codeant-cli 0.3.7 → 0.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Code review CLI tool",
   "type": "module",
   "bin": {

package/src/commands/secrets.js

@@ -2,6 +2,8 @@ import { useState, useEffect } from 'react';
 import { useApp } from 'ink';
 import SecretsApiHelper from '../utils/secretsApiHelper.js';
 import { detectSecrets } from '../utils/secretsDetector.js';
+import { fetchApi } from '../utils/fetchApi.js';
+import { detectRemote, detectRepoName, detectBaseUrl } from '../scm/index.js';
 import {
   renderInitializing,
   renderFetchingDiff,
@@ -9,9 +11,10 @@ import {
   renderNoFiles,
   renderError,
   renderDone,
+  renderBypassPrompt,
 } from '../components/SecretsUI.js';
 
-export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include = [], exclude = [], lastNCommits = 1, baseBranch = null, baseCommit = null }) {
+export default function Secrets({ scanType = 'all', include = [], exclude = [], lastNCommits = 1, baseBranch = null, baseCommit = null, hook = false }) {
   const { exit } = useApp();
   const [status, setStatus] = useState('initializing');
   const [secrets, setSecrets] = useState([]);
@@ -20,14 +23,6 @@ export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include
   const [scanMeta, setScanMeta] = useState(null);
   const [startTime] = useState(() => Date.now());
 
-  const shouldFailOn = (confidenceScore) => {
-    const score = confidenceScore?.toUpperCase();
-    if (score === 'FALSE_POSITIVE') return false;
-    if (failOn === 'HIGH') return score === 'HIGH';
-    if (failOn === 'MEDIUM') return score === 'HIGH' || score === 'MEDIUM';
-    return true;
-  };
-
   useEffect(() => {
     let cancelled = false;
 
@@ -79,13 +74,65 @@ export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include
     return () => { cancelled = true; };
   }, [scanType, include, exclude, lastNCommits, baseBranch, baseCommit]);
 
+  // Build secrets payload for API calls
+  function buildSecretsPayload() {
+    return secrets.flatMap(file =>
+      file.secrets.map(s => ({ type: s.type, file_path: file.file_path, line_number: s.line_number }))
+    );
+  }
+
+  // Build remote info using existing scm detection
+  function getRemoteBody() {
+    const service = detectRemote();
+    const repo = detectRepoName();
+    if (!service || !repo) return null;
+    return { service, repo, base_url: detectBaseUrl() };
+  }
+
+  // Fire-and-forget block event + exit 1
+  function reportBlockAndExit() {
+    const remote = getRemoteBody();
+    if (remote) {
+      fetchApi('/extension/push-protection/event', 'POST', {
+        ...remote,
+        secrets: buildSecretsPayload(),
+      }).catch(() => {});
+    }
+    setTimeout(() => { process.exitCode = 1; exit(new Error('Secrets detected')); }, 100);
+  }
+
+  // Handle bypass selection
+  async function handleBypassSelect(reason) {
+    if (reason === 'cancel') {
+      reportBlockAndExit();
+      return;
+    }
+    const remote = getRemoteBody();
+    if (remote) {
+      try {
+        await fetchApi('/extension/push-protection/bypass', 'POST', {
+          ...remote,
+          secrets: buildSecretsPayload(),
+          reason: reason.startsWith('other:') ? 'other' : reason,
+          custom_reason: reason.startsWith('other:') ? reason.slice(6) : undefined,
+        });
+      } catch {
+        reportBlockAndExit();
+        return;
+      }
+    }
+    setTimeout(() => exit(), 100);
+  }
+
   useEffect(() => {
     if (status === 'done') {
-      const hasBlockingSecrets = secrets.some(file =>
-        file.secrets.some(secret => shouldFailOn(secret.confidence_score))
-      );
-      if (hasBlockingSecrets) {
-        setTimeout(() => { process.exitCode = 1; exit(new Error('Secrets detected')); }, 100);
+      const hasSecrets = secrets.some(file => file.secrets.length > 0);
+      if (hasSecrets) {
+        if (hook && process.stdin.isTTY) {
+          setStatus('prompt_bypass');
+        } else {
+          reportBlockAndExit();
+        }
       } else {
         setTimeout(() => exit(), 100);
       }
@@ -101,7 +148,8 @@ export default function Secrets({ scanType = 'all', failOn = 'CRITICAL', include
   if (status === 'scanning') return renderScanning(startTime, fileCount, scanMeta);
   if (status === 'no_files') return renderNoFiles(scanType, lastNCommits, baseBranch, baseCommit);
   if (status === 'error') return renderError(error);
-  if (status === 'done') return renderDone(secrets, failOn, shouldFailOn, startTime, fileCount, scanMeta);
+  if (status === 'prompt_bypass') return renderBypassPrompt(secrets, handleBypassSelect);
+  if (status === 'done') return renderDone(secrets, startTime, fileCount, scanMeta);
 
   return null;
 }

package/src/components/SecretsUI.js

@@ -1,5 +1,5 @@
 import React, { useState, useEffect } from 'react';
-import { Box, Text } from 'ink';
+import { Box, Text, useInput } from 'ink';
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
@@ -7,19 +7,8 @@ const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧',
 const DIVIDER = '─'.repeat(55);
 const STEPS = ['Init', 'Fetch', 'Scan'];
 
-const CONFIDENCE_COLORS = {
-  HIGH: 'red',
-  MEDIUM: 'yellow',
-  LOW: 'cyan',
-  FALSE_POSITIVE: 'gray',
-};
-
 // ── Helpers ──────────────────────────────────────────────────────────────────
 
-function getConfidenceColor(score) {
-  return CONFIDENCE_COLORS[score?.toUpperCase()] || 'gray';
-}
-
 function padEnd(str, len) {
   return str + ' '.repeat(Math.max(0, len - str.length));
 }
@@ -211,22 +200,13 @@ export function renderNotLoggedIn() {
   );
 }
 
-export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount, meta) {
+export function renderDone(secrets, startTime, fileCount, meta) {
   const allSecrets = secrets.flatMap(file =>
     file.secrets.map(s => ({ ...s, file_path: file.file_path }))
   );
 
-  const blockingSecrets = allSecrets.filter(s => shouldFailOn(s.confidence_score));
-  const hasBlocking = blockingSecrets.length > 0;
   const elapsed = startTime ? formatElapsed(startTime) : null;
 
-  // Count by confidence
-  const counts = {};
-  allSecrets.forEach(s => {
-    const conf = s.confidence_score?.toUpperCase() || 'UNKNOWN';
-    counts[conf] = (counts[conf] || 0) + 1;
-  });
-
   // Group by file
   const grouped = {};
   allSecrets.forEach(s => {
@@ -269,9 +249,6 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
       ));
 
       fileSecrets.forEach((secret, si) => {
-        const conf = secret.confidence_score?.toUpperCase() || 'UNKNOWN';
-        const confColor = getConfidenceColor(conf);
-        const isBlocking = shouldFailOn(secret.confidence_score);
         const isLast = si === fileSecrets.length - 1;
         const branch = isLast ? '└─' : '├─';
         const lineStr = secret.line_number ? `L${secret.line_number}` : '';
@@ -279,12 +256,8 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
         els.push(React.createElement(
           Box, { key: `s-${fi}-${si}` },
           React.createElement(Text, { color: 'gray' }, `    ${branch} `),
-          React.createElement(Text, {
-            color: confColor,
-            bold: isBlocking,
-          }, padEnd(conf, 16)),
           React.createElement(Text, { color: 'gray' }, padEnd(lineStr, 6)),
-          React.createElement(Text, { color: isBlocking ? 'white' : 'gray', dimColor: !isBlocking }, secret.type || ''),
+          React.createElement(Text, { color: 'white' }, secret.type || ''),
         ));
       });
 
@@ -330,28 +303,17 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
 
   // Secret stats line
   if (allSecrets.length > 0) {
-    const stats = [`${allSecrets.length} secret${allSecrets.length !== 1 ? 's' : ''} found`];
-    for (const conf of ['HIGH', 'MEDIUM', 'LOW', 'FALSE_POSITIVE']) {
-      if (counts[conf]) {
-        const label = conf === 'FALSE_POSITIVE' ? 'false positive' : conf.toLowerCase();
-        stats.push(`${counts[conf]} ${label}`);
-      }
-    }
     els.push(React.createElement(
-      Text, { key: 'stats', color: 'gray' }, stats.join('  ·  '),
+      Text, { key: 'stats', color: 'gray' },
+      `${allSecrets.length} secret${allSecrets.length !== 1 ? 's' : ''} found`,
     ));
   }
 
   // Status line
-  if (hasBlocking) {
+  if (allSecrets.length > 0) {
     els.push(React.createElement(
       Text, { key: 'status', color: 'red', bold: true },
-      `✗ ${blockingSecrets.length} blocking secret${blockingSecrets.length !== 1 ? 's' : ''} — remove before committing`,
-    ));
-  } else if (allSecrets.length > 0) {
-    els.push(React.createElement(
-      Text, { key: 'status', color: 'green', bold: true },
-      '✓ No blocking secrets found',
+      `✗ ${allSecrets.length} secret${allSecrets.length !== 1 ? 's' : ''} found — remove before committing`,
     ));
   } else {
     els.push(React.createElement(
@@ -364,3 +326,89 @@ export function renderDone(secrets, failOn, shouldFailOn, startTime, fileCount,
     Box, { flexDirection: 'column', paddingX: 1, paddingY: 1 }, ...els,
   );
 }
+
+
+// ── Bypass Prompt ───────────────────────────────────────────────────────────
+
+function BypassPrompt({ secrets, onSelect }) {
+  const [selected, setSelected] = React.useState(0);
+  const [mode, setMode] = React.useState('menu'); // 'menu' | 'typing'
+  const [customReason, setCustomReason] = React.useState('');
+  const allSecrets = secrets.flatMap(file =>
+    file.secrets.map(s => ({ ...s, file_path: file.file_path }))
+  );
+
+  const options = [
+    { label: "It's a false positive", value: 'false_positive' },
+    { label: "It's used in tests", value: 'used_in_tests' },
+    { label: "I'll fix it later", value: 'fix_later' },
+    { label: 'Other (type your reason)', value: 'other' },
+    { label: 'Cancel \u2014 block this push', value: 'cancel' },
+  ];
+
+  useInput((input, key) => {
+    if (mode === 'menu') {
+      if (key.upArrow) {
+        setSelected(s => (s - 1 + options.length) % options.length);
+      } else if (key.downArrow) {
+        setSelected(s => (s + 1) % options.length);
+      } else if (key.return) {
+        if (options[selected].value === 'other') {
+          setMode('typing');
+        } else {
+          onSelect(options[selected].value);
+        }
+      }
+    } else {
+      // typing mode
+      if (key.return) {
+        const reason = customReason.trim();
+        if (reason) {
+          onSelect('other:' + reason);
+        }
+      } else if (key.escape) {
+        setMode('menu');
+        setCustomReason('');
+      } else if (key.backspace || key.delete) {
+        setCustomReason(s => s.slice(0, -1));
+      } else if (input && !key.ctrl && !key.meta) {
+        setCustomReason(s => s + input);
+      }
+    }
+  });
+
+  const els = [];
+  els.push(React.createElement(Text, { key: 'div-top', color: 'gray', dimColor: true }, DIVIDER));
+  els.push(React.createElement(
+    Text, { key: 'title', color: 'yellow', bold: true },
+    `${allSecrets.length} secret(s) detected. Select an action:`,
+  ));
+  els.push(React.createElement(Text, { key: 'sp' }, ''));
+
+  if (mode === 'menu') {
+    options.forEach((opt, i) => {
+      const prefix = i === selected ? '> ' : '  ';
+      const color = i === selected ? 'cyan' : 'white';
+      els.push(React.createElement(
+        Text, { key: `opt-${i}`, color, bold: i === selected },
+        `${prefix}${opt.label}`,
+      ));
+    });
+  } else {
+    els.push(React.createElement(Text, { key: 'typing-label', color: 'cyan' }, '  Type your reason (Enter to submit, Esc to go back):'));
+    els.push(React.createElement(Text, { key: 'typing-sp' }, ''));
+    els.push(React.createElement(
+      Text, { key: 'typing-input', color: 'white' },
+      `  > ${customReason}\u2588`,
+    ));
+  }
+
+  els.push(React.createElement(Text, { key: 'sp2' }, ''));
+  els.push(React.createElement(Text, { key: 'div-bot', color: 'gray', dimColor: true }, DIVIDER));
+
+  return React.createElement(Box, { flexDirection: 'column', paddingX: 1, paddingY: 1 }, ...els);
+}
+
+export function renderBypassPrompt(secrets, onSelect) {
+  return React.createElement(BypassPrompt, { secrets, onSelect });
+}

package/src/index.js

@@ -10,6 +10,7 @@ import GetBaseUrl from './commands/getBaseUrl.js';
 import Login from './commands/login.js';
 import Logout from './commands/logout.js';
 import Review from './commands/review.js';
+import { runReviewHeadless } from './reviewHeadless.js';
 import Welcome from './components/Welcome.js';
 import * as scm from './scm/index.js';
 import { setConfigValue } from './utils/config.js';
@@ -58,9 +59,9 @@ program
   .option('--last-n-commits <n>', 'Scan last n commits (max 5)', parseInt)
   .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
   .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
-  .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
+  .option('--hook', 'Running from pre-push hook (enables bypass prompt)')
   .action((options) => {
     let scanType = 'all';
     let lastNCommits = 1;
@@ -95,9 +96,7 @@ program
       ? (Array.isArray(options.exclude) ? options.exclude : splitGlobs(options.exclude))
       : [];
 
-    const failOn = options.failOn?.toUpperCase() || 'CRITICAL';
-
-    render(React.createElement(Secrets, { scanType, failOn, include, exclude, lastNCommits, baseBranch, baseCommit }));
+    render(React.createElement(Secrets, { scanType, include, exclude, lastNCommits, baseBranch, baseCommit, hook: options.hook }));
   });
 
 program
@@ -114,7 +113,8 @@ program
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
-  .action((options) => {
+  .option('--headless', 'Output clean JSON with no spinners (for agents and CI)')
+  .action(async (options) => {
     let scanType = 'all';
     let lastNCommits = 1;
     let baseBranch = null;
@@ -150,7 +150,23 @@ program
 
     const failOn = options.failOn?.toUpperCase() || 'CRITICAL';
 
-    render(React.createElement(Review, { scanType, lastNCommits, failOn, include, exclude, baseBranch, baseCommit }));
+    if (options.headless) {
+      const result = await runReviewHeadless({
+        workspacePath: process.cwd(),
+        scanType,
+        lastNCommits,
+        include,
+        exclude,
+        baseBranch,
+        baseCommit,
+        onProgress: (msg) => console.error(`[progress] ${msg}`),
+        onFilesReady: (files, meta) => console.error(`[files] Reviewing ${files.length} file(s)`),
+      });
+      console.log(JSON.stringify(result, null, 2));
+      process.exit(result.error ? 1 : 0);
+    } else {
+      render(React.createElement(Review, { scanType, lastNCommits, failOn, include, exclude, baseBranch, baseCommit }));
+    }
   });
 
 program

package/src/reviewHeadless.js

@@ -126,9 +126,9 @@ export async function runReviewHeadless(options = {}) {
 
     onProgress(`Analyzing ${perFileRequests.length} file${perFileRequests.length !== 1 ? 's' : ''} in parallel...`);
 
-    // ── Per-file agent turn loops (parallel) ────────────────────────────
+    // ── Per-file agent turn loops (parallel, fault-tolerant) ─────────────
     const perFileResults = await Promise.all(
-      perFileRequests.map((fileReq) => {
+      perFileRequests.map(async (fileReq) => {
         const filename = fileReq._filename;
         delete fileReq._filename;
 
@@ -138,7 +138,15 @@ export async function runReviewHeadless(options = {}) {
         }
         delete fileReq.file_contents;
 
-        return runTurnLoop(fileReq, gitRoot, false);
+        try {
+          onProgress(`Reviewing ${filename}...`);
+          const result = await runTurnLoop(fileReq, gitRoot, false);
+          onProgress(`Done reviewing ${filename}`);
+          return result;
+        } catch (err) {
+          console.error(`[error] Failed to review ${filename}: ${err.message}`);
+          return { finalMessage: null, finalOutput: null };
+        }
       })
     );
 
@@ -149,20 +157,26 @@ export async function runReviewHeadless(options = {}) {
       output: perFileResults[i].finalOutput,
     })).filter(r => r.output?.code_suggestions?.length > 0);
 
-    // ── Per-file reflector loops (parallel) ──────────────────────────────
-    onProgress('Running reflector...');
+    onProgress(`${perFileWithSuggestions.length} file(s) have suggestions, running reflector...`);
+
+    // ── Per-file reflector loops (parallel, fault-tolerant) ──────────────
     const reflectorResults = await Promise.all(
-      perFileWithSuggestions.map(({ diff_content, suggestions }) =>
-        runTurnLoop(
-          {
-            diff_content,
-            prompt_template_name: 'reflector',
-            extra_variables: { suggestion_str: suggestions },
-          },
-          gitRoot,
-          true
-        )
-      )
+      perFileWithSuggestions.map(async ({ diff_content, suggestions }, i) => {
+        try {
+          return await runTurnLoop(
+            {
+              diff_content,
+              prompt_template_name: 'reflector',
+              extra_variables: { suggestion_str: suggestions },
+            },
+            gitRoot,
+            true
+          );
+        } catch (err) {
+          console.error(`[error] Reflector failed for file ${i}: ${err.message}`);
+          return { finalMessage: null, finalOutput: null };
+        }
+      })
     );
 
     // ── Parse results ───────────────────────────────────────────────────

package/src/scm/index.js

@@ -95,3 +95,10 @@ export function listCodeReviews(opts) { return getProvider(opts.remote).listCode
 export function getCodeReview(opts) { return getProvider(opts.remote).getCodeReview(opts); }
 export function searchComments(opts) { return getProvider(opts.remote).searchComments(opts); }
 export function resolveConversation(opts) { return getProvider(opts.remote).resolveConversation(opts); }
+
+// Auto-detect base URL (git host) from origin
+export function detectBaseUrl() {
+  const origin = getOrigin();
+  if (!origin) return '';
+  const host = parseOriginUrl(origin); return host ? 'https://' + host : '';
+}

package/src/utils/fetchApi.js

@@ -23,6 +23,11 @@ const fetchApi = async (endpoint, method = 'GET', body = null) => {
 
   try {
     const response = await fetch(url, options);
+
+    if (response.status === 403) {
+      throw new Error('Access denied (403). Please run `codeant logout` and then `codeant login` to re-authenticate.');
+    }
+
     const data = await response.json();
 
     if (!response.ok) {

package/src/utils/installPushProtectionHook.js

@@ -3,32 +3,29 @@ import { readFileSync, writeFileSync, chmodSync, existsSync, unlinkSync, mkdirSy
 import path from 'path';
 
 const HOOK_MARKER = '# codeant-push-protection';
+const HOOK_MARKER_END = '# end-codeant-push-protection';
 
 /**
  * Build the full pre-push hook script (with shebang).
- * @param {string} failOn - Severity threshold (e.g. "HIGH", "CRITICAL")
  */
-function buildHookScript(failOn = 'HIGH') {
+function buildHookScript() {
   return `#!/bin/sh
-${buildHookBlock(failOn)}
+${buildHookBlock()}
 `;
 }
 
 /**
  * Build just the CodeAnt block (no shebang), used when appending to an existing hook.
- * @param {string} failOn - Severity threshold
  */
-function buildHookBlock(failOn = 'HIGH') {
+function buildHookBlock() {
   return `${HOOK_MARKER}
 # Auto-installed by CodeAnt AI — blocks pushes containing secrets.
 # To disable: delete this hook or run "codeant push-protection disable"
 command -v codeant >/dev/null 2>&1 || exit 0
-codeant secrets --committed --fail-on ${failOn}
+codeant secrets --committed --hook
 ${HOOK_MARKER_END}`;
 }
 
-const HOOK_MARKER_END = '# end-codeant-push-protection';
-
 /**
  * Replace the CodeAnt block in a hook file with new content (or remove it).
  */
@@ -37,7 +34,6 @@ function replaceCodeAntBlock(fileContent, newBlock) {
   let endIdx = fileContent.indexOf(HOOK_MARKER_END);
   if (startIdx === -1) return fileContent;
   if (endIdx === -1) {
-    // Legacy hook without end marker — remove from start marker to EOF
     endIdx = fileContent.length;
   } else {
     endIdx += HOOK_MARKER_END.length;
@@ -85,13 +81,9 @@ function getHooksDir(gitRoot) {
  * Install a pre-push hook that runs secret scanning before push.
  *
  * @param {string} workspacePath - Path to the git repository
- * @param {object} [options]
- * @param {string} [options.failOn="HIGH"] - Severity threshold
  * @returns {{ installed: boolean, hookPath: string|null, message: string }}
  */
-export function installPushProtectionHook(workspacePath, options = {}) {
-  const { failOn = 'HIGH' } = options;
-
+export function installPushProtectionHook(workspacePath) {
   const gitRoot = findGitRoot(workspacePath);
   if (!gitRoot) {
     return { installed: false, hookPath: null, message: 'Not a git repository' };
@@ -108,19 +100,24 @@ export function installPushProtectionHook(workspacePath, options = {}) {
     const existing = readFileSync(hookPath, 'utf-8');
     if (existing.includes(HOOK_MARKER)) {
       // Replace only our block, preserve everything else
-      const updated = replaceCodeAntBlock(existing, buildHookBlock(failOn));
+      const updated = replaceCodeAntBlock(existing, buildHookBlock());
       writeFileSync(hookPath, updated, 'utf-8');
       chmodSync(hookPath, 0o755);
       return { installed: true, hookPath, message: 'Hook updated' };
     }
-    // There's a user-managed hook — append our block (no duplicate shebang)
-    const appended = existing.trimEnd() + '\n\n' + buildHookBlock(failOn) + '\n';
+    // There's a user-managed hook — append only for shell hooks to avoid breaking non-shell scripts
+    const firstLine = existing.split('\n', 1)[0] || '';
+    const isShellHook = firstLine.startsWith('#!') ? /\/(ba|z|k)?sh(\s|$)/.test(firstLine) : true;
+    if (!isShellHook) {
+      return { installed: false, hookPath, message: 'Existing pre-push hook is non-shell; cannot append CodeAnt block safely' };
+    }
+    const appended = existing.trimEnd() + '\n\n' + buildHookBlock() + '\n';
     writeFileSync(hookPath, appended, 'utf-8');
     chmodSync(hookPath, 0o755);
     return { installed: true, hookPath, message: 'Hook appended to existing pre-push' };
   }
 
-  writeFileSync(hookPath, buildHookScript(failOn), 'utf-8');
+  writeFileSync(hookPath, buildHookScript(), 'utf-8');
   chmodSync(hookPath, 0o755);
   return { installed: true, hookPath, message: 'Hook installed' };
 }
@@ -152,7 +149,6 @@ export function removePushProtectionHook(workspacePath) {
   // Remove our block (between start and end markers)
   const remaining = replaceCodeAntBlock(content, '').trim();
   if (!remaining || remaining === '#!/bin/sh') {
-    // Nothing left — delete the file
     unlinkSync(hookPath);
     return { removed: true, message: 'Hook removed' };
   }

package/src/utils/secretsDetector.js

@@ -185,7 +185,6 @@ export function scanFile(filePath, content) {
         type: rule.id,
         description: rule.description,
         line_number: lineNum,
-        confidence_score: rule.entropy > 0 ? 'HIGH' : 'MEDIUM',
         secret_snippet: maskSecret(secret),
       });
     }