javi-forge 1.25.0 → 1.26.0

package/dist/cli/dispatch/tdd.d.ts

@@ -2,9 +2,12 @@
  * `javi-forge tdd <init|pipeline>` handler.
  *
  * Console-only (no Ink, no React, no CIContextProvider).
- * Lazy-loads ./commands/tdd.js or ./commands/tdd-pipeline.js INSIDE the function
- * to preserve cold-start performance — heavy command modules MUST NOT be
- * eager-imported at the top of this file.
+ *
+ * hook-consolidation S3: the handlers no longer WRITE `.git/hooks` themselves.
+ * They flip the `hooks.*.tdd` flag in `.javi-forge/ci.yaml` and delegate the
+ * hook install to the hardened `installCIHooks` — the single writer of
+ * `.git/hooks`. Heavy modules are lazy-imported INSIDE the function to preserve
+ * cold-start performance.
  */
 import type { CLI } from "./types.js";
 export declare function handleTdd(cli: CLI): Promise<void>;

package/dist/cli/dispatch/tdd.js

@@ -2,43 +2,74 @@
  * `javi-forge tdd <init|pipeline>` handler.
  *
  * Console-only (no Ink, no React, no CIContextProvider).
- * Lazy-loads ./commands/tdd.js or ./commands/tdd-pipeline.js INSIDE the function
- * to preserve cold-start performance — heavy command modules MUST NOT be
- * eager-imported at the top of this file.
+ *
+ * hook-consolidation S3: the handlers no longer WRITE `.git/hooks` themselves.
+ * They flip the `hooks.*.tdd` flag in `.javi-forge/ci.yaml` and delegate the
+ * hook install to the hardened `installCIHooks` — the single writer of
+ * `.git/hooks`. Heavy modules are lazy-imported INSIDE the function to preserve
+ * cold-start performance.
  */
+/** Surface an installCIHooks result to the console (notes → backups → installed
+ * → upgraded → errors), matching the `ci init` output contract. */
+function reportInstall(result) {
+    for (const note of result.notes) {
+        console.log(`ℹ ${note}`);
+    }
+    for (const backup of result.backups) {
+        console.log(`⚠ Backed up the previous hook → ${backup}`);
+    }
+    if (result.installed.length > 0) {
+        console.log(`✓ Installed git hooks: ${result.installed.join(", ")}`);
+    }
+    for (const hook of result.upgraded) {
+        const was = result.states.find((entry) => entry.name === hook)?.state;
+        console.log(`↑ Upgraded ${hook}${was === undefined ? "" : ` (was ${was})`}`);
+    }
+    for (const err of result.errors) {
+        console.error(`✗ ${err}`);
+    }
+}
 export async function handleTdd(cli) {
-    if (cli.input[1] === "init") {
-        const { installTddHooks } = await import("../../commands/tdd.js");
-        const { installed, errors } = await installTddHooks(process.cwd());
-        if (installed.length > 0) {
-            console.log(`\u2713 Installed TDD hooks: ${installed.join(", ")}`);
-            console.log("  Pre-commit hook enforces tests must pass before commit");
-        }
-        for (const err of errors) {
-            console.error(`\u2717 ${err}`);
-        }
-        process.exit(errors.length > 0 ? 1 : 0);
-    }
-    else if (cli.input[1] === "pipeline") {
-        const { installTddPipelineHook } = await import("../../commands/tdd-pipeline.js");
+    const sub = cli.input[1];
+    const force = cli.flags.force === true;
+    if (sub === "init") {
+        const { setHookFeature } = await import("../../lib/ci-config.js");
+        const { installCIHooks } = await import("../../commands/ci.js");
+        // Install FIRST: installCIHooks writes generic static shims and does not
+        // depend on the tdd flag (the flag is read at hook-RUN time). Only once the
+        // managed hook is actually in place do we flip the config — otherwise a
+        // refused install (foreign hook / husky core.hooksPath) would leave ci.yaml
+        // claiming tdd:true while no managed hook exists.
+        const result = await installCIHooks(process.cwd(), { force });
+        reportInstall(result);
+        if (result.errors.length > 0)
+            process.exit(1);
+        const configPath = await setHookFeature(process.cwd(), "pre-commit", "tdd", true);
+        console.log(`✓ Enabled TDD in ${configPath} (hooks.pre-commit.tdd: true)`);
+        console.log("  The pre-commit hook now runs the stack test command via the dispatcher.");
+        process.exit(0);
+    }
+    else if (sub === "pipeline") {
         const mode = cli.flags.mode === "warn" ? "warn" : "strict";
-        const result = await installTddPipelineHook(process.cwd(), mode);
-        if (result.installed.length > 0) {
-            console.log(`\u2713 Installed TDD pipeline hook: ${result.installed.join(", ")} [${result.mode}]`);
-            console.log(`  Pre-push hook enforces TDD pipeline (${result.mode} mode)`);
-        }
-        for (const skip of result.skipped) {
-            console.log(`\u26A0 ${skip}`);
-        }
-        for (const err of result.errors) {
-            console.error(`\u2717 ${err}`);
-        }
-        process.exit(result.errors.length > 0 ? 1 : 0);
+        const { setHookFeature } = await import("../../lib/ci-config.js");
+        const { installCIHooks } = await import("../../commands/ci.js");
+        // Install FIRST (see `init` above): never leave the config ahead of a
+        // refused install.
+        const result = await installCIHooks(process.cwd(), { force });
+        reportInstall(result);
+        if (result.errors.length > 0)
+            process.exit(1);
+        const configPath = await setHookFeature(process.cwd(), "pre-push", "tdd", mode);
+        console.log(`✓ Enabled TDD pipeline in ${configPath} (hooks.pre-push.tdd: ${mode})`);
+        console.log(mode === "warn"
+            ? "  The pre-push hook runs tests as an ADVISORY section (never blocks)."
+            : "  The pre-push hook BLOCKS the push when tests fail.");
+        process.exit(0);
     }
     else {
         console.error("Usage: javi-forge tdd <command>");
-        console.error("  init      Install TDD-enforcing pre-commit hook");
-        console.error("  pipeline  Install TDD pipeline pre-push hook (--mode strict|warn)");
+        console.error("  init      Enable the TDD pre-commit section and install the managed hooks");
+        console.error("  pipeline  Enable the TDD pre-push section (--mode strict|warn)");
         process.exit(1);
     }
 }

package/dist/cli/help.d.ts

@@ -8,7 +8,7 @@
  * Help banner shown by meow when `--help` is passed or invalid args are supplied.
  * Multi-line template literal — preserve exact formatting (whitespace is significant).
  */
-export declare const HELP_TEXT = "\n  Usage\n    $ javi-forge [command] [options]\n\n  Commands\n    init              Bootstrap a new project (default)\n    ci                Run CI simulation (lint + compile + test + security + ghagga)\n    ci validate       Validate .javi-forge/ci.yaml without running anything\n    ci init           Install git hooks that call javi-forge ci\n    tdd init          Install TDD-enforcing pre-commit hook (auto-detects stack)\n    tdd pipeline      Install TDD pipeline pre-push hook (--mode strict|warn)\n    hooks run         Run a git hook's composed sections (pre-commit | pre-push)\n    analyze           Run repoforge skills analysis\n    doctor            Show health report\n    workflow show     Render a workflow graph as ASCII (--template <name> or file path)\n    workflow validate Validate project state against a workflow graph\n    workflow list     List available workflows and built-in templates\n    plugin add        Install a plugin from GitHub (org/repo)\n    plugin remove     Remove an installed plugin\n    plugin list       List installed plugins\n    plugin search     Search the plugin registry\n    plugin validate   Validate a local plugin directory\n    plugin sync       Auto-detect and wire installed plugins\n    plugin export     Export plugin to Agent Skills spec format (skills.json)\n    plugin export     --codex: Export plugin to Codex-compatible TOML subagent files\n    plugin export-skills  Generate aggregated skills.json from all installed plugins\n    plugin export-skills global  Generate global skills.json from all globally installed plugins\n    plugin import     Import an Agent Skills spec package as a javi-forge plugin\n    skills doctor     Show skills health report (add --deep for conflict detection)\n    skills budget     Show token cost of loaded skills (add -b N for custom budget)\n    skills score      Score a skill on quality dimensions (completeness, clarity, testability, token-efficiency)\n    skills benchmark  Benchmark a skill with structural quality checks\n    skills auto       Auto-detect project stack and suggest/install matching AI skills\n    skills auto-install  Alias for skills auto\n    skill publish     Package a skill directory for marketplace distribution (generates plugin.json)\n    security baseline   Create security baseline from current audit findings\n    security check      Check for regressions against baseline (exits non-zero if found)\n    security update     Re-snapshot baseline (acknowledge current vulns)\n    security allowlist  Add all current findings to the allowlist (suppress in future checks)\n    llms-txt          Generate AI-friendly llms.txt for current project\n\n  Options\n    --dry-run       Preview changes without writing files\n    --stack         Project stack (node, python, go, rust, java-gradle, java-maven, elixir)\n    --ci            CI provider (github, gitlab, woodpecker)\n    --memory        Memory module (engram, obsidian-brain, memory-simple, none)\n    --project-name  Project name (skips name prompt)\n    --ghagga        Enable GHAGGA review system\n    --mock          Enable mock-first mode (no real API keys needed)\n    --local-ai      Include local AI dev stack (Ollama + Docker Compose)\n    --batch         Non-interactive mode (auto-proceed, no keyboard input)\n    --deep          Enable deep analysis (conflict + duplicate detection)\n    --budget, -b    Token budget limit for skills (default: 8000)\n    --skills-dir    Custom skills directory path\n    --author        Author name for skill publish\n    --repo          Repository URL for skill publish\n    --version       Show version\n    --help          Show this help\n\n  CI options (javi-forge ci)\n    --quick         Lint + compile only (fast, for pre-commit)\n    --shell         Open interactive shell in CI container\n    --detect        Show detected stack and exit\n    --config PATH   Load ordered CI runners from a versioned config file\n                    (default discovery: .javi-forge/ci.yaml)\n    --stack STACK   Force a single explicit stack (single-stack repos only \u2014\n                    insufficient for hybrid repos; use --config instead)\n    --no-docker     Run commands natively (no Docker)\n    --no-ci-ghagga  Skip GHAGGA review\n    --no-security   Skip Semgrep security scan\n    --timeout N     Per-step timeout in seconds (default: 600)\n\n  CI hooks (javi-forge ci init)\n    Install git hooks that call javi-forge ci.\n    No files copied \u2014 hooks reference the global CLI.\n    Existing hooks javi-forge did not write are refused, never clobbered.\n    --force         Overwrite a foreign or locally modified hook. The previous\n                    content is copied to a .bak sibling first; if that backup\n                    cannot be written, the hook is left untouched. Symlinked\n                    hook paths are refused even with --force.\n\n  Examples\n    $ javi-forge\n    $ javi-forge init --dry-run\n    $ javi-forge init --stack node --ci github\n    $ javi-forge ci\n    $ javi-forge ci init\n    $ javi-forge ci init --force\n    $ javi-forge tdd init\n    $ javi-forge ci --quick\n    $ javi-forge ci --no-ci-ghagga --no-security\n    $ javi-forge ci --no-docker\n    $ javi-forge ci --shell\n    $ javi-forge ci --config .javi-forge/ci.yaml\n    $ javi-forge ci validate\n    $ javi-forge ci --help\n    $ javi-forge analyze\n    $ javi-forge doctor\n    $ javi-forge plugin add mapbox/agent-skills\n    $ javi-forge plugin list\n";
+export declare const HELP_TEXT = "\n  Usage\n    $ javi-forge [command] [options]\n\n  Commands\n    init              Bootstrap a new project (default)\n    ci                Run CI simulation (lint + compile + test + security + ghagga)\n    ci validate       Validate .javi-forge/ci.yaml without running anything\n    ci init           Install git hooks that call javi-forge ci\n    tdd init          Enable the TDD pre-commit section + install managed hooks\n    tdd pipeline      Enable the TDD pre-push section (--mode strict|warn)\n    hooks run         Run a git hook's composed sections (pre-commit | pre-push)\n    analyze           Run repoforge skills analysis\n    doctor            Show health report\n    workflow show     Render a workflow graph as ASCII (--template <name> or file path)\n    workflow validate Validate project state against a workflow graph\n    workflow list     List available workflows and built-in templates\n    plugin add        Install a plugin from GitHub (org/repo)\n    plugin remove     Remove an installed plugin\n    plugin list       List installed plugins\n    plugin search     Search the plugin registry\n    plugin validate   Validate a local plugin directory\n    plugin sync       Auto-detect and wire installed plugins\n    plugin export     Export plugin to Agent Skills spec format (skills.json)\n    plugin export     --codex: Export plugin to Codex-compatible TOML subagent files\n    plugin export-skills  Generate aggregated skills.json from all installed plugins\n    plugin export-skills global  Generate global skills.json from all globally installed plugins\n    plugin import     Import an Agent Skills spec package as a javi-forge plugin\n    skills doctor     Show skills health report (add --deep for conflict detection)\n    skills budget     Show token cost of loaded skills (add -b N for custom budget)\n    skills score      Score a skill on quality dimensions (completeness, clarity, testability, token-efficiency)\n    skills benchmark  Benchmark a skill with structural quality checks\n    skills auto       Auto-detect project stack and suggest/install matching AI skills\n    skills auto-install  Alias for skills auto\n    skill publish     Package a skill directory for marketplace distribution (generates plugin.json)\n    security baseline   Create security baseline from current audit findings\n    security check      Check for regressions against baseline (exits non-zero if found)\n    security update     Re-snapshot baseline (acknowledge current vulns)\n    security allowlist  Add all current findings to the allowlist (suppress in future checks)\n    llms-txt          Generate AI-friendly llms.txt for current project\n\n  Options\n    --dry-run       Preview changes without writing files\n    --stack         Project stack (node, python, go, rust, java-gradle, java-maven, elixir)\n    --ci            CI provider (github, gitlab, woodpecker)\n    --memory        Memory module (engram, obsidian-brain, memory-simple, none)\n    --project-name  Project name (skips name prompt)\n    --ghagga        Enable GHAGGA review system\n    --mock          Enable mock-first mode (no real API keys needed)\n    --local-ai      Include local AI dev stack (Ollama + Docker Compose)\n    --batch         Non-interactive mode (auto-proceed, no keyboard input)\n    --deep          Enable deep analysis (conflict + duplicate detection)\n    --budget, -b    Token budget limit for skills (default: 8000)\n    --skills-dir    Custom skills directory path\n    --author        Author name for skill publish\n    --repo          Repository URL for skill publish\n    --version       Show version\n    --help          Show this help\n\n  CI options (javi-forge ci)\n    --quick         Lint + compile only (fast, for pre-commit)\n    --shell         Open interactive shell in CI container\n    --detect        Show detected stack and exit\n    --config PATH   Load ordered CI runners from a versioned config file\n                    (default discovery: .javi-forge/ci.yaml)\n    --stack STACK   Force a single explicit stack (single-stack repos only \u2014\n                    insufficient for hybrid repos; use --config instead)\n    --no-docker     Run commands natively (no Docker)\n    --no-ci-ghagga  Skip GHAGGA review\n    --no-security   Skip Semgrep security scan\n    --timeout N     Per-step timeout in seconds (default: 600)\n\n  CI hooks (javi-forge ci init)\n    Install git hooks that call javi-forge ci.\n    No files copied \u2014 hooks reference the global CLI.\n    Existing hooks javi-forge did not write are refused, never clobbered.\n    --force         Overwrite a foreign or locally modified hook. The previous\n                    content is copied to a .bak sibling first; if that backup\n                    cannot be written, the hook is left untouched. Symlinked\n                    hook paths are refused even with --force.\n\n  Examples\n    $ javi-forge\n    $ javi-forge init --dry-run\n    $ javi-forge init --stack node --ci github\n    $ javi-forge ci\n    $ javi-forge ci init\n    $ javi-forge ci init --force\n    $ javi-forge tdd init\n    $ javi-forge ci --quick\n    $ javi-forge ci --no-ci-ghagga --no-security\n    $ javi-forge ci --no-docker\n    $ javi-forge ci --shell\n    $ javi-forge ci --config .javi-forge/ci.yaml\n    $ javi-forge ci validate\n    $ javi-forge ci --help\n    $ javi-forge analyze\n    $ javi-forge doctor\n    $ javi-forge plugin add mapbox/agent-skills\n    $ javi-forge plugin list\n";
 /**
  * Per-command help for `ci`, shown by `javi-forge ci --help` (or when `ci` is
  * given an unknown subcommand). Kept consistent with the global HELP_TEXT

package/dist/cli/help.js

@@ -17,8 +17,8 @@ export const HELP_TEXT = `
     ci                Run CI simulation (lint + compile + test + security + ghagga)
     ci validate       Validate .javi-forge/ci.yaml without running anything
     ci init           Install git hooks that call javi-forge ci
-    tdd init          Install TDD-enforcing pre-commit hook (auto-detects stack)
-    tdd pipeline      Install TDD pipeline pre-push hook (--mode strict|warn)
+    tdd init          Enable the TDD pre-commit section + install managed hooks
+    tdd pipeline      Enable the TDD pre-push section (--mode strict|warn)
     hooks run         Run a git hook's composed sections (pre-commit | pre-push)
     analyze           Run repoforge skills analysis
     doctor            Show health report

package/dist/commands/ci.js

@@ -269,11 +269,21 @@ export async function resolveCIRunners(projectDir, options = {}) {
     const configPath = config ?? (await findCIConfig(projectDir));
     if (configPath) {
         const ciConfig = await loadCIConfig(configPath);
-        const runners = [];
-        for (const runnerConfig of ciConfig.runners) {
-            runners.push(await resolveConfiguredRunner(projectDir, runnerConfig));
+        const hasRunners = ciConfig.runners.length > 0;
+        const hasGates = (ciConfig.gates ?? []).length > 0;
+        // A config that declares runners OR gates is a genuine "user configured CI"
+        // signal: resolve it as the `config` source (a gates-only v2 config keeps
+        // its zero-runner, gates-run contract — see describeRunners). A hooks-only
+        // (or otherwise empty) v2 config declares NEITHER runners NOR gates, so it
+        // must NOT suppress zero-config auto-detection: fall through so `javi-forge
+        // ci` still runs a real lint/compile/test runner instead of a no-op.
+        if (hasRunners || hasGates) {
+            const runners = [];
+            for (const runnerConfig of ciConfig.runners) {
+                runners.push(await resolveConfiguredRunner(projectDir, runnerConfig));
+            }
+            return freezeRunners("config", runners, ciConfig.gates ?? []);
         }
-        return freezeRunners("config", runners, ciConfig.gates ?? []);
     }
     // Zero-config default: single auto-detected runner (unchanged behavior).
     const info = await detectCIStack(projectDir);

package/dist/commands/doctor.d.ts

@@ -1,7 +1,15 @@
 import type { DoctorResult } from "../types/index.js";
 export type CheckStatus = "ok" | "fail" | "skip";
+interface RemoteInfo {
+    host: "github" | "gitlab" | "other";
+    owner: string;
+    repo: string;
+}
+/** Parse an origin remote URL (ssh or https) into host/owner/repo. */
+export declare function parseRemote(url: string): RemoteInfo | null;
 /**
  * Run comprehensive health checks for the project and framework.
  */
 export declare function runDoctor(projectDir?: string): Promise<DoctorResult>;
+export {};
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -34,6 +34,110 @@ async function countDir(dir) {
     const entries = await fs.readdir(dir);
     return entries.filter((e) => !e.startsWith(".")).length;
 }
+/** Read a single git config value, "" when unset or on any error. */
+async function gitConfigValue(cwd, key) {
+    try {
+        const { stdout } = await execFileAsync("git", ["config", "--get", key], {
+            cwd,
+        });
+        return stdout.trim();
+    }
+    catch {
+        return "";
+    }
+}
+/** Parse an origin remote URL (ssh or https) into host/owner/repo. */
+export function parseRemote(url) {
+    const trimmed = url.trim();
+    if (!trimmed)
+        return null;
+    // git@host:owner/repo(.git) | ssh://git@host/owner/repo | https://host/owner/repo(.git)
+    const m = trimmed.match(/(?:git@|https?:\/\/|ssh:\/\/(?:git@)?)([^/:]+)[/:]([^/]+)\/(.+?)(?:\.git)?$/);
+    if (!m)
+        return null;
+    const [, hostRaw, owner, repo] = m;
+    const host = hostRaw.includes("github")
+        ? "github"
+        : hostRaw.includes("gitlab")
+            ? "gitlab"
+            : "other";
+    return { host, owner, repo };
+}
+/**
+ * L4+L6 advisory (merged — signing is one check): report `ok` when commit
+ * signing is fully configured (`commit.gpgsign=true` AND `user.signingkey`
+ * set), otherwise `skip` with the enable snippet. Doctor is read-only — this is
+ * a recommendation, never a gate (a hook enforcing it was trivially bypassed
+ * with `--no-verify`).
+ */
+async function commitSigningCheck(cwd) {
+    const gpgSign = await gitConfigValue(cwd, "commit.gpgsign");
+    const signingKey = await gitConfigValue(cwd, "user.signingkey");
+    if (gpgSign === "true" && signingKey) {
+        return {
+            label: "Commit signing",
+            status: "ok",
+            detail: "signing enabled (commit.gpgsign=true)",
+        };
+    }
+    return {
+        label: "Commit signing",
+        status: "skip",
+        detail: "not configured — enable with: git config commit.gpgsign true && git config user.signingkey <KEY>",
+    };
+}
+/**
+ * L5 advisory: server-side branch protection is the real control (the old local
+ * push-blocking hook was CI-exempt and `--no-verify`-bypassable). When `gh` is
+ * on PATH and origin is GitHub, probe the branch protection API; a missing
+ * probe or protection is a non-alarming `skip` (advisory, not a failure).
+ * GitLab or no `gh` → `skip` with a note to verify in the forge UI.
+ */
+async function branchProtectionCheck(cwd) {
+    const remote = parseRemote(await gitConfigValue(cwd, "remote.origin.url"));
+    const label = "Branch protection";
+    if (!remote || remote.host === "other") {
+        return {
+            label,
+            status: "skip",
+            detail: "no GitHub/GitLab origin — verify branch protection in the forge UI",
+        };
+    }
+    if (remote.host === "gitlab" || !(await which("gh"))) {
+        return {
+            label,
+            status: "skip",
+            detail: "verify branch protection in the forge UI",
+        };
+    }
+    // gh + GitHub: resolve the default branch, then probe protection.
+    let branch = "main";
+    try {
+        const { stdout } = await execFileAsync("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd });
+        branch = stdout.trim().replace(/^origin\//, "") || "main";
+    }
+    catch {
+        /* fall back to main */
+    }
+    try {
+        await execFileAsync("gh", [
+            "api",
+            `repos/${remote.owner}/${remote.repo}/branches/${branch}/protection`,
+        ]);
+        return {
+            label,
+            status: "ok",
+            detail: `server-side protection enabled on ${branch}`,
+        };
+    }
+    catch {
+        return {
+            label,
+            status: "skip",
+            detail: `no server-side branch protection detected on ${branch}`,
+        };
+    }
+}
 /**
  * Run comprehensive health checks for the project and framework.
  */
@@ -76,6 +180,14 @@ export async function runDoctor(projectDir) {
         }
     }
     sections.push({ title: "System Tools", checks: toolChecks });
+    // ── 1b. Security (advisories, read-only) ────────────────────────────────────
+    // L4/L6 (commit signing) and L5 (branch protection) are advisories, NOT hooks
+    // (hook-consolidation D9): doctor reports, nothing blocks.
+    const securityChecks = [
+        await commitSigningCheck(cwd),
+        await branchProtectionCheck(cwd),
+    ];
+    sections.push({ title: "Security", checks: securityChecks });
     // ── 2. Framework Structure ─────────────────────────────────────────────────
     const structureChecks = [];
     const expectedDirs = [

package/dist/commands/hooks/sections/deps.d.ts

@@ -0,0 +1,28 @@
+/**
+ * L2 dependency-audit section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-push-deps`. Same manifest→tool ladder,
+ * run via `execFileAsync` (argv, no shell). A tool that is not installed is an
+ * advisory skip (ok:true) exactly like the bash "not installed. Skipping"
+ * branch — a missing auditor must never block a push. A genuine audit finding
+ * (the auditor ran and exited non-zero) is a blocking failure (ok:false).
+ */
+import type { HookSection } from "../../hooks.js";
+export interface DepsSectionDeps {
+    execFile: (cmd: string, args: string[], opts?: {
+        cwd?: string;
+    }) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    which: (bin: string) => Promise<boolean>;
+    fileExists: (p: string) => Promise<boolean>;
+    log: (msg: string) => void;
+}
+/**
+ * The `deps` section factory. Detects the project's manifest and runs the
+ * matching auditor. No manifest → advisory skip. A thrown error is caught and
+ * mapped to a blocking failure (never an unhandled rejection).
+ */
+export declare function depsSection(overrides?: Partial<DepsSectionDeps>): HookSection;
+//# sourceMappingURL=deps.d.ts.map

package/dist/commands/hooks/sections/deps.js

@@ -0,0 +1,126 @@
+/**
+ * L2 dependency-audit section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-push-deps`. Same manifest→tool ladder,
+ * run via `execFileAsync` (argv, no shell). A tool that is not installed is an
+ * advisory skip (ok:true) exactly like the bash "not installed. Skipping"
+ * branch — a missing auditor must never block a push. A genuine audit finding
+ * (the auditor ran and exited non-zero) is a blocking failure (ok:false).
+ */
+import path from "node:path";
+import fs from "fs-extra";
+import { execFileAsync } from "../../../lib/exec.js";
+async function whichReal(bin) {
+    try {
+        await execFileAsync("which", [bin]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultDeps() {
+    return {
+        execFile: async (cmd, args, opts) => {
+            const { stdout, stderr } = await execFileAsync(cmd, args, opts);
+            return { stdout: String(stdout), stderr: String(stderr) };
+        },
+        which: whichReal,
+        fileExists: (p) => fs.pathExists(p),
+        log: (m) => console.log(m),
+    };
+}
+/** ENOENT ⇒ the auditor binary is absent (advisory skip, never blocking). */
+function isMissingBinary(e) {
+    return e?.code === "ENOENT";
+}
+/**
+ * Run an auditor. A clean exit is ok:true; a non-zero exit (the tool ran and
+ * found something) is a blocking ok:false; a missing binary (ENOENT) is an
+ * advisory skip ok:true (parity with the bash "not installed" branch).
+ */
+async function runAudit(deps, projectDir, cmd, args) {
+    deps.log(`  ▶ ${cmd} ${args.join(" ")}`);
+    try {
+        await deps.execFile(cmd, args, { cwd: projectDir });
+        return { ok: true };
+    }
+    catch (e) {
+        if (isMissingBinary(e)) {
+            deps.log(`  ⓘ ${cmd} not installed. Skipping (does not block).`);
+            return { ok: true };
+        }
+        return {
+            ok: false,
+            detail: `high/critical vulnerabilities found (${cmd} ${args.join(" ")})`,
+        };
+    }
+}
+/**
+ * The `deps` section factory. Detects the project's manifest and runs the
+ * matching auditor. No manifest → advisory skip. A thrown error is caught and
+ * mapped to a blocking failure (never an unhandled rejection).
+ */
+export function depsSection(overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    const at = (projectDir, name) => path.join(projectDir, name);
+    return {
+        id: "deps",
+        blocking: true,
+        async run({ projectDir }) {
+            try {
+                if (await deps.fileExists(at(projectDir, "package.json"))) {
+                    if (await deps.fileExists(at(projectDir, "pnpm-lock.yaml"))) {
+                        return runAudit(deps, projectDir, "pnpm", [
+                            "audit",
+                            "--audit-level=high",
+                        ]);
+                    }
+                    if (await deps.fileExists(at(projectDir, "yarn.lock"))) {
+                        return runAudit(deps, projectDir, "yarn", [
+                            "npm",
+                            "audit",
+                            "--severity",
+                            "high",
+                        ]);
+                    }
+                    return runAudit(deps, projectDir, "npm", [
+                        "audit",
+                        "--audit-level=high",
+                    ]);
+                }
+                if ((await deps.fileExists(at(projectDir, "requirements.txt"))) ||
+                    (await deps.fileExists(at(projectDir, "pyproject.toml")))) {
+                    if (!(await deps.which("pip-audit"))) {
+                        deps.log("  ⓘ pip-audit not installed. Skipping (does not block).");
+                        return { ok: true };
+                    }
+                    return runAudit(deps, projectDir, "pip-audit", []);
+                }
+                if (await deps.fileExists(at(projectDir, "Cargo.toml"))) {
+                    if (!(await deps.which("cargo-audit"))) {
+                        deps.log("  ⓘ cargo-audit not installed. Skipping (does not block).");
+                        return { ok: true };
+                    }
+                    return runAudit(deps, projectDir, "cargo-audit", []);
+                }
+                if (await deps.fileExists(at(projectDir, "go.mod"))) {
+                    if (!(await deps.which("govulncheck"))) {
+                        deps.log("  ⓘ govulncheck not installed. Skipping (does not block).");
+                        return { ok: true };
+                    }
+                    return runAudit(deps, projectDir, "govulncheck", ["./..."]);
+                }
+                deps.log("  ⓘ no supported dependency manifest found. Skipping.");
+                return { ok: true };
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    detail: e instanceof Error ? e.message : String(e),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=deps.js.map

package/dist/commands/hooks/sections/permissions.d.ts

@@ -0,0 +1,33 @@
+/**
+ * L3 permission-boundary section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-permissions`. Builds the staged
+ * list NUL-safe (`-z` → split on "\0") and does the mode checks with `fs.stat`
+ * in TS instead of shelling out to `stat`/`grep`. Two issue classes block the
+ * commit: a world-writable file (`mode & 0o002`) and an executable
+ * (`mode & 0o111`) that is NOT an allowed script/hook/shebang file.
+ */
+import type { HookSection } from "../../hooks.js";
+export interface PermissionsSectionDeps {
+    execFile: (cmd: string, args: string[], opts?: {
+        cwd?: string;
+    }) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    /** stat a path; returns null when the file does not exist / is not a regular file. */
+    statFile: (p: string) => Promise<{
+        mode: number;
+        isFile: boolean;
+    } | null>;
+    /** first line of a file (for the shebang allowance); "" on any read error. */
+    firstLine: (p: string) => Promise<string>;
+    log: (msg: string) => void;
+}
+/**
+ * The `permissions` section factory. Injectable seams default to the real
+ * git/fs implementation. A thrown error is caught and mapped to a blocking
+ * failure (never an unhandled rejection).
+ */
+export declare function permissionsSection(overrides?: Partial<PermissionsSectionDeps>): HookSection;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/commands/hooks/sections/permissions.js

@@ -0,0 +1,101 @@
+/**
+ * L3 permission-boundary section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-permissions`. Builds the staged
+ * list NUL-safe (`-z` → split on "\0") and does the mode checks with `fs.stat`
+ * in TS instead of shelling out to `stat`/`grep`. Two issue classes block the
+ * commit: a world-writable file (`mode & 0o002`) and an executable
+ * (`mode & 0o111`) that is NOT an allowed script/hook/shebang file.
+ */
+import path from "node:path";
+import fs from "fs-extra";
+import { execFileAsync } from "../../../lib/exec.js";
+/** Extensions that legitimately carry the executable bit. */
+const SCRIPT_EXT = /\.(sh|bash|zsh|py|rb|pl)$/;
+async function statFileReal(p) {
+    try {
+        const st = await fs.stat(p);
+        return { mode: st.mode, isFile: st.isFile() };
+    }
+    catch {
+        return null;
+    }
+}
+async function firstLineReal(p) {
+    try {
+        const content = await fs.readFile(p, "utf-8");
+        return content.split("\n", 1)[0] ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function defaultDeps() {
+    return {
+        execFile: async (cmd, args, opts) => {
+            const { stdout, stderr } = await execFileAsync(cmd, args, opts);
+            return { stdout: String(stdout), stderr: String(stderr) };
+        },
+        statFile: statFileReal,
+        firstLine: firstLineReal,
+        log: (m) => console.log(m),
+    };
+}
+async function stagedFiles(deps, projectDir) {
+    const { stdout } = await deps.execFile("git", ["diff", "--cached", "--name-only", "--diff-filter=ACM", "-z"], { cwd: projectDir });
+    return stdout.split("\0").filter((f) => f.length > 0);
+}
+/**
+ * The `permissions` section factory. Injectable seams default to the real
+ * git/fs implementation. A thrown error is caught and mapped to a blocking
+ * failure (never an unhandled rejection).
+ */
+export function permissionsSection(overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    return {
+        id: "permissions",
+        blocking: true,
+        async run({ projectDir }) {
+            try {
+                const files = await stagedFiles(deps, projectDir);
+                if (files.length === 0)
+                    return { ok: true };
+                const issues = [];
+                for (const file of files) {
+                    const full = path.join(projectDir, file);
+                    const st = await deps.statFile(full);
+                    if (!st?.isFile)
+                        continue;
+                    if ((st.mode & 0o002) !== 0) {
+                        issues.push(`world-writable: ${file}`);
+                    }
+                    if ((st.mode & 0o111) !== 0) {
+                        const allowedByExt = SCRIPT_EXT.test(file);
+                        const allowedByHooksDir = file.includes("/hooks/");
+                        const allowedByShebang = allowedByExt || allowedByHooksDir
+                            ? true
+                            : (await deps.firstLine(full)).startsWith("#!");
+                        if (!allowedByExt && !allowedByHooksDir && !allowedByShebang) {
+                            issues.push(`unexpected executable: ${file}`);
+                        }
+                    }
+                }
+                if (issues.length === 0)
+                    return { ok: true };
+                return {
+                    ok: false,
+                    detail: `${issues.length} permission issue(s): ${issues
+                        .slice(0, 10)
+                        .join("; ")}`,
+                };
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    detail: e instanceof Error ? e.message : String(e),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=permissions.js.map