chore: P0/P3 credibility and robustness cleanup (6 issues)

.claude-plugin/marketplace.json

@@ -8,8 +8,8 @@
     {
       "name": "claude-code-privacy-guard",
       "source": "./",
-      "description": "🛡️ Prevent secrets and PII from being accidentally shared with Claude Code",
-      "version": "0.1.2",
+      "description": "🛡️ Prevent secrets and PII from being accidentally shared with Claude Code.",
+      "version": "0.2.8",
       "repository": "https://github.com/datumbrain/claude-code-privacy-guard"
     }
   ]

.gitattributes

@@ -1,3 +1,9 @@
+# Force LF line endings on checkout regardless of platform. Without this,
+# Windows checkouts convert committed LF to CRLF via core.autocrlf, which
+# would make the CI "dist/ matches src/" check below fail spuriously on
+# windows-latest (tsc always emits LF) even when nothing actually changed.
+* text=auto eol=lf
+
 # dist/ is compiled output from src/ (tsc). It must stay committed because the
 # plugin is installed straight from this repo with no build step, but it is a
 # generated artifact and should never be reviewed or hand-edited.

.github/workflows/ci.yml

@@ -8,10 +8,23 @@ on:
 
 jobs:
   build-test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        # Windows runners default `run:` steps to PowerShell, which chokes on
+        # the bash `if ! cmd; then` syntax below. Force bash everywhere so the
+        # same steps behave identically on all three platforms.
+        shell: bash
     strategy:
+      fail-fast: false
       matrix:
+        os: [ubuntu-latest]
         node-version: [18, 20, 22]
+        include:
+          - os: windows-latest
+            node-version: 20
+          - os: macos-latest
+            node-version: 20
     steps:
       - uses: actions/checkout@v4
 

data/regex_list_1.json

@@ -254,7 +254,7 @@
   {
     "name": "Password etc shadow",
     "description": "Password etc shadow",
-    "regex": "[a-zA-Z0-9\\-]+:(?:(?:!!?)|(?:\\*LOCK\\*?)|\\*|(?:\\*LCK\\*?)|(?:\\$.*\\$.*\\$.*?)?):\\d*:\\d*:\\d*:\\d*:\\d*:\\d*:",
+    "regex": "[a-zA-Z0-9\\-]+:(?:(?:!!?)|(?:\\*LOCK\\*?)|\\*|(?:\\*LCK\\*?)|(?:\\$[^$:]*\\$[^$:]*\\$[^$:]*)):\\d*:\\d*:\\d*:\\d*:\\d*:\\d*:",
     "risk": 8,
     "category": "Confidential"
   },
@@ -415,7 +415,7 @@
   {
     "name": "heroku_key",
     "description": "heroku_key",
-    "regex": "(heroku_api_key|HEROKU_API_KEY|heroku_secret|HEROKU_SECRET)[a-z_ =\\s\"'\\:]{0,10}[^a-zA-Z0-9-]\\w{8}(?:-\\w{4}){3}-\\w{12}[^a-zA-Z0-9\\-]",
+    "regex": "(heroku_api_key|HEROKU_API_KEY|heroku_secret|HEROKU_SECRET)[a-z_ =\\s\"'\\:]{0,10}[^a-zA-Z0-9-]\\w{8}-\\w{4}-\\w{4}-\\w{4}-\\w{12}[^a-zA-Z0-9\\-]",
     "risk": 7,
     "category": "Confidential"
   },
@@ -440,13 +440,6 @@
     "risk": 7,
     "category": "Confidential"
   },
-  {
-    "name": "slack_api_token",
-    "description": "slack_api_token",
-    "regex": "(xox[pb](?:-[a-zA-Z0-9]+){4,})",
-    "risk": 8,
-    "category": "Confidential"
-  },
   {
     "name": "ssh_dss_public",
     "description": "ssh_dss_public",

scripts/prompt-guard.js

@@ -12,7 +12,7 @@
  */
 
 import { PrivacyScanner } from '../dist/scanner/engine.js';
-import { readFileSync, mkdirSync, appendFileSync } from 'fs';
+import { readFileSync, mkdirSync, appendFileSync, writeFileSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { BUILTIN_RULES, loadExternalRulesFromJson } from '../dist/scanner/detectors.js';
 import { ConfigLoader } from '../dist/config/loader.js';
@@ -72,6 +72,53 @@ function extractPrompt(raw) {
   return raw;
 }
 
+// Pull session_id out of the same envelope, used only to dedupe the
+// "disabled by config" notice below (one notice per session, not per prompt).
+function extractSessionId(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith('{')) return undefined;
+  try {
+    const payload = JSON.parse(trimmed);
+    if (payload && typeof payload.session_id === 'string') return payload.session_id;
+  } catch {
+    // Not JSON - no session id available.
+  }
+  return undefined;
+}
+
+// A config typo or a stale "enabled": false left over from debugging means
+// every prompt goes through unscanned with no signal to the user. Emit a
+// systemMessage the first time we see a given session_id, then stay quiet for
+// the rest of that session so we're not repeating ourselves on every prompt.
+function noticeIfDisabled(sessionId) {
+  const noticePath = path.join(getCacheDir(), 'disabled-notice.json');
+
+  if (sessionId) {
+    try {
+      const stored = JSON.parse(readFileSync(noticePath, 'utf-8'));
+      if (stored && stored.lastSessionId === sessionId) return;
+    } catch {
+      // No prior notice file (or unreadable) - treat as not yet notified.
+    }
+  }
+
+  console.log(
+    JSON.stringify({
+      systemMessage:
+        '🛡️ Privacy Guard is disabled ("enabled": false in .privacy-guard.json) - prompts are not being scanned.',
+    })
+  );
+
+  if (sessionId) {
+    try {
+      mkdirSync(path.dirname(noticePath), { recursive: true });
+      writeFileSync(noticePath, JSON.stringify({ lastSessionId: sessionId }));
+    } catch {
+      // Best-effort only; failing to persist just means we notice again next time.
+    }
+  }
+}
+
 debugLog([
   `=== Hook Execution ${new Date().toISOString()} ===`,
   `CLAUDE_PLUGIN_ROOT: ${process.env.CLAUDE_PLUGIN_ROOT ?? ''}`,
@@ -86,9 +133,10 @@ try {
   // envelope would both produce false positives on paths/ids and leak the JSON
   // into redact mode's copy-pasteable output.
   let promptText = '';
+  let rawStdin = '';
   try {
-    const raw = readFileSync(0, 'utf-8');
-    promptText = extractPrompt(raw);
+    rawStdin = readFileSync(0, 'utf-8');
+    promptText = extractPrompt(rawStdin);
   } catch (error) {
     // The shell wrapper discarded stderr when debug was off; keep stderr quiet
     // and route the error to the debug log instead. Exit non-zero as before -
@@ -103,6 +151,7 @@ try {
   const config = new ConfigLoader(configPath ?? undefined).getConfig();
 
   if (config.enabled === false) {
+    noticeIfDisabled(extractSessionId(rawStdin));
     finish('disabled', 0);
   }
 

scripts/release.sh

@@ -71,6 +71,15 @@ node -e '
   fs.writeFileSync(path, JSON.stringify(plugin, null, 2) + "\n");
 ' "$new_version"
 
+echo "Syncing .claude-plugin/marketplace.json version..."
+node -e '
+  const fs = require("fs");
+  const path = ".claude-plugin/marketplace.json";
+  const marketplace = JSON.parse(fs.readFileSync(path, "utf8"));
+  for (const plugin of marketplace.plugins) plugin.version = process.argv[1];
+  fs.writeFileSync(path, JSON.stringify(marketplace, null, 2) + "\n");
+' "$new_version"
+
 echo "Creating release commit..."
 git add -A
 git commit -m "release: v${new_version}"

src/config/loader.ts

@@ -8,6 +8,20 @@ import * as path from 'path';
 
 const VALID_MODES = ['block', 'redact', 'warn'];
 
+// Every key PrivacyGuardConfig recognizes. Used only to warn on typos (e.g.
+// "alowedValues") - unknown keys are still merged through untouched so the
+// config-UI's "preserve unknown keys on save" behavior keeps working.
+const KNOWN_CONFIG_KEYS = new Set([
+  'enabled',
+  'mode',
+  'allowedDomains',
+  'disabledRules',
+  'externalRulesJsonPath',
+  'externalRulesMode',
+  'allowedValues',
+  'allowedPatterns',
+]);
+
 const DEFAULT_CONFIG: PrivacyGuardConfig = {
   enabled: true,
   mode: 'block',
@@ -37,6 +51,11 @@ export class ConfigLoader {
       if (fs.existsSync(configPath)) {
         const fileContent = fs.readFileSync(configPath, 'utf-8');
         const userConfig = JSON.parse(fileContent);
+        for (const key of Object.keys(userConfig)) {
+          if (!KNOWN_CONFIG_KEYS.has(key)) {
+            console.warn(`Privacy Guard: unknown config key "${key}" in ${configPath} - check for a typo`);
+          }
+        }
         const merged = { ...DEFAULT_CONFIG, ...userConfig };
         if (!VALID_MODES.includes(merged.mode)) {
           console.warn(`Privacy Guard: invalid "mode" value "${merged.mode}" in config, falling back to "block"`);