@pretense/cli 0.6.22 → 0.6.24

package/README.md

@@ -324,6 +324,22 @@ provider automatically (`claude` → Anthropic, `cursor`/`code` → OpenAI-compa
 on your `PATH`, `run` prints an install hint and exits non-zero instead of
 crashing — and it never tears down a proxy it did not start.
 
+### Works with your LLM
+
+`pretense run` sets the base-URL env var that each tool reads. The proxy mutates
+all three provider request shapes (`/v1/messages`, `/v1/chat/completions`,
+`/v1beta/…/generateContent`), so the same mutation engine covers every tool
+below.
+
+| Tool | Provider | Base-URL env var(s) `run` sets |
+| --- | --- | --- |
+| `claude`, `claude-code` | Anthropic | `ANTHROPIC_BASE_URL` |
+| `cursor`, `codex` | OpenAI-compatible | `OPENAI_BASE_URL` (with a `/v1` suffix) |
+| `gemini` | Google | `GEMINI_BASE_URL` **and** `GOOGLE_GEMINI_BASE_URL` |
+
+For any other tool, pass `--provider anthropic|openai|google` to pick the
+mapping.
+
 Read this before you rely on the proxy:
 
 - **npm install only.** `start` crashes on the `curl | sh` binary
@@ -543,10 +559,41 @@ of **36** compliance frameworks vendored from the `pretense-compliance-standards
 dataset (`pretense audit --list-frameworks` prints them). The two lists are not
 the same thing and should never be conflated.
 
+## Git hooks
+
+`pretense install` writes Pretense Git hooks into the current repository so a
+secret cannot reach a commit or a push:
+
+```bash
+pretense install                    # installs both pre-commit and pre-push hooks
+```
+
+<!-- docs-exec:expect "pretense install" 1 — the isolated session dir is deliberately not a git repo, so install has no .git to write into and exits 1 -->
+
+Pass `--mode pre-commit` or `--mode pre-push` to install just one, and `--force`
+to overwrite an existing hook. `pretense install` must be run from a repository
+root; it exits `1` with a named error when there is no `.git` directory.
+
+- The **pre-commit** hook runs `pretense scan pre-commit` over your staged files.
+  A commit that contains an AWS access key (`AKIA…`) is blocked with an
+  `aws-access-key` finding and never lands.
+- The **pre-push** hook runs `pretense scan pre-push` over the commits being
+  pushed (it reads git's pre-push ref lines on stdin), catching anything that
+  slipped past pre-commit.
+
 ## Supported languages
 
 TypeScript, JavaScript, Python, Go, Java, C#, Ruby, Rust.
 
+## Supported platforms
+
+The CLI runs on **macOS** (x64 and arm64), **Linux** (glibc and musl) and
+**Windows**. L1 detection (regex, 98 patterns) runs on all of them with no native
+dependencies. L2 detection needs the native `@pretense/scanner-rs` addon, which
+is not published for every platform; where it is missing the CLI degrades to L1
+in full and prints `L2 unavailable` rather than reporting less — see
+[Detection levels](#detection-levels-l1-and-l2).
+
 ## Detection levels (L1 and L2)
 
 <!-- OBSERVED, not specified. Every output block below was produced on

package/dist/{chunk-BWS6UMKL.js → chunk-AWXABIHH.js}

@@ -17,7 +17,7 @@ function versionFromPackageJson() {
     return void 0;
   }
 }
-var PRETENSE_VERSION = (true ? "0.6.22" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
+var PRETENSE_VERSION = (true ? "0.6.24" : void 0) ?? versionFromPackageJson() ?? "0.0.0-unknown";
 
 export {
   PRETENSE_VERSION

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-BWS6UMKL.js";
+} from "./chunk-AWXABIHH.js";
 import {
   __commonJS,
   __toESM,
@@ -16657,11 +16657,11 @@ function versionFromCliPackageJson() {
   return void 0;
 }
 function productVersion() {
-  return override ?? (true ? "0.6.22" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
+  return override ?? (true ? "0.6.24" : void 0) ?? versionFromCliPackageJson() ?? "0.0.0-unknown";
 }
 var UNKNOWN_COMMIT = "unknown";
 function bakedCommitSha() {
-  return "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab".length > 0 ? "6c0840ef4a9ecc06829215df3a27c5a1b1b603ab" : UNKNOWN_COMMIT;
+  return "b258672fe5eb6d72b12faf92d12452d06dfa8ab2".length > 0 ? "b258672fe5eb6d72b12faf92d12452d06dfa8ab2" : UNKNOWN_COMMIT;
 }
 var FEATURE_TIERS = {
   compliance_export: "pro",
@@ -18634,6 +18634,20 @@ function planToTier(plan) {
       return null;
   }
 }
+function parseEntitlement(body) {
+  const raw2 = body["entitlement"];
+  if (!raw2 || typeof raw2 !== "object") return void 0;
+  const e = raw2;
+  const effectivePlan = planToTier(e["effectivePlan"]);
+  const planOnRecord = planToTier(e["planOnRecord"]);
+  if (effectivePlan === null && planOnRecord === null) return void 0;
+  return {
+    effectivePlan,
+    planOnRecord,
+    comped: e["comped"] === true,
+    hasActiveSubscription: e["hasActiveSubscription"] === true
+  };
+}
 async function tierFromBackend(apiKey) {
   const url = `${getConfiguredApiRoot()}/api/cli/auth/validate`;
   const controller = new AbortController();
@@ -18668,7 +18682,7 @@ async function tierFromBackend(apiKey) {
         detail: "the plan service did not report a recognizable plan"
       };
     }
-    return { tier, source: "backend" };
+    return { tier, source: "backend", entitlement: parseEntitlement(body) };
   } catch (err) {
     const aborted = err?.name === "AbortError";
     return {
@@ -18743,8 +18757,21 @@ function tierLabel(tier) {
   if (tier === "free") return "Free";
   return `${tierName(tier)} (${priceLabel(tier)})`;
 }
+function entitlementMismatchLines(ent) {
+  const paidOnRecord = ent.planOnRecord === "pro" || ent.planOnRecord === "enterprise";
+  if (ent.effectivePlan !== "free" || !paidOnRecord) return [];
+  const planName = ent.planOnRecord === "enterprise" ? "Enterprise" : "Pro";
+  return [
+    `${planName} plan present, but no active subscription or comp \u2014 running as Free.`,
+    "Attach a Stripe subscription or set the org comp flag \u2014 pretense.ai/dashboard/settings."
+  ];
+}
 function planMismatchHint(resolution) {
-  if (resolution.tier !== "free" || resolution.source !== "backend") return [];
+  if (resolution.source !== "backend") return [];
+  if (resolution.entitlement) {
+    return entitlementMismatchLines(resolution.entitlement);
+  }
+  if (resolution.tier !== "free") return [];
   return [
     "Not the plan you expected? An org flagged PRO without an active",
     "subscription/comp resolves to Free \u2014 see pretense.ai/dashboard/settings or contact support."
@@ -20376,7 +20403,7 @@ async function verifyApiKey(apiKey) {
       return { outcome: "rejected", url, detail: "the API reported the key as not valid" };
     }
     const plan = typeof body["plan"] === "string" ? body["plan"] : void 0;
-    return { outcome: "valid", url, plan };
+    return { outcome: "valid", url, plan, entitlement: parseEntitlement(body) };
   } catch (err) {
     const aborted = err?.name === "AbortError";
     return {
@@ -20495,14 +20522,15 @@ function authCommand() {
       };
       writeCredentials(creds);
       if (verified) {
-        const planIsFree = String(verification.plan ?? "").trim().toLowerCase() === "free";
+        const mismatchLines = verification.entitlement ? entitlementMismatchLines(verification.entitlement) : String(verification.plan ?? "").trim().toLowerCase() === "free" ? [
+          "Not the plan you expected? A PRO-flagged org without an active",
+          "subscription/comp resolves to Free \u2014 see pretense.ai/dashboard/settings."
+        ] : [];
         console.log(
           chalk10.green("\n  Authenticated. The key was verified by the Pretense API.") + chalk10.dim(`
   Key:    ${maskApiKey(opts.apiKey)}`) + chalk10.dim(`
   Server: ${verification.url}`) + (verification.plan ? chalk10.dim(`
-  Plan:   ${verification.plan}`) : "") + (planIsFree ? chalk10.dim(
-            "\n  Not the plan you expected? A PRO-flagged org without an active\n  subscription/comp resolves to Free \u2014 see pretense.ai/dashboard/settings."
-          ) : "") + "\n" + storageNotice()
+  Plan:   ${verification.plan}`) : "") + (mismatchLines.length > 0 ? chalk10.dim("\n  " + mismatchLines.join("\n  ")) : "") + "\n" + storageNotice()
         );
         return;
       }

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   PRETENSE_VERSION
-} from "./chunk-BWS6UMKL.js";
+} from "./chunk-AWXABIHH.js";
 import {
   init_esm_shims
 } from "./chunk-TWMRHZGM.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pretense/cli",
-  "version": "0.6.22",
+  "version": "0.6.24",
   "description": "Local-first AI firewall that mutates proprietary code before sending to LLM APIs",
   "type": "module",
   "bin": {
@@ -25,13 +25,13 @@
     "vitest": "^1.0.0",
     "@pretense/billing": "0.1.0",
     "@pretense/compliance-engine": "0.1.0",
+    "@pretense/protocol": "0.1.0",
     "@pretense/learner": "0.2.0",
     "@pretense/mutator": "0.2.0",
     "@pretense/proxy": "0.1.0",
     "@pretense/scanner": "0.2.0",
     "@pretense/scanner-rs": "0.2.0",
-    "@pretense/store": "0.2.0",
-    "@pretense/protocol": "0.1.0"
+    "@pretense/store": "0.2.0"
   },
   "publishConfig": {
     "access": "public",