rafter-cli 0.8.4__tar.gz → 0.8.6__tar.gz

{rafter_cli-0.8.4 → rafter_cli-0.8.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.8.4
+Version: 0.8.6
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team
@@ -66,9 +66,9 @@ rafter agent init --all          # install all detected integrations
 rafter agent init --local        # write config to ./.rafter (ephemeral/benchmark)
 rafter agent list                # show detected integrations + status
 rafter agent enable claude-code  # toggle a single platform on/off
-rafter agent scan .              # scan for secrets
-rafter agent scan --diff HEAD~1  # scan changed files
-rafter agent scan --history      # scan full git history (betterleaks engine)
+rafter secrets .                 # scan for secrets
+rafter secrets --diff HEAD~1     # scan changed files
+rafter secrets --history         # scan full git history (betterleaks engine)
 rafter agent exec "git commit"   # execute with risk assessment
 rafter agent audit               # view security logs
 rafter agent audit --verify      # verify tamper-evident hash chain

{rafter_cli-0.8.4 → rafter_cli-0.8.6}/README.md

@@ -40,9 +40,9 @@ rafter agent init --all          # install all detected integrations
 rafter agent init --local        # write config to ./.rafter (ephemeral/benchmark)
 rafter agent list                # show detected integrations + status
 rafter agent enable claude-code  # toggle a single platform on/off
-rafter agent scan .              # scan for secrets
-rafter agent scan --diff HEAD~1  # scan changed files
-rafter agent scan --history      # scan full git history (betterleaks engine)
+rafter secrets .                 # scan for secrets
+rafter secrets --diff HEAD~1     # scan changed files
+rafter secrets --history         # scan full git history (betterleaks engine)
 rafter agent exec "git commit"   # execute with risk assessment
 rafter agent audit               # view security logs
 rafter agent audit --verify      # verify tamper-evident hash chain

{rafter_cli-0.8.4 → rafter_cli-0.8.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.8.4"
+version = "0.8.6"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.8.4 → rafter_cli-0.8.6}/rafter_cli/commands/agent.py

@@ -30,9 +30,10 @@ from ..core.pattern_engine import PatternEngine
 from ..scanners.betterleaks import BetterleaksScanner
 from ..scanners.regex_scanner import RegexScanner, ScanResult
 from ..scanners.secret_patterns import DEFAULT_SECRET_PATTERNS
+from ..scanners.union import union_scan_results
 from ..utils.formatter import fmt, is_agent_mode, print_stderr
 from ..utils.skill_manager import SkillManager
-from ..utils.binary_manager import BinaryManager
+from ..utils.binary_manager import BinaryManager, BETTERLEAKS_VERSION
 
 agent_app = typer.Typer(name="agent", help="Agent security features", no_args_is_help=True)
 
@@ -1453,8 +1454,22 @@ def init(
 # ── scan ─────────────────────────────────────────────────────────────
 
 
-def _select_engine(preference: str, quiet: bool) -> str:
-    """Return 'betterleaks' or 'patterns'."""
+def _select_engine(preference: str, quiet: bool, auto_update: bool = True) -> str:
+    """Return 'betterleaks', 'patterns', or 'both'.
+
+    ``auto`` (the default) resolves to ``both`` whenever betterleaks is
+    available and usable — rafter then runs both engines and unions their
+    findings (sable-j85), so a miss in one (betterleaks 1.1.x does not detect
+    AWS access keys — sable-h2y) is still caught by the other. It degrades to
+    ``patterns``-only when betterleaks is absent or a stale binary can't be
+    refreshed. Explicit ``--engine betterleaks`` / ``--engine patterns`` stay
+    single-engine.
+
+    ``auto_update`` (default True) controls sable-o4k behavior: when the
+    resolved engine is betterleaks but the managed binary is stale, auto-update
+    it before scanning. The caller resolves this from ``--no-auto-update`` and
+    the ``scan.auto_update_betterleaks`` config key.
+    """
     valid_engines = ("auto", "betterleaks", "patterns")
     if preference not in valid_engines:
         print(f"Invalid engine: {preference}. Valid values: {', '.join(valid_engines)}", file=sys.stderr)
@@ -1471,26 +1486,93 @@ def _select_engine(preference: str, quiet: bool) -> str:
             if not quiet:
                 print_stderr(fmt.warning("Betterleaks requested but not available, using patterns"))
             return "patterns"
+        return _ensure_betterleaks_usable(quiet, auto_update)
+
+    # auto — run BOTH engines when betterleaks is usable; otherwise patterns.
+    if not available:
+        return "patterns"
+    usable = _ensure_betterleaks_usable(quiet, auto_update)
+    return "both" if usable == "betterleaks" else "patterns"
+
+
+def _ensure_betterleaks_usable(quiet: bool, auto_update: bool) -> str:
+    """sable-o4k — guard against a stale rafter-managed betterleaks binary
+    silently returning zero findings (a leftover binary from an older rafter
+    parses fine with ``version`` but emits a JSON shape the current parser
+    rejects).
+
+    When the managed binary is stale we auto-update it to the pinned version
+    (default on; opt out with ``--no-auto-update`` or
+    ``scan.auto_update_betterleaks: false``). In an interactive TTY we confirm
+    first. If the update is disabled, declined, or fails, we degrade to the
+    patterns engine and print a CTA rather than scanning with a binary that
+    yields nothing.
+    """
+    bm = BinaryManager()
+    if not bm.is_managed_betterleaks_stale():
         return "betterleaks"
 
-    # auto
-    return "betterleaks" if available else "patterns"
+    current = bm.get_betterleaks_version()
+    cta = "Fix manually with: rafter agent update-betterleaks"
+    stale = f"Stale betterleaks binary ({current}; expected v{BETTERLEAKS_VERSION})"
+
+    if not auto_update:
+        if not quiet:
+            print_stderr(fmt.warning(f"{stale}. Auto-update is off — using the patterns engine for this scan. {cta}"))
+        return "patterns"
+
+    # Only prompt when there's a human at a TTY; otherwise auto-update proceeds
+    # (default on) so non-interactive runs aren't left with a broken engine.
+    if sys.stdin.isatty() and not quiet:
+        answer = input(f"  {stale}. Update it now? [Y/n] ").strip().lower()
+        if answer not in ("", "y", "yes"):
+            print_stderr(fmt.warning(f"Skipped — using the patterns engine for this scan. {cta}"))
+            return "patterns"
+
+    if not quiet:
+        print_stderr(fmt.info(f"Updating betterleaks to v{BETTERLEAKS_VERSION}..."))
+    try:
+        bm.download_betterleaks(
+            (lambda m: print_stderr(f"   {m}")) if not quiet else None,
+            BETTERLEAKS_VERSION,
+        )
+        if not quiet:
+            print_stderr(fmt.success(f"Betterleaks updated to v{BETTERLEAKS_VERSION}."))
+        return "betterleaks"
+    except Exception as exc:  # noqa: BLE001 — degrade to patterns on any failure
+        if not quiet:
+            print_stderr(fmt.warning(f"Betterleaks update failed ({exc}) — using the patterns engine for this scan. {cta}"))
+        return "patterns"
 
 
 def _scan_file(file_path: str, engine: str, custom_patterns=None) -> list[ScanResult]:
+    def run_patterns() -> list[ScanResult]:
+        scanner = RegexScanner(custom_patterns)
+        r = scanner.scan_file(file_path)
+        return [r] if r.matches else []
+
+    if engine == "both":
+        # sable-j85 — run both engines and union. A betterleaks failure
+        # degrades to patterns-only rather than losing the scan.
+        bl_results: list[ScanResult] = []
+        try:
+            bl = BetterleaksScanner()
+            result = bl.scan_file(file_path)
+            if result.matches:
+                bl_results = [ScanResult(file=result.file, matches=result.matches)]
+        except Exception:
+            print_stderr(fmt.warning("Betterleaks scan failed, using patterns only for this run"))
+        return union_scan_results(bl_results, run_patterns())
+
     if engine == "betterleaks":
         try:
             bl = BetterleaksScanner()
             result = bl.scan_file(file_path)
             return [ScanResult(file=result.file, matches=result.matches)] if result.matches else []
         except Exception:
-            scanner = RegexScanner(custom_patterns)
-            r = scanner.scan_file(file_path)
-            return [r] if r.matches else []
-    else:
-        scanner = RegexScanner(custom_patterns)
-        r = scanner.scan_file(file_path)
-        return [r] if r.matches else []
+            return run_patterns()
+
+    return run_patterns()
 
 
 def _path_matches_exclude_pattern(rel_path: str, pattern: str) -> bool:
@@ -1569,17 +1651,29 @@ def _scan_directory(
         custom = [{"name": p.name, "regex": p.regex, "severity": p.severity} for p in scan_cfg.custom_patterns] if scan_cfg.custom_patterns else None
         exclude = scan_cfg.exclude_paths or None
 
-    if engine == "betterleaks":
+    def run_patterns() -> list[ScanResult]:
+        scanner = RegexScanner(custom)
+        return scanner.scan_directory(dir_path, exclude_paths=exclude, respect_gitignore=respect_gitignore)
+
+    if engine == "both":
+        # sable-j85 — run both engines and union; the exclude-paths post-filter
+        # below applies to the merged set.
+        bl_results: list[ScanResult] = []
+        try:
+            bl = BetterleaksScanner()
+            bl_results = [ScanResult(file=r.file, matches=r.matches) for r in bl.scan_directory(dir_path, use_git=history)]
+        except Exception:
+            print_stderr(fmt.warning("Betterleaks scan failed, using patterns only for this run"))
+        results = union_scan_results(bl_results, run_patterns())
+    elif engine == "betterleaks":
         try:
             bl = BetterleaksScanner()
             results = bl.scan_directory(dir_path, use_git=history)
             results = [ScanResult(file=r.file, matches=r.matches) for r in results]
         except Exception:
-            scanner = RegexScanner(custom)
-            results = scanner.scan_directory(dir_path, exclude_paths=exclude, respect_gitignore=respect_gitignore)
+            results = run_patterns()
     else:
-        scanner = RegexScanner(custom)
-        results = scanner.scan_directory(dir_path, exclude_paths=exclude, respect_gitignore=respect_gitignore)
+        results = run_patterns()
     # sable-yz0 — post-filter chokepoint. See _apply_exclude_paths docstring.
     return _apply_exclude_paths(results, exclude, dir_path)
 
@@ -1605,7 +1699,9 @@ def _output_scan_results(
         files_out = [
             {"file": r.file, "matches": [
                 {"pattern": {"name": m.pattern.name, "severity": m.pattern.severity, "description": m.pattern.description or ""},
-                 "line": m.line, "column": m.column, "redacted": m.redacted}
+                 "line": m.line, "column": m.column, "redacted": m.redacted,
+                 # sable-j85 — present only for auto-mode (both-engine) scans.
+                 **({"engines": m.engines} if m.engines else {})}
                 for m in r.matches
             ]}
             for r in kept_results
@@ -1674,6 +1770,7 @@ def _watch_and_scan(
     custom_patterns,
     scan_cfg,
     suppressions: list | None = None,
+    auto_update: bool = True,
 ) -> None:
     """Watch a path for changes and re-scan on each change. Ctrl+C exits."""
     try:
@@ -1684,7 +1781,7 @@ def _watch_and_scan(
         raise typer.Exit(code=2)
 
     logger = AuditLogger()
-    eng = _select_engine(engine, quiet)
+    eng = _select_engine(engine, quiet, auto_update)
 
     if not quiet:
         print_stderr(fmt.info(f"Watching {watch_path} for changes ({eng}). Press Ctrl+C to exit."))
@@ -1815,6 +1912,7 @@ def scan(
     watch: bool = typer.Option(False, "--watch", help="Watch for file changes and re-scan on change"),
     history: bool = typer.Option(False, "--history", help="Scan git history for secrets (requires betterleaks engine)"),
     gitignore: bool = typer.Option(True, "--gitignore/--no-gitignore", help="Respect .gitignore when walking the scan target (default: on)"),
+    auto_update: bool = typer.Option(True, "--auto-update/--no-auto-update", help="Auto-update a stale managed betterleaks binary; --no-auto-update falls back to the patterns engine instead (default: on)"),
 ):
     """Scan files or directories for secrets. [deprecated: use 'rafter secrets' instead]"""
     print(
@@ -1831,6 +1929,10 @@ def scan(
         if scan_cfg.custom_patterns else None
     )
 
+    # sable-o4k — stale-binary auto-update is on unless the CLI flag or the
+    # scan.auto_update_betterleaks config key opts out. Either disables it.
+    auto_update_enabled = auto_update and scan_cfg.auto_update_betterleaks
+
     from ..core.custom_patterns import load_suppressions, policy_ignore_to_suppressions
     suppressions = policy_ignore_to_suppressions(scan_cfg.ignore) + load_suppressions()
 
@@ -1856,7 +1958,7 @@ def scan(
         if not quiet:
             print(f"Scanning {len(changed)} file(s) changed since {diff}...", file=sys.stderr)
 
-        eng = _select_engine(engine, quiet)
+        eng = _select_engine(engine, quiet, auto_update_enabled)
         all_results: list[ScanResult] = []
         for f in changed:
             resolved = os.path.abspath(f)
@@ -1886,7 +1988,7 @@ def scan(
         if not quiet:
             print(f"Scanning {len(staged_files)} staged file(s)...", file=sys.stderr)
 
-        eng = _select_engine(engine, quiet)
+        eng = _select_engine(engine, quiet, auto_update_enabled)
         all_results = []
         for f in staged_files:
             resolved = os.path.abspath(f)
@@ -1904,10 +2006,10 @@ def scan(
 
     # --watch
     if watch:
-        _watch_and_scan(resolved_path, engine, quiet, json_output, format, custom_patterns, scan_cfg, suppressions)
+        _watch_and_scan(resolved_path, engine, quiet, json_output, format, custom_patterns, scan_cfg, suppressions, auto_update_enabled)
         return
 
-    eng = _select_engine(engine, quiet)
+    eng = _select_engine(engine, quiet, auto_update_enabled)
 
     if os.path.isdir(resolved_path):
         if not quiet:
@@ -3072,6 +3174,26 @@ def status(
     else:
         print(f"\nConfig:       not found — run: rafter agent init")
 
+    # --- Hook off-switch (trusted-source only: env / global config) ---
+    from ..core.hook_control import resolve_hook_control
+
+    c = resolve_hook_control()
+
+    def _describe(on: bool, src: str) -> str:
+        if on:
+            return "active"
+        via = "RAFTER_DISABLE_* env" if src == "env" else "global config"
+        return f"DISABLED (via {via})"
+
+    if not c.hook_enabled:
+        print(f"Hooks:        {_describe(False, c.source_hook)}")
+    elif not c.secret_scan_enabled or not c.command_policy_enabled:
+        print("Hooks:        active (partial)")
+        print(f"  secret scan:    {_describe(c.secret_scan_enabled, c.source_secret_scan)}")
+        print(f"  command policy: {_describe(c.command_policy_enabled, c.source_command_policy)}")
+    else:
+        print("Hooks:        active")
+
     # --- Betterleaks ---
     bm = BinaryManager()
     bl_local = bm.get_betterleaks_path()
@@ -3207,6 +3329,9 @@ def status(
 
 
 def _agent_status_json(config_path: Path, audit_path: Path) -> dict[str, Any]:
+    from ..core.hook_control import resolve_hook_control
+
+    c = resolve_hook_control()
     return {
         "installed": config_path.exists(),
         "version": __version__,
@@ -3215,6 +3340,16 @@ def _agent_status_json(config_path: Path, audit_path: Path) -> dict[str, Any]:
         "betterleaks_available": _betterleaks_available(),
         "config_path": _format_home_path(config_path),
         "audit_log_path": _format_home_path(audit_path),
+        "hook_control": {
+            "hook_enabled": c.hook_enabled,
+            "secret_scan_enabled": c.secret_scan_enabled,
+            "command_policy_enabled": c.command_policy_enabled,
+            "source": {
+                "hook": c.source_hook,
+                "secret_scan": c.source_secret_scan,
+                "command_policy": c.source_command_policy,
+            },
+        },
     }
 
 
@@ -3359,7 +3494,7 @@ def baseline_create(
 
     print(f"Scanning {resolved} to build baseline...", file=sys.stderr)
 
-    eng = _select_engine(engine, quiet=False)
+    eng = _select_engine(engine, quiet=False, auto_update=scan_cfg.auto_update_betterleaks)
     if os.path.isdir(resolved):
         results = _scan_directory(resolved, eng, scan_cfg)
     else:

{rafter_cli-0.8.4 → rafter_cli-0.8.6}/rafter_cli/commands/hook.py

@@ -2,6 +2,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 
@@ -180,49 +181,171 @@ def _normalize_posttool_input(raw: dict, fmt: str) -> tuple[str, dict | None]:
     return raw.get("tool_name", "unknown"), raw.get("tool_response")
 
 
+def _load_scan_config():
+    """Load the policy-merged scan config + suppression list the same way
+    scan.py does, so hook decisions match ``rafter secrets`` (sable-55u).
+
+    Returns ``(scan_cfg, suppressions, custom_patterns)``. The hook is
+    patterns-only by design (no betterleaks subprocess — it runs on every
+    tool call and must stay fast), so betterleaks version skew can never
+    affect it; it still honors custom patterns, ``exclude_paths``, and
+    ``ignore`` from ``.rafter.yml``.
+    """
+    from ..core.config_manager import ConfigManager
+    from ..core.custom_patterns import load_suppressions, policy_ignore_to_suppressions
+
+    cfg = ConfigManager().load_with_policy()
+    scan_cfg = cfg.agent.scan
+    custom_patterns = (
+        [{"name": p.name, "regex": p.regex, "severity": p.severity} for p in scan_cfg.custom_patterns]
+        if scan_cfg and scan_cfg.custom_patterns else None
+    )
+    # Policy ignore rules first so an explicit reason wins over a bare
+    # .rafterignore line covering the same finding.
+    suppressions = policy_ignore_to_suppressions(scan_cfg.ignore if scan_cfg else None) + load_suppressions()
+    return scan_cfg, suppressions, custom_patterns
+
+
+# Cap on individual findings listed in a deny reason before truncating.
+_MAX_REASON_FINDINGS = 10
+
+
+def _format_staged_secret_reason(result: dict) -> str:
+    """Render a deny reason that names each offending file + pattern (+ line
+    when known) instead of a bare count, so the agent knows what to fix
+    without a second ``rafter secrets`` run. Truncates long lists.
+    """
+    repo_root = result.get("repo_root") or os.getcwd()
+    lines: list[str] = []
+    shown = 0
+    for r in result["findings"]:
+        try:
+            rel = os.path.relpath(r.file, repo_root)
+        except ValueError:
+            rel = os.path.basename(r.file)
+        for m in r.matches:
+            if shown >= _MAX_REASON_FINDINGS:
+                lines.append(f"  …and {result['count'] - shown} more")
+                break
+            loc = f":{m.line}" if m.line else ""
+            lines.append(f"  {rel}{loc} — {m.pattern.name}")
+            shown += 1
+        else:
+            continue
+        break
+    return "\n".join([
+        f"{result['count']} secret(s) detected in {result['files']} staged file(s):",
+        *lines,
+        "Hook scan is pattern-only (betterleaks version is irrelevant). "
+        "Run 'rafter secrets --staged' for full detail, or add an exclude_paths/ignore "
+        "rule to .rafter.yml if this is a false positive.",
+    ])
+
+
 def _scan_staged_files() -> dict:
+    """Scan git staged files, routed through the SAME config-aware pipeline
+    as ``rafter secrets --staged`` (sable-55u). Previously the hook ran
+    RegexScanner directly on the raw staged list with no config, so it
+    phantom-blocked commits on findings the CLI would suppress.
+    """
+    empty = {"secrets_found": False, "count": 0, "files": 0, "findings": [], "repo_root": os.getcwd()}
     try:
+        repo_root = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"],
+            capture_output=True, text=True,
+        ).stdout.strip() or os.getcwd()
+
         output = subprocess.run(
             ["git", "diff", "--cached", "--name-only", "--diff-filter=ACM"],
             capture_output=True, text=True,
         ).stdout.strip()
         if not output:
-            return {"secrets_found": False, "count": 0, "files": 0}
+            return {**empty, "repo_root": repo_root}
         staged = [f for f in output.split("\n") if f.strip()]
-        scanner = RegexScanner()
-        results = scanner.scan_files(staged)
-        total = sum(len(r.matches) for r in results)
-        return {"secrets_found": len(results) > 0, "count": total, "files": len(results)}
+
+        from ..core.custom_patterns import apply_suppressions
+        from .agent import _apply_exclude_paths
+
+        scan_cfg, suppressions, custom_patterns = _load_scan_config()
+        scanner = RegexScanner(custom_patterns)
+
+        raw = []
+        for f in staged:
+            resolved = os.path.join(repo_root, f)
+            if not os.path.isfile(resolved):
+                continue
+            r = scanner.scan_file(resolved)
+            if r.matches:
+                raw.append(r)
+
+        exclude = scan_cfg.exclude_paths if scan_cfg else None
+        after_exclude = _apply_exclude_paths(raw, exclude, repo_root)
+        kept, _suppressed = apply_suppressions(after_exclude, suppressions)
+        total = sum(len(r.matches) for r in kept)
+        return {
+            "secrets_found": len(kept) > 0,
+            "count": total,
+            "files": len(kept),
+            "findings": kept,
+            "repo_root": repo_root,
+        }
     except (subprocess.CalledProcessError, subprocess.TimeoutExpired, OSError) as exc:
         print(f"rafter: staged file scan failed: {exc}", file=sys.stderr)
-        return {"secrets_found": False, "count": 0, "files": 0}
-
-
-def _evaluate_bash(command: str) -> dict:
-    interceptor = CommandInterceptor()
+        return empty
+
+
+def _evaluate_bash(command: str, control=None) -> dict:
+    # The production caller (the pretool dispatch) always passes a resolved
+    # control. `control=None` defaults to fully-enabled — fail-safe, and keeps
+    # the function callable from focused tests that exercise interception/scan
+    # without constructing a control object.
+    if control is None:
+        from ..core.hook_control import HookControl
+
+        control = HookControl(
+            hook_enabled=True,
+            secret_scan_enabled=True,
+            command_policy_enabled=True,
+            source_hook="default",
+            source_secret_scan="default",
+            source_command_policy="default",
+        )
     audit = AuditLogger()
-    evaluation = interceptor.evaluate(command)
 
-    # Blocked — hard deny
-    if not evaluation.allowed and not evaluation.requires_approval:
-        audit.log_command_intercepted(command, False, "blocked", evaluation.reason)
-        return {"decision": "deny", "reason": _format_blocked_message(command, evaluation)}
+    # Command-risk interception — gated by command_policy. When disabled, skip the
+    # block/approval logic but still fall through to the staged-secret scan below.
+    if control.command_policy_enabled:
+        interceptor = CommandInterceptor()
+        evaluation = interceptor.evaluate(command)
 
-    # Requires approval — deny (hook can't prompt interactively)
-    if evaluation.requires_approval:
-        audit.log_command_intercepted(command, False, "blocked", evaluation.reason)
-        return {"decision": "deny", "reason": _format_approval_message(command, evaluation)}
+        # Blocked — hard deny
+        if not evaluation.allowed and not evaluation.requires_approval:
+            audit.log_command_intercepted(command, False, "blocked", evaluation.reason)
+            return {"decision": "deny", "reason": _format_blocked_message(command, evaluation)}
 
-    # Git commit/push — scan staged files
+        # Requires approval — deny (hook can't prompt interactively)
+        if evaluation.requires_approval:
+            audit.log_command_intercepted(command, False, "blocked", evaluation.reason)
+            return {"decision": "deny", "reason": _format_approval_message(command, evaluation)}
+
+    # Git commit/push — scan staged files. Gated by secret_scan so the git-commit
+    # secret check survives command_policy being disabled on its own.
     trimmed = command.strip()
-    if trimmed.startswith(("git commit", "git push")):
+    if control.secret_scan_enabled and trimmed.startswith(("git commit", "git push")):
         result = _scan_staged_files()
         if result["secrets_found"]:
-            audit.log_secret_detected("staged files", f"{result['count']} secret(s)", "blocked")
+            # Audit per file so the log records WHICH file + pattern, not a bare count.
+            repo_root = result.get("repo_root") or os.getcwd()
+            for r in result["findings"]:
+                try:
+                    rel = os.path.relpath(r.file, repo_root)
+                except ValueError:
+                    rel = os.path.basename(r.file)
+                names = list({m.pattern.name for m in r.matches})
+                audit.log_secret_detected(rel, ", ".join(names), "blocked")
             return {
                 "decision": "deny",
-                "reason": f"{result['count']} secret(s) detected in {result['files']} staged file(s). "
-                          "Run 'rafter secrets --staged' for details.",
+                "reason": _format_staged_secret_reason(result),
             }
 
     audit.log_command_intercepted(command, True, "allowed")
@@ -234,19 +357,32 @@ def _evaluate_write(tool_input: dict) -> dict:
     if not content:
         return {"decision": "allow"}
 
-    scanner = RegexScanner()
-    if scanner.has_secrets(content):
-        matches = scanner.scan_text(content)
-        names = list({m.pattern.name for m in matches})
-        audit = AuditLogger()
-        audit.log_secret_detected(
-            tool_input.get("file_path", "file content"),
-            ", ".join(names),
-            "blocked",
-        )
-        return {"decision": "deny", "reason": f"Secret detected in file content: {', '.join(names)}"}
+    # Route through the same config pipeline as scan.py so the hook honors
+    # custom patterns, exclude_paths, and ignore rules from .rafter.yml.
+    from ..core.custom_patterns import apply_suppressions
+    from ..scanners.regex_scanner import ScanResult
+    from .agent import _apply_exclude_paths
 
-    return {"decision": "allow"}
+    scan_cfg, suppressions, custom_patterns = _load_scan_config()
+    scanner = RegexScanner(custom_patterns)
+    matches = scanner.scan_text(content)
+    if not matches:
+        return {"decision": "allow"}
+
+    file_path = tool_input.get("file_path", "file content")
+    # Apply exclude_paths + suppressions keyed on the target file path, so a
+    # write to a policy-excluded path is allowed (matching `rafter secrets`).
+    exclude = scan_cfg.exclude_paths if scan_cfg else None
+    after_exclude = _apply_exclude_paths([ScanResult(file=file_path, matches=matches)], exclude, os.getcwd())
+    kept, _suppressed = apply_suppressions(after_exclude, suppressions)
+    kept_matches = kept[0].matches if kept else []
+    if not kept_matches:
+        return {"decision": "allow"}
+
+    names = list({m.pattern.name for m in kept_matches})
+    audit = AuditLogger()
+    audit.log_secret_detected(file_path, ", ".join(names), "blocked")
+    return {"decision": "deny", "reason": f"Secret detected in {file_path}: {', '.join(names)}"}
 
 
 @hook_app.command("pretool")
@@ -273,10 +409,21 @@ def pretool(
         if not isinstance(tool_input, dict):
             tool_input = {}
 
+        # Honor the (trusted-source-only) hook off-switch before doing any work.
+        from ..core.hook_control import resolve_hook_control
+
+        control = resolve_hook_control()
+        if not control.hook_enabled:
+            _write_pretool_decision({"decision": "allow"}, format)
+            return
+
         if tool_name == "Bash":
-            decision = _evaluate_bash(tool_input.get("command", ""))
+            decision = _evaluate_bash(tool_input.get("command", ""), control)
         elif tool_name in ("Write", "Edit"):
-            decision = _evaluate_write(tool_input)
+            if not control.secret_scan_enabled:
+                decision = {"decision": "allow"}
+            else:
+                decision = _evaluate_write(tool_input)
         else:
             decision = {"decision": "allow"}