sec-gate 0.1.6 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sec-gate",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Pre-commit security gate for OWASP Top 10 2021 — SAST, SCA and misconfig checks for Node/Express, Go and React codebases",
   "author": {
     "name": "Sundram Bhardwaj",

package/scripts/postinstall.js

@@ -1,4 +1,6 @@
 #!/usr/bin/env node
+// security-scan: disable rule-id: detect-non-literal-fs-filename reason: all paths derived from git rev-parse or hardcoded BIN_DIR constants, never user input
+// security-scan: disable rule-id: path-join-resolve-traversal reason: all paths derived from git rev-parse or hardcoded BIN_DIR constants, never user input
 
 /**
  * sec-gate postinstall script
@@ -149,17 +151,28 @@ function installGovulncheck() {
 
 // ─────────────────────────────────────────────────────────
 // [3/3] Auto-install pre-commit hook in the current git repo
-// Backs up any existing hook before writing.
+// Detects husky automatically and injects into .husky/pre-commit.
+// Falls back to .git/hooks/pre-commit for non-husky repos.
 // Skipped silently if not inside a git repo.
 // ─────────────────────────────────────────────────────────
 const HOOK_MARKER = '# installed-by: sec-gate';
 
-function buildHookScript() {
+function isHuskyRepo(repoRoot) {
+  if (fs.existsSync(path.join(repoRoot, '.husky'))) return true;
+  const pkgPath = path.join(repoRoot, 'package.json');
+  if (!fs.existsSync(pkgPath)) return false;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    return !!deps.husky;
+  } catch { return false; }
+}
+
+function buildStandaloneHook() {
   return [
     '#!/usr/bin/env sh',
     HOOK_MARKER,
     '',
-    '# Set SEC_GATE_SKIP=1 to bypass (emergency only)',
     'if [ "$SEC_GATE_SKIP" = "1" ]; then',
     '  echo "sec-gate: skipped (SEC_GATE_SKIP=1)"',
     '  exit 0',
@@ -179,9 +192,31 @@ function buildHookScript() {
   ].join('\n');
 }
 
+function buildHuskyInjectionBlock() {
+  return [
+    '',
+    HOOK_MARKER,
+    'if [ "$SEC_GATE_SKIP" != "1" ]; then',
+    '  if command -v sec-gate >/dev/null 2>&1; then',
+    '    sec-gate scan --staged',
+    '    SEC_GATE_EXIT=$?',
+    '    if [ $SEC_GATE_EXIT -ne 0 ]; then exit $SEC_GATE_EXIT; fi',
+    '  else',
+    '    echo "sec-gate: not found in PATH. Run: npm install -g sec-gate"',
+    '    exit 1',
+    '  fi',
+    'fi',
+    '# end-sec-gate',
+    ''
+  ].join('\n');
+}
+
+function buildNewHuskyHook() {
+  return ['#!/usr/bin/env sh', '. "$(dirname -- "$0")/_/husky.sh"', buildHuskyInjectionBlock()].join('\n');
+}
+
 function autoInstallHook() {
   let repoRoot;
-
   try {
     repoRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], {
       encoding: 'utf8',
@@ -193,24 +228,51 @@ function autoInstallHook() {
     return;
   }
 
-  const hookDir  = path.join(repoRoot, '.git', 'hooks');
-  const hookPath = path.join(hookDir, 'pre-commit');
+  if (isHuskyRepo(repoRoot)) {
+    // ── Husky repo ────────────────────────────────────────────────────────
+    const huskyHookPath = path.join(repoRoot, '.husky', 'pre-commit');
+    console.log('sec-gate [3/3]: husky detected — injecting into .husky/pre-commit');
 
-  fs.mkdirSync(hookDir, { recursive: true });
+    if (fs.existsSync(huskyHookPath)) {
+      const existing = fs.readFileSync(huskyHookPath, 'utf8');
+      if (existing.includes(HOOK_MARKER)) {
+        console.log('sec-gate [3/3]: already injected into husky hook');
+        return;
+      }
+      // Inject after husky.sh source line
+      const lines = existing.split('\n');
+      let insertAt = lines.length;
+      for (let i = 0; i < lines.length; i++) {
+        if (lines[i].includes('husky.sh')) { insertAt = i + 1; break; }
+      }
+      lines.splice(insertAt, 0, ...buildHuskyInjectionBlock().split('\n'));
+      fs.writeFileSync(huskyHookPath, lines.join('\n'), { encoding: 'utf8', mode: 0o755 });
+    } else {
+      fs.mkdirSync(path.dirname(huskyHookPath), { recursive: true });
+      fs.writeFileSync(huskyHookPath, buildNewHuskyHook(), { encoding: 'utf8', mode: 0o755 });
+    }
+    console.log(`sec-gate [3/3]: injected into ${huskyHookPath}`);
+
+  } else {
+    // ── Standalone repo ───────────────────────────────────────────────────
+    const hookDir  = path.join(repoRoot, '.git', 'hooks');
+    const hookPath = path.join(hookDir, 'pre-commit');
+    fs.mkdirSync(hookDir, { recursive: true });
 
-  if (fs.existsSync(hookPath)) {
-    const existing = fs.readFileSync(hookPath, 'utf8');
-    if (existing.includes(HOOK_MARKER)) {
-      console.log('sec-gate [3/3]: pre-commit hook already installed');
-      return;
+    if (fs.existsSync(hookPath)) {
+      const existing = fs.readFileSync(hookPath, 'utf8');
+      if (existing.includes(HOOK_MARKER)) {
+        console.log('sec-gate [3/3]: pre-commit hook already installed');
+        return;
+      }
+      const backup = `${hookPath}.sec-gate.bak`;
+      fs.copyFileSync(hookPath, backup);
+      console.log(`sec-gate [3/3]: backed up existing hook → ${backup}`);
     }
-    const backup = `${hookPath}.sec-gate.bak`;
-    fs.copyFileSync(hookPath, backup);
-    console.log(`sec-gate [3/3]: backed up existing hook → ${backup}`);
-  }
 
-  fs.writeFileSync(hookPath, buildHookScript(), { encoding: 'utf8', mode: 0o755 });
-  console.log(`sec-gate [3/3]: pre-commit hook installed in ${repoRoot}`);
+    fs.writeFileSync(hookPath, buildStandaloneHook(), { encoding: 'utf8', mode: 0o755 });
+    console.log(`sec-gate [3/3]: pre-commit hook installed in ${repoRoot}`);
+  }
 }
 
 // ─────────────────────────────────────────────────────────

package/src/cli.js

@@ -10,6 +10,7 @@ function usage() {
     '  sec-gate scan           Scan all tracked files',
     '  sec-gate scan --staged  Scan only staged files (used by pre-commit hook)',
     '  sec-gate doctor         Check all components are installed and working',
+    '  sec-gate --version      Print the installed version',
     ''
   ].join('\n'));
 }
@@ -19,6 +20,7 @@ function parseArgs(argv) {
   for (const a of argv) {
     if (a === '--staged') args.staged = true;
     else if (a === '--help' || a === '-h') args.help = true;
+    else if (a === '--version' || a === '-v') args.version = true;
     else args._.push(a);
   }
   return args;
@@ -28,6 +30,13 @@ async function run() {
   const argv = process.argv.slice(2);
   const args = parseArgs(argv);
 
+  if (args.version) {
+    const { version } = require('../package.json');
+    // eslint-disable-next-line no-console
+    console.log(`sec-gate v${version}`);
+    process.exit(0);
+  }
+
   if (args.help || args._.length === 0) {
     usage();
     process.exit(0);

package/src/commands/install.js

@@ -1,19 +1,80 @@
-const fs = require('fs');
-const path = require('path');
-const { getRepoRoot } = require('../git/repo');
+'use strict';
 
+// security-scan: disable rule-id: path-join-resolve-traversal reason: all paths in this file are derived from `git rev-parse --show-toplevel` or hardcoded constants, never from user input
+// security-scan: disable rule-id: detect-non-literal-fs-filename reason: all paths in this file are derived from `git rev-parse --show-toplevel` or hardcoded constants, never from user input
+
+/**
+ * sec-gate install — Generic pre-commit hook injector
+ *
+ * STRATEGY (tool-agnostic):
+ * ─────────────────────────
+ * Every git hook manager (husky, lefthook, simple-git-hooks, pre-commit,
+ * custom hooksPath, etc.) ultimately tells git WHERE to look for hooks.
+ * Git has one source of truth for this: `git config core.hooksPath`.
+ * If that is not set, git falls back to `.git/hooks/`.
+ *
+ * So instead of enumerating every possible tool by name, we:
+ *   1. Ask git itself: "where will you look for the pre-commit hook?"
+ *   2. Resolve that path to an absolute location on disk.
+ *   3. If a pre-commit file already exists there → inject sec-gate as
+ *      the first real command (after any shebang/bootstrap lines).
+ *   4. If no file exists yet → create a minimal shell hook.
+ *
+ * Special cases handled on top of the generic base:
+ *   • Husky v4  — stores hooks in package.json, not in a shell file.
+ *   • simple-git-hooks — same: package.json config, not a shell file.
+ *   • lefthook  — YAML config, not a shell file.
+ *   • pre-commit (Python) — YAML config.
+ *   These are detected BEFORE the generic path logic and handled
+ *   by patching their config files. After patching we still also
+ *   write to whatever path git resolves, as a safety net.
+ *
+ * Result: works for any tool — known or unknown — as long as it
+ * honours git's core.hooksPath or places hooks in .git/hooks/.
+ */
+
+const fs               = require('fs');
+const path             = require('path');
+const { execFileSync } = require('child_process');
+const { getRepoRoot }  = require('../git/repo');
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Constants
+// ─────────────────────────────────────────────────────────────────────────────
 const HOOK_MARKER = '# installed-by: sec-gate';
+const END_MARKER  = '# end-sec-gate';
 
-function getHookPath(repoRoot) {
-  return path.join(repoRoot, '.git', 'hooks', 'pre-commit');
+// ─────────────────────────────────────────────────────────────────────────────
+// Shell snippets
+// ─────────────────────────────────────────────────────────────────────────────
+
+/** Block injected into ANY existing shell hook file */
+function secGateShellBlock() {
+  return [
+    '',
+    HOOK_MARKER,
+    'if [ "$SEC_GATE_SKIP" != "1" ]; then',
+    '  if command -v sec-gate >/dev/null 2>&1; then',
+    '    sec-gate scan --staged',
+    '    _SG_EXIT=$?',
+    '    if [ $_SG_EXIT -ne 0 ]; then exit $_SG_EXIT; fi',
+    '  else',
+    '    echo "sec-gate: not found. Run: npm install -g sec-gate"',
+    '    exit 1',
+    '  fi',
+    'fi',
+    END_MARKER,
+    ''
+  ].join('\n');
 }
 
-function buildHookScript() {
+/** Full standalone hook — used when no file exists yet */
+function standaloneHook() {
   return [
     '#!/usr/bin/env sh',
     HOOK_MARKER,
     '',
-    '# Set SEC_GATE_SKIP=1 to bypass (emergency only)',
+    '# Bypass: SEC_GATE_SKIP=1 git commit -m "..."',
     'if [ "$SEC_GATE_SKIP" = "1" ]; then',
     '  echo "sec-gate: skipped (SEC_GATE_SKIP=1)"',
     '  exit 0',
@@ -26,72 +87,298 @@ function buildHookScript() {
     '  sec-gate scan --staged',
     '  exit $?',
     'else',
-    '  echo "sec-gate: not found in PATH. Install it: npm install -g sec-gate"',
+    '  echo "sec-gate: not found. Run: npm install -g sec-gate"',
     '  exit 1',
     'fi',
     ''
   ].join('\n');
 }
 
-function isAlreadyInstalled(hookPath) {
-  if (!fs.existsSync(hookPath)) return false;
-  const content = fs.readFileSync(hookPath, 'utf8');
-  return content.includes(HOOK_MARKER);
-}
+// ─────────────────────────────────────────────────────────────────────────────
+// Core: ask git where it will look for hooks
+// ─────────────────────────────────────────────────────────────────────────────
 
-function suggestPrepareScript(repoRoot) {
-  const pkgPath = path.join(repoRoot, 'package.json');
-  if (!fs.existsSync(pkgPath)) return;
+/**
+ * Returns the absolute path to the pre-commit hook file that git WILL execute.
+ * This is the single source of truth — works regardless of which hook manager
+ * set core.hooksPath.
+ */
+function resolveGitHookPath(repoRoot) {
+  let hooksDir;
 
-  let pkg;
   try {
-    pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    // git config core.hooksPath — set by husky v6, lefthook, custom configs, etc.
+    const configured = execFileSync(
+      'git', ['config', '--local', 'core.hooksPath'],
+      { encoding: 'utf8', cwd: repoRoot, stdio: ['ignore', 'pipe', 'ignore'] }
+    ).trim();
+
+    if (configured) {
+      // Resolve relative paths (e.g. ".husky", ".githooks") against repo root
+      hooksDir = path.isAbsolute(configured)
+        ? configured
+        : path.join(repoRoot, configured);
+    }
   } catch {
+    // core.hooksPath not set — use default
+  }
+
+  if (!hooksDir) {
+    hooksDir = path.join(repoRoot, '.git', 'hooks');
+  }
+
+  return path.join(hooksDir, 'pre-commit');
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Core: inject into a shell hook file (generic, works for any manager)
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Injects the sec-gate shell block into hookPath.
+ *
+ * Insertion strategy (makes sec-gate run FIRST):
+ *   - Skip shebang line (#!/...)
+ *   - Skip any "bootstrap" lines (source/., export PATH, nvm/asdf/volta inits,
+ *     husky.sh, lefthook bootstrap, etc.)
+ *   - Insert sec-gate block after all those lines, before real commands
+ *
+ * This means sec-gate always runs before lint-staged, eslint, prettier,
+ * or whatever else the hook manager added.
+ */
+function injectIntoShellHook(hookPath) {
+  if (alreadyInstalled(hookPath)) {
+    console.log(`sec-gate: already installed in ${hookPath}`);
+    return;
+  }
+
+  let lines;
+  if (fs.existsSync(hookPath)) {
+    lines = fs.readFileSync(hookPath, 'utf8').split('\n');
+  } else {
+    // File does not exist — create it from scratch
+    fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+    fs.writeFileSync(hookPath, standaloneHook(), { encoding: 'utf8', mode: 0o755 });
+    console.log(`sec-gate: created pre-commit hook at ${hookPath}`);
     return;
   }
 
-  const hasPrepare = pkg.scripts && pkg.scripts.prepare && pkg.scripts.prepare.includes('sec-gate install');
+  // Find insertion point: after shebang + bootstrap/sourcing lines
+  // Bootstrap patterns — lines that set up the environment, not real commands
+  const BOOTSTRAP_PATTERNS = [
+    /^#/,                        // comments (including shebang)
+    /^\s*$/,                     // blank lines
+    /\.\s+"[^"]*"/,              // . "path/to/something.sh"  (posix source)
+    /\.\s+\S+/,                  // . /path/to/script
+    /source\s+/i,                // source /path/to/script
+    /export\s+/,                 // export PATH=...
+    /^eval\s+/,                  // eval "$(nvm/asdf/volta)"
+    /nvm|asdf|volta|rbenv|pyenv/ // version manager inits
+  ];
+
+  let insertAt = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const isBootstrap = BOOTSTRAP_PATTERNS.some((re) => re.test(lines[i]));
+    if (isBootstrap) {
+      insertAt = i + 1; // keep moving insertion point past bootstrap lines
+    } else {
+      break; // first non-bootstrap line — stop here
+    }
+  }
+
+  lines.splice(insertAt, 0, ...secGateShellBlock().split('\n'));
+  fs.writeFileSync(hookPath, lines.join('\n'), { encoding: 'utf8', mode: 0o755 });
+  console.log(`sec-gate: injected into ${hookPath}`);
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Helpers
+// ─────────────────────────────────────────────────────────────────────────────
+
+function alreadyInstalled(filePath) {
+  if (!fs.existsSync(filePath)) return false;
+  return fs.readFileSync(filePath, 'utf8').includes(HOOK_MARKER);
+}
+
+function readPkg(repoRoot) {
+  const p = path.join(repoRoot, 'package.json');
+  if (!fs.existsSync(p)) return null;
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch { return null; }
+}
+
+function writePkg(repoRoot, pkg) {
+  fs.writeFileSync(
+    path.join(repoRoot, 'package.json'),
+    JSON.stringify(pkg, null, 2) + '\n',
+    'utf8'
+  );
+}
+
+function hasDep(pkg, name) {
+  if (!pkg) return false;
+  return !!(
+    (pkg.dependencies     && pkg.dependencies[name]) ||
+    (pkg.devDependencies  && pkg.devDependencies[name]) ||
+    (pkg.peerDependencies && pkg.peerDependencies[name])
+  );
+}
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Config-file-based hook managers
+// These store their hook commands in YAML/JSON config, not shell files.
+// We patch those config files AND then also inject into the resolved shell
+// hook path as a safety net.
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Husky v4 — hooks live in package.json under "husky.hooks"
+ */
+function patchHuskyV4(repoRoot, pkg) {
+  if (!pkg || !pkg.husky || !pkg.husky.hooks) return false;
+
+  const existing = (pkg.husky.hooks['pre-commit'] || '').trim();
+  if (existing.includes('sec-gate')) return false; // already there
+
+  pkg.husky.hooks['pre-commit'] = existing
+    ? `sec-gate scan --staged && ${existing}`
+    : 'sec-gate scan --staged';
+
+  writePkg(repoRoot, pkg);
+  console.log('sec-gate: patched husky v4 hooks in package.json');
+  return true;
+}
+
+/**
+ * simple-git-hooks — hooks live in package.json under "simple-git-hooks"
+ */
+function patchSimpleGitHooks(repoRoot, pkg) {
+  if (!pkg) return false;
+  const sgh = pkg['simple-git-hooks'];
+  if (!sgh && !hasDep(pkg, 'simple-git-hooks')) return false;
+
+  const existing = ((sgh && sgh['pre-commit']) || '').trim();
+  if (existing.includes('sec-gate')) return false;
+
+  if (!pkg['simple-git-hooks']) pkg['simple-git-hooks'] = {};
+  pkg['simple-git-hooks']['pre-commit'] = existing
+    ? `sec-gate scan --staged && ${existing}`
+    : 'sec-gate scan --staged';
+
+  writePkg(repoRoot, pkg);
+  console.log('sec-gate: patched simple-git-hooks in package.json');
+  console.log('          run `npx simple-git-hooks` to apply.');
+  return true;
+}
+
+/**
+ * lefthook — hooks live in lefthook.yml / lefthook.json
+ */
+function patchLefthook(repoRoot) {
+  const candidates = [
+    'lefthook.yml', '.lefthook.yml',
+    'lefthook.yaml', '.lefthook.yaml',
+    'lefthook.json', '.lefthook.json'
+  ].map((f) => path.join(repoRoot, f));
+
+  const ymlPath = candidates.find(fs.existsSync);
+  if (!ymlPath) return false;
+
+  const content = fs.readFileSync(ymlPath, 'utf8');
+  if (content.includes('sec-gate')) return false;
+
+  // Inject a pre-commit command with priority 1 (runs first)
+  const injection = [
+    '',
+    '# installed-by: sec-gate',
+    'pre-commit:',
+    '  commands:',
+    '    sec-gate:',
+    '      priority: 1',
+    '      run: sec-gate scan --staged',
+    ''
+  ].join('\n');
+
+  fs.writeFileSync(ymlPath, content + injection, 'utf8');
+  console.log(`sec-gate: patched ${path.basename(ymlPath)}`);
+  console.log('          run `lefthook install` to apply.');
+  return true;
+}
+
+/**
+ * pre-commit (Python tool) — .pre-commit-config.yaml
+ */
+function patchPreCommitPy(repoRoot) {
+  const configPath = path.join(repoRoot, '.pre-commit-config.yaml');
+  if (!fs.existsSync(configPath)) return false;
+
+  const content = fs.readFileSync(configPath, 'utf8');
+  if (content.includes('sec-gate')) return false;
+
+  const localHook = [
+    '',
+    '# installed-by: sec-gate',
+    '- repo: local',
+    '  hooks:',
+    '  - id: sec-gate',
+    '    name: sec-gate OWASP security scan',
+    '    language: system',
+    '    entry: sec-gate scan --staged',
+    '    pass_filenames: false',
+    '    stages: [commit]',
+    ''
+  ].join('\n');
+
+  fs.writeFileSync(configPath, content + localHook, 'utf8');
+  console.log('sec-gate: patched .pre-commit-config.yaml');
+  console.log('          run `pre-commit install` to apply.');
+  return true;
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Suggest prepare script tip
+// ─────────────────────────────────────────────────────────────────────────────
+function suggestPrepareScript(pkg) {
+  if (!pkg) return;
+  const hasPrepare = pkg.scripts && pkg.scripts.prepare &&
+    pkg.scripts.prepare.includes('sec-gate install');
   if (!hasPrepare) {
     console.log('');
-    console.log('  TIP: To auto-install this hook for every developer on your team,');
-    console.log('  add this to your repo\'s package.json "scripts":');
-    console.log('');
-    console.log('    "prepare": "sec-gate install"');
-    console.log('');
-    console.log('  Then any developer who runs `npm install` in this repo');
-    console.log('  gets the pre-commit hook automatically — no manual step needed.');
+    console.log('  TIP: Add to package.json so teammates get the hook automatically:');
+    console.log('    "scripts": { "prepare": "sec-gate install" }');
+    console.log('  Then npm/pnpm/yarn install auto-runs sec-gate install for everyone.');
     console.log('');
   }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Main
+// ─────────────────────────────────────────────────────────────────────────────
 async function installHook() {
   const repoRoot = getRepoRoot();
-  const hookPath = getHookPath(repoRoot);
 
   if (!fs.existsSync(path.join(repoRoot, '.git'))) {
-    throw new Error('sec-gate install: .git directory not found. Run this inside a git repository.');
+    throw new Error('sec-gate install: .git not found. Run inside a git repository.');
   }
 
-  fs.mkdirSync(path.dirname(hookPath), { recursive: true });
-
-  if (isAlreadyInstalled(hookPath)) {
-    console.log('sec-gate: pre-commit hook is already installed.');
-    suggestPrepareScript(repoRoot);
-    return;
-  }
+  const pkg = readPkg(repoRoot);
 
-  // Backup any existing hook that wasn't installed by us
-  if (fs.existsSync(hookPath)) {
-    const backupPath = `${hookPath}.sec-gate.bak`;
-    fs.copyFileSync(hookPath, backupPath);
-    console.log(`sec-gate: backed up existing hook to ${backupPath}`);
-  }
+  // ── Step 1: patch any config-file-based hook managers ─────────────────────
+  // These tools store hooks in YAML/JSON, not shell files.
+  // We patch their config so their runner also executes sec-gate.
+  patchHuskyV4(repoRoot, pkg);
+  patchSimpleGitHooks(repoRoot, pkg);
+  patchLefthook(repoRoot);
+  patchPreCommitPy(repoRoot);
 
-  fs.writeFileSync(hookPath, buildHookScript(), { encoding: 'utf8', mode: 0o755 });
-  console.log(`sec-gate: pre-commit hook installed at ${hookPath}`);
+  // ── Step 2: resolve where git ACTUALLY runs the pre-commit hook ───────────
+  // This works for ANY tool — husky v6, lefthook, custom hooksPath, or bare.
+  // We just ask git itself where it will look, then inject there.
+  const resolvedHookPath = resolveGitHookPath(repoRoot);
+  console.log(`sec-gate: git will execute pre-commit hook from: ${resolvedHookPath}`);
+  injectIntoShellHook(resolvedHookPath);
 
-  suggestPrepareScript(repoRoot);
+  // ── Step 3: suggest prepare script for team auto-setup ────────────────────
+  suggestPrepareScript(pkg);
 }
 
 module.exports = { installHook };

package/src/commands/scan.js

@@ -1,3 +1,4 @@
+// security-scan: disable rule-id: detect-non-literal-fs-filename reason: lockfile paths come from a hardcoded allowlist of known filenames, never user input
 const { getStagedFiles, hasStagedDependencyFiles } = require('../git/stagedFiles');
 const { listTrackedFiles } = require('../git/trackedFiles');
 const { runSemgrep } = require('../scanners/semgrep');
@@ -12,10 +13,20 @@ function formatFinding(f) {
   return `- ${loc} [${f.checkId}]${owasp}\n  ${f.message}`;
 }
 
+const LOCKFILES = new Set([
+  'pnpm-lock.yaml',
+  'package-lock.json',
+  'npm-shrinkwrap.json',
+  'yarn.lock',
+  'go.mod',
+  'go.sum'
+]);
+
 function isSemgrepTargetPath(p) {
   if (!p) return false;
-  if (p.endsWith('pnpm-lock.yaml')) return false;
-  if (p === 'go.mod' || p === 'go.sum') return false;
+
+  const base = require('path').basename(p);
+  if (LOCKFILES.has(base)) return false;
 
   return (
     p.endsWith('.js') ||
@@ -60,12 +71,23 @@ async function scan({ staged }) {
   } else {
     const fs = require('fs');
 
-    if (fs.existsSync('pnpm-lock.yaml')) {
-      const scaOsv = await runOsvScanner({ lockfile: 'pnpm-lock.yaml' });
+    // Detect which Node lockfile exists — support npm, pnpm and yarn
+    const nodeLockfiles = [
+      'pnpm-lock.yaml',      // pnpm
+      'package-lock.json',   // npm
+      'npm-shrinkwrap.json', // npm (legacy)
+      'yarn.lock'            // yarn
+    ];
+    const foundLockfile = nodeLockfiles.find((lf) => fs.existsSync(lf));
+
+    if (foundLockfile) {
+      // eslint-disable-next-line no-console
+      console.log(`sec-gate: running OSV-Scanner on ${foundLockfile}`);
+      const scaOsv = await runOsvScanner({ lockfile: foundLockfile });
       allFindings.push(...scaOsv);
     } else {
       // eslint-disable-next-line no-console
-      console.log('sec-gate: pnpm-lock.yaml not found; skipping OSV-Scanner');
+      console.log('sec-gate: no Node lockfile found (pnpm-lock.yaml / package-lock.json / yarn.lock); skipping OSV-Scanner');
     }
 
     if (fs.existsSync('go.mod')) {
@@ -86,8 +108,24 @@ async function scan({ staged }) {
     process.exit(1);
   }
 
+  // ── Success summary ────────────────────────────────────────────────────────
+  const checks = [];
+  if (semgrepTargets.length > 0) {
+    checks.push(`SAST (${semgrepTargets.length} file${semgrepTargets.length > 1 ? 's' : ''})`);
+  }
+  if (depChanged || !staged) {
+    const fs = require('fs');
+    const nodeLockfilesCheck = ['pnpm-lock.yaml', 'package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock'];
+    const foundLock = nodeLockfilesCheck.find((lf) => fs.existsSync(lf));
+    if (foundLock) checks.push(`SCA-node (${foundLock})`);
+    if (fs.existsSync('go.mod')) checks.push('SCA-go (go.mod)');
+  }
+
+  const checksRan = checks.length > 0 ? checks.join(', ') : 'no checks applicable';
+  // eslint-disable-next-line no-console
+  console.log(`sec-gate: all checks passed — no vulnerabilities found by sec-gate`);
   // eslint-disable-next-line no-console
-  console.log('sec-gate: no findings after inline suppression');
+  console.log(`sec-gate: checks ran: ${checksRan}`);
 }
 
 module.exports = { scan };

package/src/git/stagedFiles.js

@@ -1,3 +1,4 @@
+const path = require('path');
 const { execSync } = require('child_process');
 
 function getStagedFiles() {
@@ -17,8 +18,15 @@ function getStagedFiles() {
 
 function hasStagedDependencyFiles(files) {
   if (!files || files.length === 0) return false;
-  const depNames = new Set(['pnpm-lock.yaml', 'go.mod', 'go.sum']);
-  return files.some((f) => depNames.has(f));
+  const depNames = new Set([
+    'pnpm-lock.yaml',       // pnpm
+    'package-lock.json',    // npm
+    'npm-shrinkwrap.json',  // npm (legacy)
+    'yarn.lock',            // yarn
+    'go.mod',               // Go
+    'go.sum'                // Go
+  ]);
+  return files.some((f) => depNames.has(path.basename(f)));
 }
 
 module.exports = { getStagedFiles, hasStagedDependencyFiles };

package/src/suppressions/inlineTag.js

@@ -53,15 +53,18 @@ function applyInlineSuppressions({ findings }) {
 
       let suppressed = false;
 
-      if (typeof f.line === 'number') {
+      // File-wide suppression: if the file contains a suppress comment for this
+      // rule-id (or '*') anywhere, suppress ALL findings of that rule in that file.
+      // This is the intended use of top-of-file suppression comments.
+      suppressed = hasInlineSuppressionAnywhere({ fileText: text, checkId: f.checkId });
+
+      // If not file-wide suppressed, check the near-line window for line findings
+      if (!suppressed && typeof f.line === 'number') {
         suppressed = hasInlineSuppressionNearLine({
           fileText: text,
           findingLine: f.line,
           checkId: f.checkId
         });
-      } else {
-        // SCA findings often lack line numbers; allow suppression anywhere in the file.
-        suppressed = hasInlineSuppressionAnywhere({ fileText: text, checkId: f.checkId });
       }
 
       if (suppressed) continue;