codeant-cli 0.3.6 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {
@@ -25,7 +25,8 @@
   "main": "./src/reviewHeadless.js",
   "exports": {
     ".": "./src/reviewHeadless.js",
-    "./review": "./src/reviewHeadless.js"
+    "./review": "./src/reviewHeadless.js",
+    "./push-protection": "./src/utils/installPushProtectionHook.js"
   },
   "files": [
     "src"

package/src/commands/secrets.js

@@ -11,7 +11,7 @@ import {
   renderDone,
 } from '../components/SecretsUI.js';
 
-export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include = [], exclude = [], lastNCommits = 1, baseBranch = null, baseCommit = null }) {
+export default function Secrets({ scanType = 'all', include = [], exclude = [], lastNCommits = 1, baseBranch = null, baseCommit = null }) {
   const { exit } = useApp();
   const [status, setStatus] = useState('initializing');
   const [secrets, setSecrets] = useState([]);
@@ -20,14 +20,6 @@ export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include
   const [scanMeta, setScanMeta] = useState(null);
   const [startTime] = useState(() => Date.now());
 
-  const shouldFailOn = (confidenceScore) => {
-    const score = confidenceScore?.toUpperCase();
-    if (score === 'FALSE_POSITIVE') return false;
-    if (failOn === 'HIGH') return score === 'HIGH';
-    if (failOn === 'MEDIUM') return score === 'HIGH' || score === 'MEDIUM';
-    return true;
-  };
-
   useEffect(() => {
     let cancelled = false;
 
@@ -81,10 +73,10 @@ export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include
 
   useEffect(() => {
     if (status === 'done') {
-      const hasBlockingSecrets = secrets.some(file =>
-        file.secrets.some(secret => shouldFailOn(secret.confidence_score))
+      const hasSecrets = secrets.some(file =>
+        file.secrets.length > 0
       );
-      if (hasBlockingSecrets) {
+      if (hasSecrets) {
         setTimeout(() => { process.exitCode = 1; exit(new Error('Secrets detected')); }, 100);
       } else {
         setTimeout(() => exit(), 100);
@@ -101,7 +93,7 @@ export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include
   if (status === 'scanning') return renderScanning(startTime, fileCount, scanMeta);
   if (status === 'no_files') return renderNoFiles(scanType, lastNCommits, baseBranch, baseCommit);
   if (status === 'error') return renderError(error);
-  if (status === 'done') return renderDone(secrets, failOn, shouldFailOn, startTime, fileCount, scanMeta);
+  if (status === 'done') return renderDone(secrets, startTime, fileCount, scanMeta);
 
   return null;
 }

package/src/components/SecretsUI.js

@@ -7,19 +7,8 @@ const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧',
 const DIVIDER = '─'.repeat(55);
 const STEPS = ['Init', 'Fetch', 'Scan'];
 
-const CONFIDENCE_COLORS = {
-  HIGH: 'red',
-  MEDIUM: 'yellow',
-  LOW: 'cyan',
-  FALSE_POSITIVE: 'gray',
-};
-
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
-function getConfidenceColor(score) {
-  return CONFIDENCE_COLORS[score?.toUpperCase()] || 'gray';
-}
-
 function padEnd(str, len) {
   return str + ' '.repeat(Math.max(0, len - str.length));
 }
@@ -211,22 +200,13 @@ export function renderNotLoggedIn() {
   );
 }
 
-export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount, meta) {
+export function renderDone(secrets, startTime, fileCount, meta) {
   const allSecrets = secrets.flatMap(file =>
     file.secrets.map(s => ({ ...s, file_path: file.file_path }))
   );
 
-  const blockingSecrets = allSecrets.filter(s => shouldFailOn(s.confidence_score));
-  const hasBlocking = blockingSecrets.length > 0;
   const elapsed = startTime ? formatElapsed(startTime) : null;
 
-  // Count by confidence
-  const counts = {};
-  allSecrets.forEach(s => {
-    const conf = s.confidence_score?.toUpperCase() || 'UNKNOWN';
-    counts[conf] = (counts[conf] || 0) + 1;
-  });
-
   // Group by file
   const grouped = {};
   allSecrets.forEach(s => {
@@ -269,9 +249,6 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
       ));
 
       fileSecrets.forEach((secret, si) => {
-        const conf = secret.confidence_score?.toUpperCase() || 'UNKNOWN';
-        const confColor = getConfidenceColor(conf);
-        const isBlocking = shouldFailOn(secret.confidence_score);
         const isLast = si === fileSecrets.length - 1;
         const branch = isLast ? '└─' : '├─';
         const lineStr = secret.line_number ? `L${secret.line_number}` : '';
@@ -279,12 +256,8 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
         els.push(React.createElement(
           Box, { key: `s-${fi}-${si}` },
           React.createElement(Text, { color: 'gray' }, `    ${branch} `),
-          React.createElement(Text, {
-            color: confColor,
-            bold: isBlocking,
-          }, padEnd(conf, 16)),
           React.createElement(Text, { color: 'gray' }, padEnd(lineStr, 6)),
-          React.createElement(Text, { color: isBlocking ? 'white' : 'gray', dimColor: !isBlocking }, secret.type || ''),
+          React.createElement(Text, { color: 'white' }, secret.type || ''),
         ));
       });
 
@@ -330,28 +303,17 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
 
   // Secret stats line
   if (allSecrets.length > 0) {
-    const stats = [`${allSecrets.length} secret${allSecrets.length !== 1 ? 's' : ''} found`];
-    for (const conf of ['HIGH', 'MEDIUM', 'LOW', 'FALSE_POSITIVE']) {
-      if (counts[conf]) {
-        const label = conf === 'FALSE_POSITIVE' ? 'false positive' : conf.toLowerCase();
-        stats.push(`${counts[conf]} ${label}`);
-      }
-    }
     els.push(React.createElement(
-      Text, { key: 'stats', color: 'gray' }, stats.join('  ·  '),
+      Text, { key: 'stats', color: 'gray' },
+      `${allSecrets.length} secret${allSecrets.length !== 1 ? 's' : ''} found`,
     ));
   }
 
   // Status line
-  if (hasBlocking) {
+  if (allSecrets.length > 0) {
     els.push(React.createElement(
       Text, { key: 'status', color: 'red', bold: true },
-      `✗ ${blockingSecrets.length} blocking secret${blockingSecrets.length !== 1 ? 's' : ''} — remove before committing`,
-    ));
-  } else if (allSecrets.length > 0) {
-    els.push(React.createElement(
-      Text, { key: 'status', color: 'green', bold: true },
-      '✓ No blocking secrets found',
+      `✗ ${allSecrets.length} secret${allSecrets.length !== 1 ? 's' : ''} found — remove before committing`,
     ));
   } else {
     els.push(React.createElement(

package/src/index.js

@@ -10,6 +10,7 @@ import GetBaseUrl from './commands/getBaseUrl.js';
 import Login from './commands/login.js';
 import Logout from './commands/logout.js';
 import Review from './commands/review.js';
+import { runReviewHeadless } from './reviewHeadless.js';
 import Welcome from './components/Welcome.js';
 import * as scm from './scm/index.js';
 import { setConfigValue } from './utils/config.js';
@@ -58,7 +59,6 @@ program
   .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
   .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
   .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
-  .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
   .action((options) => {
@@ -95,9 +95,7 @@ program
       ? (Array.isArray(options.exclude) ? options.exclude : splitGlobs(options.exclude))
       : [];
 
-    const failOn = options.failOn?.toUpperCase() || 'CRITICAL';
-
-    render(React.createElement(Secrets, { scanType, failOn, include, exclude, lastNCommits, baseBranch, baseCommit }));
+    render(React.createElement(Secrets, { scanType, include, exclude, lastNCommits, baseBranch, baseCommit }));
   });
 
 program
@@ -114,7 +112,8 @@ program
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
-  .action((options) => {
+  .option('--headless', 'Output clean JSON with no spinners (for agents and CI)')
+  .action(async (options) => {
     let scanType = 'all';
     let lastNCommits = 1;
     let baseBranch = null;
@@ -150,7 +149,23 @@ program
 
     const failOn = options.failOn?.toUpperCase() || 'CRITICAL';
 
-    render(React.createElement(Review, { scanType, lastNCommits, failOn, include, exclude, baseBranch, baseCommit }));
+    if (options.headless) {
+      const result = await runReviewHeadless({
+        workspacePath: process.cwd(),
+        scanType,
+        lastNCommits,
+        include,
+        exclude,
+        baseBranch,
+        baseCommit,
+        onProgress: (msg) => console.error(`[progress] ${msg}`),
+        onFilesReady: (files, meta) => console.error(`[files] Reviewing ${files.length} file(s)`),
+      });
+      console.log(JSON.stringify(result, null, 2));
+      process.exit(result.error ? 1 : 0);
+    } else {
+      render(React.createElement(Review, { scanType, lastNCommits, failOn, include, exclude, baseBranch, baseCommit }));
+    }
   });
 
 program

package/src/reviewHeadless.js

@@ -126,9 +126,9 @@ export async function runReviewHeadless(options = {}) {
 
     onProgress(`Analyzing ${perFileRequests.length} file${perFileRequests.length !== 1 ? 's' : ''} in parallel...`);
 
-    // ── Per-file agent turn loops (parallel) ────────────────────────────
+    // ── Per-file agent turn loops (parallel, fault-tolerant) ─────────────
     const perFileResults = await Promise.all(
-      perFileRequests.map((fileReq) => {
+      perFileRequests.map(async (fileReq) => {
         const filename = fileReq._filename;
         delete fileReq._filename;
 
@@ -138,7 +138,15 @@ export async function runReviewHeadless(options = {}) {
         }
         delete fileReq.file_contents;
 
-        return runTurnLoop(fileReq, gitRoot, false);
+        try {
+          onProgress(`Reviewing ${filename}...`);
+          const result = await runTurnLoop(fileReq, gitRoot, false);
+          onProgress(`Done reviewing ${filename}`);
+          return result;
+        } catch (err) {
+          console.error(`[error] Failed to review ${filename}: ${err.message}`);
+          return { finalMessage: null, finalOutput: null };
+        }
       })
     );
 
@@ -149,20 +157,26 @@ export async function runReviewHeadless(options = {}) {
       output: perFileResults[i].finalOutput,
     })).filter(r => r.output?.code_suggestions?.length > 0);
 
-    // ── Per-file reflector loops (parallel) ──────────────────────────────
-    onProgress('Running reflector...');
+    onProgress(`${perFileWithSuggestions.length} file(s) have suggestions, running reflector...`);
+
+    // ── Per-file reflector loops (parallel, fault-tolerant) ──────────────
     const reflectorResults = await Promise.all(
-      perFileWithSuggestions.map(({ diff_content, suggestions }) =>
-        runTurnLoop(
-          {
-            diff_content,
-            prompt_template_name: 'reflector',
-            extra_variables: { suggestion_str: suggestions },
-          },
-          gitRoot,
-          true
-        )
-      )
+      perFileWithSuggestions.map(async ({ diff_content, suggestions }, i) => {
+        try {
+          return await runTurnLoop(
+            {
+              diff_content,
+              prompt_template_name: 'reflector',
+              extra_variables: { suggestion_str: suggestions },
+            },
+            gitRoot,
+            true
+          );
+        } catch (err) {
+          console.error(`[error] Reflector failed for file ${i}: ${err.message}`);
+          return { finalMessage: null, finalOutput: null };
+        }
+      })
     );
 
     // ── Parse results ───────────────────────────────────────────────────

package/src/utils/fetchApi.js

@@ -23,6 +23,11 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
 
   try {
     const response = await fetch(url, options);
+
+    if (response.status === 403) {
+      throw new Error('Access denied (403). Please run `codeant logout` and then `codeant login` to re-authenticate.');
+    }
+
     const data = await response.json();
 
     if (!response.ok) {

package/src/utils/installPushProtectionHook.js

@@ -0,0 +1,159 @@
+import { execSync } from 'child_process';
+import { readFileSync, writeFileSync, chmodSync, existsSync, unlinkSync, mkdirSync } from 'fs';
+import path from 'path';
+
+const HOOK_MARKER = '# codeant-push-protection';
+const HOOK_MARKER_END = '# end-codeant-push-protection';
+
+/**
+ * Build the full pre-push hook script (with shebang).
+ */
+function buildHookScript() {
+  return `#!/bin/sh
+${buildHookBlock()}
+`;
+}
+
+/**
+ * Build just the CodeAnt block (no shebang), used when appending to an existing hook.
+ */
+function buildHookBlock() {
+  return `${HOOK_MARKER}
+# Auto-installed by CodeAnt AI — blocks pushes containing secrets.
+# To disable: delete this hook or run "codeant push-protection disable"
+command -v codeant >/dev/null 2>&1 || exit 0
+codeant secrets --committed
+${HOOK_MARKER_END}`;
+}
+
+/**
+ * Replace the CodeAnt block in a hook file with new content (or remove it).
+ */
+function replaceCodeAntBlock(fileContent, newBlock) {
+  const startIdx = fileContent.indexOf(HOOK_MARKER);
+  let endIdx = fileContent.indexOf(HOOK_MARKER_END);
+  if (startIdx === -1) return fileContent;
+  if (endIdx === -1) {
+    endIdx = fileContent.length;
+  } else {
+    endIdx += HOOK_MARKER_END.length;
+  }
+  const before = fileContent.slice(0, startIdx);
+  const after = fileContent.slice(endIdx);
+  return (before + newBlock + after).replace(/\n{3,}/g, '\n\n');
+}
+
+/**
+ * Find the git root directory for a given workspace path.
+ */
+function findGitRoot(workspacePath) {
+  try {
+    return execSync('git rev-parse --show-toplevel', {
+      cwd: workspacePath,
+      encoding: 'utf-8',
+      timeout: 5000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Get the effective hooks directory (respects core.hooksPath).
+ */
+function getHooksDir(gitRoot) {
+  try {
+    const custom = execSync('git config --get core.hooksPath', {
+      cwd: gitRoot,
+      encoding: 'utf-8',
+      timeout: 5000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    if (custom) return path.resolve(gitRoot, custom);
+  } catch {
+    // No custom hooksPath — use default
+  }
+  return path.join(gitRoot, '.git', 'hooks');
+}
+
+/**
+ * Install a pre-push hook that runs secret scanning before push.
+ *
+ * @param {string} workspacePath - Path to the git repository
+ * @returns {{ installed: boolean, hookPath: string|null, message: string }}
+ */
+export function installPushProtectionHook(workspacePath) {
+  const gitRoot = findGitRoot(workspacePath);
+  if (!gitRoot) {
+    return { installed: false, hookPath: null, message: 'Not a git repository' };
+  }
+
+  const hooksDir = getHooksDir(gitRoot);
+  if (!existsSync(hooksDir)) {
+    mkdirSync(hooksDir, { recursive: true });
+  }
+  const hookPath = path.join(hooksDir, 'pre-push');
+
+  // If hook already exists, check if it's ours
+  if (existsSync(hookPath)) {
+    const existing = readFileSync(hookPath, 'utf-8');
+    if (existing.includes(HOOK_MARKER)) {
+      // Replace only our block, preserve everything else
+      const updated = replaceCodeAntBlock(existing, buildHookBlock());
+      writeFileSync(hookPath, updated, 'utf-8');
+      chmodSync(hookPath, 0o755);
+      return { installed: true, hookPath, message: 'Hook updated' };
+    }
+    // There's a user-managed hook — append only for shell hooks to avoid breaking non-shell scripts
+    const firstLine = existing.split('\n', 1)[0] || '';
+    const isShellHook = firstLine.startsWith('#!') ? /\/(ba|z|k)?sh(\s|$)/.test(firstLine) : true;
+    if (!isShellHook) {
+      return { installed: false, hookPath, message: 'Existing pre-push hook is non-shell; cannot append CodeAnt block safely' };
+    }
+    const appended = existing.trimEnd() + '\n\n' + buildHookBlock() + '\n';
+    writeFileSync(hookPath, appended, 'utf-8');
+    chmodSync(hookPath, 0o755);
+    return { installed: true, hookPath, message: 'Hook appended to existing pre-push' };
+  }
+
+  writeFileSync(hookPath, buildHookScript(), 'utf-8');
+  chmodSync(hookPath, 0o755);
+  return { installed: true, hookPath, message: 'Hook installed' };
+}
+
+/**
+ * Remove the CodeAnt pre-push hook (or just our section if appended).
+ *
+ * @param {string} workspacePath
+ * @returns {{ removed: boolean, message: string }}
+ */
+export function removePushProtectionHook(workspacePath) {
+  const gitRoot = findGitRoot(workspacePath);
+  if (!gitRoot) {
+    return { removed: false, message: 'Not a git repository' };
+  }
+
+  const hooksDir = getHooksDir(gitRoot);
+  const hookPath = path.join(hooksDir, 'pre-push');
+
+  if (!existsSync(hookPath)) {
+    return { removed: false, message: 'No pre-push hook found' };
+  }
+
+  const content = readFileSync(hookPath, 'utf-8');
+  if (!content.includes(HOOK_MARKER)) {
+    return { removed: false, message: 'Hook is not managed by CodeAnt' };
+  }
+
+  // Remove our block (between start and end markers)
+  const remaining = replaceCodeAntBlock(content, '').trim();
+  if (!remaining || remaining === '#!/bin/sh') {
+    unlinkSync(hookPath);
+    return { removed: true, message: 'Hook removed' };
+  }
+
+  writeFileSync(hookPath, remaining + '\n', 'utf-8');
+  chmodSync(hookPath, 0o755);
+  return { removed: true, message: 'CodeAnt section removed from hook' };
+}

package/src/utils/secretsDetector.js

@@ -185,7 +185,6 @@ export function scanFile(filePath, content) {
         type: rule.id,
         description: rule.description,
         line_number: lineNum,
-        confidence_score: rule.entropy > 0 ? 'HIGH' : 'MEDIUM',
         secret_snippet: maskSecret(secret),
       });
     }