javi-forge 1.25.1 → 1.27.0

package/ci-local/hooks/commit-msg

@@ -1,6 +1,13 @@
 #!/bin/bash
 set -e
 # =============================================================================
+# LEGACY — retained for reference only (hook-consolidation).
+# The canonical hook mechanism is now `.git/hooks/` written by `installCIHooks`
+# (javi-forge ci init / init). The shipped commit-msg shim lives in
+# assets/hooks/commit-msg; `javi-forge init` no longer copies this directory or
+# sets `core.hooksPath=ci-local/hooks`. This body is kept for historical
+# reference and is NOT the source of truth. See docs/commands.md → hooks.
+# =============================================================================
 # COMMIT-MSG: Block accidental AI-attribution in commit messages
 # =============================================================================
 # Best-effort, NOT an adversarial-grade security control.

package/ci-local/hooks/pre-commit

@@ -1,5 +1,13 @@
 #!/bin/bash
 # =============================================================================
+# LEGACY — retained for reference only (hook-consolidation).
+# The canonical hook mechanism is now `.git/hooks/` written by `installCIHooks`
+# (javi-forge ci init / init), whose static shims exec the dispatcher
+# `javi-forge hooks run <name>`. `javi-forge init` no longer copies this
+# directory or sets `core.hooksPath=ci-local/hooks`; a repo still on that legacy
+# path is auto-migrated on the next install. This body is kept for historical
+# reference and is NOT the source of truth. See docs/commands.md → hooks.
+# =============================================================================
 # PRE-COMMIT: Quick CI check via javi-forge
 # =============================================================================
 # Requires: npm install -g javi-forge

package/ci-local/hooks/pre-push

@@ -1,5 +1,13 @@
 #!/bin/bash
 # =============================================================================
+# LEGACY — retained for reference only (hook-consolidation).
+# The canonical hook mechanism is now `.git/hooks/` written by `installCIHooks`
+# (javi-forge ci init / init), whose static shims exec the dispatcher
+# `javi-forge hooks run <name>`. `javi-forge init` no longer copies this
+# directory or sets `core.hooksPath=ci-local/hooks`; a repo still on that legacy
+# path is auto-migrated on the next install. This body is kept for historical
+# reference and is NOT the source of truth. See docs/commands.md → hooks.
+# =============================================================================
 # PRE-PUSH: Full CI simulation via javi-forge
 # =============================================================================
 # Requires: npm install -g javi-forge

package/dist/cli/dispatch/ci.js

@@ -83,7 +83,7 @@ export async function handleCi(cli, ctx) {
         }
         if (installed.length > 0) {
             console.log(`✓ Installed git hooks: ${installed.join(", ")}`);
-            console.log("  Hooks call javi-forge ci (with npx fallback)");
+            console.log("  Hooks call javi-forge hooks run (with npx fallback)");
         }
         // Upgrades are reported DISTINCTLY from fresh installs: replacing an
         // older javi-forge hook is not the same event as writing a new one.

package/dist/cli/dispatch/skills-cmd.js

@@ -57,6 +57,10 @@ export async function handleSkillsCmd(cli, ctx) {
                 console.error(`\u2717 Skill not found: ${skillPath}`);
                 process.exit(1);
             }
+            if (result.unread) {
+                console.error(`\u2717 Skill could not be scored \u2014 ${result.unread}: ${skillPath}`);
+                process.exit(1);
+            }
             console.log(`\nSkill: ${result.skillName}`);
             console.log(`  Completeness:      ${result.completeness}/100`);
             console.log(`  Clarity:           ${result.clarity}/100`);
@@ -77,6 +81,10 @@ export async function handleSkillsCmd(cli, ctx) {
             console.error(`\u2717 Skill not found: ${skillPath}`);
             process.exit(1);
         }
+        if (result.unread) {
+            console.error(`\u2717 Skill could not be benchmarked \u2014 ${result.unread}: ${skillPath}`);
+            process.exit(1);
+        }
         console.log(`\nBenchmark: ${result.skillName}`);
         for (const check of result.checks) {
             const icon = check.passed ? "\u2713" : "\u2717";

package/dist/commands/ci.js

@@ -269,11 +269,21 @@ export async function resolveCIRunners(projectDir, options = {}) {
     const configPath = config ?? (await findCIConfig(projectDir));
     if (configPath) {
         const ciConfig = await loadCIConfig(configPath);
-        const runners = [];
-        for (const runnerConfig of ciConfig.runners) {
-            runners.push(await resolveConfiguredRunner(projectDir, runnerConfig));
+        const hasRunners = ciConfig.runners.length > 0;
+        const hasGates = (ciConfig.gates ?? []).length > 0;
+        // A config that declares runners OR gates is a genuine "user configured CI"
+        // signal: resolve it as the `config` source (a gates-only v2 config keeps
+        // its zero-runner, gates-run contract — see describeRunners). A hooks-only
+        // (or otherwise empty) v2 config declares NEITHER runners NOR gates, so it
+        // must NOT suppress zero-config auto-detection: fall through so `javi-forge
+        // ci` still runs a real lint/compile/test runner instead of a no-op.
+        if (hasRunners || hasGates) {
+            const runners = [];
+            for (const runnerConfig of ciConfig.runners) {
+                runners.push(await resolveConfiguredRunner(projectDir, runnerConfig));
+            }
+            return freezeRunners("config", runners, ciConfig.gates ?? []);
         }
-        return freezeRunners("config", runners, ciConfig.gates ?? []);
     }
     // Zero-config default: single auto-detected runner (unchanged behavior).
     const info = await detectCIStack(projectDir);
@@ -477,7 +487,11 @@ export async function runCI(options, onStep, onGateOutcome) {
     try {
         const ctxResult = await refreshContextDir(projectDir);
         if (ctxResult) {
-            report(onStep, stepContext, "Refresh .context/ directory", "done", "INDEX.md + summary.md updated");
+            // An unreadable manifest is reported, not silently treated as no deps.
+            const detail = ctxResult.warnings.length > 0
+                ? `INDEX.md + summary.md updated (manifest warnings: ${ctxResult.warnings.join("; ")})`
+                : "INDEX.md + summary.md updated";
+            report(onStep, stepContext, "Refresh .context/ directory", "done", detail);
         }
         else {
             report(onStep, stepContext, "Refresh .context/ directory", "skipped", "no .context/ or no manifest");

package/dist/commands/doctor.d.ts

@@ -1,7 +1,15 @@
 import type { DoctorResult } from "../types/index.js";
 export type CheckStatus = "ok" | "fail" | "skip";
+interface RemoteInfo {
+    host: "github" | "gitlab" | "other";
+    owner: string;
+    repo: string;
+}
+/** Parse an origin remote URL (ssh or https) into host/owner/repo. */
+export declare function parseRemote(url: string): RemoteInfo | null;
 /**
  * Run comprehensive health checks for the project and framework.
  */
 export declare function runDoctor(projectDir?: string): Promise<DoctorResult>;
+export {};
 //# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.js

@@ -34,6 +34,110 @@ async function countDir(dir) {
     const entries = await fs.readdir(dir);
     return entries.filter((e) => !e.startsWith(".")).length;
 }
+/** Read a single git config value, "" when unset or on any error. */
+async function gitConfigValue(cwd, key) {
+    try {
+        const { stdout } = await execFileAsync("git", ["config", "--get", key], {
+            cwd,
+        });
+        return stdout.trim();
+    }
+    catch {
+        return "";
+    }
+}
+/** Parse an origin remote URL (ssh or https) into host/owner/repo. */
+export function parseRemote(url) {
+    const trimmed = url.trim();
+    if (!trimmed)
+        return null;
+    // git@host:owner/repo(.git) | ssh://git@host/owner/repo | https://host/owner/repo(.git)
+    const m = trimmed.match(/(?:git@|https?:\/\/|ssh:\/\/(?:git@)?)([^/:]+)[/:]([^/]+)\/(.+?)(?:\.git)?$/);
+    if (!m)
+        return null;
+    const [, hostRaw, owner, repo] = m;
+    const host = hostRaw.includes("github")
+        ? "github"
+        : hostRaw.includes("gitlab")
+            ? "gitlab"
+            : "other";
+    return { host, owner, repo };
+}
+/**
+ * L4+L6 advisory (merged — signing is one check): report `ok` when commit
+ * signing is fully configured (`commit.gpgsign=true` AND `user.signingkey`
+ * set), otherwise `skip` with the enable snippet. Doctor is read-only — this is
+ * a recommendation, never a gate (a hook enforcing it was trivially bypassed
+ * with `--no-verify`).
+ */
+async function commitSigningCheck(cwd) {
+    const gpgSign = await gitConfigValue(cwd, "commit.gpgsign");
+    const signingKey = await gitConfigValue(cwd, "user.signingkey");
+    if (gpgSign === "true" && signingKey) {
+        return {
+            label: "Commit signing",
+            status: "ok",
+            detail: "signing enabled (commit.gpgsign=true)",
+        };
+    }
+    return {
+        label: "Commit signing",
+        status: "skip",
+        detail: "not configured — enable with: git config commit.gpgsign true && git config user.signingkey <KEY>",
+    };
+}
+/**
+ * L5 advisory: server-side branch protection is the real control (the old local
+ * push-blocking hook was CI-exempt and `--no-verify`-bypassable). When `gh` is
+ * on PATH and origin is GitHub, probe the branch protection API; a missing
+ * probe or protection is a non-alarming `skip` (advisory, not a failure).
+ * GitLab or no `gh` → `skip` with a note to verify in the forge UI.
+ */
+async function branchProtectionCheck(cwd) {
+    const remote = parseRemote(await gitConfigValue(cwd, "remote.origin.url"));
+    const label = "Branch protection";
+    if (!remote || remote.host === "other") {
+        return {
+            label,
+            status: "skip",
+            detail: "no GitHub/GitLab origin — verify branch protection in the forge UI",
+        };
+    }
+    if (remote.host === "gitlab" || !(await which("gh"))) {
+        return {
+            label,
+            status: "skip",
+            detail: "verify branch protection in the forge UI",
+        };
+    }
+    // gh + GitHub: resolve the default branch, then probe protection.
+    let branch = "main";
+    try {
+        const { stdout } = await execFileAsync("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd });
+        branch = stdout.trim().replace(/^origin\//, "") || "main";
+    }
+    catch {
+        /* fall back to main */
+    }
+    try {
+        await execFileAsync("gh", [
+            "api",
+            `repos/${remote.owner}/${remote.repo}/branches/${branch}/protection`,
+        ]);
+        return {
+            label,
+            status: "ok",
+            detail: `server-side protection enabled on ${branch}`,
+        };
+    }
+    catch {
+        return {
+            label,
+            status: "skip",
+            detail: `no server-side branch protection detected on ${branch}`,
+        };
+    }
+}
 /**
  * Run comprehensive health checks for the project and framework.
  */
@@ -76,6 +180,14 @@ export async function runDoctor(projectDir) {
         }
     }
     sections.push({ title: "System Tools", checks: toolChecks });
+    // ── 1b. Security (advisories, read-only) ────────────────────────────────────
+    // L4/L6 (commit signing) and L5 (branch protection) are advisories, NOT hooks
+    // (hook-consolidation D9): doctor reports, nothing blocks.
+    const securityChecks = [
+        await commitSigningCheck(cwd),
+        await branchProtectionCheck(cwd),
+    ];
+    sections.push({ title: "Security", checks: securityChecks });
     // ── 2. Framework Structure ─────────────────────────────────────────────────
     const structureChecks = [];
     const expectedDirs = [
@@ -207,6 +319,15 @@ export async function runDoctor(projectDir) {
                 status: "ok",
                 detail: "INDEX.md + summary.md updated",
             });
+            // A manifest that could not be read is not "no dependencies" — surface
+            // each warning so an unreadable/oversized/invalid manifest is visible.
+            for (const warning of result.warnings) {
+                contextChecks.push({
+                    label: "dependency manifest",
+                    status: "fail",
+                    detail: warning,
+                });
+            }
         }
         else {
             contextChecks.push({

package/dist/commands/hooks/sections/deps.d.ts

@@ -0,0 +1,28 @@
+/**
+ * L2 dependency-audit section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-push-deps`. Same manifest→tool ladder,
+ * run via `execFileAsync` (argv, no shell). A tool that is not installed is an
+ * advisory skip (ok:true) exactly like the bash "not installed. Skipping"
+ * branch — a missing auditor must never block a push. A genuine audit finding
+ * (the auditor ran and exited non-zero) is a blocking failure (ok:false).
+ */
+import type { HookSection } from "../../hooks.js";
+export interface DepsSectionDeps {
+    execFile: (cmd: string, args: string[], opts?: {
+        cwd?: string;
+    }) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    which: (bin: string) => Promise<boolean>;
+    fileExists: (p: string) => Promise<boolean>;
+    log: (msg: string) => void;
+}
+/**
+ * The `deps` section factory. Detects the project's manifest and runs the
+ * matching auditor. No manifest → advisory skip. A thrown error is caught and
+ * mapped to a blocking failure (never an unhandled rejection).
+ */
+export declare function depsSection(overrides?: Partial<DepsSectionDeps>): HookSection;
+//# sourceMappingURL=deps.d.ts.map

package/dist/commands/hooks/sections/deps.js

@@ -0,0 +1,126 @@
+/**
+ * L2 dependency-audit section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-push-deps`. Same manifest→tool ladder,
+ * run via `execFileAsync` (argv, no shell). A tool that is not installed is an
+ * advisory skip (ok:true) exactly like the bash "not installed. Skipping"
+ * branch — a missing auditor must never block a push. A genuine audit finding
+ * (the auditor ran and exited non-zero) is a blocking failure (ok:false).
+ */
+import path from "node:path";
+import fs from "fs-extra";
+import { execFileAsync } from "../../../lib/exec.js";
+async function whichReal(bin) {
+    try {
+        await execFileAsync("which", [bin]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function defaultDeps() {
+    return {
+        execFile: async (cmd, args, opts) => {
+            const { stdout, stderr } = await execFileAsync(cmd, args, opts);
+            return { stdout: String(stdout), stderr: String(stderr) };
+        },
+        which: whichReal,
+        fileExists: (p) => fs.pathExists(p),
+        log: (m) => console.log(m),
+    };
+}
+/** ENOENT ⇒ the auditor binary is absent (advisory skip, never blocking). */
+function isMissingBinary(e) {
+    return e?.code === "ENOENT";
+}
+/**
+ * Run an auditor. A clean exit is ok:true; a non-zero exit (the tool ran and
+ * found something) is a blocking ok:false; a missing binary (ENOENT) is an
+ * advisory skip ok:true (parity with the bash "not installed" branch).
+ */
+async function runAudit(deps, projectDir, cmd, args) {
+    deps.log(`  ▶ ${cmd} ${args.join(" ")}`);
+    try {
+        await deps.execFile(cmd, args, { cwd: projectDir });
+        return { ok: true };
+    }
+    catch (e) {
+        if (isMissingBinary(e)) {
+            deps.log(`  ⓘ ${cmd} not installed. Skipping (does not block).`);
+            return { ok: true };
+        }
+        return {
+            ok: false,
+            detail: `high/critical vulnerabilities found (${cmd} ${args.join(" ")})`,
+        };
+    }
+}
+/**
+ * The `deps` section factory. Detects the project's manifest and runs the
+ * matching auditor. No manifest → advisory skip. A thrown error is caught and
+ * mapped to a blocking failure (never an unhandled rejection).
+ */
+export function depsSection(overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    const at = (projectDir, name) => path.join(projectDir, name);
+    return {
+        id: "deps",
+        blocking: true,
+        async run({ projectDir }) {
+            try {
+                if (await deps.fileExists(at(projectDir, "package.json"))) {
+                    if (await deps.fileExists(at(projectDir, "pnpm-lock.yaml"))) {
+                        return runAudit(deps, projectDir, "pnpm", [
+                            "audit",
+                            "--audit-level=high",
+                        ]);
+                    }
+                    if (await deps.fileExists(at(projectDir, "yarn.lock"))) {
+                        return runAudit(deps, projectDir, "yarn", [
+                            "npm",
+                            "audit",
+                            "--severity",
+                            "high",
+                        ]);
+                    }
+                    return runAudit(deps, projectDir, "npm", [
+                        "audit",
+                        "--audit-level=high",
+                    ]);
+                }
+                if ((await deps.fileExists(at(projectDir, "requirements.txt"))) ||
+                    (await deps.fileExists(at(projectDir, "pyproject.toml")))) {
+                    if (!(await deps.which("pip-audit"))) {
+                        deps.log("  ⓘ pip-audit not installed. Skipping (does not block).");
+                        return { ok: true };
+                    }
+                    return runAudit(deps, projectDir, "pip-audit", []);
+                }
+                if (await deps.fileExists(at(projectDir, "Cargo.toml"))) {
+                    if (!(await deps.which("cargo-audit"))) {
+                        deps.log("  ⓘ cargo-audit not installed. Skipping (does not block).");
+                        return { ok: true };
+                    }
+                    return runAudit(deps, projectDir, "cargo-audit", []);
+                }
+                if (await deps.fileExists(at(projectDir, "go.mod"))) {
+                    if (!(await deps.which("govulncheck"))) {
+                        deps.log("  ⓘ govulncheck not installed. Skipping (does not block).");
+                        return { ok: true };
+                    }
+                    return runAudit(deps, projectDir, "govulncheck", ["./..."]);
+                }
+                deps.log("  ⓘ no supported dependency manifest found. Skipping.");
+                return { ok: true };
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    detail: e instanceof Error ? e.message : String(e),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=deps.js.map

package/dist/commands/hooks/sections/permissions.d.ts

@@ -0,0 +1,33 @@
+/**
+ * L3 permission-boundary section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-permissions`. Builds the staged
+ * list NUL-safe (`-z` → split on "\0") and does the mode checks with `fs.stat`
+ * in TS instead of shelling out to `stat`/`grep`. Two issue classes block the
+ * commit: a world-writable file (`mode & 0o002`) and an executable
+ * (`mode & 0o111`) that is NOT an allowed script/hook/shebang file.
+ */
+import type { HookSection } from "../../hooks.js";
+export interface PermissionsSectionDeps {
+    execFile: (cmd: string, args: string[], opts?: {
+        cwd?: string;
+    }) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    /** stat a path; returns null when the file does not exist / is not a regular file. */
+    statFile: (p: string) => Promise<{
+        mode: number;
+        isFile: boolean;
+    } | null>;
+    /** first line of a file (for the shebang allowance); "" on any read error. */
+    firstLine: (p: string) => Promise<string>;
+    log: (msg: string) => void;
+}
+/**
+ * The `permissions` section factory. Injectable seams default to the real
+ * git/fs implementation. A thrown error is caught and mapped to a blocking
+ * failure (never an unhandled rejection).
+ */
+export declare function permissionsSection(overrides?: Partial<PermissionsSectionDeps>): HookSection;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/commands/hooks/sections/permissions.js

@@ -0,0 +1,101 @@
+/**
+ * L3 permission-boundary section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-permissions`. Builds the staged
+ * list NUL-safe (`-z` → split on "\0") and does the mode checks with `fs.stat`
+ * in TS instead of shelling out to `stat`/`grep`. Two issue classes block the
+ * commit: a world-writable file (`mode & 0o002`) and an executable
+ * (`mode & 0o111`) that is NOT an allowed script/hook/shebang file.
+ */
+import path from "node:path";
+import fs from "fs-extra";
+import { execFileAsync } from "../../../lib/exec.js";
+/** Extensions that legitimately carry the executable bit. */
+const SCRIPT_EXT = /\.(sh|bash|zsh|py|rb|pl)$/;
+async function statFileReal(p) {
+    try {
+        const st = await fs.stat(p);
+        return { mode: st.mode, isFile: st.isFile() };
+    }
+    catch {
+        return null;
+    }
+}
+async function firstLineReal(p) {
+    try {
+        const content = await fs.readFile(p, "utf-8");
+        return content.split("\n", 1)[0] ?? "";
+    }
+    catch {
+        return "";
+    }
+}
+function defaultDeps() {
+    return {
+        execFile: async (cmd, args, opts) => {
+            const { stdout, stderr } = await execFileAsync(cmd, args, opts);
+            return { stdout: String(stdout), stderr: String(stderr) };
+        },
+        statFile: statFileReal,
+        firstLine: firstLineReal,
+        log: (m) => console.log(m),
+    };
+}
+async function stagedFiles(deps, projectDir) {
+    const { stdout } = await deps.execFile("git", ["diff", "--cached", "--name-only", "--diff-filter=ACM", "-z"], { cwd: projectDir });
+    return stdout.split("\0").filter((f) => f.length > 0);
+}
+/**
+ * The `permissions` section factory. Injectable seams default to the real
+ * git/fs implementation. A thrown error is caught and mapped to a blocking
+ * failure (never an unhandled rejection).
+ */
+export function permissionsSection(overrides = {}) {
+    const deps = { ...defaultDeps(), ...overrides };
+    return {
+        id: "permissions",
+        blocking: true,
+        async run({ projectDir }) {
+            try {
+                const files = await stagedFiles(deps, projectDir);
+                if (files.length === 0)
+                    return { ok: true };
+                const issues = [];
+                for (const file of files) {
+                    const full = path.join(projectDir, file);
+                    const st = await deps.statFile(full);
+                    if (!st?.isFile)
+                        continue;
+                    if ((st.mode & 0o002) !== 0) {
+                        issues.push(`world-writable: ${file}`);
+                    }
+                    if ((st.mode & 0o111) !== 0) {
+                        const allowedByExt = SCRIPT_EXT.test(file);
+                        const allowedByHooksDir = file.includes("/hooks/");
+                        const allowedByShebang = allowedByExt || allowedByHooksDir
+                            ? true
+                            : (await deps.firstLine(full)).startsWith("#!");
+                        if (!allowedByExt && !allowedByHooksDir && !allowedByShebang) {
+                            issues.push(`unexpected executable: ${file}`);
+                        }
+                    }
+                }
+                if (issues.length === 0)
+                    return { ok: true };
+                return {
+                    ok: false,
+                    detail: `${issues.length} permission issue(s): ${issues
+                        .slice(0, 10)
+                        .join("; ")}`,
+                };
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    detail: e instanceof Error ? e.message : String(e),
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=permissions.js.map

package/dist/commands/hooks/sections/secrets.d.ts

@@ -0,0 +1,58 @@
+/**
+ * L1 secret-scan section (hook-consolidation S4).
+ *
+ * Port of `templates/security-hooks/pre-commit-secrets` into TypeScript. The
+ * bash body built the staged-file list with `git diff --cached --name-only`
+ * and then piped it through `xargs git diff` (pre-commit-secrets:52) — a
+ * whitespace split that silently dropped any path containing a space and
+ * swallowed the git error with `|| true` (K-005). This port builds the staged
+ * list NUL-safe (`-z` → split on `"\0"`) and passes each filename as a SEPARATE
+ * argv element to `git diff` (no shell, no xargs), so a path like
+ * `app secrets.env` is scanned as ONE path and can never be split.
+ *
+ * A matched pattern in an ADDED diff line blocks the commit (ok:false).
+ */
+import type { HookSection } from "../../hooks.js";
+/** ARG_MAX guard: cap the number of file paths per `git diff` argv batch. */
+export declare const DEFAULT_CHUNK_SIZE = 512;
+/**
+ * maxBuffer for the content `git diff` read. Node's default is 1 MiB; a staged
+ * diff larger than that rejects and (caught) blocks every large legitimate
+ * commit with a cryptic buffer error. Raise the ceiling to a generous but
+ * BOUNDED 64 MiB so ordinary large commits scan, while a genuinely pathological
+ * diff still fails closed instead of exhausting memory.
+ */
+export declare const DIFF_MAX_BUFFER: number;
+interface Finding {
+    file: string;
+    line: number;
+    pattern: string;
+}
+export interface SecretsSectionDeps {
+    /** argv-only exec (no shell). Defaults to the real `git` via execFileAsync. */
+    execFile: (cmd: string, args: string[], opts?: {
+        cwd?: string;
+        maxBuffer?: number;
+    }) => Promise<{
+        stdout: string;
+        stderr: string;
+    }>;
+    log: (msg: string) => void;
+    /** File-count per `git diff` batch (ARG_MAX guard). Defaults to 512. */
+    chunkSize: number;
+}
+/**
+ * Walk a unified diff and report every ADDED line (`+`, never `+++`) that
+ * matches a secret pattern, tracking the new-file path and line number so a
+ * finding reads `path:line pattern`.
+ */
+export declare function scanDiff(diff: string): Finding[];
+/**
+ * The `secrets` section factory. Injectable seams default to the real
+ * `git`-via-execFileAsync implementation; tests pass mocks. A thrown git error
+ * becomes a blocking `{ ok: false }` (never an unhandled rejection), matching
+ * the ciSection/tddSection hardening.
+ */
+export declare function secretsSection(overrides?: Partial<SecretsSectionDeps>): HookSection;
+export {};
+//# sourceMappingURL=secrets.d.ts.map