@rafter-security/cli 0.5.3 → 0.5.9

package/dist/commands/agent/init.js

@@ -52,6 +52,150 @@ function installClaudeCodeHooks() {
     console.log(fmt.success(`Installed PreToolUse hooks to ${settingsPath}`));
     console.log(fmt.success(`Installed PostToolUse hooks to ${settingsPath}`));
 }
+/** MCP server entry for rafter — shared across MCP-native clients */
+const RAFTER_MCP_ENTRY = {
+    command: "rafter",
+    args: ["mcp", "serve"],
+};
+/**
+ * Install MCP server config for Gemini CLI (~/.gemini/settings.json)
+ */
+function installGeminiMcp() {
+    const homeDir = os.homedir();
+    const geminiDir = path.join(homeDir, ".gemini");
+    const settingsPath = path.join(geminiDir, "settings.json");
+    if (!fs.existsSync(geminiDir)) {
+        fs.mkdirSync(geminiDir, { recursive: true });
+    }
+    let settings = {};
+    if (fs.existsSync(settingsPath)) {
+        try {
+            settings = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
+        }
+        catch {
+            console.log(fmt.warning("Existing Gemini settings.json was unreadable, creating new one"));
+        }
+    }
+    if (!settings.mcpServers)
+        settings.mcpServers = {};
+    settings.mcpServers.rafter = { ...RAFTER_MCP_ENTRY };
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), "utf-8");
+    console.log(fmt.success(`Installed Rafter MCP server to ${settingsPath}`));
+    return true;
+}
+/**
+ * Install MCP server config for Cursor (~/.cursor/mcp.json)
+ */
+function installCursorMcp() {
+    const homeDir = os.homedir();
+    const cursorDir = path.join(homeDir, ".cursor");
+    const mcpPath = path.join(cursorDir, "mcp.json");
+    if (!fs.existsSync(cursorDir)) {
+        fs.mkdirSync(cursorDir, { recursive: true });
+    }
+    let config = {};
+    if (fs.existsSync(mcpPath)) {
+        try {
+            config = JSON.parse(fs.readFileSync(mcpPath, "utf-8"));
+        }
+        catch {
+            console.log(fmt.warning("Existing Cursor mcp.json was unreadable, creating new one"));
+        }
+    }
+    if (!config.mcpServers)
+        config.mcpServers = {};
+    config.mcpServers.rafter = { ...RAFTER_MCP_ENTRY };
+    fs.writeFileSync(mcpPath, JSON.stringify(config, null, 2), "utf-8");
+    console.log(fmt.success(`Installed Rafter MCP server to ${mcpPath}`));
+    return true;
+}
+/**
+ * Install MCP server config for Windsurf (~/.codeium/windsurf/mcp_config.json)
+ */
+function installWindsurfMcp() {
+    const homeDir = os.homedir();
+    const windsurfDir = path.join(homeDir, ".codeium", "windsurf");
+    const mcpPath = path.join(windsurfDir, "mcp_config.json");
+    if (!fs.existsSync(windsurfDir)) {
+        fs.mkdirSync(windsurfDir, { recursive: true });
+    }
+    let config = {};
+    if (fs.existsSync(mcpPath)) {
+        try {
+            config = JSON.parse(fs.readFileSync(mcpPath, "utf-8"));
+        }
+        catch {
+            console.log(fmt.warning("Existing Windsurf mcp_config.json was unreadable, creating new one"));
+        }
+    }
+    if (!config.mcpServers)
+        config.mcpServers = {};
+    config.mcpServers.rafter = { ...RAFTER_MCP_ENTRY };
+    fs.writeFileSync(mcpPath, JSON.stringify(config, null, 2), "utf-8");
+    console.log(fmt.success(`Installed Rafter MCP server to ${mcpPath}`));
+    return true;
+}
+/**
+ * Install MCP server config for Continue.dev (~/.continue/config.json)
+ */
+function installContinueDevMcp() {
+    const homeDir = os.homedir();
+    const continueDir = path.join(homeDir, ".continue");
+    const configPath = path.join(continueDir, "config.json");
+    if (!fs.existsSync(continueDir)) {
+        fs.mkdirSync(continueDir, { recursive: true });
+    }
+    let config = {};
+    if (fs.existsSync(configPath)) {
+        try {
+            config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+        }
+        catch {
+            console.log(fmt.warning("Existing Continue.dev config.json was unreadable, creating new one"));
+        }
+    }
+    if (!config.mcpServers)
+        config.mcpServers = [];
+    // Remove existing rafter entry if present (array format)
+    if (Array.isArray(config.mcpServers)) {
+        config.mcpServers = config.mcpServers.filter((s) => s.name !== "rafter");
+        config.mcpServers.push({
+            name: "rafter",
+            command: RAFTER_MCP_ENTRY.command,
+            args: RAFTER_MCP_ENTRY.args,
+        });
+    }
+    else {
+        // Object format (newer Continue.dev versions)
+        config.mcpServers.rafter = { ...RAFTER_MCP_ENTRY };
+    }
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+    console.log(fmt.success(`Installed Rafter MCP server to ${configPath}`));
+    return true;
+}
+/**
+ * Install MCP config for Aider (~/.aider.conf.yml)
+ * Aider uses YAML config with mcpServers list
+ */
+function installAiderMcp() {
+    const homeDir = os.homedir();
+    const configPath = path.join(homeDir, ".aider.conf.yml");
+    // Aider's YAML config is simple — we append the MCP flag if not present
+    let content = "";
+    if (fs.existsSync(configPath)) {
+        content = fs.readFileSync(configPath, "utf-8");
+    }
+    // Check if rafter MCP is already configured
+    if (content.includes("rafter mcp serve")) {
+        console.log(fmt.success("Rafter MCP already configured in Aider config"));
+        return true;
+    }
+    // Append MCP server config
+    const mcpLine = "\n# Rafter security MCP server\nmcp-server-command: rafter mcp serve\n";
+    fs.writeFileSync(configPath, content + mcpLine, "utf-8");
+    console.log(fmt.success(`Installed Rafter MCP server to ${configPath}`));
+    return true;
+}
 async function installClaudeCodeSkills() {
     const homeDir = os.homedir();
     const claudeSkillsDir = path.join(homeDir, ".claude", "skills");
@@ -88,14 +232,53 @@ async function installClaudeCodeSkills() {
         console.log(fmt.warning(`Agent Security skill template not found at ${agentTemplatePath}`));
     }
 }
+function installCodexSkills() {
+    const homeDir = os.homedir();
+    const agentsSkillsDir = path.join(homeDir, ".agents", "skills");
+    // Install Backend Skill
+    const backendDir = path.join(agentsSkillsDir, "rafter");
+    const backendSkillPath = path.join(backendDir, "SKILL.md");
+    const backendTemplatePath = path.join(__dirname, "..", "..", "..", ".claude", "skills", "rafter", "SKILL.md");
+    if (!fs.existsSync(backendDir)) {
+        fs.mkdirSync(backendDir, { recursive: true });
+    }
+    if (fs.existsSync(backendTemplatePath)) {
+        fs.copyFileSync(backendTemplatePath, backendSkillPath);
+        console.log(fmt.success(`Installed Rafter Backend skill to ${backendSkillPath}`));
+    }
+    else {
+        console.log(fmt.warning(`Backend skill template not found at ${backendTemplatePath}`));
+    }
+    // Install Agent Security Skill
+    const agentDir = path.join(agentsSkillsDir, "rafter-agent-security");
+    const agentSkillPath = path.join(agentDir, "SKILL.md");
+    const agentTemplatePath = path.join(__dirname, "..", "..", "..", ".claude", "skills", "rafter-agent-security", "SKILL.md");
+    if (!fs.existsSync(agentDir)) {
+        fs.mkdirSync(agentDir, { recursive: true });
+    }
+    if (fs.existsSync(agentTemplatePath)) {
+        fs.copyFileSync(agentTemplatePath, agentSkillPath);
+        console.log(fmt.success(`Installed Rafter Agent Security skill to ${agentSkillPath}`));
+    }
+    else {
+        console.log(fmt.warning(`Agent Security skill template not found at ${agentTemplatePath}`));
+    }
+}
 export function createInitCommand() {
     return new Command("init")
         .description("Initialize agent security system")
         .option("--risk-level <level>", "Set risk level (minimal, moderate, aggressive)", "moderate")
-        .option("--skip-openclaw", "Skip OpenClaw skill installation")
-        .option("--skip-claude-code", "Skip Claude Code skill installation")
-        .option("--claude-code", "Force Claude Code skill installation")
-        .option("--skip-gitleaks", "Skip Gitleaks binary download")
+        .option("--with-openclaw", "Install OpenClaw integration")
+        .option("--with-claude-code", "Install Claude Code integration")
+        .option("--with-codex", "Install Codex CLI integration")
+        .option("--with-gemini", "Install Gemini CLI integration")
+        .option("--with-aider", "Install Aider integration")
+        .option("--with-cursor", "Install Cursor integration")
+        .option("--with-windsurf", "Install Windsurf integration")
+        .option("--with-continue", "Install Continue.dev integration")
+        .option("--with-gitleaks", "Download and install Gitleaks binary")
+        .option("--all", "Install all detected integrations and download Gitleaks")
+        .option("--update", "Re-download gitleaks and reinstall integrations without resetting config")
         .action(async (opts) => {
         console.log(fmt.header("Rafter Agent Security Setup"));
         console.log(fmt.divider());
@@ -103,19 +286,64 @@ export function createInitCommand() {
         const manager = new ConfigManager();
         // Detect environments
         const hasOpenClaw = fs.existsSync(path.join(os.homedir(), ".openclaw"));
-        const hasClaudeCode = opts.claudeCode || fs.existsSync(path.join(os.homedir(), ".claude"));
-        if (hasOpenClaw) {
-            console.log(fmt.success("Detected environment: OpenClaw"));
-        }
-        else {
-            console.log(fmt.info("OpenClaw not detected"));
-        }
-        if (hasClaudeCode) {
-            console.log(fmt.success("Detected environment: Claude Code"));
+        const hasClaudeCode = fs.existsSync(path.join(os.homedir(), ".claude"));
+        const hasCodex = fs.existsSync(path.join(os.homedir(), ".codex"));
+        const hasGemini = fs.existsSync(path.join(os.homedir(), ".gemini"));
+        const hasCursor = fs.existsSync(path.join(os.homedir(), ".cursor"));
+        const hasWindsurf = fs.existsSync(path.join(os.homedir(), ".codeium", "windsurf"));
+        const hasContinueDev = fs.existsSync(path.join(os.homedir(), ".continue"));
+        const hasAider = fs.existsSync(path.join(os.homedir(), ".aider.conf.yml"));
+        // Resolve opt-in flags (--all enables all detected)
+        const wantOpenClaw = opts.withOpenclaw || opts.all;
+        const wantClaudeCode = opts.withClaudeCode || opts.all;
+        const wantCodex = opts.withCodex || opts.all;
+        const wantGemini = opts.withGemini || opts.all;
+        const wantCursor = opts.withCursor || opts.all;
+        const wantWindsurf = opts.withWindsurf || opts.all;
+        const wantContinue = opts.withContinue || opts.all;
+        const wantAider = opts.withAider || opts.all;
+        const wantGitleaks = opts.withGitleaks || opts.all;
+        // Show detected environments with opt-in hints
+        const detected = [];
+        if (hasOpenClaw)
+            detected.push("OpenClaw");
+        if (hasClaudeCode)
+            detected.push("Claude Code");
+        if (hasCodex)
+            detected.push("Codex CLI");
+        if (hasGemini)
+            detected.push("Gemini CLI");
+        if (hasCursor)
+            detected.push("Cursor");
+        if (hasWindsurf)
+            detected.push("Windsurf");
+        if (hasContinueDev)
+            detected.push("Continue.dev");
+        if (hasAider)
+            detected.push("Aider");
+        if (detected.length > 0) {
+            console.log(fmt.info(`Detected environments: ${detected.join(", ")}`));
         }
         else {
-            console.log(fmt.info("Claude Code not detected"));
+            console.log(fmt.info("No agent environments detected"));
         }
+        // Warn about requested but undetected environments
+        if (wantOpenClaw && !hasOpenClaw)
+            console.log(fmt.warning("OpenClaw requested but not detected (~/.openclaw not found)"));
+        if (wantClaudeCode && !hasClaudeCode)
+            console.log(fmt.warning("Claude Code requested but not detected (~/.claude not found)"));
+        if (wantCodex && !hasCodex)
+            console.log(fmt.warning("Codex CLI requested but not detected (~/.codex not found)"));
+        if (wantGemini && !hasGemini)
+            console.log(fmt.warning("Gemini CLI requested but not detected (~/.gemini not found)"));
+        if (wantCursor && !hasCursor)
+            console.log(fmt.warning("Cursor requested but not detected (~/.cursor not found)"));
+        if (wantWindsurf && !hasWindsurf)
+            console.log(fmt.warning("Windsurf requested but not detected (~/.codeium/windsurf not found)"));
+        if (wantContinue && !hasContinueDev)
+            console.log(fmt.warning("Continue.dev requested but not detected (~/.continue not found)"));
+        if (wantAider && !hasAider)
+            console.log(fmt.warning("Aider requested but not detected (~/.aider.conf.yml not found)"));
         // Initialize directory structure
         try {
             await manager.initialize();
@@ -134,8 +362,8 @@ export function createInitCommand() {
         }
         manager.set("agent.riskLevel", opts.riskLevel);
         console.log(fmt.success(`Set risk level: ${opts.riskLevel}`));
-        // Check / download Gitleaks binary (optional)
-        if (!opts.skipGitleaks) {
+        // Check / download Gitleaks binary (opt-in via --with-gitleaks or --all)
+        if (wantGitleaks) {
             const binaryManager = new BinaryManager();
             const platformInfo = binaryManager.getPlatformInfo();
             // Helper: show diagnostics for a failing binary (mirrors Python's agent init)
@@ -151,7 +379,7 @@ export function createInitCommand() {
                 console.log(fmt.info("To fix: install gitleaks (https://github.com/gitleaks/gitleaks/releases) and ensure it is on PATH, then re-run 'rafter agent init'."));
                 console.log();
             };
-            if (binaryManager.isGitleaksInstalled()) {
+            if (!opts.update && binaryManager.isGitleaksInstalled()) {
                 // Local binary exists — verify it actually works
                 const verResult = await binaryManager.verifyGitleaksVerbose();
                 if (verResult.ok) {
@@ -164,8 +392,9 @@ export function createInitCommand() {
                 }
             }
             else {
-                // Not installed locally — check PATH (mirrors Python's shutil.which)
-                const pathBinary = binaryManager.findGitleaksOnPath();
+                // Not installed locally (or --update forcing re-download) — check PATH first
+                // unless --update was passed (in that case force a fresh managed install)
+                const pathBinary = opts.update ? null : binaryManager.findGitleaksOnPath();
                 if (pathBinary) {
                     const verResult = await binaryManager.verifyGitleaksVerbose(pathBinary);
                     if (verResult.ok) {
@@ -202,10 +431,12 @@ export function createInitCommand() {
                 }
             }
         }
-        // Install OpenClaw skill if applicable
-        if (hasOpenClaw && !opts.skipOpenclaw) {
+        // Install OpenClaw skill if opted in
+        let openclawOk = false;
+        if (hasOpenClaw && wantOpenClaw) {
             const skillManager = new SkillManager();
             const result = await skillManager.installRafterSkillVerbose();
+            openclawOk = result.ok;
             if (result.ok) {
                 console.log(fmt.success("Installed Rafter Security skill to ~/.openclaw/skills/rafter-security.md"));
                 manager.set("agent.environments.openclaw.enabled", true);
@@ -219,28 +450,139 @@ export function createInitCommand() {
                 }
             }
         }
-        // Install Claude Code skills + hooks if applicable
-        if (hasClaudeCode && !opts.skipClaudeCode) {
+        // Install Claude Code skills + hooks if opted in
+        let claudeCodeOk = false;
+        if (hasClaudeCode && wantClaudeCode) {
             try {
                 await installClaudeCodeSkills();
                 installClaudeCodeHooks();
                 manager.set("agent.environments.claudeCode.enabled", true);
+                claudeCodeOk = true;
             }
             catch (e) {
                 console.error(fmt.error(`Failed to install Claude Code integration: ${e}`));
             }
         }
+        // Install Codex CLI skills if opted in
+        let codexOk = false;
+        if (hasCodex && wantCodex) {
+            try {
+                installCodexSkills();
+                manager.set("agent.environments.codex.enabled", true);
+                codexOk = true;
+            }
+            catch (e) {
+                console.error(fmt.error(`Failed to install Codex CLI integration: ${e}`));
+            }
+        }
+        // Install Gemini CLI MCP if opted in
+        let geminiOk = false;
+        if (hasGemini && wantGemini) {
+            try {
+                geminiOk = installGeminiMcp();
+                if (geminiOk)
+                    manager.set("agent.environments.gemini.enabled", true);
+            }
+            catch (e) {
+                console.error(fmt.error(`Failed to install Gemini CLI integration: ${e}`));
+            }
+        }
+        // Install Cursor MCP if opted in
+        let cursorOk = false;
+        if (hasCursor && wantCursor) {
+            try {
+                cursorOk = installCursorMcp();
+                if (cursorOk)
+                    manager.set("agent.environments.cursor.enabled", true);
+            }
+            catch (e) {
+                console.error(fmt.error(`Failed to install Cursor integration: ${e}`));
+            }
+        }
+        // Install Windsurf MCP if opted in
+        let windsurfOk = false;
+        if (hasWindsurf && wantWindsurf) {
+            try {
+                windsurfOk = installWindsurfMcp();
+                if (windsurfOk)
+                    manager.set("agent.environments.windsurf.enabled", true);
+            }
+            catch (e) {
+                console.error(fmt.error(`Failed to install Windsurf integration: ${e}`));
+            }
+        }
+        // Install Continue.dev MCP if opted in
+        let continueOk = false;
+        if (hasContinueDev && wantContinue) {
+            try {
+                continueOk = installContinueDevMcp();
+                if (continueOk)
+                    manager.set("agent.environments.continueDev.enabled", true);
+            }
+            catch (e) {
+                console.error(fmt.error(`Failed to install Continue.dev integration: ${e}`));
+            }
+        }
+        // Install Aider MCP if opted in
+        let aiderOk = false;
+        if (hasAider && wantAider) {
+            try {
+                aiderOk = installAiderMcp();
+                if (aiderOk)
+                    manager.set("agent.environments.aider.enabled", true);
+            }
+            catch (e) {
+                console.error(fmt.error(`Failed to install Aider integration: ${e}`));
+            }
+        }
         console.log();
         console.log(fmt.success("Agent security initialized!"));
         console.log();
-        console.log("Next steps:");
-        if (hasOpenClaw && !opts.skipOpenclaw) {
-            console.log("  - Restart OpenClaw to load skill");
+        const anyIntegration = openclawOk || claudeCodeOk || codexOk || geminiOk || cursorOk || windsurfOk || continueOk || aiderOk;
+        if (anyIntegration) {
+            console.log("Next steps:");
+            if (openclawOk)
+                console.log("  - Restart OpenClaw to load skill");
+            if (claudeCodeOk)
+                console.log("  - Restart Claude Code to load skills");
+            if (codexOk)
+                console.log("  - Restart Codex CLI to load skills");
+            if (geminiOk)
+                console.log("  - Restart Gemini CLI to load MCP server");
+            if (cursorOk)
+                console.log("  - Restart Cursor to load MCP server");
+            if (windsurfOk)
+                console.log("  - Restart Windsurf to load MCP server");
+            if (continueOk)
+                console.log("  - Restart Continue.dev to load MCP server");
+            if (aiderOk)
+                console.log("  - Restart Aider to load MCP server");
         }
-        if (hasClaudeCode && !opts.skipClaudeCode) {
-            console.log("  - Restart Claude Code to load skills");
+        else if (detected.length > 0) {
+            console.log("No integrations were installed. To install, re-run with opt-in flags:");
+            console.log("  rafter agent init --all                  # Install all detected");
+            if (hasClaudeCode)
+                console.log("  rafter agent init --with-claude-code     # Claude Code only");
+            if (hasOpenClaw)
+                console.log("  rafter agent init --with-openclaw        # OpenClaw only");
+            if (hasCodex)
+                console.log("  rafter agent init --with-codex           # Codex CLI only");
+            if (hasGemini)
+                console.log("  rafter agent init --with-gemini          # Gemini CLI only");
+            if (hasCursor)
+                console.log("  rafter agent init --with-cursor          # Cursor only");
+            if (hasWindsurf)
+                console.log("  rafter agent init --with-windsurf        # Windsurf only");
+            if (hasContinueDev)
+                console.log("  rafter agent init --with-continue        # Continue.dev only");
+            if (hasAider)
+                console.log("  rafter agent init --with-aider           # Aider only");
         }
-        console.log("  - Run: rafter agent scan . (test secret scanning)");
+        else {
+            console.log("No agent environments detected. Install an agent tool and re-run with --with-<tool>.");
+        }
+        console.log();
+        console.log("  - Run: rafter scan local . (test secret scanning)");
         console.log("  - Configure: rafter agent config show");
         console.log();
     });

package/dist/commands/agent/install-hook.js

@@ -8,25 +8,36 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 export function createInstallHookCommand() {
     return new Command("install-hook")
-        .description("Install pre-commit hook to scan for secrets")
+        .description("Install git hook to scan for secrets")
         .option("--global", "Install globally for all repos (via git config)")
+        .option("--push", "Install pre-push hook instead of pre-commit")
         .action(async (opts) => {
         await installHook(opts);
     });
 }
 async function installHook(opts) {
+    const hookName = opts.push ? "pre-push" : "pre-commit";
+    const templateName = opts.push ? "pre-push-hook.sh" : "pre-commit-hook.sh";
     if (opts.global) {
-        await installGlobalHook();
+        await installGlobalHook(hookName, templateName);
     }
     else {
-        await installLocalHook();
+        await installLocalHook(hookName, templateName);
     }
 }
+function getTemplatePath(templateName) {
+    const templatePath = path.join(__dirname, "..", "..", "..", "resources", templateName);
+    if (!fs.existsSync(templatePath)) {
+        console.error("❌ Error: Hook template not found");
+        console.error(`   Expected at: ${templatePath}`);
+        process.exit(1);
+    }
+    return templatePath;
+}
 /**
- * Install pre-commit hook for current repository
+ * Install hook for current repository
  */
-async function installLocalHook() {
-    // Check if in a git repository
+async function installLocalHook(hookName, templateName) {
     try {
         execSync("git rev-parse --git-dir", { stdio: "pipe" });
     }
@@ -35,80 +46,63 @@ async function installLocalHook() {
         console.error("   Run this command from inside a git repository");
         process.exit(1);
     }
-    // Get .git directory
     const gitDir = execSync("git rev-parse --git-dir", { encoding: "utf-8" }).trim();
     const hooksDir = path.resolve(gitDir, "hooks");
-    const hookPath = path.join(hooksDir, "pre-commit");
-    // Ensure hooks directory exists
+    const hookPath = path.join(hooksDir, hookName);
     if (!fs.existsSync(hooksDir)) {
         fs.mkdirSync(hooksDir, { recursive: true });
     }
-    // Check if hook already exists
     if (fs.existsSync(hookPath)) {
         const existing = fs.readFileSync(hookPath, "utf-8");
-        // Check if it's already a Rafter hook
-        if (existing.includes("Rafter Security Pre-Commit Hook")) {
-            console.log("✓ Rafter pre-commit hook already installed");
+        const marker = hookName === "pre-push" ? "Rafter Security Pre-Push Hook" : "Rafter Security Pre-Commit Hook";
+        if (existing.includes(marker)) {
+            console.log(`✓ Rafter ${hookName} hook already installed`);
             return;
         }
-        // Backup existing hook
         const backupPath = `${hookPath}.backup-${Date.now()}`;
         fs.copyFileSync(hookPath, backupPath);
         console.log(`📦 Backed up existing hook to: ${path.basename(backupPath)}`);
     }
-    // Get hook template path
-    const templatePath = path.join(__dirname, "..", "..", "..", "resources", "pre-commit-hook.sh");
-    if (!fs.existsSync(templatePath)) {
-        console.error("❌ Error: Hook template not found");
-        console.error(`   Expected at: ${templatePath}`);
-        process.exit(1);
-    }
-    // Copy hook template
-    const hookContent = fs.readFileSync(templatePath, "utf-8");
+    const hookContent = fs.readFileSync(getTemplatePath(templateName), "utf-8");
     fs.writeFileSync(hookPath, hookContent, "utf-8");
-    // Make executable
     fs.chmodSync(hookPath, 0o755);
-    console.log("✓ Installed Rafter pre-commit hook");
+    console.log(`✓ Installed Rafter ${hookName} hook`);
     console.log(`  Location: ${hookPath}`);
     console.log();
-    console.log("The hook will:");
-    console.log("  • Scan staged files for secrets before each commit");
-    console.log("  • Block commits if secrets are detected");
-    console.log("  • Can be bypassed with: git commit --no-verify (not recommended)");
+    if (hookName === "pre-push") {
+        console.log("The hook will:");
+        console.log("  • Scan commits being pushed for secrets");
+        console.log("  • Block pushes if secrets are detected");
+        console.log("  • Can be bypassed with: git push --no-verify (not recommended)");
+    }
+    else {
+        console.log("The hook will:");
+        console.log("  • Scan staged files for secrets before each commit");
+        console.log("  • Block commits if secrets are detected");
+        console.log("  • Can be bypassed with: git commit --no-verify (not recommended)");
+    }
     console.log();
 }
 /**
- * Install pre-commit hook globally for all repositories
+ * Install hook globally for all repositories
  */
-async function installGlobalHook() {
-    // Create global hooks directory
+async function installGlobalHook(hookName, templateName) {
     const homeDir = os.homedir();
     if (!homeDir) {
         console.error("❌ Error: Could not determine home directory");
         process.exit(1);
     }
     const globalHooksDir = path.join(homeDir, ".rafter", "git-hooks");
-    const hookPath = path.join(globalHooksDir, "pre-commit");
-    // Create directory
+    const hookPath = path.join(globalHooksDir, hookName);
     if (!fs.existsSync(globalHooksDir)) {
         fs.mkdirSync(globalHooksDir, { recursive: true });
     }
-    // Get hook template path
-    const templatePath = path.join(__dirname, "..", "..", "..", "resources", "pre-commit-hook.sh");
-    if (!fs.existsSync(templatePath)) {
-        console.error("❌ Error: Hook template not found");
-        console.error(`   Expected at: ${templatePath}`);
-        process.exit(1);
-    }
-    // Copy hook template
-    const hookContent = fs.readFileSync(templatePath, "utf-8");
+    const hookContent = fs.readFileSync(getTemplatePath(templateName), "utf-8");
     fs.writeFileSync(hookPath, hookContent, "utf-8");
-    // Make executable
     fs.chmodSync(hookPath, 0o755);
-    // Configure git to use global hooks directory
     try {
         execSync(`git config --global core.hooksPath "${globalHooksDir}"`, { stdio: "pipe" });
-        console.log("✓ Installed Rafter pre-commit hook globally");
+        console.log(`✓ Installed Rafter ${hookName} hook globally`);
         console.log(`  Location: ${hookPath}`);
         console.log(`  Git config: core.hooksPath = ${globalHooksDir}`);
         console.log();
@@ -118,7 +112,7 @@ async function installGlobalHook() {
         console.log(`  git config --global --unset core.hooksPath`);
         console.log();
         console.log("To install per-repository instead:");
-        console.log(`  cd <repo> && rafter agent install-hook`);
+        console.log(`  cd <repo> && rafter agent install-hook${hookName === "pre-push" ? " --push" : ""}`);
         console.log();
     }
     catch (e) {