@titan-design/egress-scan 0.0.0 → 0.1.1

package/README.md

@@ -32,16 +32,27 @@ notices and errors to stderr.
   exits 2 rather than skipping the scan.
 - **Private term list.** `$TITAN_EGRESS_TERMS`, else
   `${XDG_CONFIG_HOME:-$HOME/.config}/titan-egress/private-terms`. When `CI` is set it is never
-  looked up. Locally a missing list prints a notice and the scan continues;
-  `TITAN_EGRESS_REQUIRE_TERMS=1` makes that exit 2. A list readable by other users prints a
-  notice and still loads.
+  looked up. Locally a missing list prints a notice and the scan continues. A list readable by
+  other users prints a notice and still loads.
+- **`TITAN_EGRESS_REQUIRE_TERMS=1` is the agent-hook switch.** It fails closed: `CI` no longer
+  skips the list, and a missing, unreadable or term-less list (only comments and blank lines)
+  exits 2 with a message naming the variable. The value is read case-insensitively and trimmed:
+  `1`, `true`, `yes`, `on` are on; empty, `0`, `false`, `no`, `off` are off; anything else exits 2.
+  No other variable turns it back into a pass.
 - **Allow file.** `.egress-allow` at the repo root. A malformed file exits 2.
 - **Hook.** `install-hook` writes `hooks/pre-push` into the directory
   `git rev-parse --git-path hooks` names: `core.hooksPath` when set, otherwise the common git
   directory, which every linked worktree shares. It never sets `core.hooksPath`, never
   replaces a `pre-push` it did not write (exit 2 with a chaining hint), and does nothing when
-  `CI` is set. The hook runs the pushing worktree's `node_modules/.bin/titan-egress-scan`,
-  falls back to the package's built `dist/bin.js`, and fails closed when neither exists.
+  `CI` is set. The hook runs the first scanner it finds, in this order: (1) the pushing
+  worktree's `node_modules/.bin/titan-egress-scan`, then its
+  `node_modules/@titan-design/egress-scan/dist/bin.js`; (2) the same two paths in the main
+  checkout, the parent of `git rev-parse --git-common-dir`; (3) `titan-egress-scan` on `PATH`,
+  which considers only absolute `PATH` entries, so a `.` or empty segment never runs a
+  scanner planted in the pushed tree.
+  A linked worktree without `node_modules` therefore pushes when the main checkout or `PATH`
+  has the scanner. When none is found the hook exits 1 (fail closed) and names the three places
+  it looked, plus `pnpm install && pnpm build` and `npm i -g @titan-design/egress-scan`.
 
 ## Scanning a push
 

package/dist/bin.js

@@ -44,8 +44,26 @@ function readIfPresent(file, what) {
     throw new ConfigError(`${what} could not be read`);
   }
 }
-function missingTerms(env) {
-  if (env.TITAN_EGRESS_REQUIRE_TERMS === "1") {
+var ON_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+var OFF_VALUES = /* @__PURE__ */ new Set(["", "0", "false", "no", "off"]);
+function requiresTerms(env) {
+  const value = (env.TITAN_EGRESS_REQUIRE_TERMS ?? "").trim().toLowerCase();
+  if (ON_VALUES.has(value)) return true;
+  if (OFF_VALUES.has(value)) return false;
+  throw new ConfigError("TITAN_EGRESS_REQUIRE_TERMS is not one of 1, true, yes, on, 0, false, no, off");
+}
+function readTermFile(file, required) {
+  try {
+    return readIfPresent(file, "private term list");
+  } catch (error) {
+    if (required && error instanceof ConfigError) {
+      throw new ConfigError("private term list could not be read and TITAN_EGRESS_REQUIRE_TERMS=1");
+    }
+    throw error;
+  }
+}
+function missingTerms(required) {
+  if (required) {
     throw new ConfigError("private term list not found and TITAN_EGRESS_REQUIRE_TERMS=1");
   }
   return { ...NOT_LOADED, notices: ["private term list not found; generic rules only"] };
@@ -59,13 +77,18 @@ function compileTerms(text) {
   }
 }
 function loadTerms(env) {
-  if (isCi(env)) return NOT_LOADED;
+  const required = requiresTerms(env);
+  if (isCi(env) && !required) return NOT_LOADED;
   const file = termFilePath(env);
-  const text = file === void 0 ? void 0 : readIfPresent(file, "private term list");
-  if (file === void 0 || text === void 0) return missingTerms(env);
+  const text = file === void 0 ? void 0 : readTermFile(file, required);
+  if (file === void 0 || text === void 0) return missingTerms(required);
   const openToOthers = process.platform !== "win32" && (fs.statSync(file).mode & 63) !== 0;
   const notices = openToOthers ? ["private term list is readable by other users; chmod 600 it"] : [];
-  return { terms: compileTerms(text), loaded: true, notices };
+  const terms = compileTerms(text);
+  if (terms.length === 0 && required) {
+    throw new ConfigError("private term list holds no terms and TITAN_EGRESS_REQUIRE_TERMS=1");
+  }
+  return { terms, loaded: true, notices };
 }
 function loadAllow(root) {
   const text = readIfPresent(path.join(root, ".egress-allow"), ".egress-allow");

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bin.ts","../src/cli.ts","../src/config.ts","../src/git.ts","../src/install.ts"],"sourcesContent":["#!/usr/bin/env node\nimport * as fs from \"node:fs\";\nimport { runCli } from \"./cli.js\";\n\nprocess.exitCode = runCli(process.argv.slice(2), {\n  cwd: process.cwd(),\n  env: process.env,\n  readStdin: () => fs.readFileSync(0, \"utf-8\"),\n  out: (line) => process.stdout.write(`${line}\\n`),\n  err: (line) => process.stderr.write(`${line}\\n`),\n});\n","import { parseArgs } from \"node:util\";\nimport { ConfigError, loadAllow, loadTerms } from \"./config.js\";\nimport type { ScanSource } from \"./diff.js\";\nimport {\n  commitsForRange,\n  commitsForUpdate,\n  isRemoteName,\n  isRevision,\n  parsePrePush,\n  readCommit,\n  readTree,\n  repoRoot,\n} from \"./git.js\";\nimport { installHook, type InstallResult } from \"./install.js\";\nimport { formatReport } from \"./report.js\";\nimport { scan } from \"./scan.js\";\n\nexport interface CliIo {\n  readonly cwd: string;\n  readonly env: Readonly<Record<string, string | undefined>>;\n  readStdin(): string;\n  out(line: string): void;\n  err(line: string): void;\n}\n\nconst USAGE = [\n  \"usage: titan-egress-scan <command>\",\n  \"  pre-push <remote>     scan the commits a push sends (reads git's pre-push stdin)\",\n  \"  range <base> <head>   scan every commit in base..head (CI)\",\n  \"  tree                  scan every tracked file at HEAD\",\n  \"  install-hook          install the pre-push hook into git's hooks directory\",\n  \"exit: 0 clean, 1 findings, 2 usage or configuration error\",\n];\n\nconst PREFIX = \"titan-egress-scan: \";\n\nfunction readCommits(root: string, shas: readonly string[]): ScanSource[] {\n  return [...new Set(shas)].map((sha) => readCommit(root, sha));\n}\n\nfunction prePushSources(root: string, remote: string, stdin: string): ScanSource[] {\n  const updates = parsePrePush(stdin);\n  return readCommits(\n    root,\n    updates.flatMap((update) => commitsForUpdate(root, remote, update)),\n  );\n}\n\nfunction runScan(io: CliIo, collect: (root: string) => ScanSource[]): number {\n  const root = repoRoot(io.cwd);\n  const allow = loadAllow(root);\n  const { terms, loaded, notices } = loadTerms(io.env);\n  for (const notice of notices) io.err(PREFIX + notice);\n  const result = scan(collect(root), { terms, allow });\n  for (const line of formatReport(result.findings, { ...result, termsLoaded: loaded })) io.out(line);\n  return result.findings.length > 0 ? 1 : 0;\n}\n\nconst INSTALL_MESSAGES: Record<InstallResult[\"outcome\"], string> = {\n  installed: \"pre-push hook installed\",\n  updated: \"pre-push hook updated\",\n  unchanged: \"pre-push hook already installed\",\n  \"skipped-in-ci\": \"CI detected; hook not installed\",\n  \"foreign-hook\": \"an existing pre-push hook was not written by this tool; left it in place.\",\n};\n\nfunction runInstall(io: CliIo): number {\n  const result = installHook(io.cwd, io.env);\n  const where = result.hookPath === undefined ? \"\" : ` (${result.hookPath})`;\n  if (result.outcome !== \"foreign-hook\") {\n    io.out(PREFIX + INSTALL_MESSAGES[result.outcome] + where);\n    return 0;\n  }\n  io.err(PREFIX + INSTALL_MESSAGES[result.outcome] + where);\n  io.err(PREFIX + 'chain it: call `titan-egress-scan pre-push \"$1\"` from that hook with git\\'s stdin passed through');\n  return 2;\n}\n\nfunction expectArgs(command: string, args: readonly string[], min: number, max: number): void {\n  if (args.length < min || args.length > max) throw new ConfigError(`${command}: wrong number of arguments`);\n}\n\n/** Rejects a value by its position only, so the message never repeats what was passed. */\nfunction expectValid(command: string, args: readonly string[], valid: (value: string) => boolean, what: string): void {\n  args.forEach((value, i) => {\n    if (!valid(value)) throw new ConfigError(`${command}: argument ${i + 1} is not ${what}`);\n  });\n}\n\nfunction dispatch(command: string | undefined, args: readonly string[], io: CliIo): number {\n  switch (command) {\n    case \"pre-push\":\n      // git passes the remote name and its URL; only the name is used.\n      expectArgs(command, args, 1, 2);\n      expectValid(command, args.slice(0, 1), isRemoteName, \"a remote name\");\n      return runScan(io, (root) => prePushSources(root, args[0] ?? \"\", io.readStdin()));\n    case \"range\":\n      expectArgs(command, args, 2, 2);\n      expectValid(command, args, isRevision, \"a sha or ref name\");\n      return runScan(io, (root) => readCommits(root, commitsForRange(root, args[0] ?? \"\", args[1] ?? \"\")));\n    case \"tree\":\n      expectArgs(command, args, 0, 0);\n      return runScan(io, (root) => [readTree(root)]);\n    case \"install-hook\":\n      expectArgs(command, args, 0, 0);\n      return runInstall(io);\n    default:\n      throw new ConfigError(command === undefined ? \"missing command\" : \"unknown command\");\n  }\n}\n\n/** Help counts only before the command; after it, a help flag is a usage error, never a skipped scan. */\nfunction parseCommandLine(argv: readonly string[]): { positionals: string[]; help: boolean } {\n  const { positionals, tokens } = parseArgs({\n    args: [...argv],\n    allowPositionals: true,\n    tokens: true,\n    options: { help: { type: \"boolean\", short: \"h\" } },\n  });\n  const command = tokens.find((token) => token.kind === \"positional\");\n  const helps = tokens.filter((token) => token.kind === \"option\" && token.name === \"help\");\n  if (helps.some((token) => command !== undefined && token.index > command.index)) {\n    throw new ConfigError(\"a help flag after the command is not allowed\");\n  }\n  return { positionals, help: helps.length > 0 };\n}\n\n/** Runs one command. Errors print as one line to stderr and exit 2; nothing echoes scanned text. */\nexport function runCli(argv: readonly string[], io: CliIo): number {\n  try {\n    const { positionals, help } = parseCommandLine(argv);\n    if (help) {\n      for (const line of USAGE) io.out(line);\n      return 0;\n    }\n    return dispatch(positionals[0], positionals.slice(1), io);\n  } catch (error) {\n    io.err(PREFIX + (error instanceof Error ? error.message : \"unexpected error\"));\n    if (error instanceof ConfigError) io.err(USAGE[0] ?? \"\");\n    return 2;\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { AllowFileError, EMPTY_ALLOW, parseAllow, type AllowList } from \"./allow.js\";\nimport type { TermRule } from \"./rules.js\";\nimport { parseTerms, TermFileError } from \"./terms.js\";\n\n/** A usage or configuration problem: exit 2. Messages never carry a term or scanned text. */\nexport class ConfigError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConfigError\";\n  }\n}\n\nexport interface LoadedTerms {\n  readonly terms: readonly TermRule[];\n  readonly loaded: boolean;\n  readonly notices: readonly string[];\n}\n\ntype Env = Readonly<Record<string, string | undefined>>;\n\nconst NOT_LOADED: LoadedTerms = { terms: [], loaded: false, notices: [] };\n\nexport function isCi(env: Env): boolean {\n  const value = env.CI?.toLowerCase();\n  return value !== undefined && value !== \"\" && value !== \"false\" && value !== \"0\";\n}\n\nexport function termFilePath(env: Env): string | undefined {\n  if (env.TITAN_EGRESS_TERMS) return env.TITAN_EGRESS_TERMS;\n  const configHome = env.XDG_CONFIG_HOME || (env.HOME && path.join(env.HOME, \".config\"));\n  return configHome ? path.join(configHome, \"titan-egress\", \"private-terms\") : undefined;\n}\n\nfunction readIfPresent(file: string, what: string): string | undefined {\n  try {\n    return fs.readFileSync(file, \"utf-8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new ConfigError(`${what} could not be read`);\n  }\n}\n\nfunction missingTerms(env: Env): LoadedTerms {\n  if (env.TITAN_EGRESS_REQUIRE_TERMS === \"1\") {\n    throw new ConfigError(\"private term list not found and TITAN_EGRESS_REQUIRE_TERMS=1\");\n  }\n  return { ...NOT_LOADED, notices: [\"private term list not found; generic rules only\"] };\n}\n\nfunction compileTerms(text: string): readonly TermRule[] {\n  try {\n    return parseTerms(text);\n  } catch (error) {\n    if (error instanceof TermFileError) throw new ConfigError(error.message);\n    throw error;\n  }\n}\n\n/** Loads the private term list. In CI it is never looked up; locally an absent file is a notice. */\nexport function loadTerms(env: Env): LoadedTerms {\n  if (isCi(env)) return NOT_LOADED;\n  const file = termFilePath(env);\n  const text = file === undefined ? undefined : readIfPresent(file, \"private term list\");\n  if (file === undefined || text === undefined) return missingTerms(env);\n  const openToOthers = process.platform !== \"win32\" && (fs.statSync(file).mode & 0o077) !== 0;\n  const notices = openToOthers ? [\"private term list is readable by other users; chmod 600 it\"] : [];\n  return { terms: compileTerms(text), loaded: true, notices };\n}\n\n/** Loads `.egress-allow` from the repo root. A malformed file fails the scan, never reads as empty. */\nexport function loadAllow(root: string): AllowList {\n  const text = readIfPresent(path.join(root, \".egress-allow\"), \".egress-allow\");\n  if (text === undefined) return EMPTY_ALLOW;\n  try {\n    return parseAllow(text);\n  } catch (error) {\n    if (error instanceof AllowFileError) throw new ConfigError(error.message);\n    throw error;\n  }\n}\n","import { spawnSync } from \"node:child_process\";\nimport * as path from \"node:path\";\nimport { ConfigError } from \"./config.js\";\nimport { parseCommit, parseDiff, type ScanSource } from \"./diff.js\";\n\n/** A git command that failed. The message names the subcommand, never git's output. */\nexport class GitError extends Error {\n  constructor(subcommand: string, status: number | null) {\n    super(`git ${subcommand} failed (exit ${status ?? \"signal\"}); run it by hand to see git's error`);\n    this.name = \"GitError\";\n  }\n}\n\nexport interface PushUpdate {\n  readonly localSha: string;\n  readonly remoteSha: string;\n}\n\n// Pinned so user config (prefixes, textconv, relative, external diff) cannot reshape the patch text.\nconst PATCH_FLAGS = [\n  \"-U0\",\n  \"--no-color\",\n  \"--no-ext-diff\",\n  \"--no-textconv\",\n  \"--no-relative\",\n  \"--src-prefix=a/\",\n  \"--dst-prefix=b/\",\n];\nconst MAX_BUFFER = 1024 * 1024 * 1024;\n// Every revision argument follows this, so a value that starts with a dash cannot become an option.\nconst END_OF_OPTIONS = \"--end-of-options\";\n\nconst FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;\nconst REVISION = /^(?:[0-9a-f]{7,64}|[^-\\s]\\S*)$/;\nconst REMOTE_NAME = /^[^-\\s]\\S*$/;\n\nexport function isFullSha(value: string): boolean {\n  return FULL_SHA.test(value);\n}\n\n/** A hex sha of 7 to 64 characters, or a ref name that cannot be read as an option. */\nexport function isRevision(value: string): boolean {\n  return REVISION.test(value);\n}\n\nexport function isRemoteName(value: string): boolean {\n  return REMOTE_NAME.test(value);\n}\n\nfunction requireRevision(value: string, what: string): void {\n  if (!isRevision(value)) throw new ConfigError(`${what} is not a sha or ref name`);\n}\n\nexport function git(cwd: string, args: readonly string[], input?: string): string {\n  const result = spawnSync(\"git\", args, { cwd, input, encoding: \"utf-8\", maxBuffer: MAX_BUFFER });\n  if (result.error) throw result.error;\n  if (result.status !== 0) throw new GitError(args[0] ?? \"\", result.status);\n  return result.stdout;\n}\n\nfunction lines(text: string): string[] {\n  return text.split(\"\\n\").filter((line) => line !== \"\");\n}\n\nexport function isZeroSha(sha: string): boolean {\n  return /^0+$/.test(sha);\n}\n\nexport function repoRoot(cwd: string): string {\n  return git(cwd, [\"rev-parse\", \"--show-toplevel\"]).trim();\n}\n\n/** Resolves the hooks directory as git does: `core.hooksPath` if set, else the common git dir's hooks. */\nexport function hooksDir(cwd: string): string {\n  return path.resolve(cwd, git(cwd, [\"rev-parse\", \"--git-path\", \"hooks\"]).trim());\n}\n\n/** Parses git's pre-push stdin: `<local-ref> <local-sha> <remote-ref> <remote-sha>` per line. */\nexport function parsePrePush(stdin: string): PushUpdate[] {\n  return lines(stdin).map((line, i) => {\n    const fields = line.trim().split(/\\s+/);\n    if (fields.length !== 4) throw new ConfigError(`pre-push stdin line ${i + 1}: expected four fields`);\n    for (const field of [1, 3]) {\n      if (!isFullSha(fields[field] ?? \"\")) {\n        throw new ConfigError(`pre-push stdin line ${i + 1}: field ${field + 1} is not a full sha`);\n      }\n    }\n    return { localSha: fields[1] ?? \"\", remoteSha: fields[3] ?? \"\" };\n  });\n}\n\nfunction hasCommit(cwd: string, sha: string): boolean {\n  return spawnSync(\"git\", [\"cat-file\", \"-e\", END_OF_OPTIONS, `${sha}^{commit}`], { cwd }).status === 0;\n}\n\n/** The commits one pushed ref update sends that the remote lacks, oldest first. */\nexport function commitsForUpdate(cwd: string, remote: string, update: PushUpdate): string[] {\n  if (isZeroSha(update.localSha)) return [];\n  if (!isFullSha(update.localSha) || !isFullSha(update.remoteSha)) throw new ConfigError(\"push update is not a full sha\");\n  if (!isRemoteName(remote)) throw new ConfigError(\"remote is not a remote name\");\n  const known = !isZeroSha(update.remoteSha) && hasCommit(cwd, update.remoteSha);\n  // The second `--not` flips back, so the local sha after it counts as included.\n  const range = known\n    ? [END_OF_OPTIONS, `${update.remoteSha}..${update.localSha}`]\n    : [\"--not\", `--remotes=${remote}`, \"--not\", END_OF_OPTIONS, update.localSha];\n  return lines(git(cwd, [\"rev-list\", \"--reverse\", ...range]));\n}\n\n/** The commits in `base..head`, oldest first; an all-zero base means `head` alone. */\nexport function commitsForRange(cwd: string, base: string, head: string): string[] {\n  requireRevision(base, \"range base\");\n  requireRevision(head, \"range head\");\n  if (isZeroSha(base)) return lines(git(cwd, [\"rev-list\", \"--no-walk\", END_OF_OPTIONS, head]));\n  return lines(git(cwd, [\"rev-list\", \"--reverse\", END_OF_OPTIONS, `${base}..${head}`]));\n}\n\n/** One commit's message and patch; `-c` makes a merge show the lines it brings in from any parent. */\nexport function readCommit(cwd: string, sha: string): ScanSource {\n  requireRevision(sha, \"commit\");\n  return parseCommit(sha, git(cwd, [\"show\", \"-c\", ...PATCH_FLAGS, \"--format=%B%x00\", END_OF_OPTIONS, sha]));\n}\n\n/** Every tracked file at HEAD, as one diff from the empty tree. */\nexport function readTree(cwd: string): ScanSource {\n  const emptyTree = git(cwd, [\"hash-object\", \"-t\", \"tree\", \"--stdin\"], \"\").trim();\n  return parseDiff(git(cwd, [\"diff\", ...PATCH_FLAGS, \"--no-renames\", END_OF_OPTIONS, emptyTree, \"HEAD\"]));\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { isCi } from \"./config.js\";\nimport { hooksDir } from \"./git.js\";\n\nexport const HOOK_MARKER = \"# titan-egress-scan managed pre-push hook\";\n\nexport type InstallOutcome = \"installed\" | \"updated\" | \"unchanged\" | \"skipped-in-ci\" | \"foreign-hook\";\n\nexport interface InstallResult {\n  readonly outcome: InstallOutcome;\n  readonly hookPath?: string;\n}\n\n/** The shipped hook body, one directory above both `src/` and `dist/`. */\nexport function hookBody(): string {\n  return fs.readFileSync(new URL(\"../hooks/pre-push\", import.meta.url), \"utf-8\");\n}\n\nfunction existing(hookPath: string): string | undefined {\n  return fs.existsSync(hookPath) ? fs.readFileSync(hookPath, \"utf-8\") : undefined;\n}\n\n/**\n * Writes the pre-push hook into git's hooks directory, which honours `core.hooksPath` and is\n * shared by every linked worktree. It never sets `core.hooksPath` and never replaces a hook it\n * did not write.\n */\nexport function installHook(cwd: string, env: Readonly<Record<string, string | undefined>>): InstallResult {\n  if (isCi(env)) return { outcome: \"skipped-in-ci\" };\n  const hookPath = path.join(hooksDir(cwd), \"pre-push\");\n  const body = hookBody();\n  const current = existing(hookPath);\n  if (current !== undefined && !current.includes(HOOK_MARKER)) return { outcome: \"foreign-hook\", hookPath };\n  if (current === body) return { outcome: \"unchanged\", hookPath };\n  fs.mkdirSync(path.dirname(hookPath), { recursive: true });\n  fs.writeFileSync(hookPath, body, { mode: 0o755 });\n  fs.chmodSync(hookPath, 0o755);\n  return { outcome: current === undefined ? \"installed\" : \"updated\", hookPath };\n}\n"],"mappings":";;;;;;;;;;;;;;AACA,YAAYA,SAAQ;;;ACDpB,SAAS,iBAAiB;;;ACA1B,YAAY,QAAQ;AACpB,YAAY,UAAU;AAMf,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAUA,IAAM,aAA0B,EAAE,OAAO,CAAC,GAAG,QAAQ,OAAO,SAAS,CAAC,EAAE;AAEjE,SAAS,KAAK,KAAmB;AACtC,QAAM,QAAQ,IAAI,IAAI,YAAY;AAClC,SAAO,UAAU,UAAa,UAAU,MAAM,UAAU,WAAW,UAAU;AAC/E;AAEO,SAAS,aAAa,KAA8B;AACzD,MAAI,IAAI,mBAAoB,QAAO,IAAI;AACvC,QAAM,aAAa,IAAI,mBAAoB,IAAI,QAAa,UAAK,IAAI,MAAM,SAAS;AACpF,SAAO,aAAkB,UAAK,YAAY,gBAAgB,eAAe,IAAI;AAC/E;AAEA,SAAS,cAAc,MAAc,MAAkC;AACrE,MAAI;AACF,WAAU,gBAAa,MAAM,OAAO;AAAA,EACtC,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM,IAAI,YAAY,GAAG,IAAI,oBAAoB;AAAA,EACnD;AACF;AAEA,SAAS,aAAa,KAAuB;AAC3C,MAAI,IAAI,+BAA+B,KAAK;AAC1C,UAAM,IAAI,YAAY,8DAA8D;AAAA,EACtF;AACA,SAAO,EAAE,GAAG,YAAY,SAAS,CAAC,iDAAiD,EAAE;AACvF;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI;AACF,WAAO,WAAW,IAAI;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,cAAe,OAAM,IAAI,YAAY,MAAM,OAAO;AACvE,UAAM;AAAA,EACR;AACF;AAGO,SAAS,UAAU,KAAuB;AAC/C,MAAI,KAAK,GAAG,EAAG,QAAO;AACtB,QAAM,OAAO,aAAa,GAAG;AAC7B,QAAM,OAAO,SAAS,SAAY,SAAY,cAAc,MAAM,mBAAmB;AACrF,MAAI,SAAS,UAAa,SAAS,OAAW,QAAO,aAAa,GAAG;AACrE,QAAM,eAAe,QAAQ,aAAa,YAAe,YAAS,IAAI,EAAE,OAAO,QAAW;AAC1F,QAAM,UAAU,eAAe,CAAC,4DAA4D,IAAI,CAAC;AACjG,SAAO,EAAE,OAAO,aAAa,IAAI,GAAG,QAAQ,MAAM,QAAQ;AAC5D;AAGO,SAAS,UAAU,MAAyB;AACjD,QAAM,OAAO,cAAmB,UAAK,MAAM,eAAe,GAAG,eAAe;AAC5E,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI;AACF,WAAO,WAAW,IAAI;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAgB,OAAM,IAAI,YAAY,MAAM,OAAO;AACxE,UAAM;AAAA,EACR;AACF;;;ACjFA,SAAS,iBAAiB;AAC1B,YAAYC,WAAU;AAKf,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YAAY,YAAoB,QAAuB;AACrD,UAAM,OAAO,UAAU,iBAAiB,UAAU,QAAQ,sCAAsC;AAChG,SAAK,OAAO;AAAA,EACd;AACF;AAQA,IAAM,cAAc;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,aAAa,OAAO,OAAO;AAEjC,IAAM,iBAAiB;AAEvB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,cAAc;AAEb,SAAS,UAAU,OAAwB;AAChD,SAAO,SAAS,KAAK,KAAK;AAC5B;AAGO,SAAS,WAAW,OAAwB;AACjD,SAAO,SAAS,KAAK,KAAK;AAC5B;AAEO,SAAS,aAAa,OAAwB;AACnD,SAAO,YAAY,KAAK,KAAK;AAC/B;AAEA,SAAS,gBAAgB,OAAe,MAAoB;AAC1D,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,YAAY,GAAG,IAAI,2BAA2B;AAClF;AAEO,SAAS,IAAI,KAAa,MAAyB,OAAwB;AAChF,QAAM,SAAS,UAAU,OAAO,MAAM,EAAE,KAAK,OAAO,UAAU,SAAS,WAAW,WAAW,CAAC;AAC9F,MAAI,OAAO,MAAO,OAAM,OAAO;AAC/B,MAAI,OAAO,WAAW,EAAG,OAAM,IAAI,SAAS,KAAK,CAAC,KAAK,IAAI,OAAO,MAAM;AACxE,SAAO,OAAO;AAChB;AAEA,SAAS,MAAM,MAAwB;AACrC,SAAO,KAAK,MAAM,IAAI,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AACtD;AAEO,SAAS,UAAU,KAAsB;AAC9C,SAAO,OAAO,KAAK,GAAG;AACxB;AAEO,SAAS,SAAS,KAAqB;AAC5C,SAAO,IAAI,KAAK,CAAC,aAAa,iBAAiB,CAAC,EAAE,KAAK;AACzD;AAGO,SAAS,SAAS,KAAqB;AAC5C,SAAY,cAAQ,KAAK,IAAI,KAAK,CAAC,aAAa,cAAc,OAAO,CAAC,EAAE,KAAK,CAAC;AAChF;AAGO,SAAS,aAAa,OAA6B;AACxD,SAAO,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,MAAM;AACnC,UAAM,SAAS,KAAK,KAAK,EAAE,MAAM,KAAK;AACtC,QAAI,OAAO,WAAW,EAAG,OAAM,IAAI,YAAY,uBAAuB,IAAI,CAAC,wBAAwB;AACnG,eAAW,SAAS,CAAC,GAAG,CAAC,GAAG;AAC1B,UAAI,CAAC,UAAU,OAAO,KAAK,KAAK,EAAE,GAAG;AACnC,cAAM,IAAI,YAAY,uBAAuB,IAAI,CAAC,WAAW,QAAQ,CAAC,oBAAoB;AAAA,MAC5F;AAAA,IACF;AACA,WAAO,EAAE,UAAU,OAAO,CAAC,KAAK,IAAI,WAAW,OAAO,CAAC,KAAK,GAAG;AAAA,EACjE,CAAC;AACH;AAEA,SAAS,UAAU,KAAa,KAAsB;AACpD,SAAO,UAAU,OAAO,CAAC,YAAY,MAAM,gBAAgB,GAAG,GAAG,WAAW,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW;AACrG;AAGO,SAAS,iBAAiB,KAAa,QAAgB,QAA8B;AAC1F,MAAI,UAAU,OAAO,QAAQ,EAAG,QAAO,CAAC;AACxC,MAAI,CAAC,UAAU,OAAO,QAAQ,KAAK,CAAC,UAAU,OAAO,SAAS,EAAG,OAAM,IAAI,YAAY,+BAA+B;AACtH,MAAI,CAAC,aAAa,MAAM,EAAG,OAAM,IAAI,YAAY,6BAA6B;AAC9E,QAAM,QAAQ,CAAC,UAAU,OAAO,SAAS,KAAK,UAAU,KAAK,OAAO,SAAS;AAE7E,QAAM,QAAQ,QACV,CAAC,gBAAgB,GAAG,OAAO,SAAS,KAAK,OAAO,QAAQ,EAAE,IAC1D,CAAC,SAAS,aAAa,MAAM,IAAI,SAAS,gBAAgB,OAAO,QAAQ;AAC7E,SAAO,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,GAAG,KAAK,CAAC,CAAC;AAC5D;AAGO,SAAS,gBAAgB,KAAa,MAAc,MAAwB;AACjF,kBAAgB,MAAM,YAAY;AAClC,kBAAgB,MAAM,YAAY;AAClC,MAAI,UAAU,IAAI,EAAG,QAAO,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,gBAAgB,IAAI,CAAC,CAAC;AAC3F,SAAO,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,gBAAgB,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;AACtF;AAGO,SAAS,WAAW,KAAa,KAAyB;AAC/D,kBAAgB,KAAK,QAAQ;AAC7B,SAAO,YAAY,KAAK,IAAI,KAAK,CAAC,QAAQ,MAAM,GAAG,aAAa,mBAAmB,gBAAgB,GAAG,CAAC,CAAC;AAC1G;AAGO,SAAS,SAAS,KAAyB;AAChD,QAAM,YAAY,IAAI,KAAK,CAAC,eAAe,MAAM,QAAQ,SAAS,GAAG,EAAE,EAAE,KAAK;AAC9E,SAAO,UAAU,IAAI,KAAK,CAAC,QAAQ,GAAG,aAAa,gBAAgB,gBAAgB,WAAW,MAAM,CAAC,CAAC;AACxG;;;AC9HA,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AAIf,IAAM,cAAc;AAUpB,SAAS,WAAmB;AACjC,SAAU,iBAAa,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,OAAO;AAC/E;AAEA,SAAS,SAAS,UAAsC;AACtD,SAAU,eAAW,QAAQ,IAAO,iBAAa,UAAU,OAAO,IAAI;AACxE;AAOO,SAAS,YAAY,KAAa,KAAkE;AACzG,MAAI,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,gBAAgB;AACjD,QAAM,WAAgB,WAAK,SAAS,GAAG,GAAG,UAAU;AACpD,QAAM,OAAO,SAAS;AACtB,QAAM,UAAU,SAAS,QAAQ;AACjC,MAAI,YAAY,UAAa,CAAC,QAAQ,SAAS,WAAW,EAAG,QAAO,EAAE,SAAS,gBAAgB,SAAS;AACxG,MAAI,YAAY,KAAM,QAAO,EAAE,SAAS,aAAa,SAAS;AAC9D,EAAG,cAAe,cAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,EAAG,kBAAc,UAAU,MAAM,EAAE,MAAM,IAAM,CAAC;AAChD,EAAG,cAAU,UAAU,GAAK;AAC5B,SAAO,EAAE,SAAS,YAAY,SAAY,cAAc,WAAW,SAAS;AAC9E;;;AHdA,IAAM,QAAQ;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,SAAS;AAEf,SAAS,YAAY,MAAc,MAAuC;AACxE,SAAO,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,WAAW,MAAM,GAAG,CAAC;AAC9D;AAEA,SAAS,eAAe,MAAc,QAAgB,OAA6B;AACjF,QAAM,UAAU,aAAa,KAAK;AAClC,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,QAAQ,CAAC,WAAW,iBAAiB,MAAM,QAAQ,MAAM,CAAC;AAAA,EACpE;AACF;AAEA,SAAS,QAAQ,IAAW,SAAiD;AAC3E,QAAM,OAAO,SAAS,GAAG,GAAG;AAC5B,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,EAAE,OAAO,QAAQ,QAAQ,IAAI,UAAU,GAAG,GAAG;AACnD,aAAW,UAAU,QAAS,IAAG,IAAI,SAAS,MAAM;AACpD,QAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,EAAE,OAAO,MAAM,CAAC;AACnD,aAAW,QAAQ,aAAa,OAAO,UAAU,EAAE,GAAG,QAAQ,aAAa,OAAO,CAAC,EAAG,IAAG,IAAI,IAAI;AACjG,SAAO,OAAO,SAAS,SAAS,IAAI,IAAI;AAC1C;AAEA,IAAM,mBAA6D;AAAA,EACjE,WAAW;AAAA,EACX,SAAS;AAAA,EACT,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,gBAAgB;AAClB;AAEA,SAAS,WAAW,IAAmB;AACrC,QAAM,SAAS,YAAY,GAAG,KAAK,GAAG,GAAG;AACzC,QAAM,QAAQ,OAAO,aAAa,SAAY,KAAK,KAAK,OAAO,QAAQ;AACvE,MAAI,OAAO,YAAY,gBAAgB;AACrC,OAAG,IAAI,SAAS,iBAAiB,OAAO,OAAO,IAAI,KAAK;AACxD,WAAO;AAAA,EACT;AACA,KAAG,IAAI,SAAS,iBAAiB,OAAO,OAAO,IAAI,KAAK;AACxD,KAAG,IAAI,SAAS,kGAAkG;AAClH,SAAO;AACT;AAEA,SAAS,WAAW,SAAiB,MAAyB,KAAa,KAAmB;AAC5F,MAAI,KAAK,SAAS,OAAO,KAAK,SAAS,IAAK,OAAM,IAAI,YAAY,GAAG,OAAO,6BAA6B;AAC3G;AAGA,SAAS,YAAY,SAAiB,MAAyB,OAAmC,MAAoB;AACpH,OAAK,QAAQ,CAAC,OAAO,MAAM;AACzB,QAAI,CAAC,MAAM,KAAK,EAAG,OAAM,IAAI,YAAY,GAAG,OAAO,cAAc,IAAI,CAAC,WAAW,IAAI,EAAE;AAAA,EACzF,CAAC;AACH;AAEA,SAAS,SAAS,SAA6B,MAAyB,IAAmB;AACzF,UAAQ,SAAS;AAAA,IACf,KAAK;AAEH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,kBAAY,SAAS,KAAK,MAAM,GAAG,CAAC,GAAG,cAAc,eAAe;AACpE,aAAO,QAAQ,IAAI,CAAC,SAAS,eAAe,MAAM,KAAK,CAAC,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC;AAAA,IAClF,KAAK;AACH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,kBAAY,SAAS,MAAM,YAAY,mBAAmB;AAC1D,aAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,MAAM,gBAAgB,MAAM,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAAA,IACrG,KAAK;AACH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,aAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC;AAAA,IAC/C,KAAK;AACH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,aAAO,WAAW,EAAE;AAAA,IACtB;AACE,YAAM,IAAI,YAAY,YAAY,SAAY,oBAAoB,iBAAiB;AAAA,EACvF;AACF;AAGA,SAAS,iBAAiB,MAAmE;AAC3F,QAAM,EAAE,aAAa,OAAO,IAAI,UAAU;AAAA,IACxC,MAAM,CAAC,GAAG,IAAI;AAAA,IACd,kBAAkB;AAAA,IAClB,QAAQ;AAAA,IACR,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,OAAO,IAAI,EAAE;AAAA,EACnD,CAAC;AACD,QAAM,UAAU,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,YAAY;AAClE,QAAM,QAAQ,OAAO,OAAO,CAAC,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,MAAM;AACvF,MAAI,MAAM,KAAK,CAAC,UAAU,YAAY,UAAa,MAAM,QAAQ,QAAQ,KAAK,GAAG;AAC/E,UAAM,IAAI,YAAY,8CAA8C;AAAA,EACtE;AACA,SAAO,EAAE,aAAa,MAAM,MAAM,SAAS,EAAE;AAC/C;AAGO,SAAS,OAAO,MAAyB,IAAmB;AACjE,MAAI;AACF,UAAM,EAAE,aAAa,KAAK,IAAI,iBAAiB,IAAI;AACnD,QAAI,MAAM;AACR,iBAAW,QAAQ,MAAO,IAAG,IAAI,IAAI;AACrC,aAAO;AAAA,IACT;AACA,WAAO,SAAS,YAAY,CAAC,GAAG,YAAY,MAAM,CAAC,GAAG,EAAE;AAAA,EAC1D,SAAS,OAAO;AACd,OAAG,IAAI,UAAU,iBAAiB,QAAQ,MAAM,UAAU,mBAAmB;AAC7E,QAAI,iBAAiB,YAAa,IAAG,IAAI,MAAM,CAAC,KAAK,EAAE;AACvD,WAAO;AAAA,EACT;AACF;;;ADzIA,QAAQ,WAAW,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAG;AAAA,EAC/C,KAAK,QAAQ,IAAI;AAAA,EACjB,KAAK,QAAQ;AAAA,EACb,WAAW,MAAS,iBAAa,GAAG,OAAO;AAAA,EAC3C,KAAK,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAAA,EAC/C,KAAK,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AACjD,CAAC;","names":["fs","path","fs","path"]}
+{"version":3,"sources":["../src/bin.ts","../src/cli.ts","../src/config.ts","../src/git.ts","../src/install.ts"],"sourcesContent":["#!/usr/bin/env node\nimport * as fs from \"node:fs\";\nimport { runCli } from \"./cli.js\";\n\nprocess.exitCode = runCli(process.argv.slice(2), {\n  cwd: process.cwd(),\n  env: process.env,\n  readStdin: () => fs.readFileSync(0, \"utf-8\"),\n  out: (line) => process.stdout.write(`${line}\\n`),\n  err: (line) => process.stderr.write(`${line}\\n`),\n});\n","import { parseArgs } from \"node:util\";\nimport { ConfigError, loadAllow, loadTerms } from \"./config.js\";\nimport type { ScanSource } from \"./diff.js\";\nimport {\n  commitsForRange,\n  commitsForUpdate,\n  isRemoteName,\n  isRevision,\n  parsePrePush,\n  readCommit,\n  readTree,\n  repoRoot,\n} from \"./git.js\";\nimport { installHook, type InstallResult } from \"./install.js\";\nimport { formatReport } from \"./report.js\";\nimport { scan } from \"./scan.js\";\n\nexport interface CliIo {\n  readonly cwd: string;\n  readonly env: Readonly<Record<string, string | undefined>>;\n  readStdin(): string;\n  out(line: string): void;\n  err(line: string): void;\n}\n\nconst USAGE = [\n  \"usage: titan-egress-scan <command>\",\n  \"  pre-push <remote>     scan the commits a push sends (reads git's pre-push stdin)\",\n  \"  range <base> <head>   scan every commit in base..head (CI)\",\n  \"  tree                  scan every tracked file at HEAD\",\n  \"  install-hook          install the pre-push hook into git's hooks directory\",\n  \"exit: 0 clean, 1 findings, 2 usage or configuration error\",\n];\n\nconst PREFIX = \"titan-egress-scan: \";\n\nfunction readCommits(root: string, shas: readonly string[]): ScanSource[] {\n  return [...new Set(shas)].map((sha) => readCommit(root, sha));\n}\n\nfunction prePushSources(root: string, remote: string, stdin: string): ScanSource[] {\n  const updates = parsePrePush(stdin);\n  return readCommits(\n    root,\n    updates.flatMap((update) => commitsForUpdate(root, remote, update)),\n  );\n}\n\nfunction runScan(io: CliIo, collect: (root: string) => ScanSource[]): number {\n  const root = repoRoot(io.cwd);\n  const allow = loadAllow(root);\n  const { terms, loaded, notices } = loadTerms(io.env);\n  for (const notice of notices) io.err(PREFIX + notice);\n  const result = scan(collect(root), { terms, allow });\n  for (const line of formatReport(result.findings, { ...result, termsLoaded: loaded })) io.out(line);\n  return result.findings.length > 0 ? 1 : 0;\n}\n\nconst INSTALL_MESSAGES: Record<InstallResult[\"outcome\"], string> = {\n  installed: \"pre-push hook installed\",\n  updated: \"pre-push hook updated\",\n  unchanged: \"pre-push hook already installed\",\n  \"skipped-in-ci\": \"CI detected; hook not installed\",\n  \"foreign-hook\": \"an existing pre-push hook was not written by this tool; left it in place.\",\n};\n\nfunction runInstall(io: CliIo): number {\n  const result = installHook(io.cwd, io.env);\n  const where = result.hookPath === undefined ? \"\" : ` (${result.hookPath})`;\n  if (result.outcome !== \"foreign-hook\") {\n    io.out(PREFIX + INSTALL_MESSAGES[result.outcome] + where);\n    return 0;\n  }\n  io.err(PREFIX + INSTALL_MESSAGES[result.outcome] + where);\n  io.err(PREFIX + 'chain it: call `titan-egress-scan pre-push \"$1\"` from that hook with git\\'s stdin passed through');\n  return 2;\n}\n\nfunction expectArgs(command: string, args: readonly string[], min: number, max: number): void {\n  if (args.length < min || args.length > max) throw new ConfigError(`${command}: wrong number of arguments`);\n}\n\n/** Rejects a value by its position only, so the message never repeats what was passed. */\nfunction expectValid(command: string, args: readonly string[], valid: (value: string) => boolean, what: string): void {\n  args.forEach((value, i) => {\n    if (!valid(value)) throw new ConfigError(`${command}: argument ${i + 1} is not ${what}`);\n  });\n}\n\nfunction dispatch(command: string | undefined, args: readonly string[], io: CliIo): number {\n  switch (command) {\n    case \"pre-push\":\n      // git passes the remote name and its URL; only the name is used.\n      expectArgs(command, args, 1, 2);\n      expectValid(command, args.slice(0, 1), isRemoteName, \"a remote name\");\n      return runScan(io, (root) => prePushSources(root, args[0] ?? \"\", io.readStdin()));\n    case \"range\":\n      expectArgs(command, args, 2, 2);\n      expectValid(command, args, isRevision, \"a sha or ref name\");\n      return runScan(io, (root) => readCommits(root, commitsForRange(root, args[0] ?? \"\", args[1] ?? \"\")));\n    case \"tree\":\n      expectArgs(command, args, 0, 0);\n      return runScan(io, (root) => [readTree(root)]);\n    case \"install-hook\":\n      expectArgs(command, args, 0, 0);\n      return runInstall(io);\n    default:\n      throw new ConfigError(command === undefined ? \"missing command\" : \"unknown command\");\n  }\n}\n\n/** Help counts only before the command; after it, a help flag is a usage error, never a skipped scan. */\nfunction parseCommandLine(argv: readonly string[]): { positionals: string[]; help: boolean } {\n  const { positionals, tokens } = parseArgs({\n    args: [...argv],\n    allowPositionals: true,\n    tokens: true,\n    options: { help: { type: \"boolean\", short: \"h\" } },\n  });\n  const command = tokens.find((token) => token.kind === \"positional\");\n  const helps = tokens.filter((token) => token.kind === \"option\" && token.name === \"help\");\n  if (helps.some((token) => command !== undefined && token.index > command.index)) {\n    throw new ConfigError(\"a help flag after the command is not allowed\");\n  }\n  return { positionals, help: helps.length > 0 };\n}\n\n/** Runs one command. Errors print as one line to stderr and exit 2; nothing echoes scanned text. */\nexport function runCli(argv: readonly string[], io: CliIo): number {\n  try {\n    const { positionals, help } = parseCommandLine(argv);\n    if (help) {\n      for (const line of USAGE) io.out(line);\n      return 0;\n    }\n    return dispatch(positionals[0], positionals.slice(1), io);\n  } catch (error) {\n    io.err(PREFIX + (error instanceof Error ? error.message : \"unexpected error\"));\n    if (error instanceof ConfigError) io.err(USAGE[0] ?? \"\");\n    return 2;\n  }\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { AllowFileError, EMPTY_ALLOW, parseAllow, type AllowList } from \"./allow.js\";\nimport type { TermRule } from \"./rules.js\";\nimport { parseTerms, TermFileError } from \"./terms.js\";\n\n/** A usage or configuration problem: exit 2. Messages never carry a term or scanned text. */\nexport class ConfigError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ConfigError\";\n  }\n}\n\nexport interface LoadedTerms {\n  readonly terms: readonly TermRule[];\n  readonly loaded: boolean;\n  readonly notices: readonly string[];\n}\n\ntype Env = Readonly<Record<string, string | undefined>>;\n\nconst NOT_LOADED: LoadedTerms = { terms: [], loaded: false, notices: [] };\n\nexport function isCi(env: Env): boolean {\n  const value = env.CI?.toLowerCase();\n  return value !== undefined && value !== \"\" && value !== \"false\" && value !== \"0\";\n}\n\nexport function termFilePath(env: Env): string | undefined {\n  if (env.TITAN_EGRESS_TERMS) return env.TITAN_EGRESS_TERMS;\n  const configHome = env.XDG_CONFIG_HOME || (env.HOME && path.join(env.HOME, \".config\"));\n  return configHome ? path.join(configHome, \"titan-egress\", \"private-terms\") : undefined;\n}\n\nfunction readIfPresent(file: string, what: string): string | undefined {\n  try {\n    return fs.readFileSync(file, \"utf-8\");\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return undefined;\n    throw new ConfigError(`${what} could not be read`);\n  }\n}\n\nconst ON_VALUES = new Set([\"1\", \"true\", \"yes\", \"on\"]);\nconst OFF_VALUES = new Set([\"\", \"0\", \"false\", \"no\", \"off\"]);\n\n/** An unrecognised value fails the scan: a typo must never read as off. The value is not echoed. */\nfunction requiresTerms(env: Env): boolean {\n  const value = (env.TITAN_EGRESS_REQUIRE_TERMS ?? \"\").trim().toLowerCase();\n  if (ON_VALUES.has(value)) return true;\n  if (OFF_VALUES.has(value)) return false;\n  throw new ConfigError(\"TITAN_EGRESS_REQUIRE_TERMS is not one of 1, true, yes, on, 0, false, no, off\");\n}\n\nfunction readTermFile(file: string, required: boolean): string | undefined {\n  try {\n    return readIfPresent(file, \"private term list\");\n  } catch (error) {\n    if (required && error instanceof ConfigError) {\n      throw new ConfigError(\"private term list could not be read and TITAN_EGRESS_REQUIRE_TERMS=1\");\n    }\n    throw error;\n  }\n}\n\nfunction missingTerms(required: boolean): LoadedTerms {\n  if (required) {\n    throw new ConfigError(\"private term list not found and TITAN_EGRESS_REQUIRE_TERMS=1\");\n  }\n  return { ...NOT_LOADED, notices: [\"private term list not found; generic rules only\"] };\n}\n\nfunction compileTerms(text: string): readonly TermRule[] {\n  try {\n    return parseTerms(text);\n  } catch (error) {\n    if (error instanceof TermFileError) throw new ConfigError(error.message);\n    throw error;\n  }\n}\n\n/**\n * Loads the private term list. In CI it is never looked up and an absent file is a notice, unless\n * TITAN_EGRESS_REQUIRE_TERMS=1, which always loads and fails on a missing, unreadable or empty list.\n */\nexport function loadTerms(env: Env): LoadedTerms {\n  const required = requiresTerms(env);\n  if (isCi(env) && !required) return NOT_LOADED;\n  const file = termFilePath(env);\n  const text = file === undefined ? undefined : readTermFile(file, required);\n  if (file === undefined || text === undefined) return missingTerms(required);\n  const openToOthers = process.platform !== \"win32\" && (fs.statSync(file).mode & 0o077) !== 0;\n  const notices = openToOthers ? [\"private term list is readable by other users; chmod 600 it\"] : [];\n  const terms = compileTerms(text);\n  if (terms.length === 0 && required) {\n    throw new ConfigError(\"private term list holds no terms and TITAN_EGRESS_REQUIRE_TERMS=1\");\n  }\n  return { terms, loaded: true, notices };\n}\n\n/** Loads `.egress-allow` from the repo root. A malformed file fails the scan, never reads as empty. */\nexport function loadAllow(root: string): AllowList {\n  const text = readIfPresent(path.join(root, \".egress-allow\"), \".egress-allow\");\n  if (text === undefined) return EMPTY_ALLOW;\n  try {\n    return parseAllow(text);\n  } catch (error) {\n    if (error instanceof AllowFileError) throw new ConfigError(error.message);\n    throw error;\n  }\n}\n","import { spawnSync } from \"node:child_process\";\nimport * as path from \"node:path\";\nimport { ConfigError } from \"./config.js\";\nimport { parseCommit, parseDiff, type ScanSource } from \"./diff.js\";\n\n/** A git command that failed. The message names the subcommand, never git's output. */\nexport class GitError extends Error {\n  constructor(subcommand: string, status: number | null) {\n    super(`git ${subcommand} failed (exit ${status ?? \"signal\"}); run it by hand to see git's error`);\n    this.name = \"GitError\";\n  }\n}\n\nexport interface PushUpdate {\n  readonly localSha: string;\n  readonly remoteSha: string;\n}\n\n// Pinned so user config (prefixes, textconv, relative, external diff) cannot reshape the patch text.\nconst PATCH_FLAGS = [\n  \"-U0\",\n  \"--no-color\",\n  \"--no-ext-diff\",\n  \"--no-textconv\",\n  \"--no-relative\",\n  \"--src-prefix=a/\",\n  \"--dst-prefix=b/\",\n];\nconst MAX_BUFFER = 1024 * 1024 * 1024;\n// Every revision argument follows this, so a value that starts with a dash cannot become an option.\nconst END_OF_OPTIONS = \"--end-of-options\";\n\nconst FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;\nconst REVISION = /^(?:[0-9a-f]{7,64}|[^-\\s]\\S*)$/;\nconst REMOTE_NAME = /^[^-\\s]\\S*$/;\n\nexport function isFullSha(value: string): boolean {\n  return FULL_SHA.test(value);\n}\n\n/** A hex sha of 7 to 64 characters, or a ref name that cannot be read as an option. */\nexport function isRevision(value: string): boolean {\n  return REVISION.test(value);\n}\n\nexport function isRemoteName(value: string): boolean {\n  return REMOTE_NAME.test(value);\n}\n\nfunction requireRevision(value: string, what: string): void {\n  if (!isRevision(value)) throw new ConfigError(`${what} is not a sha or ref name`);\n}\n\nexport function git(cwd: string, args: readonly string[], input?: string): string {\n  const result = spawnSync(\"git\", args, { cwd, input, encoding: \"utf-8\", maxBuffer: MAX_BUFFER });\n  if (result.error) throw result.error;\n  if (result.status !== 0) throw new GitError(args[0] ?? \"\", result.status);\n  return result.stdout;\n}\n\nfunction lines(text: string): string[] {\n  return text.split(\"\\n\").filter((line) => line !== \"\");\n}\n\nexport function isZeroSha(sha: string): boolean {\n  return /^0+$/.test(sha);\n}\n\nexport function repoRoot(cwd: string): string {\n  return git(cwd, [\"rev-parse\", \"--show-toplevel\"]).trim();\n}\n\n/** Resolves the hooks directory as git does: `core.hooksPath` if set, else the common git dir's hooks. */\nexport function hooksDir(cwd: string): string {\n  return path.resolve(cwd, git(cwd, [\"rev-parse\", \"--git-path\", \"hooks\"]).trim());\n}\n\n/** Parses git's pre-push stdin: `<local-ref> <local-sha> <remote-ref> <remote-sha>` per line. */\nexport function parsePrePush(stdin: string): PushUpdate[] {\n  return lines(stdin).map((line, i) => {\n    const fields = line.trim().split(/\\s+/);\n    if (fields.length !== 4) throw new ConfigError(`pre-push stdin line ${i + 1}: expected four fields`);\n    for (const field of [1, 3]) {\n      if (!isFullSha(fields[field] ?? \"\")) {\n        throw new ConfigError(`pre-push stdin line ${i + 1}: field ${field + 1} is not a full sha`);\n      }\n    }\n    return { localSha: fields[1] ?? \"\", remoteSha: fields[3] ?? \"\" };\n  });\n}\n\nfunction hasCommit(cwd: string, sha: string): boolean {\n  return spawnSync(\"git\", [\"cat-file\", \"-e\", END_OF_OPTIONS, `${sha}^{commit}`], { cwd }).status === 0;\n}\n\n/** The commits one pushed ref update sends that the remote lacks, oldest first. */\nexport function commitsForUpdate(cwd: string, remote: string, update: PushUpdate): string[] {\n  if (isZeroSha(update.localSha)) return [];\n  if (!isFullSha(update.localSha) || !isFullSha(update.remoteSha)) throw new ConfigError(\"push update is not a full sha\");\n  if (!isRemoteName(remote)) throw new ConfigError(\"remote is not a remote name\");\n  const known = !isZeroSha(update.remoteSha) && hasCommit(cwd, update.remoteSha);\n  // The second `--not` flips back, so the local sha after it counts as included.\n  const range = known\n    ? [END_OF_OPTIONS, `${update.remoteSha}..${update.localSha}`]\n    : [\"--not\", `--remotes=${remote}`, \"--not\", END_OF_OPTIONS, update.localSha];\n  return lines(git(cwd, [\"rev-list\", \"--reverse\", ...range]));\n}\n\n/** The commits in `base..head`, oldest first; an all-zero base means `head` alone. */\nexport function commitsForRange(cwd: string, base: string, head: string): string[] {\n  requireRevision(base, \"range base\");\n  requireRevision(head, \"range head\");\n  if (isZeroSha(base)) return lines(git(cwd, [\"rev-list\", \"--no-walk\", END_OF_OPTIONS, head]));\n  return lines(git(cwd, [\"rev-list\", \"--reverse\", END_OF_OPTIONS, `${base}..${head}`]));\n}\n\n/** One commit's message and patch; `-c` makes a merge show the lines it brings in from any parent. */\nexport function readCommit(cwd: string, sha: string): ScanSource {\n  requireRevision(sha, \"commit\");\n  return parseCommit(sha, git(cwd, [\"show\", \"-c\", ...PATCH_FLAGS, \"--format=%B%x00\", END_OF_OPTIONS, sha]));\n}\n\n/** Every tracked file at HEAD, as one diff from the empty tree. */\nexport function readTree(cwd: string): ScanSource {\n  const emptyTree = git(cwd, [\"hash-object\", \"-t\", \"tree\", \"--stdin\"], \"\").trim();\n  return parseDiff(git(cwd, [\"diff\", ...PATCH_FLAGS, \"--no-renames\", END_OF_OPTIONS, emptyTree, \"HEAD\"]));\n}\n","import * as fs from \"node:fs\";\nimport * as path from \"node:path\";\nimport { isCi } from \"./config.js\";\nimport { hooksDir } from \"./git.js\";\n\nexport const HOOK_MARKER = \"# titan-egress-scan managed pre-push hook\";\n\nexport type InstallOutcome = \"installed\" | \"updated\" | \"unchanged\" | \"skipped-in-ci\" | \"foreign-hook\";\n\nexport interface InstallResult {\n  readonly outcome: InstallOutcome;\n  readonly hookPath?: string;\n}\n\n/** The shipped hook body, one directory above both `src/` and `dist/`. */\nexport function hookBody(): string {\n  return fs.readFileSync(new URL(\"../hooks/pre-push\", import.meta.url), \"utf-8\");\n}\n\nfunction existing(hookPath: string): string | undefined {\n  return fs.existsSync(hookPath) ? fs.readFileSync(hookPath, \"utf-8\") : undefined;\n}\n\n/**\n * Writes the pre-push hook into git's hooks directory, which honours `core.hooksPath` and is\n * shared by every linked worktree. It never sets `core.hooksPath` and never replaces a hook it\n * did not write.\n */\nexport function installHook(cwd: string, env: Readonly<Record<string, string | undefined>>): InstallResult {\n  if (isCi(env)) return { outcome: \"skipped-in-ci\" };\n  const hookPath = path.join(hooksDir(cwd), \"pre-push\");\n  const body = hookBody();\n  const current = existing(hookPath);\n  if (current !== undefined && !current.includes(HOOK_MARKER)) return { outcome: \"foreign-hook\", hookPath };\n  if (current === body) return { outcome: \"unchanged\", hookPath };\n  fs.mkdirSync(path.dirname(hookPath), { recursive: true });\n  fs.writeFileSync(hookPath, body, { mode: 0o755 });\n  fs.chmodSync(hookPath, 0o755);\n  return { outcome: current === undefined ? \"installed\" : \"updated\", hookPath };\n}\n"],"mappings":";;;;;;;;;;;;;;AACA,YAAYA,SAAQ;;;ACDpB,SAAS,iBAAiB;;;ACA1B,YAAY,QAAQ;AACpB,YAAY,UAAU;AAMf,IAAM,cAAN,cAA0B,MAAM;AAAA,EACrC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAUA,IAAM,aAA0B,EAAE,OAAO,CAAC,GAAG,QAAQ,OAAO,SAAS,CAAC,EAAE;AAEjE,SAAS,KAAK,KAAmB;AACtC,QAAM,QAAQ,IAAI,IAAI,YAAY;AAClC,SAAO,UAAU,UAAa,UAAU,MAAM,UAAU,WAAW,UAAU;AAC/E;AAEO,SAAS,aAAa,KAA8B;AACzD,MAAI,IAAI,mBAAoB,QAAO,IAAI;AACvC,QAAM,aAAa,IAAI,mBAAoB,IAAI,QAAa,UAAK,IAAI,MAAM,SAAS;AACpF,SAAO,aAAkB,UAAK,YAAY,gBAAgB,eAAe,IAAI;AAC/E;AAEA,SAAS,cAAc,MAAc,MAAkC;AACrE,MAAI;AACF,WAAU,gBAAa,MAAM,OAAO;AAAA,EACtC,SAAS,OAAO;AACd,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM,IAAI,YAAY,GAAG,IAAI,oBAAoB;AAAA,EACnD;AACF;AAEA,IAAM,YAAY,oBAAI,IAAI,CAAC,KAAK,QAAQ,OAAO,IAAI,CAAC;AACpD,IAAM,aAAa,oBAAI,IAAI,CAAC,IAAI,KAAK,SAAS,MAAM,KAAK,CAAC;AAG1D,SAAS,cAAc,KAAmB;AACxC,QAAM,SAAS,IAAI,8BAA8B,IAAI,KAAK,EAAE,YAAY;AACxE,MAAI,UAAU,IAAI,KAAK,EAAG,QAAO;AACjC,MAAI,WAAW,IAAI,KAAK,EAAG,QAAO;AAClC,QAAM,IAAI,YAAY,8EAA8E;AACtG;AAEA,SAAS,aAAa,MAAc,UAAuC;AACzE,MAAI;AACF,WAAO,cAAc,MAAM,mBAAmB;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,YAAY,iBAAiB,aAAa;AAC5C,YAAM,IAAI,YAAY,sEAAsE;AAAA,IAC9F;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,aAAa,UAAgC;AACpD,MAAI,UAAU;AACZ,UAAM,IAAI,YAAY,8DAA8D;AAAA,EACtF;AACA,SAAO,EAAE,GAAG,YAAY,SAAS,CAAC,iDAAiD,EAAE;AACvF;AAEA,SAAS,aAAa,MAAmC;AACvD,MAAI;AACF,WAAO,WAAW,IAAI;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,cAAe,OAAM,IAAI,YAAY,MAAM,OAAO;AACvE,UAAM;AAAA,EACR;AACF;AAMO,SAAS,UAAU,KAAuB;AAC/C,QAAM,WAAW,cAAc,GAAG;AAClC,MAAI,KAAK,GAAG,KAAK,CAAC,SAAU,QAAO;AACnC,QAAM,OAAO,aAAa,GAAG;AAC7B,QAAM,OAAO,SAAS,SAAY,SAAY,aAAa,MAAM,QAAQ;AACzE,MAAI,SAAS,UAAa,SAAS,OAAW,QAAO,aAAa,QAAQ;AAC1E,QAAM,eAAe,QAAQ,aAAa,YAAe,YAAS,IAAI,EAAE,OAAO,QAAW;AAC1F,QAAM,UAAU,eAAe,CAAC,4DAA4D,IAAI,CAAC;AACjG,QAAM,QAAQ,aAAa,IAAI;AAC/B,MAAI,MAAM,WAAW,KAAK,UAAU;AAClC,UAAM,IAAI,YAAY,mEAAmE;AAAA,EAC3F;AACA,SAAO,EAAE,OAAO,QAAQ,MAAM,QAAQ;AACxC;AAGO,SAAS,UAAU,MAAyB;AACjD,QAAM,OAAO,cAAmB,UAAK,MAAM,eAAe,GAAG,eAAe;AAC5E,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI;AACF,WAAO,WAAW,IAAI;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,iBAAiB,eAAgB,OAAM,IAAI,YAAY,MAAM,OAAO;AACxE,UAAM;AAAA,EACR;AACF;;;AC/GA,SAAS,iBAAiB;AAC1B,YAAYC,WAAU;AAKf,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YAAY,YAAoB,QAAuB;AACrD,UAAM,OAAO,UAAU,iBAAiB,UAAU,QAAQ,sCAAsC;AAChG,SAAK,OAAO;AAAA,EACd;AACF;AAQA,IAAM,cAAc;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,aAAa,OAAO,OAAO;AAEjC,IAAM,iBAAiB;AAEvB,IAAM,WAAW;AACjB,IAAM,WAAW;AACjB,IAAM,cAAc;AAEb,SAAS,UAAU,OAAwB;AAChD,SAAO,SAAS,KAAK,KAAK;AAC5B;AAGO,SAAS,WAAW,OAAwB;AACjD,SAAO,SAAS,KAAK,KAAK;AAC5B;AAEO,SAAS,aAAa,OAAwB;AACnD,SAAO,YAAY,KAAK,KAAK;AAC/B;AAEA,SAAS,gBAAgB,OAAe,MAAoB;AAC1D,MAAI,CAAC,WAAW,KAAK,EAAG,OAAM,IAAI,YAAY,GAAG,IAAI,2BAA2B;AAClF;AAEO,SAAS,IAAI,KAAa,MAAyB,OAAwB;AAChF,QAAM,SAAS,UAAU,OAAO,MAAM,EAAE,KAAK,OAAO,UAAU,SAAS,WAAW,WAAW,CAAC;AAC9F,MAAI,OAAO,MAAO,OAAM,OAAO;AAC/B,MAAI,OAAO,WAAW,EAAG,OAAM,IAAI,SAAS,KAAK,CAAC,KAAK,IAAI,OAAO,MAAM;AACxE,SAAO,OAAO;AAChB;AAEA,SAAS,MAAM,MAAwB;AACrC,SAAO,KAAK,MAAM,IAAI,EAAE,OAAO,CAAC,SAAS,SAAS,EAAE;AACtD;AAEO,SAAS,UAAU,KAAsB;AAC9C,SAAO,OAAO,KAAK,GAAG;AACxB;AAEO,SAAS,SAAS,KAAqB;AAC5C,SAAO,IAAI,KAAK,CAAC,aAAa,iBAAiB,CAAC,EAAE,KAAK;AACzD;AAGO,SAAS,SAAS,KAAqB;AAC5C,SAAY,cAAQ,KAAK,IAAI,KAAK,CAAC,aAAa,cAAc,OAAO,CAAC,EAAE,KAAK,CAAC;AAChF;AAGO,SAAS,aAAa,OAA6B;AACxD,SAAO,MAAM,KAAK,EAAE,IAAI,CAAC,MAAM,MAAM;AACnC,UAAM,SAAS,KAAK,KAAK,EAAE,MAAM,KAAK;AACtC,QAAI,OAAO,WAAW,EAAG,OAAM,IAAI,YAAY,uBAAuB,IAAI,CAAC,wBAAwB;AACnG,eAAW,SAAS,CAAC,GAAG,CAAC,GAAG;AAC1B,UAAI,CAAC,UAAU,OAAO,KAAK,KAAK,EAAE,GAAG;AACnC,cAAM,IAAI,YAAY,uBAAuB,IAAI,CAAC,WAAW,QAAQ,CAAC,oBAAoB;AAAA,MAC5F;AAAA,IACF;AACA,WAAO,EAAE,UAAU,OAAO,CAAC,KAAK,IAAI,WAAW,OAAO,CAAC,KAAK,GAAG;AAAA,EACjE,CAAC;AACH;AAEA,SAAS,UAAU,KAAa,KAAsB;AACpD,SAAO,UAAU,OAAO,CAAC,YAAY,MAAM,gBAAgB,GAAG,GAAG,WAAW,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW;AACrG;AAGO,SAAS,iBAAiB,KAAa,QAAgB,QAA8B;AAC1F,MAAI,UAAU,OAAO,QAAQ,EAAG,QAAO,CAAC;AACxC,MAAI,CAAC,UAAU,OAAO,QAAQ,KAAK,CAAC,UAAU,OAAO,SAAS,EAAG,OAAM,IAAI,YAAY,+BAA+B;AACtH,MAAI,CAAC,aAAa,MAAM,EAAG,OAAM,IAAI,YAAY,6BAA6B;AAC9E,QAAM,QAAQ,CAAC,UAAU,OAAO,SAAS,KAAK,UAAU,KAAK,OAAO,SAAS;AAE7E,QAAM,QAAQ,QACV,CAAC,gBAAgB,GAAG,OAAO,SAAS,KAAK,OAAO,QAAQ,EAAE,IAC1D,CAAC,SAAS,aAAa,MAAM,IAAI,SAAS,gBAAgB,OAAO,QAAQ;AAC7E,SAAO,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,GAAG,KAAK,CAAC,CAAC;AAC5D;AAGO,SAAS,gBAAgB,KAAa,MAAc,MAAwB;AACjF,kBAAgB,MAAM,YAAY;AAClC,kBAAgB,MAAM,YAAY;AAClC,MAAI,UAAU,IAAI,EAAG,QAAO,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,gBAAgB,IAAI,CAAC,CAAC;AAC3F,SAAO,MAAM,IAAI,KAAK,CAAC,YAAY,aAAa,gBAAgB,GAAG,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC;AACtF;AAGO,SAAS,WAAW,KAAa,KAAyB;AAC/D,kBAAgB,KAAK,QAAQ;AAC7B,SAAO,YAAY,KAAK,IAAI,KAAK,CAAC,QAAQ,MAAM,GAAG,aAAa,mBAAmB,gBAAgB,GAAG,CAAC,CAAC;AAC1G;AAGO,SAAS,SAAS,KAAyB;AAChD,QAAM,YAAY,IAAI,KAAK,CAAC,eAAe,MAAM,QAAQ,SAAS,GAAG,EAAE,EAAE,KAAK;AAC9E,SAAO,UAAU,IAAI,KAAK,CAAC,QAAQ,GAAG,aAAa,gBAAgB,gBAAgB,WAAW,MAAM,CAAC,CAAC;AACxG;;;AC9HA,YAAYC,SAAQ;AACpB,YAAYC,WAAU;AAIf,IAAM,cAAc;AAUpB,SAAS,WAAmB;AACjC,SAAU,iBAAa,IAAI,IAAI,qBAAqB,YAAY,GAAG,GAAG,OAAO;AAC/E;AAEA,SAAS,SAAS,UAAsC;AACtD,SAAU,eAAW,QAAQ,IAAO,iBAAa,UAAU,OAAO,IAAI;AACxE;AAOO,SAAS,YAAY,KAAa,KAAkE;AACzG,MAAI,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,gBAAgB;AACjD,QAAM,WAAgB,WAAK,SAAS,GAAG,GAAG,UAAU;AACpD,QAAM,OAAO,SAAS;AACtB,QAAM,UAAU,SAAS,QAAQ;AACjC,MAAI,YAAY,UAAa,CAAC,QAAQ,SAAS,WAAW,EAAG,QAAO,EAAE,SAAS,gBAAgB,SAAS;AACxG,MAAI,YAAY,KAAM,QAAO,EAAE,SAAS,aAAa,SAAS;AAC9D,EAAG,cAAe,cAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,EAAG,kBAAc,UAAU,MAAM,EAAE,MAAM,IAAM,CAAC;AAChD,EAAG,cAAU,UAAU,GAAK;AAC5B,SAAO,EAAE,SAAS,YAAY,SAAY,cAAc,WAAW,SAAS;AAC9E;;;AHdA,IAAM,QAAQ;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,SAAS;AAEf,SAAS,YAAY,MAAc,MAAuC;AACxE,SAAO,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,WAAW,MAAM,GAAG,CAAC;AAC9D;AAEA,SAAS,eAAe,MAAc,QAAgB,OAA6B;AACjF,QAAM,UAAU,aAAa,KAAK;AAClC,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,QAAQ,CAAC,WAAW,iBAAiB,MAAM,QAAQ,MAAM,CAAC;AAAA,EACpE;AACF;AAEA,SAAS,QAAQ,IAAW,SAAiD;AAC3E,QAAM,OAAO,SAAS,GAAG,GAAG;AAC5B,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,EAAE,OAAO,QAAQ,QAAQ,IAAI,UAAU,GAAG,GAAG;AACnD,aAAW,UAAU,QAAS,IAAG,IAAI,SAAS,MAAM;AACpD,QAAM,SAAS,KAAK,QAAQ,IAAI,GAAG,EAAE,OAAO,MAAM,CAAC;AACnD,aAAW,QAAQ,aAAa,OAAO,UAAU,EAAE,GAAG,QAAQ,aAAa,OAAO,CAAC,EAAG,IAAG,IAAI,IAAI;AACjG,SAAO,OAAO,SAAS,SAAS,IAAI,IAAI;AAC1C;AAEA,IAAM,mBAA6D;AAAA,EACjE,WAAW;AAAA,EACX,SAAS;AAAA,EACT,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,gBAAgB;AAClB;AAEA,SAAS,WAAW,IAAmB;AACrC,QAAM,SAAS,YAAY,GAAG,KAAK,GAAG,GAAG;AACzC,QAAM,QAAQ,OAAO,aAAa,SAAY,KAAK,KAAK,OAAO,QAAQ;AACvE,MAAI,OAAO,YAAY,gBAAgB;AACrC,OAAG,IAAI,SAAS,iBAAiB,OAAO,OAAO,IAAI,KAAK;AACxD,WAAO;AAAA,EACT;AACA,KAAG,IAAI,SAAS,iBAAiB,OAAO,OAAO,IAAI,KAAK;AACxD,KAAG,IAAI,SAAS,kGAAkG;AAClH,SAAO;AACT;AAEA,SAAS,WAAW,SAAiB,MAAyB,KAAa,KAAmB;AAC5F,MAAI,KAAK,SAAS,OAAO,KAAK,SAAS,IAAK,OAAM,IAAI,YAAY,GAAG,OAAO,6BAA6B;AAC3G;AAGA,SAAS,YAAY,SAAiB,MAAyB,OAAmC,MAAoB;AACpH,OAAK,QAAQ,CAAC,OAAO,MAAM;AACzB,QAAI,CAAC,MAAM,KAAK,EAAG,OAAM,IAAI,YAAY,GAAG,OAAO,cAAc,IAAI,CAAC,WAAW,IAAI,EAAE;AAAA,EACzF,CAAC;AACH;AAEA,SAAS,SAAS,SAA6B,MAAyB,IAAmB;AACzF,UAAQ,SAAS;AAAA,IACf,KAAK;AAEH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,kBAAY,SAAS,KAAK,MAAM,GAAG,CAAC,GAAG,cAAc,eAAe;AACpE,aAAO,QAAQ,IAAI,CAAC,SAAS,eAAe,MAAM,KAAK,CAAC,KAAK,IAAI,GAAG,UAAU,CAAC,CAAC;AAAA,IAClF,KAAK;AACH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,kBAAY,SAAS,MAAM,YAAY,mBAAmB;AAC1D,aAAO,QAAQ,IAAI,CAAC,SAAS,YAAY,MAAM,gBAAgB,MAAM,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;AAAA,IACrG,KAAK;AACH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,aAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,CAAC;AAAA,IAC/C,KAAK;AACH,iBAAW,SAAS,MAAM,GAAG,CAAC;AAC9B,aAAO,WAAW,EAAE;AAAA,IACtB;AACE,YAAM,IAAI,YAAY,YAAY,SAAY,oBAAoB,iBAAiB;AAAA,EACvF;AACF;AAGA,SAAS,iBAAiB,MAAmE;AAC3F,QAAM,EAAE,aAAa,OAAO,IAAI,UAAU;AAAA,IACxC,MAAM,CAAC,GAAG,IAAI;AAAA,IACd,kBAAkB;AAAA,IAClB,QAAQ;AAAA,IACR,SAAS,EAAE,MAAM,EAAE,MAAM,WAAW,OAAO,IAAI,EAAE;AAAA,EACnD,CAAC;AACD,QAAM,UAAU,OAAO,KAAK,CAAC,UAAU,MAAM,SAAS,YAAY;AAClE,QAAM,QAAQ,OAAO,OAAO,CAAC,UAAU,MAAM,SAAS,YAAY,MAAM,SAAS,MAAM;AACvF,MAAI,MAAM,KAAK,CAAC,UAAU,YAAY,UAAa,MAAM,QAAQ,QAAQ,KAAK,GAAG;AAC/E,UAAM,IAAI,YAAY,8CAA8C;AAAA,EACtE;AACA,SAAO,EAAE,aAAa,MAAM,MAAM,SAAS,EAAE;AAC/C;AAGO,SAAS,OAAO,MAAyB,IAAmB;AACjE,MAAI;AACF,UAAM,EAAE,aAAa,KAAK,IAAI,iBAAiB,IAAI;AACnD,QAAI,MAAM;AACR,iBAAW,QAAQ,MAAO,IAAG,IAAI,IAAI;AACrC,aAAO;AAAA,IACT;AACA,WAAO,SAAS,YAAY,CAAC,GAAG,YAAY,MAAM,CAAC,GAAG,EAAE;AAAA,EAC1D,SAAS,OAAO;AACd,OAAG,IAAI,UAAU,iBAAiB,QAAQ,MAAM,UAAU,mBAAmB;AAC7E,QAAI,iBAAiB,YAAa,IAAG,IAAI,MAAM,CAAC,KAAK,EAAE;AACvD,WAAO;AAAA,EACT;AACF;;;ADzIA,QAAQ,WAAW,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAG;AAAA,EAC/C,KAAK,QAAQ,IAAI;AAAA,EACjB,KAAK,QAAQ;AAAA,EACb,WAAW,MAAS,iBAAa,GAAG,OAAO;AAAA,EAC3C,KAAK,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAAA,EAC/C,KAAK,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AACjD,CAAC;","names":["fs","path","fs","path"]}

package/hooks/pre-push

@@ -1,15 +1,42 @@
 #!/bin/sh
 # titan-egress-scan managed pre-push hook; `titan-egress-scan install-hook` rewrites this file.
-# It resolves the scanner from the pushing worktree and fails closed when it is missing.
+# Every linked worktree shares this hook. It looks for the scanner in the pushing worktree, then in
+# the main checkout, then on PATH, and fails closed when none has it.
 top=$(git rev-parse --show-toplevel) || exit 1
-bin="$top/node_modules/.bin/titan-egress-scan"
-if [ -x "$bin" ]; then
-  exec "$bin" pre-push "$1"
-fi
+common=$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null) ||
+  common=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd) || common=""
+main=""
+[ -n "$common" ] && main=$(dirname "$common")
+
 # pnpm skips the .bin link for a workspace package that was unbuilt at install time.
-script="$top/node_modules/@titan-design/egress-scan/dist/bin.js"
-if [ -f "$script" ]; then
-  exec node "$script" pre-push "$1"
-fi
-echo "titan-egress-scan: not installed in this worktree; run pnpm install (and pnpm build in titan-platform), then push again" >&2
+try_checkout() {
+  [ -n "$1" ] || return 0
+  if [ -x "$1/node_modules/.bin/titan-egress-scan" ]; then
+    exec "$1/node_modules/.bin/titan-egress-scan" pre-push "$2"
+  fi
+  if [ -f "$1/node_modules/@titan-design/egress-scan/dist/bin.js" ]; then
+    exec node "$1/node_modules/@titan-design/egress-scan/dist/bin.js" pre-push "$2"
+  fi
+}
+
+try_checkout "$top" "$1"
+try_checkout "$main" "$1"
+# Only absolute PATH entries count: a "." or empty entry would run a scanner the pushed tree planted.
+# `command -v` cannot be used, since some shells rewrite a relative hit into an absolute path.
+set -f
+IFS=:
+for dir in $PATH; do
+  case "$dir" in
+    /*) if [ -f "$dir/titan-egress-scan" ] && [ -x "$dir/titan-egress-scan" ]; then
+      exec "$dir/titan-egress-scan" pre-push "$1"
+    fi ;;
+  esac
+done
+{
+  echo "titan-egress-scan: scanner not found, so the push is refused. It looked in:"
+  echo "  1. $top/node_modules (.bin link, then @titan-design/egress-scan/dist/bin.js)"
+  echo "  2. ${main:-the main checkout (unresolved)}/node_modules (same two paths)"
+  echo "  3. PATH (titan-egress-scan)"
+  echo "Fix: run 'pnpm install && pnpm build' in titan-platform, or 'npm i -g @titan-design/egress-scan', then push again."
+} >&2
 exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@titan-design/egress-scan",
-  "version": "0.0.0",
+  "version": "0.1.1",
   "description": "Scan git diff text for home paths, private-workspace paths and private terms, reporting location and rule id only",
   "type": "module",
   "main": "./dist/index.js",