1 files changed, 0 insertions, 78 deletions
diff --git a/working/hook-fail-open/pre-commit b/working/hook-fail-open/pre-commit
deleted file mode 100644
index 8fa489d..0000000
--- a/working/hook-fail-open/pre-commit
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Pre-commit hook: secret scan + paren validation on staged .el files.
-# Use `git commit --no-verify` to bypass for confirmed false positives.
-
-set -u
-
-REPO_ROOT="$(git rev-parse --show-toplevel)"
-cd "$REPO_ROOT" || exit 1
-
-# --- 1. Secret scan ---
-# Patterns for common credentials. Scans only added lines in the staged diff.
-#
-# Two passes because case-sensitivity differs. AWS keys are uppercase, sk- keys
-# lowercase, PEM headers fixed, so those match case-SENSITIVELY: under -i,
-# AKIA[0-9A-Z]{16} matches any mixed-case 20-char run, which random base64 in an
-# embedded image blob hits ~6% of the time per 100KB and blocks real commits.
-# Only the keyword=value patterns need -i.
-SECRET_PATTERNS_CS='(AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9_-]{20,}|-----BEGIN (RSA|DSA|EC|OPENSSH|PGP)( PRIVATE)?( KEY| KEY BLOCK)?-----)'
-SECRET_PATTERNS_CI='(api[_-]?key|api[_-]?secret|auth[_-]?token|secret[_-]?key|bearer[_-]?token|access[_-]?token|password)[[:space:]]*[:=][[:space:]]*["'"'"'][^"'"'"']{16,}["'"'"']'
-
-# Read the diff on its own so a git failure is distinguishable from "grep
-# matched nothing".  Both end in a non-zero status, but only one of them means
-# there is nothing to scan; piping them together and swallowing the result with
-# `|| true` made a broken git look like a clean commit.
-if ! staged_diff="$(git diff --cached -U0 --diff-filter=AM)"; then
-  echo "pre-commit: cannot read the staged diff — refusing to skip the secret scan" >&2
-  exit 1
-fi
-
-# The greps keep their `|| true`: exiting 1 on no match is their normal result.
-added_lines="$(printf '%s\n' "$staged_diff" | grep '^+' | grep -v '^+++' || true)"
-
-cs_hits="$(printf '%s\n' "$added_lines" | grep -nE  "$SECRET_PATTERNS_CS" || true)"
-ci_hits="$(printf '%s\n' "$added_lines" | grep -niE "$SECRET_PATTERNS_CI" || true)"
-# awk dedupes lines both passes matched, keeping first-seen order.
-secret_hits="$(printf '%s\n%s' "$cs_hits" "$ci_hits" \
-  | grep -v '^[[:space:]]*$' | awk '!seen[$0]++' || true)"
-
-if [ -n "$secret_hits" ]; then
-  echo "pre-commit: potential secret in staged changes:" >&2
-  echo "$secret_hits" >&2
-  echo "" >&2
-  echo "Review the lines above. If this is a false positive (test fixture, documentation)," >&2
-  echo "bypass with: git commit --no-verify" >&2
-  exit 1
-fi
-
-# --- 2. Paren check on staged .el files ---
-# Same split as the secret scan above: a git failure must not read as "no .el
-# files staged", which would skip the paren check silently.
-if ! staged_names="$(git diff --cached --name-only --diff-filter=AM)"; then
-  echo "pre-commit: cannot read the staged file list — refusing to skip the paren check" >&2
-  exit 1
-fi
-
-staged_el="$(printf '%s\n' "$staged_names" | grep '\.el$' || true)"
-
-if [ -n "$staged_el" ]; then
-  paren_fail=""
-  while IFS= read -r f; do
-    [ -z "$f" ] && continue
-    [ -f "$f" ] || continue
-    if ! out="$(emacs --batch --no-site-file --no-site-lisp "$f" \
-                  --eval '(check-parens)' 2>&1)"; then
-      paren_fail="${paren_fail}${f}:
-${out}
-
-"
-    fi
-  done <<< "$staged_el"
-
-  if [ -n "$paren_fail" ]; then
-    printf 'pre-commit: paren check failed:\n\n%s' "$paren_fail" >&2
-    exit 1
-  fi
-fi
-
-exit 0