secretshield 0.7.1__tar.gz → 0.9.0__tar.gz

{secretshield-0.7.1/secretshield.egg-info → secretshield-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.7.1
+Version: 0.9.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -35,7 +35,7 @@ Dynamic: license-file
 [![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
-[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
+[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Homepage 🌐](https://therealsecretshield.freebuff.app/) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
 
 </div>
 
@@ -115,9 +115,12 @@ name = "My API Key"
 pattern = "MYAPP_[A-Za-z0-9]{32}"
 ```
 
-`secretshield scan .` picks it up automatically — no flag needed.
-Validate the file with `secretshield rules check`, or create a rule
-interactively with `secretshield rule create`.
+`secretshield scan .` picks it up automatically — no flag needed. The
+rules file itself is never treated as project content to scan, so a
+pattern that resembles a real secret won't flag its own definition.
+Validate rules with `secretshield rules check`, create one
+interactively with `secretshield rule create`, or try a pattern against
+sample text with `secretshield rule test` before committing to it.
 
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
@@ -145,3 +148,11 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+
+
+## Homepage
+
+Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
+
+**🌐 [therealsecretshield.freebuff.app](https://therealsecretshield.freebuff.app/)**

{secretshield-0.7.1 → secretshield-0.9.0}/README.md

@@ -9,7 +9,7 @@
 [![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
-[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
+[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Homepage 🌐](https://therealsecretshield.freebuff.app/) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
 
 </div>
 
@@ -89,9 +89,12 @@ name = "My API Key"
 pattern = "MYAPP_[A-Za-z0-9]{32}"
 ```
 
-`secretshield scan .` picks it up automatically — no flag needed.
-Validate the file with `secretshield rules check`, or create a rule
-interactively with `secretshield rule create`.
+`secretshield scan .` picks it up automatically — no flag needed. The
+rules file itself is never treated as project content to scan, so a
+pattern that resembles a real secret won't flag its own definition.
+Validate rules with `secretshield rules check`, create one
+interactively with `secretshield rule create`, or try a pattern against
+sample text with `secretshield rule test` before committing to it.
 
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
@@ -119,3 +122,11 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+
+
+## Homepage
+
+Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
+
+**🌐 [therealsecretshield.freebuff.app](https://therealsecretshield.freebuff.app/)**

{secretshield-0.7.1 → secretshield-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretshield"
-version = "0.7.1"
+version = "0.9.0"
 description = "Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI."
 readme = "README.md"
 license = "MIT"

{secretshield-0.7.1 → secretshield-0.9.0}/secretshield/__init__.py

@@ -23,7 +23,7 @@ from .detector import Match, detect
 from .guardian import disable, enable, is_enabled
 from .redactor import redact
 
-__version__ = "0.7.1"
+__version__ = "0.9.0"
 
 __all__ = [
     "__version__",

{secretshield-0.7.1 → secretshield-0.9.0}/secretshield/cli.py

@@ -27,7 +27,7 @@ import sys
 from pathlib import Path
 
 from . import __version__, disable, enable, is_enabled
-from .color import green, red, supports_color
+from .color import green, hyperlink, red, supports_color
 from .detector import detect
 
 # --- File type support -----------------------------------------------------
@@ -60,6 +60,32 @@ _SKIP_DIR_NAMES = {
     ".tox", "egg-info",
 }
 
+# SecretShield's own meta-files, skipped by default during a directory
+# scan -- not because of their extension (a targeted, narrow exclusion
+# by exact name, not "skip all .toml/.json files"), but because their
+# job is to *configure* detection, not to hold project source that
+# might leak a secret. A custom rule's pattern necessarily resembles
+# the very thing it's meant to catch (that's the whole point of it),
+# so without this, .secretshield-rules.toml ends up reporting itself
+# as a finding the moment a rule's pattern looks enough like a real
+# secret -- which defeats the purpose of writing the rule in the first
+# place. secretshield.toml and .secretshieldignore are excluded for
+# the same reason (settings/ignore globs aren't project secrets
+# either), and the baseline file is excluded as a defensive measure:
+# its SHA-256 hex hashes sit safely below the *default* entropy
+# threshold, but a project that lowers entropy_threshold via
+# secretshield.toml could otherwise start flagging its own baseline.
+# --no-ignore re-includes all of these, same as it does for
+# _SKIP_DIR_NAMES; explicitly scanning one of them by path (e.g.
+# `secretshield scan .secretshield-rules.toml`) is unaffected -- this
+# only changes what a directory *walk* picks up by default.
+_SKIP_FILE_NAMES = {
+    ".secretshield-rules.toml",
+    "secretshield.toml",
+    ".secretshieldignore",
+    ".secretshield-baseline.json",
+}
+
 # Bytes read from the start of a file to decide whether it looks binary.
 _BINARY_SNIFF_SIZE = 1024
 
@@ -91,6 +117,10 @@ def _looks_binary(path: Path) -> bool:
     return False
 
 
+def _is_secretshield_meta_file(name: str) -> bool:
+    return name in _SKIP_FILE_NAMES
+
+
 def _should_scan_file(
     path: Path,
     include_patterns: list[str],
@@ -140,6 +170,8 @@ def _iter_scan_files(
             continue
         if not no_ignore and any(part in _SKIP_DIR_NAMES for part in path.parts):
             continue
+        if not no_ignore and _is_secretshield_meta_file(path.name):
+            continue
         if not _should_scan_file(path, include_patterns, exclude_patterns):
             continue
         if _looks_binary(path):
@@ -378,8 +410,11 @@ def _iter_scan_sources(args: argparse.Namespace, target: Path, include_patterns:
         if not is_git_repo():
             print("secretshield: error: not inside a Git repository", file=sys.stderr)
             return
+        no_ignore = getattr(args, "no_ignore", False)
         for relpath in get_staged_files():
             path = Path(relpath)
+            if not no_ignore and _is_secretshield_meta_file(path.name):
+                continue
             if not _should_scan_file(path, include_patterns, exclude_patterns):
                 continue
             content = get_staged_content(relpath)
@@ -395,8 +430,11 @@ def _iter_scan_sources(args: argparse.Namespace, target: Path, include_patterns:
         if not is_git_repo():
             print("secretshield: error: not inside a Git repository", file=sys.stderr)
             return
+        no_ignore = getattr(args, "no_ignore", False)
         for relpath in get_diff_files(diff_ref):
             path = Path(relpath)
+            if not no_ignore and _is_secretshield_meta_file(path.name):
+                continue
             if not _should_scan_file(path, include_patterns, exclude_patterns):
                 continue
             if not path.exists() or _looks_binary(path):
@@ -598,6 +636,8 @@ def _run_scan_staged(args: argparse.Namespace) -> int:
     findings: list[dict] = []
     for relpath in get_staged_files():
         path = Path(relpath)
+        if _is_secretshield_meta_file(path.name):
+            continue
         if not _should_scan_file(path, [], []):
             continue
         content = get_staged_content(relpath)
@@ -761,6 +801,18 @@ def _cmd_init(args: argparse.Namespace) -> int:
         else:
             print(f"{green(chr(0x2713), use_color)} {path.relative_to(project_root)} already exists, leaving it unchanged")
 
+    # .secretshieldignore is created unconditionally (no extra prompt --
+    # it's a tiny, harmless starter file), the same helper --ignore-file
+    # uses, and it's always safe: an existing file is left untouched.
+    from .ignorefile import create_default_ignore_file
+
+    ignore_created, ignore_path = create_default_ignore_file(project_root)
+    if ignore_created:
+        print(f"{green(chr(0x2713), use_color)} Created {ignore_path.name}")
+        created.append(ignore_path.name)
+    else:
+        print(f"{green(chr(0x2713), use_color)} {ignore_path.name} already exists, leaving it unchanged")
+
     print("\nSecretShield is ready.")
     return 0
 
@@ -883,22 +935,128 @@ def _cmd_rule_create(args: argparse.Namespace) -> int:
     return 0
 
 
+def _cmd_rule_test(args: argparse.Namespace) -> int:
+    from .custom_rules import load_custom_rules, rules_file_path
+
+    try:
+        interactive = sys.stdin.isatty()
+    except Exception:
+        interactive = False
+
+    if not interactive:
+        print("secretshield rule test requires an interactive terminal.")
+        return 1
+
+    path = rules_file_path(Path.cwd())
+    if not path.exists():
+        print(f"No {path.name} found. Create one with `secretshield rule create`.")
+        return 0
+
+    rules, errors = load_custom_rules(Path.cwd())
+    if errors:
+        print(
+            f"secretshield: warning: {_plural(len(errors), 'invalid custom rule')} "
+            f"skipped -- run `secretshield rules check` for details.",
+            file=sys.stderr,
+        )
+    if not rules:
+        print("No valid custom rules to test.")
+        return 0
+
+    use_color = supports_color(sys.stdout)
+    print("SecretShield \u2014 Test custom rules\n")
+    print(f"Loaded {_plural(len(rules), 'rule')}: {', '.join(r.name for r in rules)}\n")
+
+    sample = input("Text to test: ")
+    if not sample:
+        print("No text entered.")
+        return 0
+
+    print()
+    for rule in rules:
+        m = rule.regex.search(sample)
+        if m:
+            span = m.end() - m.start()
+            print(f"{green(chr(0x2713), use_color)} Matched: {rule.name}")
+            print(f"  at position {m.start()}-{m.end()} ({span} character(s), value masked)")
+        else:
+            print(f"{red(chr(0x2717), use_color)} No match: {rule.name}")
+
+    return 0
+
+
 # --- argparse wiring -----------------------------------------------------
 
 
 CREATOR_MESSAGE = "SecretShield\nCreated by Samarth Chugh (Sam3360)\ngithub.com/Sam3360"
+CREATOR_GITHUB_URL = "https://github.com/Sam3360"
+
+USAGE_URL = "https://github.com/Sam3360/secretshield/blob/main/USAGE.md"
 
 
 class _CreatorAction(argparse.Action):
     """Prints creator info and exits -- mirrors argparse's built-in
     `action="version"` behavior so `--creator` works the same way
-    `--version` does, with no subcommand required."""
+    `--version` does, with no subcommand required.
+
+    The GitHub line is wrapped in a standard OSC 8 terminal hyperlink
+    (so supported terminals can Ctrl+Click it) only when connected to a
+    real terminal; piped/non-interactive output gets the same plain
+    text CREATOR_MESSAGE always had, with no escape codes.
+    """
+
+    def __init__(self, option_strings, dest, nargs=0, **kwargs):
+        super().__init__(option_strings, dest, nargs=nargs, **kwargs)
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        link_text = "github.com/Sam3360"
+        link = hyperlink(link_text, CREATOR_GITHUB_URL, supports_color(sys.stdout))
+        print(f"SecretShield\nCreated by Samarth Chugh (Sam3360)\n{link}")
+        parser.exit()
+
+
+class _UsageAction(argparse.Action):
+    """Prompts, then opens the USAGE.md documentation in the system's
+    default browser on Enter -- never before the user confirms. Ctrl+C
+    and EOF are handled cleanly, with no traceback and no browser
+    launch."""
+
+    def __init__(self, option_strings, dest, nargs=0, **kwargs):
+        super().__init__(option_strings, dest, nargs=nargs, **kwargs)
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        print("SecretShield\n")
+        print("Press Enter to open the USAGE documentation.")
+        print("Ctrl+C to cancel.")
+        try:
+            input()
+        except (KeyboardInterrupt, EOFError):
+            print()
+            parser.exit()
+            return
+        import webbrowser
+
+        webbrowser.open(USAGE_URL)
+        parser.exit()
+
+
+class _IgnoreFileAction(argparse.Action):
+    """Creates a starter .secretshieldignore in the current directory,
+    reusing the same helper `secretshield init` uses -- never
+    overwrites an existing file."""
 
     def __init__(self, option_strings, dest, nargs=0, **kwargs):
         super().__init__(option_strings, dest, nargs=nargs, **kwargs)
 
     def __call__(self, parser, namespace, values, option_string=None):
-        print(CREATOR_MESSAGE)
+        from .ignorefile import create_default_ignore_file
+
+        created, path = create_default_ignore_file(Path.cwd())
+        use_color = supports_color(sys.stdout)
+        if created:
+            print(f"{green(chr(0x2713), use_color)} Created {path.name}")
+        else:
+            print(f"{path.name} already exists.")
         parser.exit()
 
 
@@ -916,6 +1074,16 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument(
         "--creator", action=_CreatorAction, help="Show who made this and exit."
     )
+    parser.add_argument(
+        "--usage",
+        action=_UsageAction,
+        help="Open the USAGE.md documentation in your browser (asks for confirmation first).",
+    )
+    parser.add_argument(
+        "--ignore-file",
+        action=_IgnoreFileAction,
+        help="Create a starter .secretshieldignore in the current directory.",
+    )
 
     subparsers = parser.add_subparsers(dest="command")
 
@@ -1094,6 +1262,11 @@ def build_parser() -> argparse.ArgumentParser:
         "create", help="Interactively create a new rule in .secretshield-rules.toml."
     )
     rule_create_parser.set_defaults(func=_cmd_rule_create)
+    rule_test_parser = rule_subparsers.add_parser(
+        "test",
+        help="Interactively test sample text against your custom rules without scanning any file.",
+    )
+    rule_test_parser.set_defaults(func=_cmd_rule_test)
 
     return parser
 

{secretshield-0.7.1 → secretshield-0.9.0}/secretshield/color.py

@@ -40,3 +40,16 @@ def red(text: str, enabled: bool) -> str:
 
 def green(text: str, enabled: bool) -> str:
     return f"{_GREEN}{text}{_RESET}" if enabled else text
+
+
+def hyperlink(text: str, url: str, enabled: bool) -> str:
+    """
+    Wrap `text` in a standard OSC 8 terminal hyperlink escape sequence
+    pointing at `url`, so supported terminals can Ctrl+Click it --
+    while the *visible* text stays exactly `text`. Falls back to plain
+    `text` (no escape codes at all) when `enabled` is False, so
+    terminals that don't understand OSC 8 never see raw escape junk.
+    """
+    if not enabled:
+        return text
+    return f"\033]8;;{url}\033\\{text}\033]8;;\033\\"

{secretshield-0.7.1 → secretshield-0.9.0}/secretshield/ignorefile.py

@@ -10,6 +10,32 @@ from pathlib import Path
 
 IGNORE_FILENAME = ".secretshieldignore"
 
+DEFAULT_IGNORE_CONTENT = (
+    "# Add files, directories, or patterns here that SecretShield should ignore.\n"
+)
+
+
+def ignore_file_path(root: Path) -> Path:
+    return root / IGNORE_FILENAME
+
+
+def create_default_ignore_file(root: Path | None = None) -> tuple[bool, Path]:
+    """
+    Create a starter `.secretshieldignore` in `root` (default: current
+    directory) with a short explanatory comment, if one doesn't already
+    exist. Never overwrites an existing file -- shared by both the
+    `--ignore-file` CLI option and `secretshield init`, so there's only
+    one place that generates this starter content.
+
+    Returns `(created, path)`: `created` is False if the file was
+    already there (nothing was touched).
+    """
+    path = ignore_file_path(root or Path.cwd())
+    if path.exists():
+        return False, path
+    path.write_text(DEFAULT_IGNORE_CONTENT, encoding="utf-8")
+    return True, path
+
 
 def ignore_file_path(root: Path) -> Path:
     return root / IGNORE_FILENAME

{secretshield-0.7.1 → secretshield-0.9.0/secretshield.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secretshield
-Version: 0.7.1
+Version: 0.9.0
 Summary: Stop secrets before they leak -- runtime redaction, multi-language scanning, auto-fix, Git hooks, and CI, all in one CLI.
 Author: Samarth Chugh (Sam3360)
 License-Expression: MIT
@@ -35,7 +35,7 @@ Dynamic: license-file
 [![PyPI Downloads](https://api.pepy.tech/badge/secretshield/month)](https://pypi.org/project/secretshield/)
 [![License: MIT](https://img.shields.io/pypi/l/secretshield)](LICENSE)
 
-[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
+[Install](#install) · [Demo](#demo) · [Try it](#try-it) · [Homepage 🌐](https://therealsecretshield.freebuff.app/) · [Full usage guide →](https://github.com/Sam3360/secretshield/blob/main/USAGE.md)
 
 </div>
 
@@ -115,9 +115,12 @@ name = "My API Key"
 pattern = "MYAPP_[A-Za-z0-9]{32}"
 ```
 
-`secretshield scan .` picks it up automatically — no flag needed.
-Validate the file with `secretshield rules check`, or create a rule
-interactively with `secretshield rule create`.
+`secretshield scan .` picks it up automatically — no flag needed. The
+rules file itself is never treated as project content to scan, so a
+pattern that resembles a real secret won't flag its own definition.
+Validate rules with `secretshield rules check`, create one
+interactively with `secretshield rule create`, or try a pattern against
+sample text with `secretshield rule test` before committing to it.
 
 For the full command reference, configuration options, and exactly how
 Auto-Fix decides what's safe to rewrite, see the
@@ -145,3 +148,11 @@ If you find this project useful, consider [supporting its development through Gi
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+
+
+## Homepage
+
+Visit the official SecretShield homepage for an overview of the project, features, releases, and more:
+
+**🌐 [therealsecretshield.freebuff.app](https://therealsecretshield.freebuff.app/)**

{secretshield-0.7.1 → secretshield-0.9.0}/secretshield.egg-info/SOURCES.txt

@@ -49,4 +49,6 @@ tests/test_scan.py
 tests/test_ss_alias_and_creator.py
 tests/test_stdout.py
 tests/test_v030_cli_integration.py
-tests/test_v040_cli_integration.py
+tests/test_v040_cli_integration.py
+tests/test_v080_self_detection_fix.py
+tests/test_v090_cli_additions.py

secretshield-0.9.0/tests/test_v080_self_detection_fix.py

@@ -0,0 +1,341 @@
+"""
+v0.8.0: regression tests for the custom-rule self-detection bug fix,
+plus tests for the new `secretshield rule test` command.
+
+Root cause (confirmed by direct reproduction before the fix): a custom
+rule's `pattern` field, by design, resembles the very secret shape
+it's meant to catch. `.secretshield-rules.toml` is an ordinary `.toml`
+file, so a plain directory scan swept it in as regular project
+content -- meaning a rule whose pattern looked enough like a real
+secret (or whose example value happened to trip built-in entropy
+detection) caused the rules file to report itself as a finding.
+
+The fix: SecretShield's own meta-files (.secretshield-rules.toml,
+secretshield.toml, .secretshieldignore, .secretshield-baseline.json)
+are now skipped by name during a default directory scan, the same way
+_SKIP_DIR_NAMES already skips well-known directories -- not a broad
+"skip all .toml files" exclusion. --no-ignore re-includes them;
+explicitly scanning one by path is unaffected.
+"""
+
+from __future__ import annotations
+
+import subprocess
+
+from secretshield.cli import main
+
+SELF_RESEMBLING_PATTERN = "MYAPP_abc123def456ghi789jkl012mno345"
+
+
+def _init_repo(path):
+    subprocess.run(["git", "init", "-q"], cwd=path, check=True)
+    subprocess.run(["git", "config", "user.email", "t@t.com"], cwd=path, check=True)
+    subprocess.run(["git", "config", "user.name", "T"], cwd=path, check=True)
+
+
+# --- 1 & 2: reproduce, then confirm fixed -----------------------------------
+
+
+def test_custom_rule_pattern_in_source_file_is_still_detected(tmp_path, monkeypatch):
+    """A custom rule must still catch its intended pattern in real
+    project files -- the fix must not weaken detection."""
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Test Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    (tmp_path / "app.py").write_text(f'API_KEY = "{SELF_RESEMBLING_PATTERN}"\n')
+
+    exit_code = main(["scan", "."])
+    assert exit_code == 1
+
+
+def test_rules_file_does_not_self_detect(tmp_path, monkeypatch, capsys):
+    """The core bug: a rule whose pattern resembles a real secret must
+    not cause .secretshield-rules.toml to report itself."""
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Test Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    # No other files -- if anything is reported, it can only be the
+    # rules file self-matching.
+    exit_code = main(["scan", ".", "--json"])
+    assert exit_code == 0
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["secrets_found"] == 0
+    assert payload["files_scanned"] == 0
+
+
+def test_rules_file_excluded_even_from_files_scanned_count(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "X"\npattern = "AAA_[0-9]{6}"\n'
+    )
+    (tmp_path / "clean.py").write_text("print('hello')\n")
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 1  # only clean.py, not the rules file
+
+
+# --- 4 & 5: multiple custom rules + real detection ---------------------------
+
+
+def test_multiple_custom_rules_no_self_detection_any_of_them(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Rule A"\npattern = "AAA_bbbbbbbbbbbbbbbbbbbbbbbb"\n'
+        '[[rules]]\nname = "Rule B"\npattern = "BBB_cccccccccccccccccccccc"\n'
+    )
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["secrets_found"] == 0
+
+
+def test_multiple_custom_rules_still_detect_real_matches(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "Rule A"\npattern = "AAA_[0-9]{6}"\n'
+        '[[rules]]\nname = "Rule B"\npattern = "BBB_[0-9]{6}"\n'
+    )
+    (tmp_path / "app.py").write_text('a = "AAA_123456"\nb = "BBB_654321"\n')
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    kinds = {m["kind"] for m in payload["matches"]}
+    assert {"Rule A", "Rule B"}.issubset(kinds)
+
+
+# --- 6: built-in rules unaffected --------------------------------------------
+
+
+def test_built_in_detection_still_works(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    aws_key = "AKIAABCDEFGHIJKLMNOP"
+    (tmp_path / "app.py").write_text(f'x = "{aws_key}"\n')
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["matches"][0]["kind"] == "aws_access_key_id"
+
+
+# --- 7: broken custom rules behave as before ---------------------------------
+
+
+def test_broken_custom_rule_still_reported_via_rules_check(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text('[[rules]]\nname = "Bad"\npattern = "["\n')
+    exit_code = main(["rules", "check"])
+    assert exit_code == 1
+
+
+def test_broken_custom_rule_does_not_block_scan(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text('[[rules]]\nname = "Bad"\npattern = "["\n')
+    (tmp_path / "clean.py").write_text("print('hello')\n")
+    assert main(["scan", "."]) == 0
+
+
+# --- --no-ignore re-includes meta-files --------------------------------------
+
+
+def test_no_ignore_flag_allows_scanning_meta_files_again(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    main(["scan", ".", "--no-ignore", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    # With --no-ignore, the rules file IS scanned again, and since its
+    # own pattern text resembles a real secret it's expected to
+    # self-match -- this proves --no-ignore genuinely re-includes it,
+    # rather than the exclusion being silently unconditional.
+    assert payload["files_scanned"] == 1
+
+
+def test_explicit_direct_scan_of_rules_file_still_works(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    rules_file = tmp_path / ".secretshield-rules.toml"
+    rules_file.write_text(f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n')
+    # Explicitly naming the file as the scan target still works --
+    # only the default directory *walk* excludes it.
+    exit_code = main(["scan", str(rules_file)])
+    assert exit_code == 1
+
+
+# --- secretshield.toml / .secretshieldignore / baseline also excluded -------
+
+
+def test_secretshield_toml_not_scanned_by_default(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "secretshield.toml").write_text("[scan]\nentropy_threshold = 4.2\n")
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 0
+
+
+def test_secretshieldignore_not_scanned_by_default(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("vendor/\n")
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 0
+
+
+def test_baseline_file_not_scanned_by_default(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    from secretshield.baseline import write_baseline
+
+    write_baseline(tmp_path, [{"id": "a" * 64, "file": "app.py", "kind": "x", "line": 1}])
+    main(["scan", ".", "--json"])
+
+    import json
+
+    out = capsys.readouterr().out
+    payload = json.loads(out)
+    assert payload["files_scanned"] == 0
+
+
+# --- --staged / scan-staged (the pre-commit hook path) -----------------------
+
+
+def test_staged_rules_file_does_not_self_block(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    subprocess.run(["git", "add", ".secretshield-rules.toml"], cwd=tmp_path, check=True)
+
+    exit_code = main(["scan", "--staged"])
+    assert exit_code == 0
+
+
+def test_scan_staged_command_does_not_self_block(tmp_path, monkeypatch):
+    # This is the exact path the installed pre-commit hook invokes.
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    subprocess.run(["git", "add", ".secretshield-rules.toml"], cwd=tmp_path, check=True)
+
+    exit_code = main(["scan-staged"])
+    assert exit_code == 0
+
+
+def test_real_commit_of_rules_file_succeeds(tmp_path, monkeypatch):
+    """The exact real-world scenario reported: committing an update to
+    your own custom-rules file must not get blocked by itself."""
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    main(["install-hook"])
+
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "X"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    subprocess.run(["git", "add", ".secretshield-rules.toml"], cwd=tmp_path, check=True)
+
+    result = subprocess.run(
+        ["git", "commit", "-m", "add custom rule"],
+        cwd=tmp_path,
+        capture_output=True,
+        text=True,
+    )
+    assert result.returncode == 0
+
+
+# --- `secretshield rule test` ------------------------------------------------
+
+
+def test_rule_test_non_interactive_refuses(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["rule", "test"])
+    assert exit_code == 1
+
+
+def test_rule_test_no_rules_file(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    exit_code = main(["rule", "test"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "No .secretshield-rules.toml found" in out
+
+
+def test_rule_test_reports_match(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": SELF_RESEMBLING_PATTERN)
+
+    exit_code = main(["rule", "test"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "Matched: My Rule" in out
+
+
+def test_rule_test_reports_no_match(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        '[[rules]]\nname = "My Rule"\npattern = "AAA_[0-9]{6}"\n'
+    )
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": "totally unrelated text")
+
+    exit_code = main(["rule", "test"])
+    assert exit_code == 0
+    out = capsys.readouterr().out
+    assert "No match: My Rule" in out
+
+
+def test_rule_test_never_prints_raw_matched_value(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshield-rules.toml").write_text(
+        f'[[rules]]\nname = "My Rule"\npattern = "{SELF_RESEMBLING_PATTERN}"\n'
+    )
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr("builtins.input", lambda prompt="": SELF_RESEMBLING_PATTERN)
+
+    main(["rule", "test"])
+    out = capsys.readouterr().out
+    assert "value masked" in out
+
+
+# --- 8: existing suite remains green (spot-checked here too) ---------------
+
+
+def test_scan_with_no_config_files_at_all_still_works(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "clean.py").write_text("print('nothing here')\n")
+    assert main(["scan", "."]) == 0

secretshield-0.9.0/tests/test_v090_cli_additions.py

@@ -0,0 +1,275 @@
+"""
+Tests for v0.9.0: `--usage`, the OSC 8 hyperlink in `--creator`,
+`--ignore-file`, and `init` now creating `.secretshieldignore`.
+"""
+
+from __future__ import annotations
+
+import subprocess
+
+import pytest
+
+from secretshield.cli import CREATOR_GITHUB_URL, USAGE_URL, build_parser, main
+from secretshield.color import hyperlink
+from secretshield.ignorefile import DEFAULT_IGNORE_CONTENT, create_default_ignore_file
+
+
+def _init_repo(path):
+    subprocess.run(["git", "init", "-q"], cwd=path, check=True)
+    subprocess.run(["git", "config", "user.email", "t@t.com"], cwd=path, check=True)
+    subprocess.run(["git", "config", "user.name", "T"], cwd=path, check=True)
+
+
+# --- --usage ------------------------------------------------------------
+
+
+def test_usage_option_exists_in_parser():
+    parser = build_parser()
+    # Should not raise / should be recognized (will exit via the action
+    # once input() is reached -- exercised properly in the tests below).
+    assert any("--usage" in opt.option_strings for opt in parser._actions)
+
+
+def test_usage_enter_opens_browser_with_correct_url(monkeypatch, capsys):
+    monkeypatch.setattr("builtins.input", lambda: "")
+    opened = {}
+
+    def fake_open(url):
+        opened["url"] = url
+
+    monkeypatch.setattr("webbrowser.open", fake_open)
+
+    with pytest.raises(SystemExit):
+        main(["--usage"])
+
+    assert opened.get("url") == USAGE_URL
+    assert USAGE_URL == "https://github.com/Sam3360/secretshield/blob/main/USAGE.md"
+
+
+def test_usage_ctrl_c_does_not_open_browser(monkeypatch, capsys):
+    def raise_interrupt():
+        raise KeyboardInterrupt
+
+    monkeypatch.setattr("builtins.input", lambda: raise_interrupt())
+    opened = {"called": False}
+    monkeypatch.setattr("webbrowser.open", lambda url: opened.update(called=True))
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["--usage"])
+
+    assert opened["called"] is False
+    assert exc_info.value.code in (0, None)
+
+
+def test_usage_eof_does_not_open_browser(monkeypatch, capsys):
+    def raise_eof():
+        raise EOFError
+
+    monkeypatch.setattr("builtins.input", lambda: raise_eof())
+    opened = {"called": False}
+    monkeypatch.setattr("webbrowser.open", lambda url: opened.update(called=True))
+
+    with pytest.raises(SystemExit) as exc_info:
+        main(["--usage"])
+
+    assert opened["called"] is False
+    assert exc_info.value.code in (0, None)
+
+
+def test_usage_prompt_text_shown(monkeypatch, capsys):
+    monkeypatch.setattr("builtins.input", lambda: "")
+    monkeypatch.setattr("webbrowser.open", lambda url: None)
+
+    with pytest.raises(SystemExit):
+        main(["--usage"])
+
+    out = capsys.readouterr().out
+    assert "Press Enter to open the USAGE documentation." in out
+    assert "Ctrl+C to cancel." in out
+
+
+# --- --creator hyperlink -----------------------------------------------
+
+
+def test_creator_visible_text_still_correct(monkeypatch, capsys):
+    monkeypatch.setattr("sys.stdout.isatty", lambda: False)  # plain output
+    with pytest.raises(SystemExit):
+        main(["--creator"])
+    out = capsys.readouterr().out
+    assert "Samarth Chugh (Sam3360)" in out
+    assert "github.com/Sam3360" in out
+
+
+def test_creator_github_url_constant_correct():
+    assert CREATOR_GITHUB_URL == "https://github.com/Sam3360"
+
+
+def test_hyperlink_osc8_format_correct():
+    link = hyperlink("github.com/Sam3360", CREATOR_GITHUB_URL, True)
+    assert link == "\033]8;;https://github.com/Sam3360\033\\github.com/Sam3360\033]8;;\033\\"
+
+
+def test_hyperlink_visible_text_unchanged():
+    import re
+
+    link = hyperlink("github.com/Sam3360", CREATOR_GITHUB_URL, True)
+    # Parse the OSC 8 structure properly: \x1b]8;;URL\x1b\TEXT\x1b]8;;\x1b\
+    match = re.match(r"\x1b\]8;;(?P<url>[^\x1b]*)\x1b\\(?P<text>.*)\x1b\]8;;\x1b\\$", link)
+    assert match is not None
+    assert match.group("text") == "github.com/Sam3360"
+    assert match.group("url") == CREATOR_GITHUB_URL
+
+
+def test_hyperlink_falls_back_to_plain_text_when_disabled():
+    link = hyperlink("github.com/Sam3360", CREATOR_GITHUB_URL, False)
+    assert link == "github.com/Sam3360"
+    assert "\033" not in link
+
+
+def test_creator_output_has_no_escape_codes_when_not_a_tty(monkeypatch, capsys):
+    monkeypatch.setattr("sys.stdout.isatty", lambda: False)
+    with pytest.raises(SystemExit):
+        main(["--creator"])
+    out = capsys.readouterr().out
+    assert "\033" not in out
+
+
+def test_creator_output_has_hyperlink_when_tty(monkeypatch, capsys):
+    monkeypatch.setattr("sys.stdout.isatty", lambda: True)
+    monkeypatch.delenv("NO_COLOR", raising=False)
+    monkeypatch.delenv("FORCE_COLOR", raising=False)
+    with pytest.raises(SystemExit):
+        main(["--creator"])
+    out = capsys.readouterr().out
+    assert "\033]8;;https://github.com/Sam3360\033\\" in out
+
+
+# --- --ignore-file --------------------------------------------------------
+
+
+def test_ignore_file_creates_file(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    with pytest.raises(SystemExit):
+        main(["--ignore-file"])
+    assert (tmp_path / ".secretshieldignore").exists()
+
+
+def test_ignore_file_contains_starter_comment(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    with pytest.raises(SystemExit):
+        main(["--ignore-file"])
+    content = (tmp_path / ".secretshieldignore").read_text()
+    assert content == DEFAULT_IGNORE_CONTENT
+    assert content.strip().startswith("#")
+
+
+def test_ignore_file_does_not_overwrite_existing(tmp_path, monkeypatch, capsys):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("my custom rules\n")
+    with pytest.raises(SystemExit):
+        main(["--ignore-file"])
+    assert (tmp_path / ".secretshieldignore").read_text() == "my custom rules\n"
+    out = capsys.readouterr().out
+    assert "already exists" in out
+
+
+def test_ignore_file_exits_successfully(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    with pytest.raises(SystemExit) as exc_info:
+        main(["--ignore-file"])
+    assert exc_info.value.code in (0, None)
+
+
+def test_ignore_file_works_through_normal_cli(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    with pytest.raises(SystemExit):
+        main(["--ignore-file"])
+    assert (tmp_path / ".secretshieldignore").exists()
+
+
+def test_create_default_ignore_file_helper_directly(tmp_path):
+    created, path = create_default_ignore_file(tmp_path)
+    assert created is True
+    assert path.exists()
+    created2, path2 = create_default_ignore_file(tmp_path)
+    assert created2 is False
+    assert path2 == path
+
+
+# --- init creates .secretshieldignore ---------------------------------------
+
+
+def test_init_creates_secretshieldignore(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    # Not a git repo, so the hook question is skipped entirely (no
+    # prompt consumed for it) -- only config, actions, and apply remain.
+    answers = iter(["y", "n", "y"])
+    monkeypatch.setattr("builtins.input", lambda prompt="": next(answers))
+
+    main(["init"])
+    assert (tmp_path / ".secretshieldignore").exists()
+
+
+def test_init_preserves_existing_secretshieldignore(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / ".secretshieldignore").write_text("existing content\n")
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    answers = iter(["n", "n", "y"])
+    monkeypatch.setattr("builtins.input", lambda prompt="": next(answers))
+
+    main(["init"])
+    assert (tmp_path / ".secretshieldignore").read_text() == "existing content\n"
+
+
+def test_init_twice_does_not_duplicate_or_overwrite(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+
+    answers1 = iter(["n", "n", "y"])
+    monkeypatch.setattr("builtins.input", lambda prompt="": next(answers1))
+    main(["init"])
+    first_content = (tmp_path / ".secretshieldignore").read_text()
+
+    answers2 = iter(["n", "n", "y"])
+    monkeypatch.setattr("builtins.input", lambda prompt="": next(answers2))
+    main(["init"])
+    second_content = (tmp_path / ".secretshieldignore").read_text()
+
+    assert first_content == second_content == DEFAULT_IGNORE_CONTENT
+
+
+def test_init_still_creates_everything_else(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    _init_repo(tmp_path)
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    answers = iter(["y", "y", "y", "y"])
+    monkeypatch.setattr("builtins.input", lambda prompt="": next(answers))
+
+    main(["init"])
+    assert (tmp_path / "secretshield.toml").exists()
+    assert (tmp_path / ".git" / "hooks" / "pre-commit").exists()
+    assert (tmp_path / ".github" / "workflows" / "secretshield.yml").exists()
+    assert (tmp_path / ".secretshieldignore").exists()
+
+
+def test_init_non_interactive_still_refuses_cleanly(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    exit_code = main(["init"])
+    assert exit_code == 1
+    assert not (tmp_path / ".secretshieldignore").exists()
+
+
+# --- ss alias covers all new flags too --------------------------------------
+
+
+def test_ss_entry_point_supports_new_flags():
+    import tomllib
+
+    with open("pyproject.toml", "rb") as f:
+        data = tomllib.load(f)
+    scripts = data["project"]["scripts"]
+    # Both commands point at the same entry point, so any flag added to
+    # the shared parser automatically works for both -- confirm the
+    # wiring is still single-entry-point, not duplicated.
+    assert scripts["secretshield"] == scripts["ss"] == "secretshield.cli:main"