sec-gate 0.1.7 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "sec-gate",
3
- "version": "0.1.7",
3
+ "version": "0.1.8",
4
4
  "description": "Pre-commit security gate for OWASP Top 10 2021 — SAST, SCA and misconfig checks for Node/Express, Go and React codebases",
5
5
  "author": {
6
6
  "name": "Sundram Bhardwaj",
@@ -102,6 +102,11 @@ function standaloneHook() {
102
102
  * Returns the absolute path to the pre-commit hook file that git WILL execute.
103
103
  * This is the single source of truth — works regardless of which hook manager
104
104
  * set core.hooksPath.
105
+ *
106
+ * Special cases handled:
107
+ * - .husky/_ → husky's internal bootstrap shim dir, read-only, never write here.
108
+ * Fall back to .husky/pre-commit (the real hook file).
109
+ * - .husky → husky v6+ standard hooks dir, use .husky/pre-commit directly.
105
110
  */
106
111
  function resolveGitHookPath(repoRoot) {
107
112
  let hooksDir;
@@ -118,6 +123,15 @@ function resolveGitHookPath(repoRoot) {
118
123
  hooksDir = path.isAbsolute(configured)
119
124
  ? configured
120
125
  : path.join(repoRoot, configured);
126
+
127
+ // .husky/_ is husky's internal bootstrap shim directory — it is read-only
128
+ // and should never be written to. The actual user-editable hooks live in
129
+ // .husky/ (one level up). Redirect there.
130
+ const huskyShimDir = path.join(repoRoot, '.husky', '_');
131
+ if (hooksDir === huskyShimDir || hooksDir.startsWith(huskyShimDir + path.sep)) {
132
+ console.log('sec-gate: core.hooksPath points to .husky/_ (husky bootstrap shim) — redirecting to .husky/');
133
+ hooksDir = path.join(repoRoot, '.husky');
134
+ }
121
135
  }
122
136
  } catch {
123
137
  // core.hooksPath not set — use default