@prism-d1/cli 1.0.99 → 1.2.0

package/dist/src/codewatch/gitleaks.js

@@ -0,0 +1,160 @@
+/**
+ * gitleaks: shared starter config, report parsing, and the pre-commit scan.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { GITLEAKS_BASELINE_PATH, GITLEAKS_CONFIG_PATH } from './config.js';
+import { makeResult, REASON_GITLEAKS_MISSING, writeResult } from './results.js';
+import { run } from '../utils/exec.js';
+import { toolVersion } from './reviewers/index.js';
+/**
+ * Starter gitleaks config, written only when the repo has none.
+ *
+ * The secret-scan step in the workflow runs with or without this file --
+ * gitleaks ships usable defaults. What the defaults do not know is which
+ * credential-shaped strings in THIS repo are deliberate, so the first PR that
+ * touches a test fixture fails the gate on a fake key. A team that hits that
+ * with no obvious place to record the exception tends to delete the gate rather
+ * than tune it, so the tuning surface ships up front and is documented inline.
+ *
+ * `useDefault = true` is what keeps this additive: without it, declaring a
+ * config REPLACES the entire default ruleset and the gate silently stops
+ * detecting anything it does not name explicitly.
+ */
+export const GITLEAKS_STARTER_CONFIG = `# gitleaks configuration for the PRISM eval gate.
+#
+# The gate scans only the commits a PR introduces, so anything flagged here is
+# something this PR added. Two ways to handle a false positive:
+#
+#   1. Allowlist the path or pattern below (preferred -- reviewable, and it
+#      keeps working as the file changes).
+#   2. Add an inline "gitleaks:allow" comment on the offending line.
+#
+# A real exposure is NOT a false positive: rotate the credential first, because
+# deleting it from the branch does not un-expose what was already pushed.
+
+[extend]
+# Keep gitleaks' built-in ruleset. Removing this line replaces the defaults
+# entirely rather than adding to them, which turns the gate into a no-op for
+# every credential type not restated in this file.
+useDefault = true
+
+[[allowlists]]
+description = "Test fixtures and documented examples"
+paths = [
+  '''(^|/)tests?/''',
+  '''(^|/)__fixtures__/''',
+  '''(^|/)__tests__/''',
+  '''\\.example($|\\.)''',
+]
+`;
+/**
+ * One-line, platform-specific gitleaks install hint. Never a curl-piped-to-shell.
+ * Single source for the installer, the pre-commit warning and the dashboard.
+ */
+export function gitleaksInstallHint(platform = process.platform) {
+    const release = 'a release binary from https://github.com/gitleaks/gitleaks/releases';
+    if (platform === 'darwin')
+        return `brew install gitleaks (or ${release})`;
+    if (platform === 'win32')
+        return `scoop install gitleaks (or ${release})`;
+    return `${release} on your PATH, or: go install github.com/zricethezav/gitleaks/v8@latest`;
+}
+/** Writes the starter config unless the repo already has one. Returns true when written. */
+export function installGitleaksConfig(gitRoot) {
+    const dest = resolve(gitRoot, GITLEAKS_CONFIG_PATH);
+    if (existsSync(dest))
+        return false;
+    writeFileSync(dest, GITLEAKS_STARTER_CONFIG);
+    return true;
+}
+/**
+ * Converts a gitleaks JSON report to schema findings.
+ *
+ * Only location and rule fields are projected. `Secret` and `Match` are never
+ * read, so a result file cannot carry the credential even if --redact was lost.
+ */
+export function parseGitleaksReport(json) {
+    const arr = JSON.parse(json);
+    if (!Array.isArray(arr))
+        throw new Error('gitleaks report is not a JSON array');
+    return arr.map((l) => ({
+        severity: 'high',
+        category: 'security',
+        rule: String(l?.RuleID || 'gitleaks'),
+        file: String(l?.File || ''),
+        line: Number.isFinite(l?.StartLine) && l.StartLine > 0 ? l.StartLine : null,
+        message: `${String(l?.Description || 'Secret detected').slice(0, 300)} (value redacted)`,
+    }));
+}
+function currentBranch() {
+    const r = run('git', ['symbolic-ref', '--quiet', '--short', 'HEAD']);
+    return r.ok && r.stdout ? r.stdout : null;
+}
+/**
+ * `gitleaks protect --staged` against the repo config and baseline.
+ *
+ * Blocks (exit 1) on a finding and when gitleaks runs but cannot produce a
+ * verdict (bad config, unreadable report): a broken secret scan should be
+ * fixed, not silently passed. A MISSING gitleaks does not block -- it warns and
+ * records a `skipped` result with reason `gitleaks-missing`; CI's gitleaks
+ * step remains the backstop.
+ */
+export function runPreCommit(repoRoot, gitleaksBin = 'gitleaks') {
+    const started = new Date().toISOString();
+    const treeR = run('git', ['write-tree']);
+    const tree = treeR.ok ? treeR.stdout : null;
+    const branch = currentBranch();
+    const base = { kind: 'secrets', hook: 'pre-commit', tool: 'gitleaks', tree, branch, started_at: started };
+    const version = toolVersion(gitleaksBin);
+    if (!version) {
+        // Allowed, not blocked (decided): recorded as skipped so the dashboard can
+        // count commits that were never secret-scanned.
+        const result = makeResult({ ...base, status: 'skipped', finished_at: new Date().toISOString(), reason: REASON_GITLEAKS_MISSING });
+        return { exitCode: 0, result, resultPath: safeWrite(repoRoot, result) };
+    }
+    const dir = mkdtempSync(join(tmpdir(), 'prism-gitleaks-'));
+    const report = join(dir, 'report.json');
+    try {
+        const args = ['protect', '--staged', '--redact', '--no-banner', '--exit-code=1',
+            '--report-format=json', `--report-path=${report}`];
+        if (existsSync(resolve(repoRoot, GITLEAKS_CONFIG_PATH)))
+            args.push(`--config=${GITLEAKS_CONFIG_PATH}`);
+        if (existsSync(resolve(repoRoot, GITLEAKS_BASELINE_PATH)))
+            args.push(`--baseline-path=${GITLEAKS_BASELINE_PATH}`);
+        const r = spawnSync(gitleaksBin, args, { cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 120_000 });
+        let findings = null;
+        try {
+            findings = parseGitleaksReport(readFileSync(report, 'utf8'));
+        }
+        catch {
+            findings = null;
+        }
+        if (r.status === 0 && (findings === null || findings.length === 0)) {
+            const result = makeResult({ ...base, tool_version: version, status: 'ok', finished_at: new Date().toISOString() });
+            return { exitCode: 0, result, resultPath: safeWrite(repoRoot, result) };
+        }
+        if (findings && findings.length > 0) {
+            const result = makeResult({ ...base, tool_version: version, status: 'findings', findings, finished_at: new Date().toISOString(), summary: `${findings.length} secret(s) in staged changes` });
+            return { exitCode: 1, result, resultPath: safeWrite(repoRoot, result) };
+        }
+        const why = (r.error?.message || r.stderr || '').trim().split('\n').slice(-3).join(' ').slice(0, 400);
+        const result = makeResult({ ...base, tool_version: version, status: 'error', finished_at: new Date().toISOString(), reason: `gitleaks exited ${r.status} without a readable report: ${why}` });
+        return { exitCode: 1, result, resultPath: safeWrite(repoRoot, result) };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** A result that cannot be written must never change the hook's verdict. */
+export function safeWrite(repoRoot, r) {
+    try {
+        return writeResult(repoRoot, r);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=gitleaks.js.map

package/dist/src/codewatch/gitleaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../../src/codewatch/gitleaks.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,WAAW,EAAkC,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BtC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAC9E,MAAM,OAAO,GAAG,qEAAqE,CAAC;IACtF,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,6BAA6B,OAAO,GAAG,CAAC;IAC1E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,8BAA8B,OAAO,GAAG,CAAC;IAC1E,OAAO,GAAG,OAAO,yEAAyE,CAAC;AAC7F,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,aAAa,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QAC1B,QAAQ,EAAE,MAAe;QACzB,QAAQ,EAAE,UAAmB;QAC7B,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,IAAI,UAAU,CAAC;QACrC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QAC3E,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,EAAE,WAAW,IAAI,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB;KACzF,CAAC,CAAC,CAAC;AACN,CAAC;AASD,SAAS,aAAa;IACpB,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,WAAW,GAAG,UAAU;IACrE,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAkB,EAAE,IAAI,EAAE,YAAqB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAE5H,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,2EAA2E;QAC3E,gDAAgD;QAChD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAClI,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe;YAC7E,sBAAsB,EAAE,iBAAiB,MAAM,EAAE,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC,CAAC;QACvG,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,sBAAsB,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEjI,IAAI,QAAQ,GAAqB,IAAI,CAAC;QACtC,IAAI,CAAC;YAAC,QAAQ,GAAG,mBAAmB,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;QAAC,CAAC;QAEhG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACnH,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,8BAA8B,EAAE,CAAC,CAAC;YAC9L,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC,MAAM,+BAA+B,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/L,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,CAAc;IACxD,IAAI,CAAC;QAAC,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACjE,CAAC"}

package/dist/src/codewatch/globalHooks.d.ts

@@ -0,0 +1,52 @@
+import { type ManagedHook } from './hooks.js';
+export declare const GLOBAL_MARKER = "# prism-codewatch-global";
+/** Saved value of the global core.hooksPath that --global replaced. Absent when there was none. */
+export declare const PREVIOUS_FILE = ".previous-hookspath";
+/** With --force, the replaced hooks directory, whose hooks are chained after ours. */
+export declare const CHAIN_FILE = ".chain-hookspath";
+/** `git config prism.codewatch false` in a repo skips codewatch there (repo-local hooks still run). */
+export declare const OPT_OUT_KEY = "prism.codewatch";
+export declare function globalHooksDir(home?: string): string;
+/** git expands a leading ~ in core.hooksPath; do the same so values compare. */
+export declare function expandHome(p: string, home?: string): string;
+export declare function readGlobalHooksPath(): string | null;
+/** True when a core.hooksPath value points at our global hooks directory. */
+export declare function isOurHooksPath(value: string | null, home?: string): boolean;
+export declare const GLOBAL_PRE_COMMIT_SCRIPT: string;
+export declare const GLOBAL_PRE_PUSH_SCRIPT: string;
+export declare const GLOBAL_HOOK_SCRIPTS: Record<ManagedHook, string>;
+export type GlobalInstallResult = {
+    ok: true;
+    dir: string;
+    previous: string | null;
+    chained: string | null;
+    reinstalled: boolean;
+} | {
+    ok: false;
+    refused: string;
+    current: string;
+};
+export declare function installGlobal(opts?: {
+    force?: boolean;
+    home?: string;
+}): GlobalInstallResult;
+export interface GlobalUninstallResult {
+    /** What happened to core.hooksPath. */
+    config: 'restored' | 'unset' | 'left-alone' | 'not-set';
+    restoredTo: string | null;
+    removed: string[];
+}
+/** Restores the previous core.hooksPath (or unsets it) and removes our files. Never touches repo-local hooks. */
+export declare function uninstallGlobal(opts?: {
+    home?: string;
+}): GlobalUninstallResult;
+export interface GlobalStatus {
+    state: 'installed' | 'not-installed' | 'elsewhere' | 'incomplete';
+    hooksPath: string | null;
+    dir: string;
+}
+export declare function globalStatus(home?: string): GlobalStatus;
+/** A repo's own core.hooksPath (husky and similar), set in its local config. */
+export declare function repoLocalHooksPath(repo: string): string | null;
+export declare function isOptedOut(repo: string): boolean;
+//# sourceMappingURL=globalHooks.d.ts.map

package/dist/src/codewatch/globalHooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalHooks.d.ts","sourceRoot":"","sources":["../../../src/codewatch/globalHooks.ts"],"names":[],"mappings":"AAgBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzF,eAAO,MAAM,aAAa,6BAA6B,CAAC;AACxD,mGAAmG;AACnG,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,sFAAsF;AACtF,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C,uGAAuG;AACvG,eAAO,MAAM,WAAW,oBAAoB,CAAC;AAE7C,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE/D;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,CAItE;AAOD,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,IAAI,CAGnD;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CAItF;AAiDD,eAAO,MAAM,wBAAwB,QAqBf,CAAC;AAEvB,eAAO,MAAM,sBAAsB,QAcd,CAAC;AAEtB,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAG3D,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAChG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,mBAAmB,CA2BhG;AAMD,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;IACxD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iHAAiH;AACjH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,qBAAqB,CA8BnF;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,WAAW,GAAG,eAAe,GAAG,WAAW,GAAG,YAAY,CAAC;IAClE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,YAAY,CAOnE;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGhD"}

package/dist/src/codewatch/globalHooks.js

@@ -0,0 +1,235 @@
+/**
+ * Global codewatch hooks: `prism-cli enable codewatch --global`.
+ *
+ * The hooks live in ~/.prism/hooks/ and `git config --global core.hooksPath`
+ * points there, so every existing and future repo is covered with no per-repo
+ * step. A global core.hooksPath makes git ignore each repo's own .git/hooks,
+ * so these hooks run that repo-local hook themselves, after codewatch, and pass
+ * its exit code through.
+ *
+ * Every git call here goes through `git config --global`, which honours HOME
+ * and GIT_CONFIG_GLOBAL: tests point both at a scratch directory.
+ */
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmdirSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+import { run } from '../utils/exec.js';
+import { BACKUP_SUFFIX, HOOK_MARKER, MANAGED_HOOKS } from './hooks.js';
+export const GLOBAL_MARKER = '# prism-codewatch-global';
+/** Saved value of the global core.hooksPath that --global replaced. Absent when there was none. */
+export const PREVIOUS_FILE = '.previous-hookspath';
+/** With --force, the replaced hooks directory, whose hooks are chained after ours. */
+export const CHAIN_FILE = '.chain-hookspath';
+/** `git config prism.codewatch false` in a repo skips codewatch there (repo-local hooks still run). */
+export const OPT_OUT_KEY = 'prism.codewatch';
+export function globalHooksDir(home = homedir()) {
+    return join(home, '.prism', 'hooks');
+}
+/** git expands a leading ~ in core.hooksPath; do the same so values compare. */
+export function expandHome(p, home = homedir()) {
+    if (p === '~')
+        return home;
+    if (p.startsWith('~/'))
+        return join(home, p.slice(2));
+    return p;
+}
+function samePath(a, b) {
+    const norm = (p) => { try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    } };
+    return norm(a) === norm(b);
+}
+export function readGlobalHooksPath() {
+    const r = run('git', ['config', '--global', '--get', 'core.hooksPath']);
+    return r.ok && r.stdout ? r.stdout : null;
+}
+/** True when a core.hooksPath value points at our global hooks directory. */
+export function isOurHooksPath(value, home = homedir()) {
+    if (!value)
+        return false;
+    const v = expandHome(value, home);
+    return isAbsolute(v) && samePath(v, globalHooksDir(home));
+}
+/**
+ * Shared shell for both global hooks. Prints, one per line, the hooks to run
+ * after ours: the repo-local hook (unless it is a per-repo codewatch hook, in
+ * which case the team hook it had backed up), then the hook in the directory
+ * --force replaced. Never a file carrying our marker, so nothing runs twice.
+ */
+function chainPrelude(hook) {
+    return `HOOK_NAME=${hook}
+HOOK_DIR=$(cd "$(dirname "$0")" && pwd)
+PRISM_MARKER='${HOOK_MARKER}'
+prism_enabled() { [ "$(git config --bool --get ${OPT_OUT_KEY} 2>/dev/null)" != "false" ]; }
+prism_chain_targets() {
+  GD=$(git rev-parse --git-dir 2>/dev/null) || return 0
+  L="$GD/hooks/$HOOK_NAME"
+  if [ -f "$L" ] && [ -x "$L" ]; then
+    if grep -qF "$PRISM_MARKER" "$L" 2>/dev/null; then
+      if [ -x "$L${BACKUP_SUFFIX}" ]; then printf '%s\\n' "$L${BACKUP_SUFFIX}"; fi
+    else
+      printf '%s\\n' "$L"
+    fi
+  fi
+  if [ -f "$HOOK_DIR/${CHAIN_FILE}" ]; then
+    F="$(cat "$HOOK_DIR/${CHAIN_FILE}")/$HOOK_NAME"
+    if [ -f "$F" ] && [ -x "$F" ] && ! grep -qF "$PRISM_MARKER" "$F" 2>/dev/null; then printf '%s\\n' "$F"; fi
+  fi
+}
+`;
+}
+/** Runs each chained hook in turn; the first non-zero exit code is the hook's result. */
+function chainRunner(feedStdin) {
+    const call = feedStdin ? 'prism_feed | "$t" "$@"' : '"$t" "$@"';
+    return `TARGETS=$(prism_chain_targets)
+set -f
+OLDIFS=$IFS
+IFS='
+'
+for t in $TARGETS; do
+  IFS=$OLDIFS
+  ${call}
+  rc=$?
+  if [ "$rc" -ne 0 ]; then exit "$rc"; fi
+done
+exit 0
+`;
+}
+export const GLOBAL_PRE_COMMIT_SCRIPT = `#!/bin/sh
+${HOOK_MARKER} -- global pre-commit: secret scan (blocks on a finding), then this repo's own pre-commit.
+${GLOBAL_MARKER}
+# Managed file. Remove with: prism-cli enable codewatch --global --uninstall
+${chainPrelude('pre-commit')}
+if prism_enabled; then
+  if command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-commit --help 2>/dev/null | grep -q 'codewatch pre-commit'; then
+    prism-cli codewatch pre-commit || exit $?
+  elif command -v gitleaks >/dev/null 2>&1; then
+    set -- protect --staged --redact --no-banner --exit-code=1
+    [ -f .gitleaks.toml ] && set -- "$@" --config=.gitleaks.toml
+    [ -f .prism/gitleaks-baseline.json ] && set -- "$@" --baseline-path=.prism/gitleaks-baseline.json
+    if ! gitleaks "$@"; then
+      echo "prism: gitleaks flagged the staged changes; commit blocked." >&2
+      exit 1
+    fi
+    set --
+  else
+    echo "prism: neither prism-cli nor gitleaks is on PATH; secret scan skipped." >&2
+  fi
+fi
+${chainRunner(false)}`;
+export const GLOBAL_PRE_PUSH_SCRIPT = `#!/bin/sh
+${HOOK_MARKER} -- global pre-push: report-only review, then this repo's own pre-push (its exit code counts).
+${GLOBAL_MARKER}
+# Managed file. Remove with: prism-cli enable codewatch --global --uninstall
+${chainPrelude('pre-push')}
+PRISM_PUSH_INPUT=$(cat)
+prism_feed() { if [ -n "$PRISM_PUSH_INPUT" ]; then printf '%s\\n' "$PRISM_PUSH_INPUT"; fi; }
+if prism_enabled; then
+  if command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-push --help 2>/dev/null | grep -q 'codewatch pre-push'; then
+    prism_feed | prism-cli codewatch pre-push --remote "\${1:-}" || true
+  else
+    echo "prism: prism-cli (with 'codewatch pre-push') is not on PATH; local review skipped (report only)." >&2
+  fi
+fi
+${chainRunner(true)}`;
+export const GLOBAL_HOOK_SCRIPTS = {
+    'pre-commit': GLOBAL_PRE_COMMIT_SCRIPT,
+    'pre-push': GLOBAL_PRE_PUSH_SCRIPT,
+};
+export function installGlobal(opts = {}) {
+    const home = opts.home || homedir();
+    const dir = globalHooksDir(home);
+    const current = readGlobalHooksPath();
+    const ours = isOurHooksPath(current, home);
+    if (current && !ours && !opts.force) {
+        return { ok: false, current, refused: `global core.hooksPath is already set to ${current}` };
+    }
+    mkdirSync(dir, { recursive: true });
+    let chained = null;
+    if (current && !ours) {
+        // --force: remember the old value for uninstall, and chain its hooks.
+        writeFileSync(join(dir, PREVIOUS_FILE), current + '\n');
+        chained = expandHome(current, home);
+        writeFileSync(join(dir, CHAIN_FILE), chained + '\n');
+    }
+    for (const hook of MANAGED_HOOKS) {
+        const p = join(dir, hook);
+        writeFileSync(p, GLOBAL_HOOK_SCRIPTS[hook]);
+        chmodSync(p, 0o755);
+    }
+    if (!ours) {
+        const set = run('git', ['config', '--global', 'core.hooksPath', dir]);
+        if (!set.ok)
+            throw new Error(`git config --global core.hooksPath failed: ${set.stderr}`);
+    }
+    const prev = readText(join(dir, PREVIOUS_FILE));
+    return { ok: true, dir, previous: prev, chained: chained ?? readText(join(dir, CHAIN_FILE)), reinstalled: ours };
+}
+function readText(p) {
+    try {
+        return readFileSync(p, 'utf8').trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Restores the previous core.hooksPath (or unsets it) and removes our files. Never touches repo-local hooks. */
+export function uninstallGlobal(opts = {}) {
+    const home = opts.home || homedir();
+    const dir = globalHooksDir(home);
+    const current = readGlobalHooksPath();
+    const previous = readText(join(dir, PREVIOUS_FILE));
+    let config = 'not-set';
+    if (isOurHooksPath(current, home)) {
+        if (previous) {
+            run('git', ['config', '--global', 'core.hooksPath', previous]);
+            config = 'restored';
+        }
+        else {
+            run('git', ['config', '--global', '--unset', 'core.hooksPath']);
+            config = 'unset';
+        }
+    }
+    else if (current) {
+        config = 'left-alone'; // someone pointed it elsewhere since; not ours to change
+    }
+    const removed = [];
+    if (existsSync(dir)) {
+        for (const f of readdirSync(dir)) {
+            const p = join(dir, f);
+            const text = readText(p) || '';
+            if (f === PREVIOUS_FILE || f === CHAIN_FILE || text.includes(GLOBAL_MARKER)) {
+                rmSync(p, { force: true });
+                removed.push(f);
+            }
+        }
+        try {
+            rmdirSync(dir);
+        }
+        catch { /* not empty: leave other files */ }
+    }
+    return { config, restoredTo: config === 'restored' ? previous : null, removed };
+}
+export function globalStatus(home = homedir()) {
+    const dir = globalHooksDir(home);
+    const hooksPath = readGlobalHooksPath();
+    if (!hooksPath)
+        return { state: 'not-installed', hooksPath, dir };
+    if (!isOurHooksPath(hooksPath, home))
+        return { state: 'elsewhere', hooksPath, dir };
+    const complete = MANAGED_HOOKS.every((h) => (readText(join(dir, h)) || '').includes(GLOBAL_MARKER));
+    return { state: complete ? 'installed' : 'incomplete', hooksPath, dir };
+}
+/** A repo's own core.hooksPath (husky and similar), set in its local config. */
+export function repoLocalHooksPath(repo) {
+    const r = run('git', ['-C', repo, 'config', '--local', '--get', 'core.hooksPath']);
+    return r.ok && r.stdout ? r.stdout : null;
+}
+export function isOptedOut(repo) {
+    const r = run('git', ['-C', repo, 'config', '--bool', '--get', OPT_OUT_KEY]);
+    return r.ok && r.stdout === 'false';
+}
+//# sourceMappingURL=globalHooks.js.map

package/dist/src/codewatch/globalHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"globalHooks.js","sourceRoot":"","sources":["../../../src/codewatch/globalHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtI,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAoB,MAAM,YAAY,CAAC;AAEzF,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACxD,mGAAmG;AACnG,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,sFAAsF;AACtF,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C,uGAAuG;AACvG,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE7C,MAAM,UAAU,cAAc,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,CAAS,EAAE,OAAe,OAAO,EAAE;IAC5D,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,KAAoB,EAAE,OAAe,OAAO,EAAE;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAiB;IACrC,OAAO,aAAa,IAAI;;gBAEV,WAAW;iDACsB,WAAW;;;;;;mBAMzC,aAAa,+BAA+B,aAAa;;;;;uBAKrD,UAAU;0BACP,UAAU;;;;CAInC,CAAC;AACF,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,SAAkB;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,OAAO;;;;;;;IAOL,IAAI;;;;;CAKP,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG;EACtC,WAAW;EACX,aAAa;;EAEb,YAAY,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;EAiB1B,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,sBAAsB,GAAG;EACpC,WAAW;EACX,aAAa;;EAEb,YAAY,CAAC,UAAU,CAAC;;;;;;;;;;EAUxB,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D,YAAY,EAAE,wBAAwB;IACtC,UAAU,EAAE,sBAAsB;CACnC,CAAC;AAMF,MAAM,UAAU,aAAa,CAAC,OAA2C,EAAE;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,2CAA2C,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,sEAAsE;QACtE,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;QACxD,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,aAAa,CAAC,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC/E,CAAC;AASD,iHAAiH;AACjH,MAAM,UAAU,eAAe,CAAC,OAA0B,EAAE;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IACpD,IAAI,MAAM,GAAoC,SAAS,CAAC;IACxD,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC/D,MAAM,GAAG,UAAU,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,YAAY,CAAC,CAAC,yDAAyD;IAClF,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC5E,MAAM,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;AAClF,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,OAAe,OAAO,EAAE;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAClE,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACpF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACpG,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC1E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;AACtC,CAAC"}

package/dist/src/codewatch/hooks.d.ts

@@ -0,0 +1,38 @@
+export declare const HOOK_MARKER = "# prism-cli enable codewatch";
+export declare const BACKUP_SUFFIX = ".pre-prism";
+export declare const MANAGED_HOOKS: readonly ["pre-commit", "pre-push"];
+export type ManagedHook = typeof MANAGED_HOOKS[number];
+/**
+ * pre-commit: blocks on a gitleaks finding.
+ *
+ * Prefers `prism-cli codewatch pre-commit` (writes a result file). Without prism-cli
+ * on PATH it still runs gitleaks directly, so the block does not depend on the
+ * CLI being installed globally.
+ */
+export declare const PRE_COMMIT_SCRIPT = "#!/bin/sh\n# prism-cli enable codewatch -- pre-commit secret scan (blocks on a finding).\n# Managed file. Remove with: prism-cli enable codewatch --uninstall\nHOOK_DIR=$(dirname \"$0\")\nif [ -x \"$HOOK_DIR/pre-commit.pre-prism\" ]; then\n  \"$HOOK_DIR/pre-commit.pre-prism\" \"$@\" || exit $?\nfi\n# Probe first: an older prism-cli on PATH has no \"codewatch pre-commit\" and would\n# fail every commit with \"unknown command\". Its --help exits 0 with the root help,\n# so the probe checks that the subcommand's own usage line is printed.\nif command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-commit --help 2>/dev/null | grep -q 'codewatch pre-commit'; then\n  exec prism-cli codewatch pre-commit\nfi\nif command -v gitleaks >/dev/null 2>&1; then\n  set -- protect --staged --redact --no-banner --exit-code=1\n  [ -f .gitleaks.toml ] && set -- \"$@\" --config=.gitleaks.toml\n  [ -f .prism/gitleaks-baseline.json ] && set -- \"$@\" --baseline-path=.prism/gitleaks-baseline.json\n  if ! gitleaks \"$@\"; then\n    echo \"prism: gitleaks flagged the staged changes; commit blocked.\" >&2\n    echo \"prism: fix it, allowlist a false positive in .gitleaks.toml, or bypass once with --no-verify.\" >&2\n    exit 1\n  fi\n  exit 0\nfi\necho \"prism: neither prism-cli nor gitleaks is on PATH; secret scan skipped.\" >&2\nexit 0\n";
+/**
+ * pre-push: report-only review. Exits 0 no matter what the review does.
+ * stdin (the pushed refs) is buffered so both a chained hook and prism-cli see it.
+ */
+export declare const PRE_PUSH_SCRIPT = "#!/bin/sh\n# prism-cli enable codewatch -- pre-push local eval review (report only, never blocks).\n# Managed file. Remove with: prism-cli enable codewatch --uninstall\nHOOK_DIR=$(dirname \"$0\")\nPRISM_PUSH_INPUT=$(cat)\nif [ -x \"$HOOK_DIR/pre-push.pre-prism\" ]; then\n  printf '%s\\n' \"$PRISM_PUSH_INPUT\" | \"$HOOK_DIR/pre-push.pre-prism\" \"$@\" || exit $?\nfi\nif command -v prism-cli >/dev/null 2>&1 && prism-cli codewatch pre-push --help 2>/dev/null | grep -q 'codewatch pre-push'; then\n  printf '%s\\n' \"$PRISM_PUSH_INPUT\" | prism-cli codewatch pre-push --remote \"${1:-}\" || true\nelse\n  echo \"prism: prism-cli (with 'codewatch pre-push') is not on PATH; local review skipped (report only).\" >&2\nfi\nexit 0\n";
+export declare const HOOK_SCRIPTS: Record<ManagedHook, string>;
+/**
+ * Hooks directory as git resolves it: honours core.hooksPath and works in a
+ * linked worktree, where `.git` is a file and `.git/hooks` does not exist.
+ */
+export declare function resolveHooksDir(gitRoot: string): string;
+export interface HookChange {
+    hook: string;
+    action: string;
+}
+export declare function installHooks(hooksDir: string): HookChange[];
+export declare function uninstallHooks(hooksDir: string): HookChange[];
+/**
+ * Removes the retired prepare-commit-msg trailer hook (commit trailers and the
+ * token tracker are no longer used) and restores whatever it had backed up.
+ * Returns a description, or null when there was nothing to retire.
+ */
+export declare function retireLegacyCommitMsgHook(hooksDir: string): string | null;
+/** Adds `.prism/results/` to .gitignore unless an entry already covers it. */
+export declare function ensureResultsIgnored(gitRoot: string): boolean;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/src/codewatch/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/codewatch/hooks.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,WAAW,iCAAiC,CAAC;AAW1D,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,aAAa,qCAAsC,CAAC;AACjE,MAAM,MAAM,WAAW,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,i0CA0B7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,6tBAc3B,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAGpD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvD;AAWD,MAAM,WAAW,UAAU;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAE5D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAsB3D;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAkB7D;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYzE;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ7D"}