@pretense/cli 0.6.22 → 0.6.23

package/README.md

@@ -324,6 +324,22 @@ provider automatically (`claude` → Anthropic, `cursor`/`code` → OpenAI-compa
 on your `PATH`, `run` prints an install hint and exits non-zero instead of
 crashing — and it never tears down a proxy it did not start.
 
+### Works with your LLM
+
+`pretense run` sets the base-URL env var that each tool reads. The proxy mutates
+all three provider request shapes (`/v1/messages`, `/v1/chat/completions`,
+`/v1beta/…/generateContent`), so the same mutation engine covers every tool
+below.
+
+| Tool | Provider | Base-URL env var(s) `run` sets |
+| --- | --- | --- |
+| `claude`, `claude-code` | Anthropic | `ANTHROPIC_BASE_URL` |
+| `cursor`, `codex` | OpenAI-compatible | `OPENAI_BASE_URL` (with a `/v1` suffix) |
+| `gemini` | Google | `GEMINI_BASE_URL` **and** `GOOGLE_GEMINI_BASE_URL` |
+
+For any other tool, pass `--provider anthropic|openai|google` to pick the
+mapping.
+
 Read this before you rely on the proxy:
 
 - **npm install only.** `start` crashes on the `curl | sh` binary
@@ -543,10 +559,41 @@ of **36** compliance frameworks vendored from the `pretense-compliance-standards
 dataset (`pretense audit --list-frameworks` prints them). The two lists are not
 the same thing and should never be conflated.
 
+## Git hooks
+
+`pretense install` writes Pretense Git hooks into the current repository so a
+secret cannot reach a commit or a push:
+
+```bash
+pretense install                    # installs both pre-commit and pre-push hooks
+```
+
+<!-- docs-exec:expect "pretense install" 1 — the isolated session dir is deliberately not a git repo, so install has no .git to write into and exits 1 -->
+
+Pass `--mode pre-commit` or `--mode pre-push` to install just one, and `--force`
+to overwrite an existing hook. `pretense install` must be run from a repository
+root; it exits `1` with a named error when there is no `.git` directory.
+
+- The **pre-commit** hook runs `pretense scan pre-commit` over your staged files.
+  A commit that contains an AWS access key (`AKIA…`) is blocked with an
+  `aws-access-key` finding and never lands.
+- The **pre-push** hook runs `pretense scan pre-push` over the commits being
+  pushed (it reads git's pre-push ref lines on stdin), catching anything that
+  slipped past pre-commit.
+
 ## Supported languages
 
 TypeScript, JavaScript, Python, Go, Java, C#, Ruby, Rust.
 
+## Supported platforms
+
+The CLI runs on **macOS** (x64 and arm64), **Linux** (glibc and musl) and
+**Windows**. L1 detection (regex, 98 patterns) runs on all of them with no native
+dependencies. L2 detection needs the native `@pretense/scanner-rs` addon, which
+is not published for every platform; where it is missing the CLI degrades to L1
+in full and prints `L2 unavailable` rather than reporting less — see
+[Detection levels](#detection-levels-l1-and-l2).
+
 ## Detection levels (L1 and L2)
 
 <!-- OBSERVED, not specified. Every output block below was produced on

package/dist/{chunk-BWS6UMKL.js → chunk-Y7SXGTHU.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.22" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.23" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-BWS6UMKL.js";
+} from "./chunk-Y7SXGTHU.js";
 import {
   __commonJS,
   __toESM,
@@ -16657,11 +16657,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.22" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.23" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab".length > 0 ? "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab" : UNKNOWN_COMMIT;
+  return "3bc1a6f92239a8ea27af2a6558e968baf4b94d71".length > 0 ? "3bc1a6f92239a8ea27af2a6558e968baf4b94d71" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-BWS6UMKL.js";
+} from "./chunk-Y7SXGTHU.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -23,15 +23,15 @@
     "tsx": "^4.0.0",
     "typescript": "^5.4.0",
     "vitest": "^1.0.0",
-    "@pretense/billing": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
+    "@pretense/protocol": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/protocol": "0.1.0"
+    "@pretense/billing": "0.1.0",
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",