javi-forge 1.25.0 → 1.26.0

package/dist/commands/hooks/sections/secrets.d.ts

@@ -0,0 +1,58 @@
+/**
+ * L1 secret-scan section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-secrets` into TypeScript. The
+ * bash body built the staged-file list with `git diff --cached --name-only`
+ * and then piped it through `xargs git diff` (pre-commit-secrets:52) — a
+ * whitespace split that silently dropped any path containing a space and
+ * swallowed the git error with `|| true` (K-005). This port builds the staged
+ * list NUL-safe (`-z` → split on `"\0"`) and passes each filename as a SEPARATE
+ * argv element to `git diff` (no shell, no xargs), so a path like
+ * `app secrets.env` is scanned as ONE path and can never be split.
+ *
+ * A matched pattern in an ADDED diff line blocks the commit (ok:false).
+ */
+import type { HookSection } from "../../hooks.js";
+/** ARG_MAX guard: cap the number of file paths per `git diff` argv batch. */
+export declare const DEFAULT_CHUNK_SIZE = 512;
+/**
+ * maxBuffer for the content `git diff` read. Node's default is 1 MiB; a staged
+ * diff larger than that rejects and (caught) blocks every large legitimate
+ * commit with a cryptic buffer error. Raise the ceiling to a generous but
+ * BOUNDED 64 MiB so ordinary large commits scan, while a genuinely pathological
+ * diff still fails closed instead of exhausting memory.
+ */
+export declare const DIFF_MAX_BUFFER: number;
+interface Finding {
+    file: string;
+    line: number;
+    pattern: string;
+}
+export interface SecretsSectionDeps {
+    /** argv-only exec (no shell). Defaults to the real `git` via execFileAsync. */
+    execFile: (cmd: string, args: string[], opts?: {
+        cwd?: string;
+        maxBuffer?: number;
+    }) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    log: (msg: string) => void;
+    /** File-count per `git diff` batch (ARG_MAX guard). Defaults to 512. */
+    chunkSize: number;
+}
+/**
+ * Walk a unified diff and report every ADDED line (`+`, never `+++`) that
+ * matches a secret pattern, tracking the new-file path and line number so a
+ * finding reads `path:line pattern`.
+ */
+export declare function scanDiff(diff: string): Finding[];
+/**
+ * The `secrets` section factory. Injectable seams default to the real
+ * `git`-via-execFileAsync implementation; tests pass mocks. A thrown git error
+ * becomes a blocking `{ ok: false }` (never an unhandled rejection), matching
+ * the ciSection/tddSection hardening.
+ */
+export declare function secretsSection(overrides?: Partial<SecretsSectionDeps>): HookSection;
+export {};
+//# sourceMappingURL=secrets.d.ts.map

package/dist/commands/hooks/sections/secrets.js

@@ -0,0 +1,182 @@
+/**
+ * L1 secret-scan section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-secrets` into TypeScript. The
+ * bash body built the staged-file list with `git diff --cached --name-only`
+ * and then piped it through `xargs git diff` (pre-commit-secrets:52) — a
+ * whitespace split that silently dropped any path containing a space and
+ * swallowed the git error with `|| true` (K-005). This port builds the staged
+ * list NUL-safe (`-z` → split on `"\0"`) and passes each filename as a SEPARATE
+ * argv element to `git diff` (no shell, no xargs), so a path like
+ * `app secrets.env` is scanned as ONE path and can never be split.
+ *
+ * A matched pattern in an ADDED diff line blocks the commit (ok:false).
+ */
+import { execFileAsync } from "../../../lib/exec.js";
+/**
+ * Ported from `templates/security-hooks/pre-commit-secrets` SECRET_PATTERNS.
+ * bash `(?i)` → the JS `/i` flag; bash `\x27` (a single quote) → a literal `'`.
+ * No `/g` flag is used, so `.test()` never carries `lastIndex` state between
+ * lines. Order is preserved from the bash array.
+ */
+const SECRET_PATTERNS = [
+    // AWS access key id
+    { name: "aws-access-key", re: /AKIA[0-9A-Z]{16}/ },
+    // Generic API keys / tokens assigned to key-like vars
+    {
+        name: "generic-api-key",
+        re: /(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token)\s*[:=]\s*["'][A-Za-z0-9+/=_-]{20,}["']/i,
+    },
+    // Private key headers
+    {
+        name: "private-key",
+        re: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+    },
+    // GitHub tokens
+    { name: "github-token", re: /gh[pousr]_[A-Za-z0-9_]{36,}/ },
+    // Generic password assignments
+    {
+        name: "password-assignment",
+        re: /(password|passwd|pwd)\s*[:=]\s*["'][^\s"']{8,}["']/i,
+    },
+    // Slack tokens
+    { name: "slack-token", re: /xox[baprs]-[0-9a-zA-Z-]+/ },
+    // Stripe keys
+    { name: "stripe-secret-key", re: /sk_live_[0-9a-zA-Z]{24,}/ },
+    { name: "stripe-restricted-key", re: /rk_live_[0-9a-zA-Z]{24,}/ },
+    // SendGrid
+    {
+        name: "sendgrid-key",
+        re: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/,
+    },
+];
+/** ARG_MAX guard: cap the number of file paths per `git diff` argv batch. */
+export const DEFAULT_CHUNK_SIZE = 512;
+/**
+ * maxBuffer for the content `git diff` read. Node's default is 1 MiB; a staged
+ * diff larger than that rejects and (caught) blocks every large legitimate
+ * commit with a cryptic buffer error. Raise the ceiling to a generous but
+ * BOUNDED 64 MiB so ordinary large commits scan, while a genuinely pathological
+ * diff still fails closed instead of exhausting memory.
+ */
+export const DIFF_MAX_BUFFER = 64 * 1024 * 1024;
+function defaultDeps() {
+    return {
+        execFile: async (cmd, args, opts) => {
+            const { stdout, stderr } = await execFileAsync(cmd, args, opts);
+            return { stdout: String(stdout), stderr: String(stderr) };
+        },
+        log: (m) => console.log(m),
+        chunkSize: DEFAULT_CHUNK_SIZE,
+    };
+}
+/** NUL-safe staged-file list (`-z` → split on "\0", drop the trailing empty). */
+async function stagedFiles(deps, projectDir) {
+    const { stdout } = await deps.execFile("git", ["diff", "--cached", "--name-only", "--diff-filter=ACM", "-z"], { cwd: projectDir });
+    return stdout.split("\0").filter((f) => f.length > 0);
+}
+function chunk(items, size) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+/**
+ * Walk a unified diff and report every ADDED line (`+`, never `+++`) that
+ * matches a secret pattern, tracking the new-file path and line number so a
+ * finding reads `path:line pattern`.
+ */
+export function scanDiff(diff) {
+    const findings = [];
+    let currentFile = "";
+    let newLine = 0;
+    for (const line of diff.split("\n")) {
+        if (line.startsWith("+++ ")) {
+            const p = line.slice(4).trim();
+            currentFile = p === "/dev/null" ? "" : p.replace(/^b\//, "");
+            continue;
+        }
+        if (line.startsWith("--- "))
+            continue;
+        const hunk = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
+        if (hunk) {
+            newLine = Number.parseInt(hunk[1], 10);
+            continue;
+        }
+        if (line.startsWith("diff --git") ||
+            line.startsWith("index ") ||
+            line.startsWith("old mode") ||
+            line.startsWith("new mode") ||
+            line.startsWith("similarity ") ||
+            line.startsWith("rename ") ||
+            line.startsWith("new file") ||
+            line.startsWith("deleted file")) {
+            continue;
+        }
+        if (line.startsWith("+")) {
+            const content = line.slice(1);
+            for (const { name, re } of SECRET_PATTERNS) {
+                if (re.test(content)) {
+                    findings.push({ file: currentFile, line: newLine, pattern: name });
+                }
+            }
+            newLine++;
+        }
+        else if (line.startsWith("-")) {
+            // removed line — does not advance the new-file line counter
+        }
+        else {
+            // context (leading space) or blank line
+            newLine++;
+        }
+    }
+    return findings;
+}
+/**
+ * The `secrets` section factory. Injectable seams default to the real
+ * `git`-via-execFileAsync implementation; tests pass mocks. A thrown git error
+ * becomes a blocking `{ ok: false }` (never an unhandled rejection), matching
+ * the ciSection/tddSection hardening.
+ */
+export function secretsSection(overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    return {
+        id: "secrets",
+        blocking: true,
+        async run({ projectDir }) {
+            try {
+                const files = await stagedFiles(deps, projectDir);
+                if (files.length === 0)
+                    return { ok: true };
+                const findings = [];
+                for (const batch of chunk(files, deps.chunkSize)) {
+                    // `--no-color` is MANDATORY: under `color.ui=always` (or
+                    // `color.diff=always`) git emits ANSI escapes even to a pipe, so
+                    // added lines render as `\x1b[32m+secret\x1b[m` and both the
+                    // `+`/`+++ ` line checks in scanDiff fail — the scanner would then
+                    // find zero secrets and fail OPEN. Forcing color off keeps the diff
+                    // plain-text and the scan deterministic.
+                    const { stdout } = await deps.execFile("git", ["diff", "--no-color", "--cached", "--", ...batch], { cwd: projectDir, maxBuffer: DIFF_MAX_BUFFER });
+                    findings.push(...scanDiff(stdout));
+                }
+                if (findings.length === 0)
+                    return { ok: true };
+                const summary = findings
+                    .slice(0, 10)
+                    .map((f) => `${f.file || "<staged>"}:${f.line} ${f.pattern}`)
+                    .join("; ");
+                return {
+                    ok: false,
+                    detail: `${findings.length} potential secret(s): ${summary}`,
+                };
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    detail: e instanceof Error ? e.message : String(e),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/commands/hooks.d.ts

@@ -10,12 +10,15 @@
  * behavior); a config that FAILS to validate exits 1 — a broken config never
  * silently skips a gate.
  *
- * S1a scope: only the `ci` section has a body. The tdd/secrets/permissions/deps
- * sections have no factory yet (they land in S3/S4); an enabled-but-unregistered
- * feature is skipped by `composeSections` until its slice wires a factory.
+ * S1a/S3/S4 scope: the `ci`, `tdd`, `secrets`, `permissions` and `deps`
+ * sections all have factories now. `composeSections` still skips any enabled
+ * feature with no registered factory, so a future feature can land the same
+ * way.
  */
 import { type CIHooksConfig } from "../lib/ci-config.js";
+import type { Stack } from "../types/index.js";
 import { runCI } from "./ci.js";
+import { getTddTestCommand } from "./tdd.js";
 /** A single composable unit of hook work. */
 export interface HookSection {
     /** stable id — "secrets" | "permissions" | "tdd" | "deps" | "ci" */
@@ -41,6 +44,39 @@ export type HookName = "pre-commit" | "pre-push";
  * in later slices.
  */
 export declare function composeSections(name: HookName, config: CIHooksConfig | null, registry: SectionRegistry): HookSection[];
+/**
+ * Injectable seams for the `tdd` section. The section resolves the project's
+ * test command at HOOK-RUN time (never interpolated into a file), so the stack
+ * detector, the command resolver and the command runner are all overridable in
+ * tests. Every field defaults to the real implementation in `defaultRegistry`.
+ */
+export interface TddSectionDeps {
+    /** Only the stack + build tool are consumed — the wider CIStackInfo is fine. */
+    detectStack: (projectDir: string) => Promise<{
+        stackType: Stack;
+        buildTool: string;
+    }>;
+    resolveTestCmd: typeof getTddTestCommand;
+    runCommand: (cmd: string, projectDir: string) => Promise<{
+        ok: boolean;
+        detail?: string;
+    }>;
+    log: (msg: string) => void;
+}
+/**
+ * The `tdd` section: at hook-run time it detects the stack, resolves the stack
+ * test command and runs it. A null command (no test runner configured) is NOT a
+ * failure — it prints an honest skip notice and returns ok:true (parity with the
+ * old warning-only generated hook). A missing test runner must never block a
+ * commit or push. When the command resolves it runs and its exit code decides.
+ */
+export declare function tddSection(deps: TddSectionDeps): HookSection;
+/**
+ * The default section registry: the real `ci` and `tdd` factories. `tddDeps`
+ * overrides the tdd section's seams in tests (stack/command/runner); every
+ * omitted seam falls back to the real implementation.
+ */
+export declare function defaultRegistry(runCIImpl: typeof runCI, log: (msg: string) => void, tddDeps?: Partial<TddSectionDeps>): SectionRegistry;
 /** Resolve the parsed `hooks:` config for a project (null → default [ci]). */
 export declare function loadHooksConfig(projectDir: string): Promise<CIHooksConfig | null>;
 /** Injectable seams for tests; every field defaults to the real implementation. */

package/dist/commands/hooks.js

@@ -10,12 +10,18 @@
  * behavior); a config that FAILS to validate exits 1 — a broken config never
  * silently skips a gate.
  *
- * S1a scope: only the `ci` section has a body. The tdd/secrets/permissions/deps
- * sections have no factory yet (they land in S3/S4); an enabled-but-unregistered
- * feature is skipped by `composeSections` until its slice wires a factory.
+ * S1a/S3/S4 scope: the `ci`, `tdd`, `secrets`, `permissions` and `deps`
+ * sections all have factories now. `composeSections` still skips any enabled
+ * feature with no registered factory, so a future feature can land the same
+ * way.
  */
+import { spawn } from "node:child_process";
 import { findCIConfig, loadCIConfig, } from "../lib/ci-config.js";
-import { runCI } from "./ci.js";
+import { detectCIStack, runCI } from "./ci.js";
+import { depsSection } from "./hooks/sections/deps.js";
+import { permissionsSection } from "./hooks/sections/permissions.js";
+import { secretsSection } from "./hooks/sections/secrets.js";
+import { getTddTestCommand } from "./tdd.js";
 /** Fixed cheap→expensive order per hook (deterministic is a feature). */
 const PRE_COMMIT_ORDER = ["secrets", "permissions", "tdd", "ci"];
 const PRE_PUSH_ORDER = ["deps", "tdd", "ci"];
@@ -114,8 +120,89 @@ function reportStep(step, log) {
     else if (step.status === "warning")
         log(`  ⚠ ${step.label}`);
 }
-function defaultRegistry(runCIImpl, log) {
-    return { ci: () => ciSection(runCIImpl, log) };
+/**
+ * Run a resolved test command through `bash -c`, matching the rest of the
+ * codebase's project-command idiom (`runStep` in ci.ts). `getTddTestCommand`
+ * only ever returns a fixed, controlled set of commands (`npm test`,
+ * `<buildTool> run test`, `pytest`, `go test ./...`) — never user input — so
+ * `bash -c` introduces no injection vector, and it fixes native Windows where
+ * `npm`/`pnpm`/`yarn` are `.cmd` shims that a shell-less `spawn` cannot exec
+ * (ENOENT). A non-zero exit or a spawn error is a blocking failure; a passing
+ * command is ok:true.
+ */
+function runTestCommand(cmd, projectDir) {
+    return new Promise((resolve) => {
+        const proc = spawn("bash", ["-c", cmd], {
+            cwd: projectDir,
+            stdio: "inherit",
+            env: { ...process.env, CI: "true" },
+        });
+        proc.on("close", (code) => resolve(code === 0
+            ? { ok: true }
+            : { ok: false, detail: `tests failed (exit ${code ?? "unknown"})` }));
+        proc.on("error", (e) => resolve({
+            ok: false,
+            detail: e instanceof Error ? e.message : String(e),
+        }));
+    });
+}
+/**
+ * The `tdd` section: at hook-run time it detects the stack, resolves the stack
+ * test command and runs it. A null command (no test runner configured) is NOT a
+ * failure — it prints an honest skip notice and returns ok:true (parity with the
+ * old warning-only generated hook). A missing test runner must never block a
+ * commit or push. When the command resolves it runs and its exit code decides.
+ */
+export function tddSection(deps) {
+    return {
+        id: "tdd",
+        blocking: true,
+        async run({ projectDir }) {
+            // A thrown detector / resolver / runner must NEVER propagate out of the
+            // section — an unhandled rejection would crash the hook (raw stack trace)
+            // and, for an advisory pre-push tdd:"warn", would BLOCK the push,
+            // violating the advisory-never-blocks invariant. Mirror ciSection: on a
+            // throw, report a blocking-mappable failure instead.
+            try {
+                const { stackType, buildTool } = await deps.detectStack(projectDir);
+                const testCmd = await deps.resolveTestCmd(stackType, buildTool, projectDir);
+                if (testCmd === null) {
+                    deps.log(`  ⓘ tdd: no test command detected for stack '${stackType}' — skipping (a missing test runner does not block).`);
+                    return { ok: true };
+                }
+                deps.log(`  ▶ tdd: ${testCmd}`);
+                return await deps.runCommand(testCmd, projectDir);
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    detail: e instanceof Error ? e.message : String(e),
+                };
+            }
+        },
+    };
+}
+/**
+ * The default section registry: the real `ci` and `tdd` factories. `tddDeps`
+ * overrides the tdd section's seams in tests (stack/command/runner); every
+ * omitted seam falls back to the real implementation.
+ */
+export function defaultRegistry(runCIImpl, log, tddDeps = {}) {
+    return {
+        ci: () => ciSection(runCIImpl, log),
+        tdd: () => tddSection({
+            detectStack: tddDeps.detectStack ?? detectCIStack,
+            resolveTestCmd: tddDeps.resolveTestCmd ?? getTddTestCommand,
+            runCommand: tddDeps.runCommand ?? runTestCommand,
+            log: tddDeps.log ?? log,
+        }),
+        // S4 security sections. Each resolves its git/fs/exec seams at run time
+        // via the section's own defaults; unit tests inject mocks by importing
+        // the factory directly (see src/commands/hooks/sections/*.test.ts).
+        secrets: () => secretsSection({ log }),
+        permissions: () => permissionsSection({ log }),
+        deps: () => depsSection({ log }),
+    };
 }
 /** Resolve the parsed `hooks:` config for a project (null → default [ci]). */
 export async function loadHooksConfig(projectDir) {

package/dist/commands/init/steps/security.d.ts

@@ -1,28 +1,18 @@
 import type { StepFn } from "../types.js";
 /**
- * Step 14: Scaffold security hooks.
+ * Step 14: Scaffold security hooks (hook-consolidation S4 fold).
  *
  * - When options.securityHooks is false, reports "skipped".
- * - When SECURITY_HOOKS_DIR templates are missing, reports "error".
- * - Otherwise copies the 6-layer git security hooks into
- *   ci-local/hooks/security/ (skipping existing files, chmod 0755) and copies
- *   the kiteguard-style runtime settings to .claude/settings.json when absent.
+ * - Otherwise:
+ *   1. Copies the kiteguard-style runtime settings to `.claude/settings.json`
+ *      when absent (KEPT — this is a real feature).
+ *   2. Merges the `hooks:` security sections for the selected reliability
+ *      profile into `.javi-forge/ci.yaml` via `setHookFeature` (creating a
+ *      minimal `version: 2` config when absent). The dispatcher composes these
+ *      sections at hook-run time (see src/commands/hooks.ts).
+ * - The old inert `ci-local/hooks/security/` git-hook copy is GONE (those hook
+ *   bodies were ported to TypeScript sections in S4).
  * - Errors are swallowed and reported as status:"error" — never thrown.
- *
- * Extracted VERBATIM from src/commands/init.ts (PR 5 of 6).
- * Grouped with stepHookProfile for cohesion — both manage ci-local/hooks/.
  */
 export declare const stepSecurityHooks: StepFn;
-/**
- * Step 14b: Write hook reliability profile.
- *
- * - When options.securityHooks is false, reports "skipped".
- * - Otherwise writes ci-local/hooks/profile.json with the resolved profile
- *   (defaults to "standard" when hookProfile is undefined).
- * - Errors are swallowed and reported as status:"error" — never thrown.
- *
- * Extracted VERBATIM from src/commands/init.ts (PR 5 of 6).
- * Grouped with stepSecurityHooks for cohesion — both manage ci-local/hooks/.
- */
-export declare const stepHookProfile: StepFn;
 //# sourceMappingURL=security.d.ts.map

package/dist/commands/init/steps/security.js

@@ -1,103 +1,83 @@
 import path from "node:path";
 import fs from "fs-extra";
 import { SECURITY_HOOKS_DIR } from "../../../constants.js";
+import { setHookFeature } from "../../../lib/ci-config.js";
 import { ensureDirExists } from "../../../lib/common.js";
 import { report } from "../report.js";
 /**
- * Step 14: Scaffold security hooks.
+ * Hook-feature preset per reliability profile (hook-consolidation S4).
  *
- * - When options.securityHooks is false, reports "skipped".
- * - When SECURITY_HOOKS_DIR templates are missing, reports "error".
- * - Otherwise copies the 6-layer git security hooks into
- *   ci-local/hooks/security/ (skipping existing files, chmod 0755) and copies
- *   the kiteguard-style runtime settings to .claude/settings.json when absent.
- * - Errors are swallowed and reported as status:"error" — never thrown.
- *
- * Extracted VERBATIM from src/commands/init.ts (PR 5 of 6).
- * Grouped with stepHookProfile for cohesion — both manage ci-local/hooks/.
+ * The old `stepHookProfile` wrote a `ci-local/hooks/profile.json` that had ZERO
+ * runtime readers (design D7). The selector is repurposed: the chosen profile
+ * now drives WHICH `hooks:` security sections get merged into
+ * `.javi-forge/ci.yaml`, using the EXISTING `HookProfile` values (no "relaxed"):
+ *   - strict   → secrets + permissions + deps (every section)
+ *   - standard → secrets + deps
+ *   - minimal  → CI gate only (no security sections)
  */
-export const stepSecurityHooks = async (ctx) => {
-    const { projectDir, dryRun, onStep, options } = ctx;
-    const { securityHooks } = options;
-    const stepId = "security-hooks";
-    report(onStep, stepId, "Scaffold security hooks", "running");
-    try {
-        if (securityHooks) {
-            if (await fs.pathExists(SECURITY_HOOKS_DIR)) {
-                if (!dryRun) {
-                    // Copy 6-layer git security hooks into ci-local/hooks/security/
-                    const secHooksDest = path.join(projectDir, "ci-local", "hooks", "security");
-                    await ensureDirExists(secHooksDest);
-                    const hookFiles = await fs.readdir(SECURITY_HOOKS_DIR);
-                    const gitHooks = hookFiles.filter((f) => !f.endsWith(".json"));
-                    for (const hook of gitHooks) {
-                        const src = path.join(SECURITY_HOOKS_DIR, hook);
-                        const dest = path.join(secHooksDest, hook);
-                        await fs.copy(src, dest, { overwrite: false });
-                        await fs.chmod(dest, 0o755);
-                    }
-                    // Copy runtime security settings (kiteguard-style) to .claude/
-                    const settingsSrc = path.join(SECURITY_HOOKS_DIR, "claude-settings-security.json");
-                    if (await fs.pathExists(settingsSrc)) {
-                        const claudeDir = path.join(projectDir, ".claude");
-                        await ensureDirExists(claudeDir);
-                        const settingsDest = path.join(claudeDir, "settings.json");
-                        if (!(await fs.pathExists(settingsDest))) {
-                            await fs.copy(settingsSrc, settingsDest);
-                        }
-                    }
-                }
-                report(onStep, stepId, "Scaffold security hooks", "done", dryRun
-                    ? "dry-run: would scaffold security hooks"
-                    : "6 git layers + runtime hooks");
-            }
-            else {
-                report(onStep, stepId, "Scaffold security hooks", "error", "security-hooks templates not found");
-            }
-        }
-        else {
-            report(onStep, stepId, "Scaffold security hooks", "skipped", "not selected");
-        }
-    }
-    catch (e) {
-        report(onStep, stepId, "Scaffold security hooks", "error", String(e));
-    }
+const PROFILE_PRESET = {
+    minimal: { preCommit: [], prePush: [] },
+    standard: { preCommit: ["secrets"], prePush: ["deps"] },
+    strict: { preCommit: ["secrets", "permissions"], prePush: ["deps"] },
 };
 /**
- * Step 14b: Write hook reliability profile.
+ * Step 14: Scaffold security hooks (hook-consolidation S4 fold).
  *
  * - When options.securityHooks is false, reports "skipped".
- * - Otherwise writes ci-local/hooks/profile.json with the resolved profile
- *   (defaults to "standard" when hookProfile is undefined).
+ * - Otherwise:
+ *   1. Copies the kiteguard-style runtime settings to `.claude/settings.json`
+ *      when absent (KEPT — this is a real feature).
+ *   2. Merges the `hooks:` security sections for the selected reliability
+ *      profile into `.javi-forge/ci.yaml` via `setHookFeature` (creating a
+ *      minimal `version: 2` config when absent). The dispatcher composes these
+ *      sections at hook-run time (see src/commands/hooks.ts).
+ * - The old inert `ci-local/hooks/security/` git-hook copy is GONE (those hook
+ *   bodies were ported to TypeScript sections in S4).
  * - Errors are swallowed and reported as status:"error" — never thrown.
- *
- * Extracted VERBATIM from src/commands/init.ts (PR 5 of 6).
- * Grouped with stepSecurityHooks for cohesion — both manage ci-local/hooks/.
  */
-export const stepHookProfile = async (ctx) => {
+export const stepSecurityHooks = async (ctx) => {
     const { projectDir, dryRun, onStep, options } = ctx;
     const { securityHooks, hookProfile } = options;
-    const stepId = "hook-profile";
-    report(onStep, stepId, "Write hook reliability profile", "running");
+    const stepId = "security-hooks";
+    report(onStep, stepId, "Scaffold security hooks", "running");
     try {
-        if (securityHooks) {
-            if (!dryRun) {
-                const hooksDir = path.join(projectDir, "ci-local", "hooks");
-                await ensureDirExists(hooksDir);
-                const profilePath = path.join(hooksDir, "profile.json");
-                const resolvedProfile = hookProfile ?? "standard";
-                await fs.writeJson(profilePath, { profile: resolvedProfile }, { spaces: 2 });
+        if (!securityHooks) {
+            report(onStep, stepId, "Scaffold security hooks", "skipped", "not selected");
+            return;
+        }
+        const profile = hookProfile ?? "standard";
+        const preset = PROFILE_PRESET[profile];
+        if (dryRun) {
+            report(onStep, stepId, "Scaffold security hooks", "done", `dry-run: would merge ${profile} hooks preset + copy .claude/settings.json`);
+            return;
+        }
+        // 1. Copy the kiteguard-style runtime security settings to .claude/.
+        const settingsSrc = path.join(SECURITY_HOOKS_DIR, "claude-settings-security.json");
+        if (await fs.pathExists(settingsSrc)) {
+            const claudeDir = path.join(projectDir, ".claude");
+            await ensureDirExists(claudeDir);
+            const settingsDest = path.join(claudeDir, "settings.json");
+            if (!(await fs.pathExists(settingsDest))) {
+                await fs.copy(settingsSrc, settingsDest);
             }
-            report(onStep, stepId, "Write hook reliability profile", "done", dryRun
-                ? `dry-run: would write profile.json (${hookProfile ?? "standard"})`
-                : `ci-local/hooks/profile.json (${hookProfile ?? "standard"})`);
         }
-        else {
-            report(onStep, stepId, "Write hook reliability profile", "skipped", "security hooks not selected");
+        // 2. Merge the profile's security sections into .javi-forge/ci.yaml.
+        for (const feature of preset.preCommit) {
+            await setHookFeature(projectDir, "pre-commit", feature, true);
+        }
+        for (const feature of preset.prePush) {
+            await setHookFeature(projectDir, "pre-push", feature, true);
         }
+        const merged = [
+            ...preset.preCommit.map((f) => `pre-commit.${f}`),
+            ...preset.prePush.map((f) => `pre-push.${f}`),
+        ];
+        report(onStep, stepId, "Scaffold security hooks", "done", merged.length > 0
+            ? `${profile} preset: ${merged.join(", ")}`
+            : `${profile} preset: CI gate only (no security sections)`);
     }
     catch (e) {
-        report(onStep, stepId, "Write hook reliability profile", "error", String(e));
+        report(onStep, stepId, "Scaffold security hooks", "error", String(e));
     }
 };
 //# sourceMappingURL=security.js.map

package/dist/commands/init.js

@@ -14,7 +14,7 @@ import { stepManifest } from "./init/steps/manifest.js";
 import { stepMemory } from "./init/steps/memory.js";
 import { stepMock } from "./init/steps/mock.js";
 import { stepSDD } from "./init/steps/sdd.js";
-import { stepHookProfile, stepSecurityHooks } from "./init/steps/security.js";
+import { stepSecurityHooks } from "./init/steps/security.js";
 /**
  * Main init orchestrator: bootstraps a project with CI, git hooks,
  * memory module, AI config sync, SDD, ghagga, and friends.
@@ -43,7 +43,6 @@ export async function initProject(options, onStep) {
     await stepClaudeMd(ctx);
     await stepDockerDeploy(ctx);
     await stepSecurityHooks(ctx);
-    await stepHookProfile(ctx);
     await stepCodeGraph(ctx);
     await stepLocalAi(ctx);
     await stepAgentSkills(ctx);

package/dist/commands/tdd.d.ts

@@ -1,21 +1,7 @@
 import type { Stack } from "../types/index.js";
-export interface TddHookResult {
-    installed: string[];
-    errors: string[];
-}
 /**
  * Resolve the correct test command for TDD hook based on stack and build tool.
  * Returns null if no test command can be determined.
  */
 export declare function getTddTestCommand(stack: Stack, buildTool: string, projectDir: string): Promise<string | null>;
-/**
- * Generate a TDD-enforcing pre-commit hook script.
- * If testCmd is null, generates a warning-only hook.
- */
-export declare function generateTddHook(testCmd: string | null, stack: Stack): string;
-/**
- * Install TDD pre-commit hook into .git/hooks/.
- * Detects the project stack automatically and generates the appropriate hook.
- */
-export declare function installTddHooks(projectDir: string): Promise<TddHookResult>;
 //# sourceMappingURL=tdd.d.ts.map