---
name: commit
description: Safe commit helper. Runs security scan, stages tracked files, drafts a conventional commit message, and commits. Run before pushing.
model: claude-haiku-4-5
tools:
  - Bash
  - Read
  - Write
---

Run a safe commit sequence. Work through all phases in order.

---

## Phase 1: Safety Scan

Check for secrets and sensitive files. Abort if any are found.

```bash
# Check for secret files that must never be committed
git diff --cached --name-only | grep -E '\.env$|\.env\.|secrets\.|credentials\.|\.pem$|\.key$|id_rsa|id_ed25519|\.p12$|\.pfx$'
```

If any secret files are staged, stop immediately and report which files. Do NOT proceed.

Also run the comprehensive secret scanner:
```bash
[ -f scripts/check-secrets.sh ] && bash scripts/check-secrets.sh
```

If `scripts/check-secrets.sh` does not exist, fall back to inline scan:
```bash
git diff --cached | grep -E '(sk-[a-zA-Z0-9]{32,}|ghp_[a-zA-Z0-9]+|AKIA[A-Z0-9]{16}|password\s*=\s*["\x27][^"\x27]{4,})'
```

If any secrets are detected in content, stop and report. Do NOT proceed.

---

## Phase 2: Pre-commit Hooks

If `lefthook` or `husky` is configured, it will run automatically on commit. Do NOT invoke it manually here — it will run as part of Phase 4.

If `scripts/check-fast.sh` exists and is NOT configured as a hook, run it now:
```bash
[ -f scripts/check-fast.sh ] && bash scripts/check-fast.sh
```

If it exits non-zero, report the failures. Do NOT proceed until fixed.

---

## Phase 3: Stage Tracked Files

Stage only tracked files. Never stage:
- `.env`, `.env.*`
- `node_modules/`, `.next/`, `dist/`, `build/`
- `*.pem`, `*.key`, `*.p12`

```bash
# Stage all tracked modified files (excludes untracked — those require explicit git add)
git add -u
```

Show what will be committed:
```bash
git diff --cached --stat
```

---

## Phase 4: Draft Commit Message

Read `git diff --cached` to understand what changed.

Draft a conventional commit message:
- Format: `<type>(<scope>): <short description>`
- Types: `feat` | `fix` | `refactor` | `docs` | `test` | `chore` | `style` | `perf`
- Scope: affected module/package (optional but helpful)
- Description: present tense, under 72 chars, lowercase

If argument was passed to `/commit`, use it as the message (or as the description component).

---

## Phase 5: Commit

```bash
git commit -m "<type>(<scope>): <description>"
```

After commit, report:
- Commit hash (short)
- Files changed
- Message used
