenario reported: committing an update to
+    your own custom-rules file must not get blocked by itself."""
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    main(["install-hook"])
+
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    subprocess.run(["git", "add", ".secretshield-rules.toml"], cwd=tmp_path, check=True)
+
+    result = subprocess.run(
+        ["git", "commit", "-m", "add custom rule"],
+        cwd=tmp_path,
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0
+
+
+# --- `secretshield rule test` ------------------------------------------------
+
+
+def test_rule_test_non_interactive_refuses(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["rule", "test"])
+    assert exit_code == 1
+
+
+def test_rule_test_no_rules_file(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    exit_code = main(["rule", "test"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "No .secretshield-rules.toml found" in out
+
+
+def test_rule_test_reports_match(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": SELF_RESEMBLING_PATTERN)
+
+    exit_code = main(["rule", "test"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "Matched: My Rule" in out
+
+
+def test_rule_test_reports_no_match(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My Rule"\npattern = "AAA_[0-9]{6}"\n'
+    )
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": "totally unrelated text")
+
+    exit_code = main(["rule", "test"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "No match: My Rule" in out
+
+
+def test_rule_test_never_prints_raw_matched_value(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": SELF_RESEMBLING_PATTERN)
+
+    main(["rule", "test"])
+    out = capsys.readouterr().out
+    assert "value masked" in out
+
+
+# --- 8: existing suite remains green (spot-checked here too) ---------------
+
+
+def test_scan_with_no_config_files_at_all_still_works(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "clean.py").write_text("print('nothing here')\n")
+    assert main(["scan", "."]) == 0