zapdev 0.8.0 → 0.10.0

package/README.md

@@ -1,15 +1,55 @@
 # zapdev
 
-**zapdev** — a lightweight TypeScript CLI that makes small, repetitive git chores fast and precise.
+## Project Introduction
 
-## Requirements
+**zapdev** is a lightweight TypeScript CLI that makes small, repetitive Git chores fast and precise.
 
-Node.js >= 20 and git.
+It stages changes, scans them for secrets, generates Conventional Commit messages with Ollama, and streamlines repository cleanup.
 
-## Install
+## Project Architecture
+
+```mermaid
+flowchart LR
+  Entry["src/index.ts"] --> CLI["src/cli.ts"]
+  CLI --> Commands["src/commands"]
+  Commands --> Lib["src/lib"]
+  Commands --> Types["src/types"]
+  Lib --> Prompts["src/prompts"]
+  Lib --> Types
+  Lib --> Tools["Git, Gitleaks, Ollama"]
+```
+
+- `src/index.ts`: bin launcher; enables the V8 compile cache, then loads `cli.js`.
+- `src/cli.ts`: CLI entry; registers subcommands and opens the interactive menu.
+- `src/commands/`: command UI and orchestration.
+- `src/lib/`: pure logic and isolated Git, Gitleaks, and Ollama side effects.
+- `src/prompts/`: LLM prompts inlined into the bundle at build time.
+- `src/types/`: shared type declarations.
+
+## Environment Variables
+
+| Variable | Default | Required | Description |
+| --- | --- | --- | --- |
+| `OLLAMA_URL` | `http://localhost:11434` | No | Ollama base URL |
+| `OLLAMA_MODEL` | `deepseek-v4-flash:cloud` | No | Model used to generate commit messages |
+| `OLLAMA_BACKUP_MODEL` | - | No | Model used when generation with the primary model fails |
+| `OLLAMA_EFFORT` | - | No | Ollama thinking effort (`low`, `medium`, `high`, or `max`) |
+
+## Setup
+
+### Requirements
+
+- **Node.js >= 20 (required):** runs the CLI.
+- **Git (required):** provides the repository operations.
+- **Ollama (required for `commit`):** generates Conventional Commit messages.
+- **Gitleaks (recommended):** scans staged changes before message generation when available on `PATH`.
+
+### Install
+
+Install zapdev globally for daily use:
 
 ```bash
-npm install -g zapdev   # installs the `zapdev` command globally
+npm install -g zapdev
 ```
 
 Or run it once without installing:
@@ -18,15 +58,28 @@ Or run it once without installing:
 npx zapdev commit
 ```
 
-> For daily use, prefer the global install: `npx` adds resolution overhead on every run.
+### Development Setup
+
+From a clone:
+
+```bash
+npm install
+npm run zapdev      # build then run the CLI in dev
+npm run typecheck   # tsc --noEmit
+npm run lint        # eslint
+npm run test        # vitest
+npm run build       # bundle to dist/ with esbuild
+```
+
+`npm link` exposes the local `zapdev` binary after `npm run build`.
 
 ## Usage
 
-Run `zapdev` with no command to pick one from an interactive menu (falls back to usage output without a TTY).
+Run `zapdev` with no command to pick one from an interactive menu. Without a TTY, zapdev displays its usage instead.
 
 ### `zapdev commit`
 
-Stages all changes (`git add -A`), asks an Ollama model for a one-line Conventional Commits message, then lets you commit, edit or cancel, and optionally push.
+Stages all changes, scans them with Gitleaks when installed, generates a Conventional Commit message, and optionally pushes the commit.
 
 ```bash
 zapdev commit
@@ -34,67 +87,52 @@ zapdev commit
 
 | Flag | Description |
 | --- | --- |
-| `-m, --model <model>` | Override the Ollama model |
-| `-t, --type <type>` | Force the Conventional Commits type (`feat`, `fix`, `chore`, …) |
-| `--pull` | Rebase onto upstream (`git pull --rebase`) after committing, before pushing |
+| `--model <model>` | Override the Ollama model |
+| `-t, --type <type>` | Force the Conventional Commit type (`feat`, `fix`, `chore`, etc.) |
 | `-p, --push` | Push after committing without asking |
+| `-s, --staged` | Commit only changes that are already staged |
+| `-r, --rebase` | Rebase on upstream if the push is rejected |
+| `-m, --merge` | Merge upstream if the push is rejected |
 | `-y, --yes` | Skip prompts and commit directly |
 
 ```bash
-zapdev commit -t feat      # force the type; the model still writes scope + description
+zapdev commit -t feat      # force the type
+zapdev commit --staged     # leave unstaged changes untouched
 ```
 
-Pushing is optimistic — no preliminary fetch, so the common case stays a single round-trip. If the push is rejected because the branch is behind its upstream, in a TTY it offers to `git pull --rebase` and retry; non-interactively (`--yes` / piped) it stops and asks you to re-run with `--pull`. Pass `--pull` to rebase onto upstream right after the commit (a rebase conflict stops before pushing). `--yes` only silences prompts; it never rebases on its own.
+Before contacting Ollama, zapdev runs `gitleaks git --staged` when Gitleaks is installed. A failed scan stops the commit; when Gitleaks is absent, the scan is skipped.
+
+Pushing is optimistic, with no preliminary fetch. If the branch is behind upstream, `--rebase` runs `git pull --rebase`, while `--merge` runs `git pull --no-rebase --no-edit`; zapdev then retries once. Without either flag, interactive runs ask whether to rebase, merge, or quit. Runs using `--yes` or without a TTY must provide one of the flags.
 
-Without a TTY (piped / CI), it commits automatically and only pushes when `--push` is set.
+Without a TTY, zapdev commits automatically and only pushes when `--push` is set.
 
 ### `zapdev reset`
 
-Operates on a git repo, or — when the path is a plain directory — on its **direct child** repos (level 1, non-recursive). For each one: `git fetch --prune`, switch to a branch (chosen interactively, or forced with `--principal` / `--target`), then permanently delete every other local branch and every linked worktree. The principal branch (from `origin/HEAD`) and the branch you switched to are always kept. Ends with an optional `pull`.
+Operates on a Git repository or the direct child repositories of a directory. It fetches and prunes, switches branch, then permanently removes other local branches and linked worktrees.
 
 ```bash
-zapdev reset                 # the current repo, or the child repos of the current directory
-zapdev reset ~/dev           # a repo, or the child repos of a directory
-zapdev reset -p              # switch each repo to its principal branch, no prompt
-zapdev reset -t dev          # switch each repo to `dev` (or principal if absent)
+zapdev reset                 # reset the current repo or direct child repos
+zapdev reset ~/dev           # reset repos under a directory
+zapdev reset -p              # switch to the principal branch without prompting
+zapdev reset -t dev          # switch to dev or fall back to the principal branch
 ```
 
 | Flag | Description |
 | --- | --- |
 | `-p, --principal` | Switch every repo to its resolved principal branch (`origin/HEAD`) |
-| `-t, --target <branch>` | Switch every repo to `<branch>`, falling back to the principal one |
+| `-t, --target <branch>` | Switch to a target branch, falling back to the principal branch |
 | `--pull` | Pull the checked-out branch after reset without asking |
-| `-y, --yes` | Non-interactive: switch and delete without confirmation |
-
-Deletion is permanent: branches via `git branch -D` (force), worktrees via `git worktree remove --force`. Worktrees are removed first so the branches they held become deletable. Without a TTY, pass `--yes` — otherwise the destructive step is refused. `node_modules` is never scanned.
-
-## Configuration
+| `-y, --yes` | Switch and delete without confirmation |
 
-| Variable | Default | Description |
-| --- | --- | --- |
-| `OLLAMA_URL` | `http://localhost:11434` | Ollama base URL |
-| `OLLAMA_MODEL` | `deepseek-v4-flash:cloud` | Model used to generate messages |
+Deletion is permanent. Branches are removed with `git branch -D`; worktrees are removed with `git worktree remove --force`. Without a TTY, pass `--yes` or the destructive step is refused. `node_modules` is never scanned.
 
-## Development
-
-From a clone:
+### Shell Aliases
 
 ```bash
-npm install
-npm run zapdev      # build then run the CLI in dev
-npm run typecheck   # tsc --noEmit
-npm run lint        # eslint
-npm run test        # vitest
-npm run build       # bundle to dist/ (esbuild)
+alias commit="zapdev commit --yes"
+alias git-reset="zapdev reset --yes --principal --pull"
 ```
 
-`npm link` (after `npm run build`) exposes the local `zapdev` binary on your PATH.
-
-## Project structure
+## Other
 
-- `src/index.ts` — bin launcher; enables the V8 compile cache, then loads `cli.js`.
-- `src/cli.ts` — CLI entry (Citty); registers subcommands, defaults to `commit`.
-- `src/commands/` — one file per command.
-- `src/lib/` — pure logic (`config`, `commit-message`, `branches`, unit-tested) and side effects (`git`, `ollama`); shared helpers (`errors`).
-- `src/prompts/` — LLM prompts as `.md` files, imported as text (esbuild `.md` text loader) and inlined into the bundle at build time.
-- `src/types/` — shared type declarations (one file per domain) and ambient module declarations.
+zapdev is available under the MIT license.

package/dist/cli.js

@@ -1718,7 +1718,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "zapdev",
-  version: "0.8.0",
+  version: "0.10.0",
   description: "Fast, performant and lightweight git chores and dev tools using your terminal and your own local LLM.",
   type: "module",
   bin: {
@@ -1817,9 +1817,14 @@ var DEFAULT_MODEL = "deepseek-v4-flash:cloud";
 function resolveConfig(env = process.env, overrides = {}) {
   return {
     ollamaUrl: normalizeBaseUrl(overrides.ollamaUrl ?? env.OLLAMA_URL ?? DEFAULT_OLLAMA_URL),
-    model: overrides.model ?? env.OLLAMA_MODEL ?? DEFAULT_MODEL
+    model: overrides.model ?? env.OLLAMA_MODEL ?? DEFAULT_MODEL,
+    backupModel: overrides.backupModel ?? optionalValue(env.OLLAMA_BACKUP_MODEL),
+    effort: overrides.effort ?? optionalValue(env.OLLAMA_EFFORT)
   };
 }
+function optionalValue(value) {
+  return value?.trim() || void 0;
+}
 function normalizeBaseUrl(raw) {
   const trimmed = raw.trim().replace(/\/+$/, "");
   return /^https?:\/\//.test(trimmed) ? trimmed : `http://${trimmed}`;
@@ -2225,6 +2230,9 @@ async function pushSetUpstream(branch) {
 async function pullRebase() {
   await git(["pull", "--rebase"]);
 }
+async function pullMerge() {
+  await git(["pull", "--no-rebase", "--no-edit"]);
+}
 async function fetchRemote() {
   await git(["fetch"]);
 }
@@ -2296,6 +2304,25 @@ function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
+// src/lib/gitleaks.ts
+async function hasGitleaks() {
+  try {
+    await R2("gitleaks", ["version"], { nodePath: false });
+    return true;
+  } catch (error) {
+    if (error instanceof Error && error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function scanStagedChanges() {
+  const result = await R2("gitleaks", ["git", "--staged"], { nodePath: false });
+  if (result.exitCode === 0) return;
+  const output = result.stderr.trim() || result.stdout.trim();
+  throw new Error(output || "gitleaks git --staged failed");
+}
+
 // src/prompts/commit-message.md
 var commit_message_default = "You are zapdev, a CLI tool that creates commits quickly and reliably.\n\nGenerate ONE commit message in Conventional Commits format.\nA single line: imperative, English, \u226472 chars.\n\nStrictly follow this format:\n\n```text\ntype(scope): description\n```\n\nReply ONLY with the message, no backticks, no quotes, no explanation.\n";
 
@@ -2307,13 +2334,28 @@ var REQUEST_TIMEOUT_MS = 25e3;
 var KEEP_ALIVE = "30m";
 async function generateCommitMessage(diff, config, type) {
   const systemPrompt = type ? applyCommitType(COMMIT_SYSTEM_PROMPT, type) : COMMIT_SYSTEM_PROMPT;
-  const content = await chat(config, [
+  const messages = [
     { role: "system", content: systemPrompt },
     { role: "user", content: truncateDiff(diff) }
-  ]);
+  ];
+  let content;
+  try {
+    content = await chat(config, config.model, messages);
+  } catch (error) {
+    if (!config.backupModel || config.backupModel === config.model) throw error;
+    try {
+      content = await chat(config, config.backupModel, messages);
+    } catch (backupError) {
+      throw new AggregateError(
+        [error, backupError],
+        `Primary model failed: ${errorMessage(error)} Backup model failed: ${errorMessage(backupError)}`,
+        { cause: backupError }
+      );
+    }
+  }
   return sanitizeCommitMessage(content);
 }
-async function chat(config, messages) {
+async function chat(config, model, messages) {
   const url = `${config.ollamaUrl}/api/chat`;
   let response;
   try {
@@ -2321,9 +2363,10 @@ async function chat(config, messages) {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify({
-        model: config.model,
+        model,
         stream: false,
         keep_alive: KEEP_ALIVE,
+        think: config.effort,
         options: { temperature: 0.2 },
         messages
       }),
@@ -2374,7 +2417,6 @@ var commitCommand = defineCommand({
   args: {
     model: {
       type: "string",
-      alias: "m",
       description: "Override the Ollama model (defaults to $OLLAMA_MODEL)."
     },
     type: {
@@ -2382,15 +2424,26 @@ var commitCommand = defineCommand({
       alias: "t",
       description: `Force the Conventional Commits type (${COMMIT_TYPES.join(", ")}).`
     },
-    pull: {
-      type: "boolean",
-      description: "Rebase onto upstream (git pull --rebase) after committing, before pushing."
-    },
     push: {
       type: "boolean",
       alias: "p",
       description: "Push after committing without asking."
     },
+    staged: {
+      type: "boolean",
+      alias: "s",
+      description: "Commit only changes that are already staged."
+    },
+    rebase: {
+      type: "boolean",
+      alias: "r",
+      description: "Rebase on the upstream branch if the push is rejected."
+    },
+    merge: {
+      type: "boolean",
+      alias: "m",
+      description: "Merge the upstream branch if the push is rejected."
+    },
     yes: {
       type: "boolean",
       alias: "y",
@@ -2403,6 +2456,12 @@ var commitCommand = defineCommand({
       process.env,
       args.model ? { model: args.model } : {}
     );
+    if (args.rebase && args.merge) {
+      log.error("Choose either --rebase or --merge, not both.");
+      process.exitCode = 1;
+      return;
+    }
+    const syncStrategy = args.rebase ? "rebase" : args.merge ? "merge" : void 0;
     const type = args.type ? normalizeCommitType(args.type) : void 0;
     if (type === null) {
       log.error(
@@ -2412,13 +2471,32 @@ var commitCommand = defineCommand({
       return;
     }
     if (interactive) intro("zapdev commit");
-    await stageAll();
+    if (!args.staged) await stageAll();
     const diff = await getStagedDiff();
     if (!diff.trim()) {
       log.warn("Nothing to commit.");
       if (interactive) outro("Nothing to do.");
       return;
     }
+    try {
+      if (await hasGitleaks()) {
+        const scanLoader = interactive ? spinner() : void 0;
+        scanLoader?.start("Scanning staged changes with Gitleaks");
+        try {
+          await scanStagedChanges();
+          scanLoader?.stop("No leaks found");
+        } catch (error) {
+          scanLoader?.error("Gitleaks check failed");
+          throw error;
+        }
+      } else {
+        log.info("Gitleaks not found, skipping secret scan.");
+      }
+    } catch (error) {
+      log.error(`Gitleaks check failed: ${errorMessage(error)}`);
+      process.exitCode = 1;
+      return;
+    }
     const loader = interactive ? spinner() : void 0;
     loader?.start("Generating commit message");
     let message;
@@ -2471,10 +2549,6 @@ var commitCommand = defineCommand({
     }
     await commit(finalMessage);
     if (interactive) log.success(`Committed: ${finalMessage}`);
-    if (args.pull && !await rebaseOnUpstream(interactive)) {
-      process.exitCode = 1;
-      return;
-    }
     let shouldPush = Boolean(args.push);
     if (!shouldPush && interactive && !args.yes) {
       const answer = await confirm({ message: "Push?", initialValue: false });
@@ -2485,7 +2559,11 @@ var commitCommand = defineCommand({
       shouldPush = answer;
     }
     if (shouldPush) {
-      const pushed = await pushOptimistic(interactive, Boolean(args.yes));
+      const pushed = await pushOptimistic(
+        interactive,
+        interactive && !args.yes,
+        syncStrategy
+      );
       if (!pushed) {
         process.exitCode = 1;
         return;
@@ -2494,39 +2572,28 @@ var commitCommand = defineCommand({
     if (interactive) outro("Done.");
   }
 });
-async function rebaseOnUpstream(interactive) {
-  if (!await hasUpstream()) {
-    log.info("No upstream to pull from; skipping --pull.");
-    return true;
-  }
+async function syncWithUpstream(strategy, interactive) {
   const loader = interactive ? spinner() : void 0;
-  loader?.start("Pulling --rebase");
+  const label = strategy === "rebase" ? "Rebase" : "Merge";
+  loader?.start(`Pulling --${strategy === "rebase" ? "rebase" : "no-rebase"}`);
   try {
-    await pullRebase();
-    loader?.stop("\u2713 Rebased on upstream");
+    await (strategy === "rebase" ? pullRebase() : pullMerge());
+    loader?.stop(strategy === "rebase" ? "\u2713 Rebased on upstream" : "\u2713 Merged upstream");
     return true;
   } catch (error) {
-    loader?.error("Rebase failed");
-    log.error(`Rebase failed (resolve conflicts, then push): ${errorMessage(error)}`);
+    loader?.error(`${label} failed`);
+    log.error(`${label} failed (resolve conflicts, then push): ${errorMessage(error)}`);
     return false;
   }
 }
-async function pushOptimistic(interactive, assumeYes) {
+async function pushOptimistic(interactive, canPrompt, strategy) {
   const [upstream, branch] = await Promise.all([hasUpstream(), currentBranch()]);
   const doPush = () => upstream ? push() : pushSetUpstream(branch);
   const first = await tryPush(interactive, doPush);
   if (first.ok) return true;
   if (upstream && await isBehind(interactive)) {
-    if (assumeYes || !interactive) {
-      log.error("Behind upstream \u2014 re-run with --pull to rebase and push.");
-      return false;
-    }
-    const answer = await confirm({ message: "Pull --rebase and retry push?", initialValue: true });
-    if (isCancel(answer) || !answer) {
-      log.info("Not pushed (still behind).");
-      return true;
-    }
-    if (!await rebaseOnUpstream(interactive)) return false;
+    const syncStrategy = strategy ?? await chooseSyncStrategy(canPrompt);
+    if (!syncStrategy || !await syncWithUpstream(syncStrategy, interactive)) return false;
     const retry = await tryPush(interactive, doPush);
     if (retry.ok) return true;
     log.error(`Push failed: ${errorMessage(retry.error)}`);
@@ -2535,6 +2602,25 @@ async function pushOptimistic(interactive, assumeYes) {
   log.error(`Push failed: ${errorMessage(first.error)}`);
   return false;
 }
+async function chooseSyncStrategy(interactive) {
+  if (!interactive) {
+    log.error("Branch is behind upstream. Re-run with --rebase or --merge.");
+    return null;
+  }
+  const action = await select({
+    message: "Branch is behind upstream. How should zapdev sync it?",
+    options: [
+      { value: "rebase", label: "Rebase" },
+      { value: "merge", label: "Merge" },
+      { value: "quit", label: "Quit" }
+    ]
+  });
+  if (isCancel(action) || action === "quit") {
+    log.warn("Push cancelled. Commit remains local.");
+    return null;
+  }
+  return action;
+}
 async function tryPush(interactive, doPush) {
   const loader = interactive ? spinner() : void 0;
   loader?.start("Pushing");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zapdev",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Fast, performant and lightweight git chores and dev tools using your terminal and your own local LLM.",
   "type": "module",
   "bin": {