fix(scan-secrets): portable single-quote class + hyphenated key detection

hooks/scan-secrets.sh

@@ -34,7 +34,7 @@ if echo "$CONTENT" | grep -qE 'AKIA[0-9A-Z]{16}'; then
 fi
 
 # AWS Secret Access Keys (40 chars base64 after a key assignment)
-if echo "$CONTENT" | grep -qiE '(aws_secret_access_key|secret_key)[[:space:]]*[=:][[:space:]]*["\x27]?[A-Za-z0-9/+=]{40}'; then
+if echo "$CONTENT" | grep -qiE '(aws_secret_access_key|secret_key)[[:space:]]*[=:][[:space:]]*["'\''"]?[A-Za-z0-9/+=]{40}'; then
   MATCHES="$MATCHES AWS secret key;"
 fi
 
@@ -43,8 +43,8 @@ if echo "$CONTENT" | grep -qE '(ghp_|gho_|ghs_|ghr_|github_pat_)[a-zA-Z0-9_]{20,
   MATCHES="$MATCHES GitHub token;"
 fi
 
-# OpenAI / Stripe / Anthropic style keys (sk-...)
-if echo "$CONTENT" | grep -qE 'sk-[a-zA-Z0-9]{20,}'; then
+# OpenAI / Stripe / Anthropic style keys (sk-..., incl. hyphenated sk-ant-api03-...)
+if echo "$CONTENT" | grep -qE 'sk-[a-zA-Z0-9-]{20,}'; then
   MATCHES="$MATCHES API key (sk-...);"
 fi
 
@@ -66,8 +66,8 @@ fi
 # Generic password/secret/token assignments with literal string values
 # Matches: password = "actual_value", SECRET_KEY: 'actual_value', api_token="actual_value"
 # Excludes: env var references like process.env.*, os.environ.*, ${...}, getenv(...)
-if echo "$CONTENT" | grep -qiE '(password|secret|token|api_key|apikey|api_secret)[[:space:]]*[=:][[:space:]]*["\x27][^"\x27]{8,}["\x27]' && \
-   ! echo "$CONTENT" | grep -qiE '(password|secret|token|api_key|apikey|api_secret)[[:space:]]*[=:][[:space:]]*["\x27]?(process\.env|os\.environ|getenv|\$\{|ENV\[|env\()'; then
+if echo "$CONTENT" | grep -qiE '(password|secret|token|api_key|apikey|api_secret)[[:space:]]*[=:][[:space:]]*["'\''"][^"'\''"]{8,}["'\''"]' && \
+   ! echo "$CONTENT" | grep -qiE '(password|secret|token|api_key|apikey|api_secret)[[:space:]]*[=:][[:space:]]*["'\''"]?(process\.env|os\.environ|getenv|\$\{|ENV\[|env\()'; then
   MATCHES="$MATCHES hardcoded credential;"
 fi
 

hooks/tests/fixtures/scan-secrets/01-allow-clean-source.json

@@ -0,0 +1 @@
+{"name":"ordinary source allowed","stdin":{"tool_name":"Write","tool_input":{"file_path":"src/app.js","content":"export const add = (a,b) => a + b"}},"expect_exit":0}

hooks/tests/fixtures/scan-secrets/02-allow-env-reference.json

@@ -0,0 +1 @@
+{"name":"env var reference not flagged","stdin":{"tool_name":"Write","tool_input":{"file_path":"src/cfg.js","content":"const apiKey = process.env.API_KEY"}},"expect_exit":0}

hooks/tests/fixtures/scan-secrets/03-block-double-quoted-credential.json

@@ -0,0 +1 @@
+{"name":"double-quoted hardcoded credential blocked","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.js","content":"const password = \"hunter2hunter2\""}},"expect_exit":2,"expect_stdout_contains":["hardcoded credential","ask"]}

hooks/tests/fixtures/scan-secrets/04-block-single-quoted-credential.json

@@ -0,0 +1 @@
+{"name":"single-quoted credential blocked (BSD grep x27 fix)","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.py","content":"password = 'supersecretvalue'"}},"expect_exit":2,"expect_stdout_contains":["hardcoded credential"]}

hooks/tests/fixtures/scan-secrets/05-block-anthropic-hyphenated-key.json

@@ -0,0 +1 @@
+{"name":"hyphenated sk-ant-api03 key blocked","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.js","content":"const k=\"sk-ant-api03-AAAABBBBCCCCDDDDEEEEFFFFGGGG\""}},"expect_exit":2,"expect_stdout_contains":["sk-..."]}

hooks/tests/fixtures/scan-secrets/06-block-aws-access-key.json

@@ -0,0 +1 @@
+{"name":"AWS access key id blocked","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.js","content":"AKIAIOSFODNN7EXAMPLE"}},"expect_exit":2,"expect_stdout_contains":["AWS access key"]}

hooks/tests/fixtures/scan-secrets/07-block-github-token.json

@@ -0,0 +1 @@
+{"name":"github PAT blocked","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.js","content":"ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"}},"expect_exit":2,"expect_stdout_contains":["GitHub token"]}

hooks/tests/fixtures/scan-secrets/08-block-private-key.json

@@ -0,0 +1 @@
+{"name":"private key block blocked","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.pem","content":"-----BEGIN RSA PRIVATE KEY-----\nMIIabc\n-----END RSA PRIVATE KEY-----"}},"expect_exit":2,"expect_stdout_contains":["private key block"]}

hooks/tests/fixtures/scan-secrets/09-block-conn-string-creds.json

@@ -0,0 +1 @@
+{"name":"connection string with creds blocked","stdin":{"tool_name":"Write","tool_input":{"file_path":"a.js","content":"const u = \"postgres://admin:s3cretpw@db.host:5432/app\""}},"expect_exit":2,"expect_stdout_contains":["connection string"]}

hooks/tests/fixtures/scan-secrets/10-ignore-read-tool.json

@@ -0,0 +1 @@
+{"name":"non Edit/Write tool ignored","stdin":{"tool_name":"Read","tool_input":{"file_path":"a.env"}},"expect_exit":0}