feat(dev-env): shell scripts (git-hooks, worktree, deploy, regtest, nav) and smoke test

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/dev-env/scripts/git-hooks/pre-commit

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# dev-env shared pre-commit hook.
+#
+# Wired into every dev-env-managed repo via core.hooksPath. Refuses to
+# commit obvious secrets and unencrypted sops files. Body is identical
+# to the one in ~/omarchy-dev-env/setup/install-git-hooks.sh — that
+# script's per-repo install loop is replaced by core.hooksPath.
+#
+# False positives: `git commit --no-verify` to bypass.
+
+set -u
+
+# Patterns are assembled from fragments so the literal text in this
+# file doesn't match the patterns themselves — otherwise this hook
+# would always block commits that touch it.
+_PVT='PRI''VATE'
+_AWS='AWS_SEC''RET_ACCESS_KEY'
+FORBIDDEN_PATTERNS=(
+    "${_PVT} KEY"
+    "BEGIN RSA ${_PVT}"
+    "BEGIN EC ${_PVT}"
+    "BEGIN OPENSSH ${_PVT}"
+    'password\s*=\s*["\x27][^"\x27]+'
+    'secret\s*=\s*["\x27][^"\x27]+'
+    'api_key\s*=\s*["\x27][^"\x27]+'
+    'admin_key\s*=\s*["\x27][^"\x27]+'
+    "${_AWS}"
+    'POSTGRES_PASSWORD=(?!.*(example|changeme|placeholder))'
+)
+
+SKIP_FILES=(
+    '*.md'
+    '*.txt'
+    'secrets-management.md'
+    # The hook scripts themselves contain the FORBIDDEN_PATTERNS as
+    # literals — scanning them would always self-trigger.
+    'modules/dev-env/scripts/git-hooks/*'
+    # Auth test fixtures: dozens of password="secret1234" placeholders
+    # across the file — line-level markers would be ridiculous; this is
+    # exactly the kind of file SKIP_FILES exists for.
+    'tests/api/test_auth.py'
+)
+
+# Line-level allowlist. A line that matches a FORBIDDEN_PATTERN is treated
+# as a false positive in any of these cases:
+#   1. The line itself contains the marker.
+#   2. The line *immediately above* contains the marker (handy for a
+#      single-line trigger where the marker doesn't fit on the line).
+#   3. The line falls inside a "<marker> start" ... "<marker> end" block
+#      (handy for multi-line clumps — same convention as gitleaks).
+# Use sparingly — only on lines that genuinely don't hold a secret (prose
+# comments, test fixtures with placeholder values, constant strings).
+ALLOWLIST_MARKER='pragma: allowlist secret'
+
+errors=0
+
+for file in $(git diff --cached --name-only --diff-filter=ACM); do
+    skip=false
+    for pat in "${SKIP_FILES[@]}"; do
+        # shellcheck disable=SC2053
+        if [[ "$file" == $pat ]]; then
+            skip=true
+            break
+        fi
+    done
+    [[ "$skip" == true ]] && continue
+
+    blob=$(git show ":$file" 2>/dev/null) || continue
+
+    # Walk the file once to compute the set of allowlisted line numbers.
+    # Tracks both "single-line marker" and "<marker> start/end" block state.
+    declare -A allowlisted=()
+    in_block=false
+    prev_was_marker=false
+    line_num=0
+    while IFS= read -r line_content; do
+        line_num=$((line_num + 1))
+        if [[ "$line_content" == *"$ALLOWLIST_MARKER start"* ]]; then
+            in_block=true
+            prev_was_marker=false
+            continue
+        fi
+        if [[ "$line_content" == *"$ALLOWLIST_MARKER end"* ]]; then
+            in_block=false
+            prev_was_marker=false
+            continue
+        fi
+        is_marker_line=false
+        if [[ "$line_content" == *"$ALLOWLIST_MARKER"* ]]; then
+            is_marker_line=true
+        fi
+        if [[ "$in_block" == true \
+              || "$is_marker_line" == true \
+              || "$prev_was_marker" == true ]]; then
+            allowlisted[$line_num]=1
+        fi
+        prev_was_marker=$is_marker_line
+    done <<<"$blob"
+
+    for pattern in "${FORBIDDEN_PATTERNS[@]}"; do
+        while IFS= read -r match; do
+            [[ -z "$match" ]] && continue
+            line_num="${match%%:*}"
+            [[ -n "${allowlisted[$line_num]:-}" ]] && continue
+            echo "ERROR: potential secret in $file:$line_num (pattern: $pattern)"
+            errors=$((errors + 1))
+        done < <(grep -niE "$pattern" <<<"$blob" || true)
+    done
+    unset allowlisted
+done
+
+# Unencrypted or malformed sops files.
+# Structural check: a real sops YAML always contains both a top-level `sops:`
+# block AND a `mac:` field whose value is `ENC[...]`. Either signal alone is
+# trivially forgeable; together they're specific to actual sops output.
+for file in $(git diff --cached --name-only --diff-filter=ACM | grep -E 'secrets.*\.yaml$' || true); do
+    blob=$(git show ":$file" 2>/dev/null)
+    if ! grep -q '^[[:space:]]*sops:' <<<"$blob"; then
+        echo "ERROR: unencrypted secrets file: $file (no sops metadata block)"
+        echo "       run: sops -e -i $file"
+        errors=$((errors + 1))
+    elif ! grep -q '^[[:space:]]*mac: ENC\[' <<<"$blob"; then
+        echo "ERROR: secrets file has sops block but mac is not encrypted: $file"
+        echo "       file may be tampered or partially decrypted; re-encrypt with sops"
+        errors=$((errors + 1))
+    fi
+done
+
+if (( errors > 0 )); then
+    echo ""
+    echo "commit blocked: $errors potential secret(s) detected"
+    echo "false positive? add '# $ALLOWLIST_MARKER' on/above the line,"
+    echo "or wrap a block with '# $ALLOWLIST_MARKER start' ... '# $ALLOWLIST_MARKER end',"
+    echo "or bypass with: git commit --no-verify"
+    exit 1
+fi
+
+exit 0