v0.2.0 — one product, one vault, two gates

dsh-cloak + cloakpack merged into one monorepo with a shared engine. +13 signatures (36 total), inline cloakpack:allow allowlist, config allowlists, detect-secrets-style baseline workflow, entropy gate. 71 tests incl. real-git E2E. See CHANGELOG.

v0.1.0 — safety-pack your secrets

Initial release of cloakpack — safety-pack your secrets before they leave the machine.

A git pre-push guard that blocks credential leaks (not just warns), plus one-command pack (secrets → local AES-256-GCM vault, files → stable placeholders) and unpack (restore on your machine). Built for hackathon reality: the secrets are already in the repo and the demo is tomorrow.

npm i -g cloakpack
cd your-project
cloakpack init

Highlights

• Pre-push guard scans the exact tree being pushed; blocks with actionable next steps; --no-verify remains the explicit escape hatch.
• cloakpack pack — vault + placeholders + auto-stage; warns honestly when a secret also lives in history (packing cannot save it — rotate).
• Detection engine shared with dsh-cloak: 24 signature families + key-name rules + custom regex rules.
• 38 tests including a real-git E2E (blocked push → pack → clean push → unpack). Zero runtime dependencies. Node ≥ 22.

See the threat model before relying on it.