No CLI / GitHub Action — pattern library is locked to the editor only

[NK2552003]

PasteShield's ~200 pattern library is only accessible inside VS Code. A secret that slips past paste-time — committed via another editor, pasted in a terminal, or introduced by an AI code generator — has no coverage. The same patterns that power the extension could be wrapped in a Node CLI, making PasteShield a full dev-to-deploy security story.

Problem

The current scope of PasteShield is paste-time prevention only. This is valuable, but it leaves a gap:

• Developers using Cursor, Neovim, or JetBrains have no coverage at all
• AI-generated code introduced via agent tools (Copilot Agent, Claude Code) bypasses paste entirely
• Enterprise teams can't enforce PasteShield's patterns in CI/CD without a separate tool like Gitleaks
  The README already positions PasteShield and Gitleaks as complementary. A CLI would let PasteShield own the "during development in any editor" layer, not just VS Code paste events.

Proposed solution

Scope:

1. Extract the pattern engine into a standalone pasteshield-core npm package:

   npm install -D pasteshield-core
   

2. Build a thin CLI wrapper:

   npx pasteshield scan src/**/*.ts --severity medium --format json
   npx pasteshield scan --diff HEAD~1  # scan only changed lines
   npx pasteshield scan --policy .pasteshield-policy.json

3. Publish a pasteshield-action GitHub Action:

   - name: PasteShield scan
     uses: sidkr222003/pasteshield-action@v1
     with:
       severity: high
       policy: .pasteshield-policy.json
       fail-on: critical

4. Update the README to position PasteShield as paste-time + CI/CD:

   "PasteShield catches secrets at paste time in VS Code and in every PR via the GitHub Action — same patterns, from paste to production."

Acceptance criteria

• pasteshield-core package published to npm with the full pattern engine
• CLI supports scan <glob>, --severity, --format json|text, --policy flags
• --diff mode scans only lines changed since a given git ref
• GitHub Action published and documented
• Exit code 1 on detections above threshold (for CI fail-fast)
• README updated with CLI and Action usage examples

---