git-cai-cli 0.14.2__tar.gz → 0.15.2__tar.gz

git_cai_cli-0.15.2/.caiignore

@@ -0,0 +1 @@
+tests/unit/test_secrets.py

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/.gitignore

@@ -7,6 +7,8 @@ src/git_cai_cli.egg-info/
 megalinter-reports/
 __pycache__/
 .ruff_cache/
+.pytest_cache/
+.mypy_cache/
 .venv/
 
 # files

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/.linters/.pylintrc

@@ -7,7 +7,7 @@ persistent=yes                  # Save data between runs (improves inference cac
 unsafe-load-any-extension=no    # Prevent loading arbitrary C extensions for safety
 
 ignore=venv,build,dist,__pycache__,tests        # Ignore common generated/virtual dirs
-ignore-paths=.*[\\/](\.venv|\.mypy_cache|\.pytest_cache|build|dist|docs)([\\/].*)?$
+ignore-paths=.*[\\/](\.venv|\.mypy_cache|\.pytest_cache|build|dist|docs)([\\/].*)?$,.*[\\/]_version\.py$
 
 ignore-patterns=^\.#,^__init__\.py$        # Ignore editor lockfiles (e.g., Emacs)
 
@@ -66,12 +66,12 @@ check-protected-access-in-special-methods=no
                                            # Don’t warn about protected attr access in dunder methods
 
 [DESIGN]
-max-args=25                                # Max arguments per function
+max-args=30                                # Max arguments per function
 max-attributes=12                          # Max attributes per class
 max-branches=30                            # Max branches per function
-max-locals=70                              # Max locals per function
+max-locals=80                              # Max locals per function
 max-returns=10                             # Max return statements per function
-max-statements=120                         # Max total statements per function
+max-statements=130                         # Max total statements per function
 max-public-methods=20                      # Max public methods per class
 min-public-methods=1                       # Min public methods per class
 max-nested-blocks=15                       # Max nesting depth

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/.mega-linter.yml

@@ -67,6 +67,7 @@ REPOSITORY_SEMGREP_RULESETS:
     "p/r2c-security-audit",
     "p/secure-defaults",
   ]
+SECURITY_SUGGESTIONS: false
 SHOW_ELAPSED_TIME: true
 SHOW_SKIPPED_LINTERS: true
 SPELL_PROSELINT_RULES_PATH: .linters

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-cai-cli
-Version: 0.14.2
+Version: 0.15.2
 Summary: Use LLM to create git commit messages
 Author-email: Thorsten Foltz <thorsten.foltz@live.com>
 License-Expression: MIT
@@ -79,7 +79,7 @@ Currently supported providers:
 - Global configuration with per-repository overrides
 - Interactive `--init` wizard for first-time setup (provider, token, language, style)
 - Repository-specific language, style, and model selection
-- Amend the last commit message with a regenerated one
+- Amend mode refines the existing commit message instead of regenerating it from scratch, preserving trailers and intent
 - Conventional Commits format support
 - `Signed-off-by:` (DCO) trailer support via `--signoff`
 - `--print` mode that emits the generated message to stdout for scripting
@@ -95,6 +95,9 @@ Currently supported providers:
 - Generation time measurement
 - Local-only usage analytics (per-provider commits, tokens, latency) with opt-in SQLite storage
 - Shell completion for bash, zsh, and fish
+- Local secret scan that blocks the diff before it reaches the provider when likely credentials are detected
+- Configuration doctor (`--check`) that validates your setup offline, with an optional live provider probe (`--ping`)
+- Mixed code and documentation diffs are classified by the functional change rather than mislabelled as docs
 
 ---
 
@@ -261,6 +264,8 @@ git cai -g
 - `stats` – opt in to local-only usage analytics (per-run row in a SQLite DB at `~/.local/share/git-cai/stats.db`); default `false`.
 No diff content, commit messages, or file paths are stored — only metadata (provider, model, kind, repo name, token counts, latency, settings)
 - `signoff` – append a `Signed-off-by:` trailer (built from git `user.name` / `user.email`) to every commit message; default `false`
+- `secret_scan` – scan the outgoing diff for likely secrets and ask before sending; default `true`. Bypass once with `-B` / `--allow-secrets`,
+or disable entirely by setting it to `false`. Skipped for tokenless providers (Ollama), where nothing leaves the machine
 
 ---
 
@@ -268,8 +273,9 @@ No diff content, commit messages, or file paths are stored — only metadata (pr
 
 In addition to `git cai`, the following options are available:
 
-- `-A`, `--amend` – regenerate and amend the last commit message
+- `-A`, `--amend` – refine the last commit message against its diff and amend it (preserves trailers and original intent)
 - `-a`, `--all` – stage all tracked modified and deleted files
+- `-B`, `--allow-secrets` – bypass the local secret scan and send the diff even if a likely secret is detected
 - `-b`, `--branch` – include current branch name as context for the LLM
 - `-C`, `--conventional` – use Conventional Commits format (`type(scope): description`)
 - `-c`, `--crazy` – Trust the LLM and commit without checking
@@ -282,8 +288,10 @@ In addition to `git cai`, the following options are available:
 - `-h`, `--help` – show help and available commands
 - `-I`, `--init` – interactive setup wizard (writes home config and tokens.yml)
 - `-i`, `--install-completion` – install shell completion for bash, zsh, or fish
+- `-k`, `--check` – run configuration diagnostics offline (config source, provider, token, prompts, editor, style)
 - `-l`, `--list` – list available information. Valid types: `config`, `editor`, `language`, `model`, `path`, `provider`, `style`
 - `-m`, `--model` – override the model for this invocation (requires `-P`)
+- `-n`, `--ping` – with `--check`, also send a tiny request to the active provider to confirm reachability
 - `-o`, `--signoff` / `--no-signoff` – append a `Signed-off-by:` trailer (uses git `user.name` / `user.email`); applies to commit, amend, and squash modes
 - `-P`, `--provider` – override the LLM provider for this invocation
 - `-p`, `--generate-prompts` – generate default `commit_prompt.md` and `squash_prompt.md` in the current directory (for customization)
@@ -310,14 +318,17 @@ In addition to `git cai`, the following options are available:
 
 ### Amend
 
-To regenerate the last commit message and amend it:
+To refine the last commit message and amend it:
 
 ```sh
 git cai -A
 ```
 
-This reads the diff from the most recent commit, sends it to the LLM, and opens the editor for review.
-Use with `-c` to amend immediately without the editor: `git cai -A -c`.
+This reads the diff from the most recent commit and sends both the diff and the
+existing message to the LLM, which improves the wording while keeping the
+original intent and any trailers (issue IDs, `Co-authored-by`). The result opens
+in the editor for review. Use with `-c` to amend immediately without the editor:
+`git cai -A -c`.
 
 ### Conventional Commits
 
@@ -466,6 +477,45 @@ git cai -H language=de
 git cai -H emoji=false
 ```
 
+### Configuration check (doctor)
+
+`-k` / `--check` runs a set of offline diagnostics so you can confirm cai is
+set up correctly without contacting any provider. It reports the authoritative
+config source, validates the config keys, checks the active provider block, the
+token and `tokens.yml` permissions, prompt resolution, the editor on your PATH,
+and the configured style.
+
+```sh
+git cai -k                       # offline diagnostics only
+git cai --check                  # long form
+git cai -k -n                    # also probe the provider for reachability
+git cai --check --ping           # long form
+```
+
+Add `-n` / `--ping` to send one tiny synthetic diff to the active provider and
+confirm it is reachable (this consumes a minimal request). The command exits
+non-zero if any check fails, so it works in scripts and CI.
+
+### Secret scanning
+
+Before any diff leaves your machine, cai scans it for likely credentials
+(private keys, AWS, OpenAI, GitHub, Slack, and Google keys). When something is
+found, the location is shown as `path:line` with a masked value and you are
+asked to confirm before anything is sent.
+
+```sh
+git cai                          # scan runs automatically, prompts on a hit
+git cai -B                       # bypass the scan for this run
+git cai --allow-secrets          # long form
+git cai -S secret_scan=false     # disable the scan persistently
+```
+
+Obvious placeholders (`example`, `dummy`, repeated filler, and similar) are
+ignored to keep the noise down, and the scan is skipped entirely for tokenless
+providers such as Ollama, where nothing leaves the machine. In non-interactive
+runs (`-c` / `--crazy`, or no TTY) a detection aborts the send instead of
+prompting; re-run with `-B` to override.
+
 ---
 
 ## License

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/README.md

@@ -49,7 +49,7 @@ Currently supported providers:
 - Global configuration with per-repository overrides
 - Interactive `--init` wizard for first-time setup (provider, token, language, style)
 - Repository-specific language, style, and model selection
-- Amend the last commit message with a regenerated one
+- Amend mode refines the existing commit message instead of regenerating it from scratch, preserving trailers and intent
 - Conventional Commits format support
 - `Signed-off-by:` (DCO) trailer support via `--signoff`
 - `--print` mode that emits the generated message to stdout for scripting
@@ -65,6 +65,9 @@ Currently supported providers:
 - Generation time measurement
 - Local-only usage analytics (per-provider commits, tokens, latency) with opt-in SQLite storage
 - Shell completion for bash, zsh, and fish
+- Local secret scan that blocks the diff before it reaches the provider when likely credentials are detected
+- Configuration doctor (`--check`) that validates your setup offline, with an optional live provider probe (`--ping`)
+- Mixed code and documentation diffs are classified by the functional change rather than mislabelled as docs
 
 ---
 
@@ -231,6 +234,8 @@ git cai -g
 - `stats` – opt in to local-only usage analytics (per-run row in a SQLite DB at `~/.local/share/git-cai/stats.db`); default `false`.
 No diff content, commit messages, or file paths are stored — only metadata (provider, model, kind, repo name, token counts, latency, settings)
 - `signoff` – append a `Signed-off-by:` trailer (built from git `user.name` / `user.email`) to every commit message; default `false`
+- `secret_scan` – scan the outgoing diff for likely secrets and ask before sending; default `true`. Bypass once with `-B` / `--allow-secrets`,
+or disable entirely by setting it to `false`. Skipped for tokenless providers (Ollama), where nothing leaves the machine
 
 ---
 
@@ -238,8 +243,9 @@ No diff content, commit messages, or file paths are stored — only metadata (pr
 
 In addition to `git cai`, the following options are available:
 
-- `-A`, `--amend` – regenerate and amend the last commit message
+- `-A`, `--amend` – refine the last commit message against its diff and amend it (preserves trailers and original intent)
 - `-a`, `--all` – stage all tracked modified and deleted files
+- `-B`, `--allow-secrets` – bypass the local secret scan and send the diff even if a likely secret is detected
 - `-b`, `--branch` – include current branch name as context for the LLM
 - `-C`, `--conventional` – use Conventional Commits format (`type(scope): description`)
 - `-c`, `--crazy` – Trust the LLM and commit without checking
@@ -252,8 +258,10 @@ In addition to `git cai`, the following options are available:
 - `-h`, `--help` – show help and available commands
 - `-I`, `--init` – interactive setup wizard (writes home config and tokens.yml)
 - `-i`, `--install-completion` – install shell completion for bash, zsh, or fish
+- `-k`, `--check` – run configuration diagnostics offline (config source, provider, token, prompts, editor, style)
 - `-l`, `--list` – list available information. Valid types: `config`, `editor`, `language`, `model`, `path`, `provider`, `style`
 - `-m`, `--model` – override the model for this invocation (requires `-P`)
+- `-n`, `--ping` – with `--check`, also send a tiny request to the active provider to confirm reachability
 - `-o`, `--signoff` / `--no-signoff` – append a `Signed-off-by:` trailer (uses git `user.name` / `user.email`); applies to commit, amend, and squash modes
 - `-P`, `--provider` – override the LLM provider for this invocation
 - `-p`, `--generate-prompts` – generate default `commit_prompt.md` and `squash_prompt.md` in the current directory (for customization)
@@ -280,14 +288,17 @@ In addition to `git cai`, the following options are available:
 
 ### Amend
 
-To regenerate the last commit message and amend it:
+To refine the last commit message and amend it:
 
 ```sh
 git cai -A
 ```
 
-This reads the diff from the most recent commit, sends it to the LLM, and opens the editor for review.
-Use with `-c` to amend immediately without the editor: `git cai -A -c`.
+This reads the diff from the most recent commit and sends both the diff and the
+existing message to the LLM, which improves the wording while keeping the
+original intent and any trailers (issue IDs, `Co-authored-by`). The result opens
+in the editor for review. Use with `-c` to amend immediately without the editor:
+`git cai -A -c`.
 
 ### Conventional Commits
 
@@ -436,6 +447,45 @@ git cai -H language=de
 git cai -H emoji=false
 ```
 
+### Configuration check (doctor)
+
+`-k` / `--check` runs a set of offline diagnostics so you can confirm cai is
+set up correctly without contacting any provider. It reports the authoritative
+config source, validates the config keys, checks the active provider block, the
+token and `tokens.yml` permissions, prompt resolution, the editor on your PATH,
+and the configured style.
+
+```sh
+git cai -k                       # offline diagnostics only
+git cai --check                  # long form
+git cai -k -n                    # also probe the provider for reachability
+git cai --check --ping           # long form
+```
+
+Add `-n` / `--ping` to send one tiny synthetic diff to the active provider and
+confirm it is reachable (this consumes a minimal request). The command exits
+non-zero if any check fails, so it works in scripts and CI.
+
+### Secret scanning
+
+Before any diff leaves your machine, cai scans it for likely credentials
+(private keys, AWS, OpenAI, GitHub, Slack, and Google keys). When something is
+found, the location is shown as `path:line` with a masked value and you are
+asked to confirm before anything is sent.
+
+```sh
+git cai                          # scan runs automatically, prompts on a hit
+git cai -B                       # bypass the scan for this run
+git cai --allow-secrets          # long form
+git cai -S secret_scan=false     # disable the scan persistently
+```
+
+Obvious placeholders (`example`, `dummy`, repeated filler, and similar) are
+ignored to keep the noise down, and the scan is skipped entirely for tokenless
+providers such as Ollama, where nothing leaves the machine. In non-interactive
+runs (`-c` / `--crazy`, or no TTY) a detection aborts the send instead of
+prompting; re-run with `-B` to override.
+
 ---
 
 ## License

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/docs/git-cai.txt

@@ -12,6 +12,7 @@ SYNOPSIS
 [verse]
 `git cai` [-A | --amend] [-a | --all] [-C | --conventional]
         [-b | --branch] [-c | --crazy] [-d | --debug]
+        [-B | --allow-secrets] [-k | --check] [-n | --ping]
         [-e TEMPERATURE | --temperature TEMPERATURE]
         [-F | --full-files | --no-full-files] [-f PATH | --files PATH]
         [-g | --generate-config]
@@ -93,6 +94,10 @@ so you can review or adjust the message before amending. This is useful when
 the original commit message was poorly worded or when you want the LLM to
 produce a better summary.
 +
+git-cai also sends the existing commit message to the LLM, so it refines and
+improves the current wording instead of starting over, preserving issue
+references and trailers such as `Co-authored-by`.
++
 Combine with `-c` to skip the editor and amend immediately.
 +
 Cannot be combined with `--squash` or `--list`.
@@ -113,6 +118,18 @@ Cannot be combined with `--list`, `--update`, or `--squash`.
 git cai -a
 ----
 
+-B, --allow-secrets::
+Bypass the local secret scan for this invocation and send the diff to the LLM
+even if a likely secret (API key, token, private key) is detected. By default
+git-cai scans the exact content it is about to send and blocks on a match; use
+this flag in non-interactive contexts where you have confirmed the match is a
+false positive. See also the `secret_scan` config key.
++
+----
+git cai -B
+git cai -A --allow-secrets
+----
+
 -b, --branch / --no-branch::
 Include the current Git branch name as context when generating the commit
 message. The LLM uses the branch name to better understand the intent and
@@ -306,6 +323,31 @@ file for the completions to take effect.
 git cai -i
 ----
 
+-k, --check::
+Run configuration diagnostics and exit. The check is offline by default: it
+reports which config is authoritative (repository, home, or built-in), validates
+the config keys, confirms the default provider has a model/temperature and a
+usable token, that the commit/squash/full-files/PR prompts resolve, and that the
+configured editor is on `PATH`. Exits non-zero if any check fails. Add `--ping`
+to also probe the active provider with a tiny live request.
++
+Cannot be combined with other mode flags (`--amend`, `--squash`, `--PR`,
+`--list`, `--stats`, `--init`, `--update`).
++
+----
+git cai --check
+git cai --check --ping
+----
+
+-n, --ping::
+Only meaningful together with `--check`. After the offline checks, send one
+small request to the active provider and report whether it is reachable and how
+long it took. Useful to confirm an API key and network path end to end.
++
+----
+git cai --check --ping
+----
+
 -l, --list [config|editor|language|model|path|provider|style]::
 List information about a specific category. Provide one of the supported
 list types as the next argument. Without an argument, a help text is shown
@@ -865,6 +907,25 @@ Available configuration keys:
 - `emoji` -- enable or disable emojis in commit messages (`true`/`false`)
 - `branch_context` -- include current branch name as LLM context (`true`/`false`)
 - `conventional` -- use Conventional Commits format (`true`/`false`)
+- `secret_scan` -- scan the diff (and any full-file contents) for likely
+  secrets before sending to the LLM (`true`/`false`, default `true`). On a
+  match the send is blocked and you are asked to confirm (or pass
+  `--allow-secrets`); each finding reports the file and line. Only distinctive
+  credential formats are flagged (private keys, AWS/GitHub/Slack/Google/OpenAI
+  keys); obvious placeholders (values containing `example`, `sample`, `dummy`,
+  and repeated-character filler) are ignored. Local providers (Ollama) skip the
+  scan, since nothing leaves the machine. When you confirm a flagged send in an
+  interactive commit (a false alarm), git-cai offers, per flagged file, to
+  remember the decision: add the file to `.caiignore` (drop it from git-cai
+  entirely), add it to `secret_scan_exclude` (keep sending it but skip its
+  scan), or skip (remember nothing).
+- `secret_scan_exclude` -- list of repo-relative paths whose contents are
+  exempt from the secret scan while still being sent to the LLM (default empty).
+  Use this for files that keep tripping a false positive (such as test fixtures)
+  but that you still want git-cai to see. Paths are matched with gitignore
+  semantics, like `.caiignore`, so directory patterns work too. The
+  false-alarm prompt writes here when you choose "keep, skip scan", targeting
+  the repository `cai_config.yml` if one exists, otherwise the home config.
 - `load_tokens_from` -- path to the tokens file
 - `prompt_file` -- path to the commit prompt Markdown file
 - `squash_prompt_file` -- path to the squash prompt Markdown file

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/docs/man/git-cai.1

@@ -2,12 +2,12 @@
 .\"     Title: git-cai
 .\"    Author: Thorsten Foltz
 .\" Generator: Asciidoctor 2.0.26
-.\"      Date: 2026-06-14
+.\"      Date: 2026-06-24
 .\"    Manual: \ \&
 .\"    Source: \ \&
 .\"  Language: English
 .\"
-.TH "GIT\-CAI" "1" "2026-06-14" "\ \&" "\ \&"
+.TH "GIT\-CAI" "1" "2026-06-24" "\ \&" "\ \&"
 .ie \n(.g .ds Aq \(aq
 .el       .ds Aq '
 .ss \n[.ss] 0
@@ -34,6 +34,7 @@ git-cai \- AI\-powered commit message generator
 .nf
 \f(CRgit cai\fP [\-A | \-\-amend] [\-a | \-\-all] [\-C | \-\-conventional]
         [\-b | \-\-branch] [\-c | \-\-crazy] [\-d | \-\-debug]
+        [\-B | \-\-allow\-secrets] [\-k | \-\-check] [\-n | \-\-ping]
         [\-e TEMPERATURE | \-\-temperature TEMPERATURE]
         [\-F | \-\-full\-files | \-\-no\-full\-files] [\-f PATH | \-\-files PATH]
         [\-g | \-\-generate\-config]
@@ -219,6 +220,10 @@ so you can review or adjust the message before amending. This is useful when
 the original commit message was poorly worded or when you want the LLM to
 produce a better summary.
 .sp
+git\-cai also sends the existing commit message to the LLM, so it refines and
+improves the current wording instead of starting over, preserving issue
+references and trailers such as \f(CRCo\-authored\-by\fP.
+.sp
 Combine with \f(CR\-c\fP to skip the editor and amend immediately.
 .sp
 Cannot be combined with \f(CR\-\-squash\fP or \f(CR\-\-list\fP.
@@ -250,6 +255,24 @@ git cai \-a
 .if n .RE
 .RE
 .sp
+\-B, \-\-allow\-secrets
+.RS 4
+Bypass the local secret scan for this invocation and send the diff to the LLM
+even if a likely secret (API key, token, private key) is detected. By default
+git\-cai scans the exact content it is about to send and blocks on a match; use
+this flag in non\-interactive contexts where you have confirmed the match is a
+false positive. See also the \f(CRsecret_scan\fP config key.
+.sp
+.if n .RS 4
+.nf
+.fam C
+git cai \-B
+git cai \-A \-\-allow\-secrets
+.fam
+.fi
+.if n .RE
+.RE
+.sp
 \-b, \-\-branch / \-\-no\-branch
 .RS 4
 Include the current Git branch name as context when generating the commit
@@ -527,6 +550,43 @@ git cai \-i
 .if n .RE
 .RE
 .sp
+\-k, \-\-check
+.RS 4
+Run configuration diagnostics and exit. The check is offline by default: it
+reports which config is authoritative (repository, home, or built\-in), validates
+the config keys, confirms the default provider has a model/temperature and a
+usable token, that the commit/squash/full\-files/PR prompts resolve, and that the
+configured editor is on \f(CRPATH\fP. Exits non\-zero if any check fails. Add \f(CR\-\-ping\fP
+to also probe the active provider with a tiny live request.
+.sp
+Cannot be combined with other mode flags (\f(CR\-\-amend\fP, \f(CR\-\-squash\fP, \f(CR\-\-PR\fP,
+\f(CR\-\-list\fP, \f(CR\-\-stats\fP, \f(CR\-\-init\fP, \f(CR\-\-update\fP).
+.sp
+.if n .RS 4
+.nf
+.fam C
+git cai \-\-check
+git cai \-\-check \-\-ping
+.fam
+.fi
+.if n .RE
+.RE
+.sp
+\-n, \-\-ping
+.RS 4
+Only meaningful together with \f(CR\-\-check\fP. After the offline checks, send one
+small request to the active provider and report whether it is reachable and how
+long it took. Useful to confirm an API key and network path end to end.
+.sp
+.if n .RS 4
+.nf
+.fam C
+git cai \-\-check \-\-ping
+.fam
+.fi
+.if n .RE
+.RE
+.sp
 \-l, \-\-list [config|editor|language|model|path|provider|style]
 .RS 4
 List information about a specific category. Provide one of the supported
@@ -1389,6 +1449,45 @@ Available configuration keys:
 .  sp -1
 .  IP \(bu 2.3
 .\}
+\f(CRsecret_scan\fP \(em scan the diff (and any full\-file contents) for likely
+secrets before sending to the LLM (\f(CRtrue\fP/\f(CRfalse\fP, default \f(CRtrue\fP). On a
+match the send is blocked and you are asked to confirm (or pass
+\f(CR\-\-allow\-secrets\fP); each finding reports the file and line. Only distinctive
+credential formats are flagged (private keys, AWS/GitHub/Slack/Google/OpenAI
+keys); obvious placeholders (values containing \f(CRexample\fP, \f(CRsample\fP, \f(CRdummy\fP,
+and repeated\-character filler) are ignored. Local providers (Ollama) skip the
+scan, since nothing leaves the machine. When you confirm a flagged send in an
+interactive commit (a false alarm), git\-cai offers, per flagged file, to
+remember the decision: add the file to \f(CR.caiignore\fP (drop it from git\-cai
+entirely), add it to \f(CRsecret_scan_exclude\fP (keep sending it but skip its
+scan), or skip (remember nothing).
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
+\f(CRsecret_scan_exclude\fP \(em list of repo\-relative paths whose contents are
+exempt from the secret scan while still being sent to the LLM (default empty).
+Use this for files that keep tripping a false positive (such as test fixtures)
+but that you still want git\-cai to see. Paths are matched with gitignore
+semantics, like \f(CR.caiignore\fP, so directory patterns work too. The
+false\-alarm prompt writes here when you choose "keep, skip scan", targeting
+the repository \f(CRcai_config.yml\fP if one exists, otherwise the home config.
+.RE
+.sp
+.RS 4
+.ie n \{\
+\h'-04'\(bu\h'+03'\c
+.\}
+.el \{\
+.  sp -1
+.  IP \(bu 2.3
+.\}
 \f(CRload_tokens_from\fP \(em path to the tokens file
 .RE
 .sp

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/src/git_cai_cli/__init__.py

@@ -1,3 +1,5 @@
+"""git-cai-cli: AI-powered git commit message generator."""
+
 from ._version import __version__
 
 __all__ = ["__version__"]

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/src/git_cai_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.14.2'
-__version_tuple__ = version_tuple = (0, 14, 2)
+__version__ = version = '0.15.2'
+__version_tuple__ = version_tuple = (0, 15, 2)
 
-__commit_id__ = commit_id = 'gf575cff14'
+__commit_id__ = commit_id = 'g12ea7cd4d'

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/src/git_cai_cli/cli/cli.py

@@ -203,6 +203,24 @@ def callback(  # pylint: disable=too-many-arguments,too-many-positional-argument
         "--emoji/--no-emoji",
         help="Override emoji usage for this invocation. Use --no-emoji to disable when config enables it.",
     ),
+    check: bool = typer.Option(
+        False,
+        "-k",
+        "--check",
+        help="Run configuration diagnostics (offline). Add --ping for a live provider probe.",
+    ),
+    ping: bool = typer.Option(
+        False,
+        "-n",
+        "--ping",
+        help="With --check, also send a tiny request to the active provider to confirm reachability.",
+    ),
+    allow_secrets: bool = typer.Option(
+        False,
+        "-B",
+        "--allow-secrets",
+        help="Bypass the local secret scan and send the diff even if a likely secret is detected.",
+    ),
 ):
     """
     CLI entry point for git-cai-cli.
@@ -224,6 +242,7 @@ def callback(  # pylint: disable=too-many-arguments,too-many-positional-argument
 
     mode = resolve_mode(
         amend=amend,
+        check=check,
         init=init,
         list_flag=list_flag,
         pr=pr,
@@ -232,6 +251,10 @@ def callback(  # pylint: disable=too-many-arguments,too-many-positional-argument
         update=update,
     )
 
+    if ping and not check:
+        typer.echo("Error: --ping is only valid together with --check.", err=True)
+        raise typer.Exit(code=1)
+
     sql_override: bool | None = None
     if sql is not None:
         normalized = sql.strip().lower()
@@ -339,6 +362,8 @@ def callback(  # pylint: disable=too-many-arguments,too-many-positional-argument
         style_override=style,
         language_override=language,
         emoji_override=emoji,
+        live_check=ping,
+        allow_secrets=allow_secrets,
     )
 
 

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/src/git_cai_cli/cli/helptext.py

@@ -17,6 +17,7 @@ Usage:
 Flags:
   -A, --amend              Regenerate and amend the last commit message
   -a, --all                Stage all modified and deleted files that are already tracked by Git
+  -B, --allow-secrets      Bypass the local secret scan and send even if a secret is detected
   -b, --branch             Include current branch name as context for the LLM
   -C, --conventional       Use Conventional Commits format (type(scope): description)
   -c, --crazy              Commit immediately without opening editor (trust LLM output)
@@ -30,10 +31,12 @@ Flags:
   -h, --help               Show this help message or opens manual
   -I, --init               Interactive setup wizard (writes home config and tokens.yml)
   -i, --install-completion Install shell completion for git-cai
+  -k, --check              Run configuration diagnostics (offline; add --ping for a live probe)
   -L, --language CODE      Override the commit message language (e.g. de, fr, none)
   -l, --list [TYPE]        List information. TYPE: config, editor, language,
                            model, path, provider, style
   -m, --model NAME         Override model for this invocation (requires --provider)
+  -n, --ping               With --check, probe the active provider for reachability
   -o, --signoff            Append a `Signed-off-by:` trailer (git user.name / user.email)
   -P, --provider NAME      Override LLM provider for this invocation
   -p, --generate-prompts   Generate default commit/squash/full_files/pr prompt files

{git_cai_cli-0.14.2 → git_cai_cli-0.15.2}/src/git_cai_cli/cli/modes.py

@@ -13,6 +13,7 @@ class Mode(Enum):
     """
 
     AMEND = auto()
+    CHECK = auto()
     COMMIT = auto()
     INIT = auto()
     LIST = auto()
@@ -25,6 +26,7 @@ class Mode(Enum):
 def resolve_mode(
     *,
     amend: bool,
+    check: bool = False,
     init: bool = False,
     list_flag: bool,
     pr: bool,
@@ -35,17 +37,19 @@ def resolve_mode(
     """
     Resolves the operational mode based on the provided flags.
     """
-    flags = [amend, init, list_flag, pr, squash, stats, update]
+    flags = [amend, check, init, list_flag, pr, squash, stats, update]
     if sum(flags) > 1:
         typer.echo(
-            "Error: --amend, --init, --list, --PR, --squash, --stats, and --update "
-            "cannot be used together.",
+            "Error: --amend, --check, --init, --list, --PR, --squash, --stats, and "
+            "--update cannot be used together.",
             err=True,
         )
         raise typer.Exit(code=1)
 
     if amend:
         return Mode.AMEND
+    if check:
+        return Mode.CHECK
     if init:
         return Mode.INIT
     if list_flag: