fix: harden hooks, scanner, and CLI behavior by pixincreate · Pull Request #52 · pixincreate/KeyWatch

pixincreate · 2026-04-21T15:21:32Z

Summary

Security and usability fixes for KeyWatch:

Security

Shell injection protection - Escape user input in generated hooks (allowed_repos, blocked_repos, exclude patterns)
Path validation - Hooks verify key-watch is on PATH before running

Usability

Portable detector loading - Checks executable directory first, falls back to CWD
Non-UTF8 handling - Binary files gracefully skipped (no crash)
Filenames with spaces - Hook uses IFS= read -r for safe handling
Error distinction - Exit code 1 = secret found, other = runtime error

Cleanup

Remove CLI help text typos ("push/push" → "push")
Remove non-English text

Testing

Added 4 new tests covering:
- test_non_utf8_file_handling
- test_hook_generation_pre_push
- test_hook_generation_pre_commit
- test_hook_shell_escaping

All tests pass (14 total).

Files changed:

src/hooks.rs - New module for hook generation
src/detector.rs - Portable config loading
src/scanner.rs - Non-UTF8 handling
src/lib.rs - Export hooks
src/main.rs - Use hooks module
tests/integration_tests.rs - New tests

- Add shell injection protection in generated hooks (escape user input) - Make detector loading portable (check exe dir first, then CWD) - Handle non-UTF8 files gracefully (skip binary files) - Fix filenames with spaces via IFS= read -r in pre-commit hook - Distinguish secret detection (exit 1) from runtime errors - Clean CLI help text (remove typos and non-English text) - Add comprehensive tests for new features Closes #32

- Add exit_code_on_secrets/no_secrets tests (verify findings behavior) - Add verify_integrity_flag test - Add exclude_pattern_filtering test (verify *.log exclusion works) - Add portable_config_loading test (detectors.toml loading) - Add hook_missing_binary_path and hook_missing_detectors_toml tests 21 tests now pass (was 14). Closes #32

- Document security hardening in hooks - Add Development section with just commands - Add Security Notes section - Update project structure - Add CHANGELOG entry for v1.1.0

- Move hook templates to templates/pre-push.sh and templates/pre-commit.sh - Rename v->escaped, ch->character for clarity - just check passes (21 tests)

- DEFAULT_BINARY_NAME constant - Remove generic render_template, use specific render_pre_push/pre_commit - Remove empty string placeholders from templates - just check passes

- find_keywatch() searches: PATH -> hook_dir -> target/debug - Works during development without cargo install - Remove blocking local hooks

Consolidate ScanMetadata and ReportMetadata into single struct. Move scan_time to report level, not metadata level.

- Add EXIT_MODE_ALWAYS, EXIT_MODE_CRITICAL, EXIT_MODE_STRICT constants - Add SEVERITY_HIGH constant - Use descriptive variable names instead of single-char - Remove redundant imports

- Output summary instead of JSON by default (verbose for full JSON) - Add install.sh script for easy installation to ~/.local/bin or /usr/local/bin - Add uninstall.sh script for clean removal - Update README with script-based installation instructions

- Rewrite README to be concise (~50 lines) - Add binary aliases: keywatch, watch (in addition to key-watch) - Simplify install script: cargo install first, then local binary fallback - Remove legacy hooks/keywatch.sh - Remove .pre-commit-config.yaml - Default: all repos allowed (no restrictions)

- Simplify README (~60 lines) - Rewrite CHANGELOG with clear sections - Add tests: binary_aliases, exit_mode_always, exit_mode_critical

- scanner_tests.rs (9 tests) - hooks_tests.rs (5 tests) - report_tests.rs (2 tests) - exit_tests.rs (5 tests) - utils_tests.rs (2 tests) 24 tests pass

Copilot

Pull request overview

This PR hardens and expands KeyWatch’s CLI and git-hook workflow by adding hook generation/installation, improving detector config discovery, adding non‑UTF8 handling, and reorganizing tests/docs to match the new behavior.

Changes:

Add a hooks module + hook templates and a CLI pathway to install pre-commit/pre-push hooks.
Make detector loading more portable (exe-relative lookup) and make scanning handle non‑UTF8 files without crashing.
Restructure the test suite and simplify documentation/packaging (new binaries/aliases, justfile, install script).

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
`tests/utils_tests.rs`	Adds tests for `write_to_file` and detector initialization.
`tests/scanner_tests.rs`	Adds scanning tests including exclusions and non‑UTF8 handling.
`tests/report_tests.rs`	Adds report serialization tests aligned to the new report shape.
`tests/integration_tests.rs`	Removes legacy integration tests (split into focused test modules).
`tests/hooks_tests.rs`	Adds tests for hook generation and basic template expectations.
`tests/exit_tests.rs`	Adds tests intended to cover exit behaviors (currently doesn’t assert process exit codes).
`templates/pre-push.sh`	New pre-push hook template with PATH/config checks and a scan invocation.
`templates/pre-commit.sh`	New pre-commit hook template to scan staged files.
`src/utils.rs`	Adds cross-platform `make_executable()` helper.
`src/scanner.rs`	Switches `run_scan` to `Result`, adds exclusion globs, non‑UTF8 skipping, multiline partitioning.
`src/report.rs`	Adjusts report schema + returns `Result` from `create_report`, adds severity counting helper.
`src/main.rs`	Adds hook install flow, integrity check, new exit-mode behavior and summary output.
`src/lib.rs`	Exports the new hooks module / re-exports hook generators.
`src/hooks.rs`	New module to render hook templates and attempt shell-escaping of CLI inputs.
`src/detector.rs`	Makes detector regex compilation fallible and adds exe-relative config lookup.
`src/cli.rs`	Extends CLI options for hooks, exclusions, exit modes, integrity verification, repo controls.
`scripts/install.sh`	Adds install/uninstall helper script and local install fallbacks.
`README.md`	Replaces long-form documentation with a shorter usage-focused README.
`justfile`	Adds `just` commands for common dev tasks.
`hooks/keywatch.sh`	Removes legacy hook script.
`CHANGELOG.md`	Updates changelog entries to reflect new features/cleanup.
`Cargo.toml`	Moves to Rust 2024 edition, adds multiple binaries/aliases, updates deps, adds glob.
`Cargo.lock`	Updates lockfile for dependency/version changes.
`.pre-commit-config.yaml`	Removes legacy pre-commit configuration.

Copilot

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 7 comments.

pixincreate self-assigned this Apr 21, 2026

pixincreate added bug Something isn't working enhancement New feature or request labels Apr 21, 2026

pixincreate added 22 commits April 21, 2026 21:50

chore: add justfile for common development tasks

35472ce

docs: update README and CHANGELOG for v1.1.0

200d10a

- Document security hardening in hooks - Add Development section with just commands - Add Security Notes section - Update project structure - Add CHANGELOG entry for v1.1.0

fix: keep unreleased, not dated

c26a590

fix: remove unused import

e23b436

chore: remove noise comments

f9c5792

refactor: extract hooks to templates/, meaningful variable names

ab22ef5

- Move hook templates to templates/pre-push.sh and templates/pre-commit.sh - Rename v->escaped, ch->character for clarity - just check passes (21 tests)

refactor: named constants, simplify template rendering

99a7af8

- DEFAULT_BINARY_NAME constant - Remove generic render_template, use specific render_pre_push/pre_commit - Remove empty string placeholders from templates - just check passes

fix: hook finds binary relative to itself, not just PATH

a4a087b

- find_keywatch() searches: PATH -> hook_dir -> target/debug - Works during development without cargo install - Remove blocking local hooks

revert: PATH-only check for global installs

3c93584

refactor: remove redundant ReportMetadata struct

e664ae0

Consolidate ScanMetadata and ReportMetadata into single struct. Move scan_time to report level, not metadata level.

refactor: replace hardcoded strings with named constants

be33293

- Add EXIT_MODE_ALWAYS, EXIT_MODE_CRITICAL, EXIT_MODE_STRICT constants - Add SEVERITY_HIGH constant - Use descriptive variable names instead of single-char - Remove redundant imports

Fix: use EXIT_MODE_STRICT constant in match arm

2c5ec5f

chore: update rust edition to 2024

3a7949a

Fix: remove redundant .to_string(), restore .git exclusion in scanner

d04c63f

Fix: rename single-char vars f->finding in get_severity_counts

3c3c8c7

Update: concise README/CHANGELOG, add 3 tests (24 total)

71885c5

- Simplify README (~60 lines) - Rewrite CHANGELOG with clear sections - Add tests: binary_aliases, exit_mode_always, exit_mode_critical

Refactor: split tests into 5 module files

c810fa5

- scanner_tests.rs (9 tests) - hooks_tests.rs (5 tests) - report_tests.rs (2 tests) - exit_tests.rs (5 tests) - utils_tests.rs (2 tests) 24 tests pass

Fix: fmt and clippy warnings

ecc745c

Fix: unused variable in scanner_tests

6c0572c

pixincreate requested a review from Copilot May 4, 2026 10:27

Copilot started reviewing on behalf of pixincreate May 4, 2026 10:27 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

pixincreate force-pushed the fix/keywatch-security-hooks branch from d85d82e to d3fa519 Compare May 4, 2026 16:40

Fix: address review feedback and split bin entrypoints

6ecdb71

pixincreate force-pushed the fix/keywatch-security-hooks branch from d3fa519 to 6ecdb71 Compare May 4, 2026 16:49

pixincreate requested a review from Copilot May 4, 2026 16:52

Copilot started reviewing on behalf of pixincreate May 4, 2026 16:52 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

Comment thread src/scanner.rs

Comment thread src/scanner.rs

Comment thread src/scanner.rs Outdated

Comment thread src/detector.rs

Comment thread templates/pre-commit.sh

Comment thread templates/pre-push.sh

Comment thread tests/utils_tests.rs

pixincreate changed the title ~~fix: security-hardened hooks, portable config, non-UTF8 handling~~ fix: harden hooks, scanner, and CLI behavior May 4, 2026

fix: review feedback - scanner metadata, hook quoting, tests

07070ac

pixincreate force-pushed the fix/keywatch-security-hooks branch from e49402a to 07070ac Compare May 4, 2026 17:27

pixincreate merged commit 51694d4 into main May 4, 2026
5 checks passed

pixincreate deleted the fix/keywatch-security-hooks branch May 4, 2026 17:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: harden hooks, scanner, and CLI behavior#52

fix: harden hooks, scanner, and CLI behavior#52
pixincreate merged 25 commits intomainfrom
fix/keywatch-security-hooks

pixincreate commented Apr 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

pixincreate commented Apr 21, 2026

Summary

Security

Usability

Cleanup

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants