@soulbatical/tetra-dev-toolkit 1.8.5 → 1.8.6

package/bin/tetra-setup.js

@@ -153,7 +153,7 @@ echo "✅ Pre-commit checks passed"
     console.log('   ⏭️  .husky/pre-commit already exists (use --force to overwrite)')
   }
 
-  // Create or extend pre-push hook with hygiene check
+  // Create or extend pre-push hook with hygiene check + RLS security gate
   const prePushPath = join(huskyDir, 'pre-push')
   const hygieneBlock = `
 # Tetra hygiene check — blocks push if repo contains clutter
@@ -167,23 +167,72 @@ if [ $? -ne 0 ]; then
   exit 1
 fi
 echo "✅ Repo hygiene passed"
+`
+
+  // RLS security gate — auto-detects Doppler project from doppler.yaml
+  const rlsBlock = `
+# Tetra RLS Security Gate — blocks push if DB has security violations
+# Auto-detects Doppler project from doppler.yaml
+DOPPLER_PROJECT=""
+for dopfile in doppler.yaml backend/doppler.yaml; do
+  if [ -f "$dopfile" ]; then
+    DOPPLER_PROJECT=$(grep 'project:' "$dopfile" | head -1 | sed 's/.*project: *//')
+    break
+  fi
+done
+
+if [ -n "$DOPPLER_PROJECT" ]; then
+  echo ""
+  echo "🔐 Running RLS security gate..."
+  doppler run --project "$DOPPLER_PROJECT" --config dev_backend -- npx tetra-check-rls --errors-only 2>/dev/null
+  RLS_EXIT=$?
+  if [ $RLS_EXIT -ne 0 ]; then
+    echo ""
+    echo "════════════════════════════════════════════════════════════"
+    echo "❌ PUSH BLOCKED — RLS SECURITY VIOLATION"
+    echo "════════════════════════════════════════════════════════════"
+    echo ""
+    echo "Fix all errors before pushing."
+    echo "Run for details: doppler run --project $DOPPLER_PROJECT --config dev_backend -- npx tetra-check-rls"
+    echo ""
+    exit 1
+  fi
+  echo "✅ RLS security gate passed"
+else
+  echo "⚠️  No doppler.yaml found — skipping RLS check (add doppler.yaml to enable)"
+fi
 `
 
   if (!existsSync(prePushPath)) {
-    // No pre-push hook yet — create one
-    const prePushContent = `#!/bin/sh\n${hygieneBlock}\n`
+    // No pre-push hook yet — create one with both checks
+    const prePushContent = `#!/bin/sh\n${hygieneBlock}\n${rlsBlock}\n`
     writeFileSync(prePushPath, prePushContent)
     execSync(`chmod +x ${prePushPath}`)
-    console.log('   ✅ Created .husky/pre-push with hygiene check')
+    console.log('   ✅ Created .husky/pre-push with hygiene + RLS security gate')
   } else {
-    // Pre-push hook exists — add hygiene check if not already there
-    const existing = readFileSync(prePushPath, 'utf-8')
+    // Pre-push hook exists — add missing checks
+    let existing = readFileSync(prePushPath, 'utf-8')
+    let changed = false
+
     if (!existing.includes('tetra-audit hygiene')) {
-      writeFileSync(prePushPath, existing.trimEnd() + '\n' + hygieneBlock)
+      existing = existing.trimEnd() + '\n' + hygieneBlock
+      changed = true
       console.log('   ✅ Added hygiene check to existing .husky/pre-push')
     } else {
       console.log('   ⏭️  .husky/pre-push already has hygiene check')
     }
+
+    if (!existing.includes('tetra-check-rls')) {
+      existing = existing.trimEnd() + '\n' + rlsBlock
+      changed = true
+      console.log('   ✅ Added RLS security gate to existing .husky/pre-push')
+    } else {
+      console.log('   ⏭️  .husky/pre-push already has RLS security gate')
+    }
+
+    if (changed) {
+      writeFileSync(prePushPath, existing)
+    }
   }
 
   // Add prepare script to package.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.8.5",
+  "version": "1.8.6",
   "publishConfig": {
     "access": "restricted"
   },