chore: release v0.2.0 Performance & Precision Update

Author: ianramy

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "rustywoof"
-version = "0.1.9"
+version = "0.2.0"
 rust-version = "1.94"
 edition = "2024"
 description = "A blazing fast, relentless secret scanner & supply chain defensive tool. Written in Rust"
@@ -70,13 +70,15 @@ serde_json = "1.0.149"
 # For fast substring searching in large text data
 aho-corasick = "1.1.4"
 
-# For parsing and writing YAML files (like configuration or manifest files)
-# Note: Changed `serde-yaml` to `serde-yml`
-serde_yml = "0.0.12"
-
 # For self-update functionality
 self_update = { version = "0.44.0", features = ["archive-tar", "archive-zip"] }
 
+# For blazing fast, zero-copy memory-mapped file reading
+memmap2 = "0.9.10"
+
+# For serializing and deserializing Rust data structures
+serde_norway = "0.9.42"
+
 [profile.release]
 # Maximum performance optimization
 opt-level = 3

Cargo.toml

@@ -0,0 +1,20 @@
+# Release v0.2.0 - Performance & Precision Update - 04/06/2026
+
+Rustywoof `v0.2.0` is a massive architectural upgrade focused on enterprise-grade performance, lockfile auditing accuracy, and improved developer experience. We've replaced heavy heap allocations with zero-copy memory mapping, moved to a lock-free concurrency model, and hardened our supply chain parsers.
+
+## Features & Developer Experience
+* **Configurable Cryptographic Sensitivity:** Added `min_entropy` to `.woof.toml`. Teams can now tune the Shannon entropy threshold to silence false positives (like dummy test tokens) while maintaining strict guards for production secrets.
+* **Robust `requirements.txt` Parsing:** Replaced basic string splitting with a resilient Regex extractor. The engine now flawlessly handles environment markers, version ranges (`>=`, `~=`), and inline comments.
+* **Graceful Background Updates:** Resolved the "Ghost Update" race condition. The background self-updater now synchronizes properly with the CLI execution thread, ensuring developers are reliably notified of new engine updates without hanging the terminal.
+
+## Performance Optimizations
+* **Zero-Copy Memory Mapping:** Replaced `fs::read_to_string` with OS-level memory mapping (`memmap2`). The Aho-Corasick automaton now scans raw `&[u8]` byte slices directly, drastically reducing RAM allocation and CPU overhead on large repositories.
+* **Lock-Free Concurrency:** Eliminated the Mutex bottleneck (`Arc<Mutex<Vec>>`) that throttled multi-threaded execution. Findings are now transmitted instantly via a multi-producer single-consumer (`mpsc`) channel, vastly improving parallel scan times.
+* **Binary Fast-Fail Heuristic:** The scanner now inspects the first 512 bytes of a file for null (`\0`) characters, instantly skipping compiled binaries and assets before attempting expensive UTF-8 validation.
+* **Structured Deserialization:** Migrated lockfile parsing away from arbitrary DOM trees (`serde_json::Value`). By using strict Rust structs and ignoring unused fields, `package-lock.json` and `pnpm-lock.yaml` parsing times and memory footprint have been slashed.
+
+## Bug Fixes
+* **Git Hook Pathing Lockout:** Fixed a critical issue where the generated pre-commit hook would permanently block Git commits if the user did not have `woof` installed globally in their `PATH`. The hook now features a graceful fallback.
+* **Directory Exclusion Traversals:** Corrected the implementation of the `ignore` crate. The scanner now correctly respects string paths defined in `.woof.toml` via `OverrideBuilder`, preventing unbounded traversals into `node_modules/` or `target/`.
+* **Yarn Audit Blindspot:** Patched an audit/remediate mismatch. The engine now correctly parses `yarn.lock` during the OSV threat intelligence sweep.
+* **pnpm Peer Dependency Parsing:** Fixed a string-splitting bug in the `pnpm-lock.yaml` parser that incorrectly captured peer dependencies as part of the SemVer string (e.g., `18.2.0(react@18.2.0)`), which previously caused OSV API query rejections.

Changelog.md

@@ -1,74 +1,158 @@
-# 🐕 Rustywoof (woof)
+# Rustywoof
 
-> **Enterprise-grade secret scanner and supply chain watchdog.**
+[![Version](https://img.shields.io/badge/version-v0.2.0-blue.svg)](https://github.com/ianramy/rustywoof/releases)
+[![Language](https://img.shields.io/badge/language-Rust-orange.svg)](https://www.rust-lang.org/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](https://opensource.org/licenses/MIT)
+[![Category](https://img.shields.io/badge/category-Cybersecurity-red.svg)]()
+[![Integration](https://img.shields.io/badge/integration-OSV_Database-purple.svg)](https://osv.dev/)
+[![Status](https://img.shields.io/badge/status-Open_Source-brightgreen.svg)]()
 
-Rustywoof is a blazing-fast, memory-safe CLI tool designed to detect exposed cryptographic credentials and compromised dependencies before they breach your perimeter. Built in Rust, it utilizes an `O(n)` Aho-Corasick automaton to scan thousands of files in milliseconds without crashing your CI/CD pipelines.
+**Enterprise-grade perimeter defense, secret scanner, and supply chain watchdog.**
 
-## ✨ Features
+Rustywoof is a high-performance, memory-safe command-line engine designed to detect exposed cryptographic credentials and compromised dependencies before they breach your system perimeter. Built entirely in Rust, it is engineered for strict enterprise CI/CD environments, utilizing zero-copy memory mapping and an O(n) Aho-Corasick automaton to analyze thousands of files in milliseconds without exhausting system resources.
 
-- **High-Speed Regex Pre-filtering:** Uses Aho-Corasick for simultaneous, multi-pattern literal prefix matching.
-- **OOM-Immune Engine:** Strict file-size constraints and binary bypassing ensure stability on massive monorepos.
-- **Live Threat Intelligence:** Queries the Open Source Vulnerability (OSV) API using JSON batching to audit Node, Rust, and Python lockfiles in under 500ms.
-- **Proactive Perimeter Defense:** Automatically detects un-tracked `.env` files and manages Git `pre-commit` hooks.
-- **Mathematical Context:** Calculates the Shannon Entropy of leaked credentials to reduce false positives.
+---
 
-## 🚀 Installation
+## Security & Trust Posture
+
+We recognize that running a security binary locally requires absolute trust. Rustywoof is built with strict operational transparency:
+
+* **No Telemetry or Exfiltration:** The engine does not track user data, usage analytics, or exfiltrate source code.
+
+* **Local Execution:** Secret scanning operations (Aho-Corasick pre-filtering and Regex validation) are executed entirely on your local machine.
+
+* **Verifiable Outbound Traffic:** The only outbound network requests made by Rustywoof are standard HTTPS POST requests directed exclusively to [https://api.osv.dev](https://api.osv.dev) (Google's Open Source Vulnerability database) during the audit or patrol commands. 
+
+* **Open Source Verifiability:** The complete source code is available for independent audit. We encourage security researchers and engineers to compile the binary directly from the source.
+
+---
+
+## Core Capabilities
+
+### 1. High-Performance Secret Detection
+
+* **Aho-Corasick Automaton:** Utilizes simultaneous, multi-pattern literal prefix matching to filter text in O(n) time before invoking expensive Regex evaluations.
+
+* **Zero-Copy Architecture:** Employs OS-level memory mapping (mmap) to read files directly as byte slices, drastically reducing RAM allocation.
+
+* **Binary Fast-Fail Heuristic:** Instantly identifies and bypasses compiled binaries by evaluating the initial byte headers, preventing Out-Of-Memory (OOM) crashes on large artifacts.
+
+* **Cryptographic Context:** Calculates the Shannon Entropy of matched strings to confidently differentiate between genuine cryptographic keys and high-entropy plaintext, heavily reducing false positives.
+
+### 2. Supply Chain Threat Intelligence
+
+* **OSV Batch Querying:** Parses multiple lockfiles (Cargo, npm, pnpm, yarn, Poetry, pip) and audits them against the Open Source Vulnerability (OSV) database. (Note: This specific feature requires an active internet connection to query the upstream database).
+* **Local Threat Caching:** To prevent network bottlenecks during repeated CI/CD runs, Rustywoof caches OSV API responses locally with a 12-hour Time-To-Live (TTL).
+* **Automated Remediation:** Capable of spawning shell processes to force native package managers to update a compromised dependency to a secure target version.
+
+### 3. Proactive Perimeter Defense
+
+* **Staged-Only Git Hooks:** Manages pre-commit hooks that strictly scan newly staged files (git diff --cached), ensuring rapid execution without scanning the entire repository.
+* **Environment Guarding:** Automatically detects untracked .env files and interactively deploys strict .gitignore configurations to prevent accidental credential leakage.
+
+---
+
+## Installation
 
 ### Option 1: Quick Install (macOS / Linux)
 
+To install Rustywoof on macOS or Linux, run the following command in your terminal:
+
 ```bash
-curl --proto '=https' --tlsv1.2 -LsSf [https://github.com/ianramy/rustywoof/releases/latest/download/installer.sh](https://github.com/ianramy/rustywoof/releases/latest/download/installer.sh) | sh
+curl -sSL https://ianramy.co.ke/rustywoof/installer.sh | sh
 ```
 
-### Option 2: Via Cargo (Rust developers)
+### Option 2: Windows (PowerShell)
+
+To install Rustywoof on Windows, run the following command in your PowerShell terminal:
+
+```bash
+irm https://ianramy.co.ke/rustywoof/installer.ps1 | iex
+```
+
+### Option 3: Compile from Source (Via Cargo)
+
+To compile the engine from source, use Cargo, Rust's package manager.
 
 ```bash
 cargo install rustywoof
+```
 
-# or
+> [!NOTE]
+> For the highest level of trust, use `cargo binstall` to compile the engine from source.
 
+```bash
 cargo binstall rustywoof
 ```
 
-### Option 3: Windows (PowerShell)
+
+### Option 4: Node.js Package Managers
+
+To install Rustywoof via Node.js package managers, use the following commands:
 
 ```bash
-irm [https://github.com/ianramy/rustywoof/releases/latest/download/installer.ps1](https://github.com/ianramy/rustywoof/releases/latest/download/installer.ps1) | iex
+npm install -g @ianramy/rustywoof
 ```
 
-## 🛠️ Usage
+```bash
+pnpm install -g @ianramy/rustywoof
+```
 
-Rustywoof is designed to be simple and devastatingly effective.
+```bash
+yarn global add @ianramy/rustywoof
+```
 
 ```bash
-# Execute a full perimeter sweep (Code + Dependencies)
+bun install -g @ianramy/rustywoof
+```
+
+---
+
+## Usage Guide
+
+Rustywoof is designed to provide maximum visibility with minimal configuration.
+
+```bash
+# Execute a full perimeter sweep (Code Secrets + Dependency Threats)
 woof patrol
 
-# Scan a specific directory for secrets
+# Scan a specific directory or file for exposed secrets
 woof scan ./src
 
-# Audit lockfiles against the OSV vulnerability database
+# Audit project lockfiles against the OSV vulnerability database
 woof audit
 
 # Force a package manager to remediate a compromised dependency
 woof remediate axios 1.7.4
 
-# Deploy the pre-commit guard to block leaked secrets
+# Deploy the Watchdog pre-commit guard to block leaked secrets natively in Git
 woof hook install
 ```
 
-## ⚙️ Configuration
+---
+
+## Configuration
 
-Run `woof init` to generate a `.woof.toml` file in your project root. You can add custom domain-specific regex rules and ignore paths here.
+Run `woof init` to generate a `.woof.toml` configuration file in your project root. This allows teams to define domain-specific rules, suppress false positives via entropy tuning, and manage scan perimeters.
 
 ```toml
+# Directories to bypass during sweeps
 ignore_paths = ["tests/", "node_modules/", "target/"]
 
+# Adjust the Shannon entropy threshold (lower values increase sensitivity)
+min_entropy = 3.0
+
+# Define proprietary token formats
 [[custom_rules]]
 name = "Internal API Token"
 pattern = "api_prod_[a-zA-Z0-9]{32}"
 ```
 
-## 🛡️ License
+> [!NOTE]
+> Developers can also use inline suppression directives like `// woof:ignore-next-line` directly in their source code to bypass specific flagged strings.
+
+---
+
+## License
 
-This project is licensed under the [MIT License](LICENSE) - see the LICENSE file for details.
+This software is distributed under the [MIT License](LICENSE). See the LICENSE file in the repository for full details.

README.md

@@ -1,15 +1,17 @@
 // src/config.rs
 
 use crate::error::SystemError;
-use miette::{Result, WrapErr, IntoDiagnostic};
+use miette::{IntoDiagnostic, Result, WrapErr};
 use serde::{Deserialize, Serialize};
 use std::fs;
 use std::path::Path;
 
-#[derive(Serialize, Deserialize, Default, Debug)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct Config {
     pub ignore_paths: Vec<String>,
     pub custom_rules: Vec<CustomRule>,
+    #[serde(default = "default_entropy")]
+    pub min_entropy: f32,
 }
 
 #[derive(Serialize, Deserialize, Debug)]
@@ -18,6 +20,20 @@ pub struct CustomRule {
     pub pattern: String,
 }
 
+fn default_entropy() -> f32 {
+    3.0
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        Config {
+            ignore_paths: vec![],
+            custom_rules: vec![],
+            min_entropy: default_entropy(),
+        }
+    }
+}
+
 pub fn load_config() -> Result<Config> {
     let config_path = Path::new(".woof.toml");
 
@@ -40,9 +56,11 @@ pub fn init_config() -> Result<()> {
             "target/".to_string(),
         ],
         custom_rules: vec![],
+        min_entropy: 3.0,
     };
 
-    let toml_content = toml::to_string_pretty(&config).map_err(SystemError::ConfigSerializeFailed)?;
+    let toml_content =
+        toml::to_string_pretty(&config).map_err(SystemError::ConfigSerializeFailed)?;
 
     fs::write(".woof.toml", toml_content)
         .map_err(SystemError::ConfigWriteFailed)

src/config.rs

@@ -9,6 +9,14 @@ use std::path::Path;
 
 const PRE_COMMIT_HOOK: &str = r#"#!/bin/sh
 # Watchdog Perimeter Defense Hook
+
+# [FIX] Check if woof is in the PATH before enforcing the hook
+if ! command -v woof >/dev/null 2>&1; then
+    echo "[WARN] Watchdog (woof) is not installed or not in PATH."
+    echo "[WARN] Skipping perimeter evaluation. Please install Rustywoof to secure commits."
+    exit 0
+fi
+
 echo "[INFO] Watchdog evaluating commit perimeter..."
 woof check .
 if [ $? -ne 0 ]; then

src/git.rs

@@ -3,6 +3,7 @@
 use clap::{Parser, Subcommand};
 use miette::Result;
 use std::process;
+use std::time::Duration;
 
 mod config;
 mod detector;
@@ -161,7 +162,7 @@ fn main() -> Result<()> {
 
     // 2. Check if the background thread found an update
     if !matches!(cli.command, Commands::Update) {
-        if let Ok(Some(new_version)) = update_receiver.try_recv() {
+        if let Ok(Some(new_version)) = update_receiver.recv_timeout(Duration::from_millis(150)) {
             println!(
                 "\n\x1b[33m[NOTICE]\x1b[0m A new engine update (v{}) is available! Run `woof update` to update.",
                 new_version