@bytesbrains/pi-contrib-gate 1.7.0 → 1.8.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bytesbrains/pi-contrib-gate",
-  "version": "1.7.0",
-  "description": "Contribution gateway for AI agents \u2014 enforce branch naming, conventional commits, pre-commit quality gates, and PR automation.",
+  "version": "1.8.0",
+  "description": "Contribution gateway for AI agents — enforce branch naming, conventional commits, pre-commit quality gates, and PR automation.",
   "keywords": [
     "pi-package",
     "pi-extension",
@@ -48,4 +48,4 @@
   "devDependencies": {
     "vitest": "^2.1.9"
   }
-}
+}

package/src/config.ts

@@ -71,6 +71,9 @@ export function loadConfig(cwd: string): ContribConfig {
         doctorAudit: result["quality.doctorAudit"] !== "false",
         maxFilesChanged: parseInt(result["quality.maxFilesChanged"] as string) || DEFAULT_CONFIG.quality.maxFilesChanged,
         maxLinesAdded: parseInt(result["quality.maxLinesAdded"] as string) || DEFAULT_CONFIG.quality.maxLinesAdded,
+        lensErrors: parseBool(result["quality.lensErrors"] as string, DEFAULT_CONFIG.quality.lensErrors),
+        maxLensErrors: parseInt(result["quality.maxLensErrors"] as string) || DEFAULT_CONFIG.quality.maxLensErrors,
+        secretScan: parseBool(result["quality.secretScan"] as string, DEFAULT_CONFIG.quality.secretScan),
       },
       requireIssueValidation: parseBool(result["requireIssueValidation"] as string, DEFAULT_CONFIG.requireIssueValidation),
     };

package/src/intercepts.ts

@@ -90,6 +90,21 @@ export async function interceptToolCall(event: any, ctx: ExtensionContext) {
       };
     }
 
+    // Run secret scan on all direct commits (including main/dev)
+    if (config.quality.secretScan) {
+      const leak = exec("gitleaks protect --staged --no-banner 2>&1", ctx.cwd);
+      if (!leak.ok) {
+        const leakLines = leak.stdout
+          .split("\n")
+          .filter((l: string) => l.includes("Finding:") || l.includes("RuleID:") || l.includes("File:"))
+          .join("\n  ");
+        return {
+          block: true,
+          reason: `Secrets/credentials detected in staged changes!\n  ${leakLines}\n\n  Remove secrets before committing. Add a .gitleaks.toml allowlist or gitleaks:allow comment for false positives.`,
+        };
+      }
+    }
+
     if (config.commits.convention === "conventional") {
       const msgMatch = cmd.match(/-m\s+"([^"]+)"/);
       if (msgMatch) {

package/src/types.ts

@@ -28,6 +28,8 @@ export interface ContribConfig {
 		lensErrors: boolean;
 		/** Max allowed LSP errors in staged files (default: 0) */
 		maxLensErrors: number;
+		/** Scan staged changes for secrets/credentials with gitleaks (default: true) */
+		secretScan: boolean;
 	};
 	/** Validate that the linked Gitea issue actually exists before starting work (default: true) */
 	requireIssueValidation: boolean;
@@ -65,6 +67,7 @@ export const DEFAULT_CONFIG: ContribConfig = {
 		maxLinesAdded: 500,
 		lensErrors: true,
 		maxLensErrors: 0,
+		secretScan: true,
 	},
 	requireIssueValidation: true,
 };

package/src/validate.ts

@@ -48,6 +48,25 @@ export function runQualityGate(
 		);
 	}
 
+	
+	// ── Secret / credential scan with gitleaks ─────────────────
+	if (config.quality.secretScan) {
+		const leak = exec("gitleaks protect --staged --no-banner 2>&1", cwd);
+		if (!leak.ok) {
+			// gitleaks exit code 1 = leaks found
+			const leakSummary = leak.stdout
+				.split("\n")
+				.filter((l) => l.includes("Finding:") || l.includes("RuleID:") || l.includes("File:"))
+				.join("\n  ");
+			errors.push(
+				`Secrets/credentials detected in staged changes!\n  ${leakSummary}\n\n  Remove secrets from files before committing. If this is a false positive, add a .gitleaks.toml allowlist or use gitleaks:allow comment.`,
+			);
+		} else if (leak.stderr && !leak.stderr.includes("no leaks found")) {
+			// gitleaks might output to stderr even on success (warnings, etc.)
+			// Only flag as error if the exit code was non-zero, already handled above.
+		}
+	}
+
 	const diff = exec("git diff --cached --name-only", cwd);
 	if (diff.ok) {
 		const files = diff.stdout.split("\n").filter(Boolean);