dotman-git 1.2.3__tar.gz → 1.3.1__tar.gz

{dotman_git-1.2.3 → dotman_git-1.3.1}/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-06-27
+
+### Added
+
+- **Template substitution in deployed files** — `{{VAR}}` placeholders in config files (e.g. `{{HOSTNAME}}`, `{{USER}}`, `{{OS}}`) are now rendered automatically during deploy. Enabled by default via `render_templates` on each section.
+- **Conditional template syntax** — `{{ if OS == "darwin" }}...{{ endif }}` and `{{ if VAR != "value" }}...{{ endif }}` blocks in config files. Conditionals are evaluated before variable substitution. Uses stdlib regex, no new dependencies.
+- **Vault key rotation** — `dot-man vault rotate-key` re-encrypts all secrets with a new Fernet key. Old key backed up to `.key.bak`. `dot-man vault status` shows vault stats.
+- **Expanded `--dry-run` on navigate** — now shows all 4 phases: sections that would save, branch status, files that would deploy + hooks, config update.
+- **62 new tests** — `test_save_cmd.py` (23), `test_status_cmd.py` (18), `test_navigate_helpers.py` (21), plus 14 template/conditional tests.
+- **Shell completions split** — extracted completion functions into `completions.py` (310 lines), `common.py` reduced from 642 to 260 lines.
+- **Priority improvement plan** — documented 20-item prioritized improvement roadmap in `docs/PRIORITY_PLAN.md`.
+
+### Fixed
+
+- **`doctor_cmd.py:117`** — `.exists()` called on string instead of `Path`. Added `from pathlib import Path` and wrapped `DOT_MAN_TOML` in `Path()`.
+- **`remote_cmd.py:225`** — `Path` passed where API expects `str`. Added `str()` conversion.
+- **Stale coverage claims** — README and TODO updated from 83% to 81% (actual), test count from 1519 to 1526.
+- **`test_doctor_cmd.py`** — fixed test to properly mock `DOT_MAN_DIR` instead of relying on bug-induced crash.
+- **Import patch targets** — `test_completion.py` and `test_shell_completions.py` updated to patch `dot_man.cli.completions._git_runner`.
+
+### Refactored
+
+- **Deduplicate hook execution in navigate** — extracted `_run_shell_hooks()` helper, replacing 3 identical ~25-line hook blocks.
+- **Split `common.py`** — completion functions moved to `completions.py`, backward-compatible re-exports preserved.
+
 ## [1.2.3] - 2026-06-11
 
 ### Added

{dotman_git-1.2.3 → dotman_git-1.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dotman-git
-Version: 1.2.3
+Version: 1.3.1
 Summary: Dotfile manager with git-powered branching
 Author-email: Bishoy Ehab <beshoyehabhhmm@gmail.com>
 License: MIT
@@ -18,7 +18,6 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Operating System :: MacOS
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
@@ -26,7 +25,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: System :: Systems Administration
 Classifier: Topic :: Utilities
 Classifier: Typing :: Typed
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: click>=8.0
@@ -70,13 +69,14 @@ Dynamic: license-file
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![Checked with mypy](https://www.mypy-lang.org/static/mypy_badge.svg)](https://mypy-lang.org/)
 [![Coverage](https://img.shields.io/badge/coverage-83%25-green)](https://github.com/BeshoyEhab/dot-man)
+[![Docs](https://img.shields.io/badge/docs-online-blue)](https://beshoyehab.github.io/dot-man/)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/BeshoyEhab/dot-man/pulls)
 
 ---
 
 *Switch your entire development environment in one command.*
 
-[**Install**](#installation) · [**Quick Start**](#quick-start) · [**Commands**](#commands) · [**Config**](#configuration) · [**Docs**](docs/)
+[**Install**](https://github.com/BeshoyEhab/dot-man#installation) · [**Quick Start**](https://github.com/BeshoyEhab/dot-man#quick-start) · [**Commands**](https://github.com/BeshoyEhab/dot-man#commands) · [**Config**](https://github.com/BeshoyEhab/dot-man#configuration) · [**Docs**](https://beshoyehab.github.io/dot-man/)
 
 </div>
 
@@ -483,7 +483,7 @@ System variables (`{{HOSTNAME}}`, `{{USER}}`, `{{SHELL}}`, etc.) are auto-popula
 | Version | `1.2.3` |
 | Python | `3.10 · 3.11 · 3.12 · 3.13` |
 | Platforms | Linux, macOS |
-| Test Coverage | 83% (1519 tests) |
+| Test Coverage | 81% (1526 tests) |
 | Commands | 30+ |
 | PyPI | [`dotman-git`](https://pypi.org/project/dotman-git/) |
 

{dotman_git-1.2.3 → dotman_git-1.3.1}/README.md

@@ -13,13 +13,14 @@
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![Checked with mypy](https://www.mypy-lang.org/static/mypy_badge.svg)](https://mypy-lang.org/)
 [![Coverage](https://img.shields.io/badge/coverage-83%25-green)](https://github.com/BeshoyEhab/dot-man)
+[![Docs](https://img.shields.io/badge/docs-online-blue)](https://beshoyehab.github.io/dot-man/)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/BeshoyEhab/dot-man/pulls)
 
 ---
 
 *Switch your entire development environment in one command.*
 
-[**Install**](#installation) · [**Quick Start**](#quick-start) · [**Commands**](#commands) · [**Config**](#configuration) · [**Docs**](docs/)
+[**Install**](https://github.com/BeshoyEhab/dot-man#installation) · [**Quick Start**](https://github.com/BeshoyEhab/dot-man#quick-start) · [**Commands**](https://github.com/BeshoyEhab/dot-man#commands) · [**Config**](https://github.com/BeshoyEhab/dot-man#configuration) · [**Docs**](https://beshoyehab.github.io/dot-man/)
 
 </div>
 
@@ -426,7 +427,7 @@ System variables (`{{HOSTNAME}}`, `{{USER}}`, `{{SHELL}}`, etc.) are auto-popula
 | Version | `1.2.3` |
 | Python | `3.10 · 3.11 · 3.12 · 3.13` |
 | Platforms | Linux, macOS |
-| Test Coverage | 83% (1519 tests) |
+| Test Coverage | 81% (1526 tests) |
 | Commands | 30+ |
 | PyPI | [`dotman-git`](https://pypi.org/project/dotman-git/) |
 

{dotman_git-1.2.3 → dotman_git-1.3.1}/dot_man/__init__.py

@@ -1,4 +1,4 @@
 """dot-man: Dotfile manager with git-powered branching."""
 
-__version__ = "1.2.3"
+__version__ = "1.3.1"
 __author__ = "Bishoy Ehab"

{dotman_git-1.2.3 → dotman_git-1.3.1}/dot_man/cli/__init__.py

@@ -4,7 +4,7 @@ This package provides the CLI entry point for dot-man.
 It exposes the modular CLI implementation.
 """
 
-from . import discover_cmd, encrypt_cmd, export_cmd, import_cmd
+from . import bootstrap_cmd, discover_cmd, encrypt_cmd, export_cmd, import_cmd
 from .add_cmd import add
 from .audit_cmd import audit
 from .backup_cmd import backup
@@ -35,19 +35,21 @@ from .config_cmd import config
 from .deploy_cmd import deploy
 from .doctor_cmd import doctor
 from .edit_cmd import edit
+from .hooks_cmd import hooks
 
 # Import commands for easier access and backward compatibility
 from .init_cmd import init
 from .interface import cli
 from .log_cmd import checkout, diff, log
 from .main import main
-from .navigate_cmd import hooks, navigate
+from .navigate_cmd import navigate
 from .onboarding import is_first_run, mark_onboarded, run_onboarding
 from .profile_cmd import profile
 from .remote_cmd import remote, sync
 from .restore_cmd import restore
 from .revert_cmd import revert
 from .rollback_cmd import rollback
+from .save_cmd import save
 from .show_cmd import show
 from .status_cmd import status
 from .switch_cmd import switch
@@ -96,6 +98,7 @@ __all__ = [
     "config",
     "revert",
     "restore",
+    "save",
     "clean",
     "doctor",
     "verify",
@@ -112,6 +115,7 @@ __all__ = [
     "export_cmd",
     "encrypt_cmd",
     "discover_cmd",
+    "bootstrap_cmd",
     "completions",
     "watch",
     "rollback",

dotman_git-1.3.1/dot_man/cli/bootstrap_cmd.py

@@ -0,0 +1,240 @@
+"""Bootstrap command for dot-man — install packages via system package managers."""
+
+import logging
+import shutil
+import subprocess
+
+import click
+
+from .. import ui
+from .common import require_init, success, warn
+from .interface import cli as main
+
+# Package manager detection: command → (install_cmd, update_cmd)
+PACKAGE_MANAGERS = {
+    "brew": {
+        "install": "brew install {package}",
+        "update": "brew update",
+        "detect": "brew",
+    },
+    "apt": {
+        "install": "sudo apt-get install -y {package}",
+        "update": "sudo apt-get update",
+        "detect": "apt-get",
+    },
+    "dnf": {
+        "install": "sudo dnf install -y {package}",
+        "update": "sudo dnf check-update",
+        "detect": "dnf",
+    },
+    "pacman": {
+        "install": "sudo pacman -S --noconfirm {package}",
+        "update": "sudo pacman -Sy",
+        "detect": "pacman",
+    },
+    "zypper": {
+        "install": "sudo zypper install -y {package}",
+        "update": "sudo zypper refresh",
+        "detect": "zypper",
+    },
+    "nix-env": {
+        "install": "nix-env -iA nixpkgs.{package}",
+        "update": "nix-channel --update",
+        "detect": "nix-env",
+    },
+    "xbps-install": {
+        "install": "sudo xbps-install -y {package}",
+        "update": "sudo xbps-install -Su",
+        "detect": "xbps-install",
+    },
+    "pkg": {
+        "install": "pkg install -y {package}",
+        "update": "pkg update",
+        "detect": "pkg",
+    },
+}
+
+
+def _detect_package_manager() -> str | None:
+    """Detect the available package manager on this system."""
+    import platform
+
+    os_name = platform.system().lower()
+
+    # Preferred order by OS
+    if os_name == "darwin":
+        preferred = ["brew"]
+    elif os_name == "linux":
+        preferred = ["apt", "dnf", "pacman", "zypper", "xbps-install", "nix-env"]
+    elif os_name == "freebsd":
+        preferred = ["pkg"]
+    else:
+        preferred = list(PACKAGE_MANAGERS.keys())
+
+    for pm in preferred:
+        if shutil.which(PACKAGE_MANAGERS[pm]["detect"]):
+            return pm
+
+    return None
+
+
+def _load_bootstrap_packages() -> dict[str, list[str]]:
+    """Load packages from dot-man config or bootstrap.toml."""
+    try:
+        from ..config import DotManConfig
+
+        config = DotManConfig()
+        config.load()
+
+        # Check for [bootstrap] section in config
+        bootstrap = config._data.get("bootstrap", {})
+        if bootstrap:
+            packages = {}
+            # Support both flat list and grouped format
+            if isinstance(bootstrap, dict):
+                for key, value in bootstrap.items():
+                    if key == "packages" and isinstance(value, list):
+                        packages["default"] = value
+                    elif isinstance(value, list):
+                        packages[key] = value
+            return packages
+
+    except Exception as e:
+        logging.debug(f"Failed to load bootstrap config: {e}")
+
+    return {}
+
+
+def _run_with_pm(pm: str, command_template: str, package: str) -> bool:
+    """Run a package manager command. Returns True on success."""
+    cmd = command_template.format(package=package)
+    ui.console.print(f"  [cyan]$ {cmd}[/cyan]")
+    try:
+        result = subprocess.run(
+            cmd, shell=True, capture_output=True, text=True, timeout=300
+        )
+        if result.returncode == 0:
+            return True
+        else:
+            warn(f"Failed to install {package} (exit code {result.returncode})")
+            if result.stderr:
+                for line in result.stderr.splitlines()[:3]:
+                    ui.console.print(f"    [dim]{line}[/dim]")
+            return False
+    except subprocess.TimeoutExpired:
+        warn(f"Timeout installing {package}")
+        return False
+    except Exception as e:
+        warn(f"Error installing {package}: {e}")
+        return False
+
+
+@main.command("bootstrap")
+@click.option(
+    "--list",
+    "list_only",
+    is_flag=True,
+    help="List packages that would be installed without installing",
+)
+@click.option("--pm", help="Package manager to use (auto-detected if not specified)")
+@click.option("--update", is_flag=True, help="Update package manager first")
+@click.argument("packages", nargs=-1)
+@require_init
+def bootstrap(list_only: bool, pm: str | None, update: bool, packages: tuple[str, ...]):
+    """Install system packages via package managers.
+
+    Detects your system package manager (brew, apt, dnf, pacman, etc.)
+    and installs the specified packages. Packages can also be defined
+    in your dot-man config under [bootstrap].
+
+    Examples:
+        # Install specific packages
+        dot-man bootstrap neovim tmux git
+
+        # List what would be installed from config
+        dot-man bootstrap --list
+
+        # Use a specific package manager
+        dot-man bootstrap --pm brew neovim
+
+        # Update package manager first
+        dot-man bootstrap --update neovim
+    """
+    # Detect package manager
+    if not pm:
+        pm = _detect_package_manager()
+        if not pm:
+            ui.console.print("[red]No supported package manager found.[/red]")
+            ui.console.print(
+                "Supported: brew, apt, dnf, pacman, zypper, nix-env, xbps-install, pkg"
+            )
+            ui.console.print("Use --pm to specify one manually.")
+            raise SystemExit(1)
+
+    if pm not in PACKAGE_MANAGERS:
+        ui.console.print(f"[red]Unknown package manager: {pm}[/red]")
+        raise SystemExit(1)
+
+    pm_info = PACKAGE_MANAGERS[pm]
+    ui.console.print(f"[bold]Using package manager:[/bold] [cyan]{pm}[/cyan]")
+
+    # Collect packages from args and config
+    all_packages: dict[str, list[str]] = {}
+
+    if packages:
+        all_packages["command-line"] = list(packages)
+
+    config_packages = _load_bootstrap_packages()
+    all_packages.update(config_packages)
+
+    if not all_packages:
+        ui.console.print("[yellow]No packages specified.[/yellow]")
+        ui.console.print("Usage: dot-man bootstrap <package1> <package2> ...")
+        ui.console.print("Or add [bootstrap] section to your dot-man.toml:")
+        ui.console.print('  [bootstrap]\n  packages = ["neovim", "tmux", "git"]')
+        return
+
+    # List mode
+    if list_only:
+        ui.console.print()
+        ui.console.print("[bold]Packages to install:[/bold]")
+        for group, pkgs in all_packages.items():
+            ui.console.print(f"  [cyan]{group}:[/cyan]")
+            for pkg in pkgs:
+                ui.console.print(f"    • {pkg}")
+        ui.console.print()
+        total = sum(len(pkgs) for pkgs in all_packages.values())
+        ui.console.print(f"  [dim]{total} package(s) total[/dim]")
+        return
+
+    # Update package manager if requested
+    if update:
+        ui.console.print()
+        ui.console.print("[bold]Updating package manager...[/bold]")
+        _run_with_pm(pm, pm_info["update"], "")
+
+    # Install packages
+    installed = 0
+    failed = 0
+
+    for group, pkgs in all_packages.items():
+        ui.console.print()
+        ui.console.print(f"[bold]Installing {group}:[/bold]")
+        for pkg in pkgs:
+            ui.console.print(f"\n[bold]→ {pkg}[/bold]")
+            result = _run_with_pm(pm, pm_info["install"], pkg)
+            if result:
+                installed += 1
+            else:
+                failed += 1
+
+    # Summary
+    ui.console.print()
+    ui.console.print("[bold]Bootstrap complete:[/bold]")
+    ui.console.print(f"  [green]✓ {installed} installed[/green]")
+    if failed:
+        ui.console.print(f"  [red]✗ {failed} failed[/red]")
+    ui.console.print()
+
+    if installed > 0:
+        success(f"Installed {installed} package(s) via {pm}")

dotman_git-1.3.1/dot_man/cli/common.py

@@ -0,0 +1,268 @@
+"""Common utilities for dot-man CLI commands."""
+
+import logging
+import re
+from functools import wraps
+from typing import Callable
+
+import click
+
+from .. import ui
+from ..constants import DOT_MAN_DIR, REPO_DIR
+from ..core import GitManager
+from ..secrets import PermanentRedactGuard, SecretGuard, SecretMatch
+from .completions import (  # noqa: F401 — re-exports for backward compat
+    _clear_all_caches,
+    _clear_completion_cache,
+    _set_git_runner,
+    complete_branches,
+    complete_commits,
+    complete_config_keys,
+    complete_profiles,
+    complete_sections,
+    complete_switch_args,
+    complete_tags,
+    complete_template_keys,
+)
+
+
+def error(message: str, exit_code: int = 1) -> None:
+    """Print error message and exit."""
+    ui.error(message, exit_code)
+
+
+def success(message: str) -> None:
+    """Print success message."""
+    ui.success(message)
+
+
+def warn(message: str) -> None:
+    """Print warning message."""
+    ui.warn(message)
+
+
+def handle_exception(exc: BaseException, context: str = "Operation") -> None:
+    """Handle exceptions with user-friendly diagnostics."""
+    from ..exceptions import DotManError, ErrorDiagnostic
+
+    if isinstance(exc, DotManError):
+        error(str(exc), exc.exit_code)
+        return
+
+    if isinstance(exc, KeyboardInterrupt):
+        ui.console.print()
+        warn("Operation cancelled by user")
+        raise SystemExit(130)
+
+    diagnostic = ErrorDiagnostic.from_exception(exc)  # type: ignore[arg-type]
+    ui.console.print()
+    ui.console.print(f"[red bold]{diagnostic.title}[/red bold]")
+    ui.console.print(f"[red]{diagnostic.details}[/red]")
+    ui.console.print()
+    ui.console.print(f"[dim]💡 {diagnostic.suggestion}[/dim]")
+    raise SystemExit(1)
+
+
+class AliasedCommand(click.Command):
+    """Custom Command class that supports aliases."""
+
+    def __init__(self, *args, aliases=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self._aliases = aliases or []
+
+    @property
+    def aliases(self):
+        return self._aliases
+
+
+def command(name=None, cls=None, aliases=None, **kwargs):
+    """Decorator to create a command with optional aliases."""
+    if cls is None:
+        cls = AliasedCommand
+
+    def decorator(f):
+        return click.command(name=name, cls=cls, aliases=aliases, **kwargs)(f)
+
+    return decorator
+
+
+class DotManGroup(click.Group):
+    """Custom Click Group to provide suggestions for typos."""
+
+    def add_command(self, command, name=None):
+        name = name or command.name
+        super().add_command(command, name)
+        if hasattr(command, "aliases") and command.aliases:
+            for alias in command.aliases:
+                super().add_command(command, alias)
+
+    def get_command(self, ctx, cmd_name):
+        rv = click.Group.get_command(self, ctx, cmd_name)
+        if rv is not None:
+            return rv
+
+        matches = [cmd for cmd in self.list_commands(ctx)]
+        suggestion = ui.suggest_command(cmd_name, matches)
+
+        ui.error(f"Unknown command '{cmd_name}'", exit_code=0)
+        if suggestion:
+            ui.warn(f"Did you mean '{suggestion}'?")
+
+        ctx.exit(2)
+
+
+def require_init(func):
+    """Decorator to require initialization before running command."""
+
+    @wraps(func)
+    def wrapper(*args, **kwargs):
+        if not DOT_MAN_DIR.exists():
+            ui.console.print()
+            ui.print_banner("🎯 Welcome to dot-man!")
+            ui.console.print()
+            ui.console.print("[bold]The Dotfile Manager for Professionals[/bold]")
+            ui.console.print()
+            ui.console.print("[bold cyan]Coming from another tool?[/bold cyan]")
+            ui.console.print(
+                "  [cyan]dot-man import chezmoi[/cyan]    - Import from chezmoi"
+            )
+            ui.console.print(
+                "  [cyan]dot-man import yadm[/cyan]       - Import from yadm"
+            )
+            ui.console.print(
+                "  [cyan]dot-man import stow[/cyan]       - Import from GNU Stow"
+            )
+            ui.console.print(
+                "  [cyan]dot-man import all[/cyan]        - Auto-detect and import"
+            )
+            ui.console.print()
+            ui.console.print("[bold cyan]Get started:[/bold cyan]")
+            ui.console.print(
+                "  [cyan]dot-man init[/cyan]              - Initialize your dotfiles repository"
+            )
+            ui.console.print(
+                "  [cyan]dot-man init --help[/cyan]       - See all init options"
+            )
+            ui.console.print()
+            ui.console.print("[bold cyan]Quick overview:[/bold cyan]")
+            ui.console.print(
+                "  [cyan]dot-man add <path>[/cyan]         - Add files to track"
+            )
+            ui.console.print(
+                "  [cyan]dot-man status[/cyan]            - View tracked files"
+            )
+            ui.console.print(
+                "  [cyan]dot-man navigate <branch>[/cyan]  - Switch between configurations"
+            )
+            ui.console.print(
+                "  [cyan]dot-man --help[/cyan]            - See all commands"
+            )
+            ui.console.print()
+            ui.console.print("[dim]💡 Run 'dot-man init' to get started![/dim]")
+            ui.console.print()
+            raise SystemExit(1)
+
+        if not REPO_DIR.exists() or not (REPO_DIR / ".git").exists():
+            error("Repository not initialized. Run 'dot-man init' first.", exit_code=1)
+
+        return func(*args, **kwargs)
+
+    return wrapper
+
+
+def parse_branch_arg(arg: str) -> dict:
+    """Parse branch argument with @tag or commit SHA support."""
+    match = re.match(r"^(.+)@(.+)$", arg)
+    if match:
+        base = match.group(1)
+        target = match.group(2)
+
+        if not base:
+            base = "HEAD"
+
+        if re.match(r"^[a-f0-9]{7,40}$", target):
+            return {"type": "commit", "base": base, "target": target}
+
+        return {"type": "tag", "base": base, "target": target}
+
+    if re.match(r"^[a-f0-9]{7,40}$", arg):
+        return {"type": "commit", "base": "HEAD", "target": arg}
+
+    try:
+        git = GitManager()
+        if arg in git.list_tags():
+            return {"type": "tag", "base": "HEAD", "target": arg}
+    except Exception as e:
+        logging.debug(f"Could not check tags: {e}")
+
+    return {"type": "branch", "base": arg, "target": arg}
+
+
+class BranchParamType(click.ParamType):
+    """Parameter type that accepts branch, branch@tag, or commit SHA."""
+
+    name = "branch"
+
+    def convert(self, value, param, ctx):
+        if not value:
+            return None
+        return parse_branch_arg(value)
+
+
+BRANCH = BranchParamType()
+
+
+def get_secret_handler() -> Callable[[SecretMatch], str]:
+    """Get a secret handler that prompts the user for action."""
+    guard = SecretGuard()
+    permanent_guard = PermanentRedactGuard()
+
+    def handle_secret(match: SecretMatch) -> str:
+        if permanent_guard.should_redact(
+            match.file, match.line_content, match.pattern_name
+        ):
+            return "REDACT"
+
+        if guard.is_allowed(match.file, match.line_content, match.pattern_name):
+            return "IGNORE"
+
+        ui.console.print()
+        ui.warn("Potential secret detected!")
+        ui.console.print(f"File: [cyan]{match.file}[/cyan]")
+        ui.console.print(f"Line {match.line_number}: {match.line_content[:80]}...")
+        ui.console.print(
+            f"Pattern: {match.pattern_name} (severity: {match.severity.value})"
+        )
+        ui.console.print()
+
+        ui.console.print("Choose how to handle this secret:")
+        ui.console.print("  1. [dim]Ignore (skip it this time)[/dim]")
+        ui.console.print(
+            "  2. [yellow]Protect (replace with ***REDACTED*** this time)[/yellow]"
+        )
+        ui.console.print(
+            "  3. [blue]Add to skip list (skip this line every time)[/blue]"
+        )
+        ui.console.print("  4. [red]Protect forever (always replace in repo)[/red]")
+        ui.console.print()
+
+        choices = ["1", "2", "3", "4"]
+        choice = ui.ask("Enter choice", choices=choices, default="2")
+
+        if choice == "1":
+            return "IGNORE"
+        elif choice == "2":
+            return "REDACT"
+        elif choice == "3":
+            guard.add_allowed(match.file, match.line_content, match.pattern_name)
+            ui.info("Added to skip list.")
+            return "IGNORE"
+        elif choice == "4":
+            permanent_guard.add_permanent_redact(
+                match.file, match.line_content, match.pattern_name
+            )
+            ui.warn("Will always redact this secret.")
+            return "REDACT"
+        return "REDACT"
+
+    return handle_secret