no-yolo-commits 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ataztech910
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,65 @@
+# no-yolo-commits
+
+[![npm version](https://img.shields.io/npm/v/no-yolo-commits.svg)](https://www.npmjs.com/package/no-yolo-commits)
+[![license](https://img.shields.io/npm/l/no-yolo-commits.svg)](./LICENSE)
+
+You know that feeling when you `git commit -m "fix"` straight onto `main` at 2am, staged changes you half-remember writing, and hit enter before your brain finishes the sentence "wait, should I—"?
+
+This stops that.
+
+```bash
+npx no-yolo-commits init
+```
+
+One command. Two things happen on every commit from now on:
+
+1. **An AI actually reads your diff** (via the [`claude`](https://claude.com/claude-code) CLI) and blocks the commit — but only for real, high-confidence problems. Not vibes, not "you could refactor this." Type-safety holes, bugs that will actually bite, broken framework patterns. If the reviewer is missing, slow, or having a bad day, it fails **open** — a flaky linter should never be the reason your commit is stuck.
+2. **`main` and `master` become look-but-don't-touch.** Try to commit straight there and instead of yelling at you, it just... makes you a branch. `ACME-1788716508-fix-the-thing-you-were-actually-fixing`, ready to go, commit already on it. You didn't even have to think of a branch name — the AI wrote that from your diff too.
+
+No dashboard. No config file to argue with. No dependencies at runtime — it's a ~150-line shell script wearing a `husky` trenchcoat.
+
+## Install
+
+```bash
+npx no-yolo-commits init
+```
+
+That's the whole install. It will, in order:
+
+- add `husky` as a devDependency (if you don't have it)
+- set `"scripts.prepare": "husky"` in `package.json`
+- drop `.husky/pre-commit` into your repo
+
+## Make it yours
+
+```bash
+npx no-yolo-commits init \
+  --prefix=ACME \
+  --stack="Next.js + TypeScript + Postgres" \
+  --protect=main,master,release
+```
+
+| Flag | Default | Does what it says |
+|---|---|---|
+| `--prefix` | your `package.json` name, shouted in caps | prefix for the auto-branch name |
+| `--stack` | `TypeScript` | tells the reviewer what it's actually looking at, so findings are relevant instead of generic |
+| `--protect` | `main,master` | which branches you're not allowed to just casually commit to |
+| `--force`, `-f` | off | steamroll an existing `.husky/pre-commit` |
+
+## The eject button
+
+This is a guardrail, not a cage. Bad day, emergency hotfix, you know exactly what you're doing:
+
+```bash
+git commit --no-verify
+```
+
+No questions asked. No shame either — that's what it's there for.
+
+## Why this exists
+
+Because I kept copy-pasting the same `.husky/pre-commit` into every new project and hand-editing the branch prefix like some kind of caveman. Now it's `npx` and thirty seconds.
+
+## License
+
+MIT — do whatever you want with it.

package/bin/cli.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync, spawnSync } = require('child_process');
+
+const CWD = process.cwd();
+
+function fail(msg) {
+  console.error(`✗ ${msg}`);
+  process.exit(1);
+}
+
+function parseArgs(argv) {
+  const args = { command: 'init', prefix: null, stack: 'TypeScript', protect: 'main,master', force: false };
+  const rest = [];
+  for (const a of argv) {
+    if (a === '--force' || a === '-f') args.force = true;
+    else if (a === '--help' || a === '-h') args.command = 'help';
+    else if (a.startsWith('--prefix=')) args.prefix = a.slice('--prefix='.length);
+    else if (a.startsWith('--stack=')) args.stack = a.slice('--stack='.length);
+    else if (a.startsWith('--protect=')) args.protect = a.slice('--protect='.length);
+    else rest.push(a);
+  }
+  if (rest[0]) args.command = rest[0];
+  return args;
+}
+
+function printHelp() {
+  console.log(`no-yolo-commits — an AI pre-commit reviewer + "no direct commits to main" guard
+
+Usage:
+  npx no-yolo-commits init [options]
+
+Options:
+  --prefix=NAME      Branch prefix used when auto-creating a branch off a
+                      protected branch, e.g. --prefix=ACME -> ACME-<ts>-<slug>
+                      (default: derived from package.json "name")
+  --stack=TEXT        One-line description of the project handed to the AI
+                      reviewer, e.g. --stack="Next.js + TypeScript + Postgres"
+                      (default: "TypeScript")
+  --protect=a,b,c     Comma-separated branch names that block direct commits
+                      (default: "main,master")
+  --force, -f         Overwrite an existing .husky/pre-commit
+  --help, -h          Show this help
+
+Requires the \`claude\` CLI on PATH to actually run the AI review — if it's
+missing, the hook warns and lets the commit through (fails open).`);
+}
+
+function readPackageJson() {
+  const pkgPath = path.join(CWD, 'package.json');
+  if (!fs.existsSync(pkgPath)) {
+    fail('No package.json in the current directory — run this from your project root.');
+  }
+  return { pkgPath, pkg: JSON.parse(fs.readFileSync(pkgPath, 'utf8')) };
+}
+
+function ensureGitRepo() {
+  const result = spawnSync('git', ['rev-parse', '--is-inside-work-tree'], { cwd: CWD, stdio: 'pipe' });
+  if (result.status !== 0) {
+    fail('Not a git repository — run `git init` first.');
+  }
+}
+
+function slugifyPrefix(name) {
+  return (name || 'wip')
+    .replace(/^@[^/]+\//, '') // drop npm scope
+    .toUpperCase()
+    .replace(/[^A-Z0-9]+/g, '')
+    .slice(0, 12) || 'WIP';
+}
+
+function run(cmd, args) {
+  console.log(`  $ ${cmd} ${args.join(' ')}`);
+  const result = spawnSync(cmd, args, { cwd: CWD, stdio: 'inherit' });
+  if (result.status !== 0) {
+    fail(`\`${cmd} ${args.join(' ')}\` failed (exit ${result.status}).`);
+  }
+}
+
+function init(args) {
+  ensureGitRepo();
+  const { pkgPath, pkg } = readPackageJson();
+
+  const huskyDir = path.join(CWD, '.husky');
+  const hookPath = path.join(huskyDir, 'pre-commit');
+
+  if (fs.existsSync(hookPath) && !args.force) {
+    fail(`${hookPath} already exists — pass --force to overwrite it.`);
+  }
+
+  const hasHusky =
+    (pkg.devDependencies && pkg.devDependencies.husky) || (pkg.dependencies && pkg.dependencies.husky);
+
+  if (!hasHusky) {
+    console.log('→ Installing husky (devDependency)...');
+    run('npm', ['install', '--save-dev', 'husky']);
+  } else {
+    console.log('✓ husky already a devDependency');
+  }
+
+  const freshPkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+  freshPkg.scripts = freshPkg.scripts || {};
+  if (freshPkg.scripts.prepare !== 'husky') {
+    freshPkg.scripts.prepare = 'husky';
+    fs.writeFileSync(pkgPath, JSON.stringify(freshPkg, null, 2) + '\n');
+    console.log('✓ set "scripts.prepare": "husky" in package.json');
+  }
+
+  console.log('→ Wiring up husky (git hooksPath)...');
+  run('npx', ['husky']);
+
+  const prefix = slugifyPrefix(args.prefix || freshPkg.name);
+  const protectedBranches = args.protect
+    .split(',')
+    .map((b) => b.trim())
+    .filter(Boolean)
+    .join(' ');
+
+  const templatePath = path.join(__dirname, '..', 'templates', 'pre-commit.sh');
+  let hookScript = fs.readFileSync(templatePath, 'utf8');
+  hookScript = hookScript
+    .replace(/__STACK__/g, args.stack.replace(/"/g, '\\"'))
+    .replace(/__PREFIX__/g, prefix)
+    .replace(/__PROTECTED__/g, protectedBranches);
+
+  fs.mkdirSync(huskyDir, { recursive: true });
+  fs.writeFileSync(hookPath, hookScript);
+  fs.chmodSync(hookPath, 0o755);
+
+  console.log(`✓ wrote ${path.relative(CWD, hookPath)}`);
+  console.log('');
+  console.log('Done. New behavior on `git commit`:');
+  console.log(`  - AI review of staged changes (needs \`claude\` on PATH) — blocks only on high-confidence issues`);
+  console.log(`  - direct commits to [${protectedBranches}] auto-branch instead, as ${prefix}-<timestamp>-<slug>`);
+  console.log('');
+  console.log('Bypass for one commit: git commit --no-verify');
+}
+
+function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.command === 'help') return printHelp();
+  if (args.command === 'init') return init(args);
+  console.error(`Unknown command "${args.command}"\n`);
+  printHelp();
+  process.exit(1);
+}
+
+main();

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "no-yolo-commits",
+  "version": "1.0.0",
+  "description": "AI pre-commit review (via the claude CLI) + a guard that auto-branches you off main/master instead of letting a direct commit land there.",
+  "keywords": [
+    "husky",
+    "git-hooks",
+    "pre-commit",
+    "ai-code-review",
+    "claude",
+    "claude-code"
+  ],
+  "license": "MIT",
+  "author": "ataztech910",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ataztech910/no-yolo-commits.git"
+  },
+  "homepage": "https://github.com/ataztech910/no-yolo-commits#readme",
+  "bugs": {
+    "url": "https://github.com/ataztech910/no-yolo-commits/issues"
+  },
+  "bin": {
+    "no-yolo-commits": "./bin/cli.js"
+  },
+  "files": [
+    "bin",
+    "templates",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/templates/pre-commit.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env sh
+
+# --- AI code review on staged changes ---
+# Fails the commit only on real, high-confidence findings. If Claude is
+# missing, times out, or errors, this fails OPEN (warns, does not block) —
+# a broken/unavailable review must never be the only thing stopping commits.
+if command -v claude >/dev/null 2>&1 && ! git diff --cached --quiet; then
+  echo "→ Running AI code review on staged changes..."
+
+  review_prompt="You are reviewing staged git changes before they are committed, for a __STACK__ project. Inspect the staged changes (run \`git diff --cached\` yourself; read full files with the Read tool when a diff hunk needs more surrounding context) and flag ONLY real, high-confidence problems: type-safety holes (any/unsafe casts), missing error handling at real failure points, obvious bugs, broken framework patterns, dead or unused code introduced by this diff.
+
+Do NOT flag stylistic preferences. Do NOT flag pre-existing patterns already used elsewhere in this codebase (check before flagging). Do NOT invent issues — if you are not confident something is a real problem, leave it out. Respond with ONLY JSON matching the schema, nothing else."
+
+  review_tmpfile="$(mktemp)"
+
+  (claude -p "$review_prompt" \
+    --output-format json \
+    --json-schema '{"type":"object","properties":{"blocking_issues":{"type":"array","items":{"type":"string"}}},"required":["blocking_issues"]}' \
+    --allowedTools "Bash(git diff*)" "Bash(git show*)" "Bash(git log*)" "Read" "Grep" "Glob" \
+    --disallowedTools "Write" "Edit" "MultiEdit" "NotebookEdit" \
+    --permission-mode bypassPermissions \
+    >"$review_tmpfile" 2>/dev/null; exit 0) &
+  review_pid=$!
+  (sleep 120; kill "$review_pid" >/dev/null 2>&1; exit 0) >/dev/null 2>&1 &
+  review_watcher_pid=$!
+  disown "$review_watcher_pid" >/dev/null 2>&1 || true
+
+  wait "$review_pid" >/dev/null 2>&1 || true
+  kill "$review_watcher_pid" >/dev/null 2>&1 || true
+  wait "$review_watcher_pid" >/dev/null 2>&1 || true
+
+  node -e '
+    const fs = require("fs")
+    try {
+      const data = JSON.parse(fs.readFileSync(process.argv[1], "utf-8"))
+      const issues = (data.structured_output && data.structured_output.blocking_issues) || []
+      if (issues.length > 0) {
+        console.error("")
+        console.error("⛔ AI review found blocking issues:")
+        for (const i of issues) console.error("  - " + i)
+        console.error("")
+        console.error("Fix these, or commit anyway with `git commit --no-verify`.")
+        process.exit(1)
+      }
+      process.exit(0)
+    } catch (e) {
+      process.exit(2)
+    }
+  ' "$review_tmpfile"
+  review_status=$?
+  rm -f "$review_tmpfile" 2>/dev/null || true
+
+  if [ "$review_status" = "1" ]; then
+    exit 1
+  elif [ "$review_status" = "2" ]; then
+    echo "⚠ AI review unavailable or timed out — continuing without it."
+  else
+    echo "✓ AI review found no blocking issues."
+  fi
+fi
+
+# --- Block direct commits to protected branches ---
+branch="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
+
+case " __PROTECTED__ " in
+  *" $branch "*) ;;
+  *) exit 0 ;;
+esac
+
+echo "⛔ Direct commits to '$branch' are blocked — creating a branch for this commit..."
+
+fallback_slug() {
+  echo "changes-$(date +%s | tail -c 5)"
+}
+
+slug=""
+
+if command -v claude >/dev/null 2>&1; then
+  diff="$(git diff --cached -- . ':(exclude)package-lock.json' ':(exclude)yarn.lock' ':(exclude)pnpm-lock.yaml' ':(exclude)*.svg' ':(exclude)*.png' 2>/dev/null | head -c 6000)"
+  diff="${diff:-}"
+
+  if [ -n "$diff" ]; then
+    tmpfile="$(mktemp)"
+    prompt="Summarize the following staged git diff as ONE short phrase in kebab-case (lowercase words separated by hyphens, no punctuation, no quotes), at most 8 words, describing what changed. Output ONLY the phrase, nothing else, no explanation."
+
+    (printf '%s' "$diff" | claude -p "$prompt" >"$tmpfile" 2>/dev/null; exit 0) &
+    claude_pid=$!
+    (sleep 25; kill "$claude_pid" >/dev/null 2>&1; exit 0) >/dev/null 2>&1 &
+    watcher_pid=$!
+    disown "$watcher_pid" >/dev/null 2>&1 || true
+
+    wait "$claude_pid" >/dev/null 2>&1 || true
+    kill "$watcher_pid" >/dev/null 2>&1 || true
+    wait "$watcher_pid" >/dev/null 2>&1 || true
+
+    raw="$(cat "$tmpfile" 2>/dev/null || true)"
+    rm -f "$tmpfile" 2>/dev/null || true
+
+    slug="$(printf '%s' "$raw" \
+      | tr '[:upper:]' '[:lower:]' \
+      | tr -cs 'a-z0-9' '-' \
+      | sed -e 's/^-*//' -e 's/-*$//' \
+      | cut -c1-60)"
+    slug="${slug:-}"
+  fi
+fi
+
+if [ -z "$slug" ]; then
+  slug="$(fallback_slug)"
+fi
+
+timestamp="$(date +%s)"
+new_branch="__PREFIX__-${timestamp}-${slug}"
+new_branch="$(printf '%s' "$new_branch" | cut -c1-100)"
+
+if ! git checkout -b "$new_branch" 2>/tmp/no-yolo-commits-error; then
+  echo "✗ Failed to create branch '$new_branch':"
+  cat /tmp/no-yolo-commits-error 2>/dev/null || true
+  rm -f /tmp/no-yolo-commits-error 2>/dev/null || true
+  echo "Commit aborted — create/switch to a feature branch manually and retry."
+  exit 1
+fi
+rm -f /tmp/no-yolo-commits-error 2>/dev/null || true
+
+echo "✓ Switched to '$new_branch' — continuing commit there."