arcane-cli 0.30.0 → 0.31.0

package/dist/index.js

@@ -2177,7 +2177,7 @@ function isArcaneHooksPath(root, value) {
   };
   return normalize(value) === normalize(ARCANE_HOOKS_DIR);
 }
-var HOOK_BODY = `#!/bin/sh
+var PRE_PUSH_HOOK_BODY = `#!/bin/sh
 # Installed by Arcane because this repository's .arcane.json sets
 # push_policy: "blocked".
 #
@@ -2233,13 +2233,13 @@ async function repositoryRoot(cwd) {
   }
   return cwd;
 }
-async function hookFilePath(cwd) {
-  return join4(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, "pre-push");
+async function hookFilePath(cwd, hookName = "pre-push") {
+  return join4(await repositoryRoot(cwd), ARCANE_HOOKS_DIR, hookName);
 }
 async function hooksPathValue(cwd) {
   return join4(await repositoryRoot(cwd), ARCANE_HOOKS_DIR).replace(/\\/g, "/");
 }
-async function installPrePushHook(cwd) {
+async function installHook(cwd, hookName, body) {
   const root = await repositoryRoot(cwd);
   const existing = await readHooksPath(cwd);
   if (existing?.unreadable === true) return { status: "refused-unreadable-config" };
@@ -2256,19 +2256,27 @@ async function installPrePushHook(cwd) {
       return { status: "refused-default-hooks", hooks: displaced };
     }
   }
-  const hookPath = join4(root, ARCANE_HOOKS_DIR, "pre-push");
-  if (existing !== void 0 && await hookBodyMatches(cwd)) return { status: "already-ours" };
+  const hookPath = join4(root, ARCANE_HOOKS_DIR, hookName);
+  if (existing !== void 0 && await hookFileMatches(cwd, hookName, body)) {
+    return { status: "already-ours" };
+  }
   await mkdir4(join4(root, ARCANE_HOOKS_DIR), { recursive: true });
-  await writeFile5(hookPath, HOOK_BODY, "utf-8");
+  await writeFile5(hookPath, body, "utf-8");
   await chmod(hookPath, 493);
   await runGit(cwd, ["config", "--local", "core.hooksPath", await hooksPathValue(cwd)]);
   return { status: "installed", path: hookPath };
 }
-async function isHookEnforced(cwd) {
+async function installPrePushHook(cwd) {
+  return installHook(cwd, "pre-push", PRE_PUSH_HOOK_BODY);
+}
+async function isHookInstalled(cwd, hookName, body) {
   const hooksPath = await readHooksPath(cwd);
   if (hooksPath === void 0 || hooksPath.unreadable === true) return false;
   if (!isArcaneHooksPath(await repositoryRoot(cwd), hooksPath.value)) return false;
-  return hookBodyMatches(cwd);
+  return hookFileMatches(cwd, hookName, body);
+}
+async function isHookEnforced(cwd) {
+  return isHookInstalled(cwd, "pre-push", PRE_PUSH_HOOK_BODY);
 }
 async function defaultHooks(cwd) {
   let hooksDir;
@@ -2284,11 +2292,11 @@ async function defaultHooks(cwd) {
     return [];
   }
 }
-async function hookBodyMatches(cwd) {
-  const hookPath = await hookFilePath(cwd);
+async function hookFileMatches(cwd, hookName, body) {
+  const hookPath = await hookFilePath(cwd, hookName);
   if (!await fileExists(hookPath)) return false;
   try {
-    if (await readFile4(hookPath, "utf-8") !== HOOK_BODY) return false;
+    if (await readFile4(hookPath, "utf-8") !== body) return false;
   } catch {
     return false;
   }
@@ -2300,21 +2308,33 @@ async function hookBodyMatches(cwd) {
     return false;
   }
 }
-async function removePrePushHook(cwd) {
+async function removeHook(cwd, hookName) {
   const existing = await readHooksPath(cwd);
   if (existing === void 0 || existing.unreadable === true) return;
-  if (!isArcaneHooksPath(await repositoryRoot(cwd), existing.value)) return;
+  const root = await repositoryRoot(cwd);
+  if (!isArcaneHooksPath(root, existing.value)) return;
   if (existing.scope !== "local" && existing.scope !== "worktree") return;
-  const scopeFlag = existing.scope === "worktree" ? "--worktree" : "--local";
   try {
-    await runGit(cwd, ["config", scopeFlag, "--unset", "core.hooksPath"]);
+    await rm2(await hookFilePath(cwd, hookName), { force: true });
   } catch {
   }
+  const hooksDir = join4(root, ARCANE_HOOKS_DIR);
+  let remaining = [];
   try {
-    await rm2(await hookFilePath(cwd), { force: true });
+    remaining = await readdir3(hooksDir);
+  } catch {
+    remaining = [];
+  }
+  if (remaining.length > 0) return;
+  const scopeFlag = existing.scope === "worktree" ? "--worktree" : "--local";
+  try {
+    await runGit(cwd, ["config", scopeFlag, "--unset", "core.hooksPath"]);
   } catch {
   }
 }
+async function removePrePushHook(cwd) {
+  return removeHook(cwd, "pre-push");
+}
 async function listRemotes(cwd) {
   try {
     const { stdout } = await runGit(cwd, ["remote"]);
@@ -2522,6 +2542,58 @@ function describeError(error) {
   return message.split("\n")[0].trim();
 }
 
+// src/modules/secrets-scan.ts
+var SECRETS_RULES = [
+  { label: "api-key", pattern: /API[_-]KEY\s*[:=]\s*\S+/i },
+  // Case-sensitive and requiring an all-caps/underscore identifier (SECRET,
+  // MY_SECRET, API_SECRET_KEY...) -- the real config/env-var convention for a
+  // credential-holding key. Widening this repository-wide (ARC-037 decision 3)
+  // surfaced that the original case-insensitive form matched ANY lowercase
+  // `secret`/`token` code identifier (e.g. `const token = value.trim();`),
+  // which is overwhelmingly a parsed/resolved value, never a literal
+  // credential. The `(?!\$?\{)` guard additionally excludes any
+  // brace-delimited placeholder -- GitHub Actions/templating references
+  // (`TOKEN: ${{ secrets.X }}`, a reference to a secret store, never the
+  // secret itself) and this codebase's own documented `{UPPER_SNAKE}`
+  // placeholder convention (denylist-scan.ts's `scanFile` already strips
+  // those before matching for the sibling org-token scan; a bare single
+  // brace, with no `scanFile`-style stripping in the copy-time call path,
+  // needed the same exclusion here rather than only the double-brace case).
+  // A minimum length of 8 further excludes short non-secret values like
+  // `write` (`id-token: write`).
+  { label: "generic-secret", pattern: /\b[A-Z0-9_]*SECRET[A-Z0-9_]*\s*[:=]\s*(?!\$?\{)\S{8,}/ },
+  { label: "generic-token", pattern: /\b[A-Z0-9_]*TOKEN[A-Z0-9_]*\s*[:=]\s*(?!\$?\{)\S{8,}/ },
+  { label: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{20,}/ },
+  // real tokens are long
+  { label: "openai-key", pattern: /sk-[A-Za-z0-9]{20,}/ },
+  { label: "pem-key", pattern: /-----BEGIN [A-Z ]+-----/ },
+  { label: "slack-token", pattern: /xox[bpars]-[A-Za-z0-9-]+/ },
+  { label: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
+  { label: "github-pat", pattern: /ghp_[A-Za-z0-9]{36}/ }
+];
+var SECRETS_PATTERNS = SECRETS_RULES.map((rule) => rule.pattern);
+var SECRETS_PRECOMMIT_HOOK_NAME = "pre-commit";
+var SECRETS_PRECOMMIT_HOOK_BODY = `#!/bin/sh
+# Installed by Arcane (ARC-037) to scan staged content for accidentally
+# committed credentials before they enter history.
+#
+# This is deliberately not tamper-proof: \`git commit --no-verify\` skips it
+# entirely. The real defense is the repository-wide scan Arcane's own build
+# runs in CI on every push -- this hook exists to catch a leak locally, for
+# free, before it ever reaches a commit.
+if ! command -v spell >/dev/null 2>&1; then
+  echo "arcane: 'spell' not found on PATH -- skipping secrets scan (see: npm install -g arcane-cli)" >&2
+  exit 0
+fi
+spell doctor --leaks
+`;
+async function installSecretsPrecommitHook(cwd) {
+  return installHook(cwd, SECRETS_PRECOMMIT_HOOK_NAME, SECRETS_PRECOMMIT_HOOK_BODY);
+}
+async function removeSecretsPrecommitHook(cwd) {
+  return removeHook(cwd, SECRETS_PRECOMMIT_HOOK_NAME);
+}
+
 // src/commands/init.ts
 var VALID_PROFILES = ["full", "lite", "governance-only", "methodology", "docs"];
 var PROFILE_ICONS = {
@@ -2894,6 +2966,28 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       );
     }
   }
+  try {
+    const hook = await installSecretsPrecommitHook(targetDir);
+    if (hook.status === "installed") {
+      printInfo("Installed a pre-commit hook that scans staged content for leaked credentials.");
+    } else if (hook.status === "refused-unreadable-config") {
+      printWarning(
+        "Did not install the secrets pre-commit hook: git could not report the current core.hooksPath (unreadable config, or a git too old for `--show-scope`)."
+      );
+    } else if (hook.status === "refused-default-hooks") {
+      printWarning(
+        `Did not install the secrets pre-commit hook: this repository has hooks in git's default directory (${hook.hooks.join(", ")}). Setting core.hooksPath would silently stop them running. Move them under \`${ARCANE_HOOKS_DIR}\` yourself and re-run.`
+      );
+    } else if (hook.status === "refused-foreign-hooks-path") {
+      printWarning(
+        `Did not install the secrets pre-commit hook: core.hooksPath is already "${hook.existing}" (${describeConfigScope(hook.scope)}), so another hook manager owns it.`
+      );
+    }
+  } catch (err) {
+    printWarning(
+      `Could not install the secrets pre-commit hook: ${err instanceof Error ? err.message : String(err)}. Run \`spell doctor --leaks\` directly to scan on demand instead.`
+    );
+  }
   let agentsConfigured = false;
   if (hasAgents && !options.profile) {
     console.log();
@@ -3650,6 +3744,10 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
   for (const file of markerFiles) {
     await stripMarkerSection(targetDir, file, { dryRun: false });
   }
+  try {
+    await removeSecretsPrecommitHook(targetDir);
+  } catch {
+  }
   console.log(`
 \u2713 Uninstalled \u2014 ${removed} files removed.`);
 }
@@ -3799,37 +3897,6 @@ async function scanRepository(repoRoot, rules, extensions, excludePrefixes = [])
   return findings;
 }
 
-// src/modules/secrets-scan.ts
-var SECRETS_RULES = [
-  { label: "api-key", pattern: /API[_-]KEY\s*[:=]\s*\S+/i },
-  // Case-sensitive and requiring an all-caps/underscore identifier (SECRET,
-  // MY_SECRET, API_SECRET_KEY...) -- the real config/env-var convention for a
-  // credential-holding key. Widening this repository-wide (ARC-037 decision 3)
-  // surfaced that the original case-insensitive form matched ANY lowercase
-  // `secret`/`token` code identifier (e.g. `const token = value.trim();`),
-  // which is overwhelmingly a parsed/resolved value, never a literal
-  // credential. The `(?!\$?\{)` guard additionally excludes any
-  // brace-delimited placeholder -- GitHub Actions/templating references
-  // (`TOKEN: ${{ secrets.X }}`, a reference to a secret store, never the
-  // secret itself) and this codebase's own documented `{UPPER_SNAKE}`
-  // placeholder convention (denylist-scan.ts's `scanFile` already strips
-  // those before matching for the sibling org-token scan; a bare single
-  // brace, with no `scanFile`-style stripping in the copy-time call path,
-  // needed the same exclusion here rather than only the double-brace case).
-  // A minimum length of 8 further excludes short non-secret values like
-  // `write` (`id-token: write`).
-  { label: "generic-secret", pattern: /\b[A-Z0-9_]*SECRET[A-Z0-9_]*\s*[:=]\s*(?!\$?\{)\S{8,}/ },
-  { label: "generic-token", pattern: /\b[A-Z0-9_]*TOKEN[A-Z0-9_]*\s*[:=]\s*(?!\$?\{)\S{8,}/ },
-  { label: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{20,}/ },
-  // real tokens are long
-  { label: "openai-key", pattern: /sk-[A-Za-z0-9]{20,}/ },
-  { label: "pem-key", pattern: /-----BEGIN [A-Z ]+-----/ },
-  { label: "slack-token", pattern: /xox[bpars]-[A-Za-z0-9-]+/ },
-  { label: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
-  { label: "github-pat", pattern: /ghp_[A-Za-z0-9]{36}/ }
-];
-var SECRETS_PATTERNS = SECRETS_RULES.map((rule) => rule.pattern);
-
 // src/modules/platform-policy.ts
 import { execFile as execFile2 } from "child_process";
 import { promisify } from "util";