@telelabsai/ship 1.1.3 → 1.1.6

package/git-hooks/pre-commit.cjs

@@ -0,0 +1,143 @@
+#!/usr/bin/env node
+
+/**
+ * Git pre-commit hook — scans staged file CONTENTS for secrets.
+ * Reads patterns from .claude/shared/secret-patterns.json (single source of truth).
+ *
+ * Exit 0 = allow commit
+ * Exit 1 = block commit (secrets found)
+ */
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Load patterns from shared config
+const patternsPath = path.join(__dirname, '..', '.claude', 'shared', 'secret-patterns.json');
+const patterns = JSON.parse(fs.readFileSync(patternsPath, 'utf8'));
+
+// Get staged files
+const stagedFiles = execSync('git diff --cached --name-only --diff-filter=ACM', { encoding: 'utf8' })
+  .trim()
+  .split('\n')
+  .filter(Boolean);
+
+if (stagedFiles.length === 0) {
+  process.exit(0);
+}
+
+// Build regex patterns from all categories
+const regexPatterns = [];
+for (const category of ['apiKeys', 'credentials', 'databaseUrls', 'privateKeys']) {
+  for (const entry of patterns[category]) {
+    regexPatterns.push({
+      name: entry.name,
+      regex: new RegExp(entry.pattern, 'g'),
+      severity: entry.severity,
+    });
+  }
+}
+
+// Build false positive checker
+const falsePositives = patterns.falsePositives;
+function isFalsePositive(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith('//') || trimmed.startsWith('#') || trimmed.startsWith('*')) {
+    return false; // Don't skip comments — secrets in comments are still secrets
+  }
+  return falsePositives.some((fp) => line.includes(fp));
+}
+
+// Skip binary and irrelevant files
+const skipExtensions = ['.png', '.jpg', '.jpeg', '.gif', '.ico', '.woff', '.woff2', '.ttf', '.eot', '.mp4', '.mp3', '.zip', '.tar', '.gz'];
+const skipFiles = ['package-lock.json', 'yarn.lock', 'pnpm-lock.yaml'];
+
+// Check dangerous files being committed
+const findings = [];
+
+for (const file of stagedFiles) {
+  // Check if file itself is dangerous
+  for (const dangerousFile of patterns.dangerousFiles) {
+    const pattern = dangerousFile.replace(/\*/g, '.*');
+    if (new RegExp(`(^|/)${pattern}$`).test(file)) {
+      findings.push({
+        file,
+        line: 0,
+        name: `Sensitive file: ${dangerousFile}`,
+        severity: 'critical',
+        match: file,
+      });
+    }
+  }
+
+  // Skip binary files
+  const ext = path.extname(file).toLowerCase();
+  if (skipExtensions.includes(ext)) continue;
+  if (skipFiles.includes(path.basename(file))) continue;
+
+  // Read staged content
+  let content;
+  try {
+    content = execSync(`git show :${file}`, { encoding: 'utf8' });
+  } catch {
+    continue;
+  }
+
+  // Scan each line
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+
+    if (isFalsePositive(line)) continue;
+
+    for (const { name, regex, severity } of regexPatterns) {
+      regex.lastIndex = 0;
+      if (regex.test(line)) {
+        findings.push({
+          file,
+          line: i + 1,
+          name,
+          severity,
+          match: line.trim().substring(0, 80),
+        });
+      }
+    }
+  }
+}
+
+if (findings.length === 0) {
+  process.exit(0);
+}
+
+// Report findings
+console.error('\n  Ship: Secrets detected in staged files!\n');
+
+const critical = findings.filter((f) => f.severity === 'critical');
+const high = findings.filter((f) => f.severity === 'high');
+const medium = findings.filter((f) => f.severity === 'medium');
+
+if (critical.length) {
+  console.error('  Critical:');
+  for (const f of critical) {
+    console.error(`    ${f.file}:${f.line} — ${f.name}`);
+    if (f.match && f.line > 0) console.error(`      ${f.match}`);
+  }
+}
+
+if (high.length) {
+  console.error('\n  High:');
+  for (const f of high) {
+    console.error(`    ${f.file}:${f.line} — ${f.name}`);
+  }
+}
+
+if (medium.length) {
+  console.error('\n  Medium:');
+  for (const f of medium) {
+    console.error(`    ${f.file}:${f.line} — ${f.name}`);
+  }
+}
+
+console.error(`\n  ${findings.length} secret(s) found. Commit blocked.`);
+console.error('  Fix: Move secrets to environment variables or add files to .gitignore.\n');
+process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telelabsai/ship",
-  "version": "1.1.3",
+  "version": "1.1.6",
   "description": "Ship code faster with pre-configured agents, skills, rules, and hooks for Claude Code.",
   "bin": {
     "ship": "cli/bin.js"
@@ -8,6 +8,7 @@
   "files": [
     "cli/",
     ".claude/",
+    "git-hooks/",
     "CLAUDE.md",
     "README.md",
     "LICENSE"