@cristiancorreau/forge 2.1.0

package/assets/core/hooks/pre-edit-check.py

@@ -0,0 +1,317 @@
+#!/usr/bin/env python3
+"""
+Forge v2 — PreToolUse hook: pre-edit-check.py
+Enforces branch guard, debug detection, and secret detection before file edits.
+"""
+
+import json
+import os
+import re
+import subprocess
+import sys
+
+
+DEBUG = os.environ.get("DEBUG", "") not in ("", "0", "false", "False")
+
+
+def dbg(msg):
+    if DEBUG:
+        print(f"[forge-hook-debug] {msg}", flush=True)
+
+
+def load_project_yaml():
+    """Walk up from cwd to find project.yaml. Returns dict or {}."""
+    try:
+        import yaml
+        path = os.getcwd()
+        for _ in range(6):
+            candidate = os.path.join(path, "project.yaml")
+            if os.path.isfile(candidate):
+                with open(candidate) as f:
+                    data = yaml.safe_load(f)
+                    return data if isinstance(data, dict) else {}
+            parent = os.path.dirname(path)
+            if parent == path:
+                break
+            path = parent
+    except Exception as e:
+        dbg(f"project.yaml load error: {e}")
+    return {}
+
+
+# ---------------------------------------------------------------------------
+# File classification helpers
+# ---------------------------------------------------------------------------
+
+CODE_EXTENSIONS = {
+    ".py", ".ts", ".js", ".tsx", ".jsx",
+    ".php", ".rb", ".go", ".rs", ".java",
+    ".cs", ".cpp", ".c", ".sh",
+}
+
+NON_CODE_EXTENSIONS = {
+    ".md", ".yaml", ".yml", ".json", ".toml", ".txt", ".lock",
+}
+
+ROOT_PROTECTED_NAMES = {"README.md", "CLAUDE.md", "CHANGELOG.md"}
+
+PROTECTED_DIRS = ("docs/", ".claude/")
+
+
+def is_code_file(file_path):
+    """Return True if the file path is considered a code file."""
+    _, ext = os.path.splitext(file_path)
+    if ext.lower() in CODE_EXTENSIONS:
+        return True
+    if ext.lower() in NON_CODE_EXTENSIONS:
+        return False
+    # Default: treat unknown extensions as non-code (safe)
+    return False
+
+
+def is_exempt_from_branch_guard(file_path):
+    """Return True if the file should be exempt from branch-guard blocking."""
+    norm = file_path.replace("\\", "/")
+    # Exempt protected dirs
+    for d in PROTECTED_DIRS:
+        if norm.startswith(d) or f"/{d.rstrip('/')}" in norm:
+            return True
+    # Exempt root-level protected names
+    basename = os.path.basename(norm)
+    if basename in ROOT_PROTECTED_NAMES:
+        return True
+    # Exempt root-level *.md files
+    if basename.endswith(".md") and "/" not in norm.lstrip("./"):
+        return True
+    # Exempt root-level *.yaml / *.json config files
+    if "/" not in norm.lstrip("./"):
+        _, ext = os.path.splitext(basename)
+        if ext.lower() in (".yaml", ".yml", ".json"):
+            return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Check 1 — Branch guard
+# ---------------------------------------------------------------------------
+
+PROTECTED_BRANCHES = {"main", "master", "develop"}
+
+
+def check_branch_guard(file_path):
+    """Block code edits on protected branches."""
+    try:
+        result = subprocess.run(
+            ["git", "branch", "--show-current"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        branch = result.stdout.strip()
+        dbg(f"current branch: {branch!r}")
+    except Exception as e:
+        dbg(f"git branch error: {e}")
+        return None
+
+    if branch not in PROTECTED_BRANCHES:
+        return None
+
+    if not is_code_file(file_path):
+        return None
+
+    if is_exempt_from_branch_guard(file_path):
+        return None
+
+    return (
+        f"forge: edición bloqueada en {branch}. Crea una feature branch:\n"
+        f"  git checkout -b feature/<tema>-$(date +%Y-%m-%d)"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Check 2 — Debug statements
+# ---------------------------------------------------------------------------
+
+def check_debug_statements(file_path, content):
+    """Warn (not block) if debug statements are found in new content."""
+    _, ext = os.path.splitext(file_path)
+    ext = ext.lower()
+
+    if ext not in CODE_EXTENSIONS:
+        return None
+
+    found = False
+    basename = os.path.basename(file_path)
+    norm = file_path.replace("\\", "/")
+
+    if ext in (".ts", ".js", ".tsx", ".jsx"):
+        if "console.log(" in content or "debugger;" in content:
+            found = True
+
+    elif ext == ".php":
+        if "var_dump(" in content or "dd(" in content or "print_r(" in content:
+            found = True
+
+    elif ext == ".py":
+        # Skip forge scripts and .agentic/ files
+        is_forge_script = basename.startswith("forge") and basename.endswith(".py")
+        in_agentic = ".agentic/" in norm
+        if not is_forge_script and not in_agentic:
+            if "print(" in content:
+                found = True
+
+    elif ext == ".rb":
+        if re.search(r"^\s*(puts |pp |p )", content, re.MULTILINE):
+            found = True
+
+    if found:
+        return (
+            f"forge: debug statement detectado en {file_path}"
+            " — recuerda quitarlo antes del commit"
+        )
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Check 3 — Secret detection
+# ---------------------------------------------------------------------------
+
+SECRET_PATTERN = re.compile(
+    r'(password|passwd|secret|api_key|apikey|token|private_key)\s*[=:]\s*["\'][^"\']{8,}["\']',
+    re.IGNORECASE,
+)
+
+LONG_SECRET_PATTERN = re.compile(
+    r'\b(key|secret|token|password|auth|api_key|apikey)\b\s*[=:]\s*["\'][A-Za-z0-9+/=_\-]{20,}["\']',
+    re.IGNORECASE,
+)
+
+EXEMPT_EXTENSIONS = {".md"}
+EXEMPT_SUFFIXES = (".env.example", ".env.sample")
+TEST_PATTERNS = re.compile(r'\.(test|spec)\.')
+
+
+def is_exempt_from_secret_check(file_path):
+    norm = file_path.replace("\\", "/")
+    basename = os.path.basename(norm)
+    _, ext = os.path.splitext(basename)
+
+    if ext.lower() in EXEMPT_EXTENSIONS:
+        return True
+    for suffix in EXEMPT_SUFFIXES:
+        if norm.endswith(suffix):
+            return True
+    if TEST_PATTERNS.search(basename):
+        return True
+    return False
+
+
+def check_secret_detection(file_path, content):
+    """Block if hardcoded credentials are detected."""
+    if is_exempt_from_secret_check(file_path):
+        return None
+
+    if SECRET_PATTERN.search(content) or LONG_SECRET_PATTERN.search(content):
+        return (
+            f"forge: posible credencial hardcodeada detectada en {file_path}."
+            " Usa variables de entorno."
+        )
+    return None
+
+
+# ---------------------------------------------------------------------------
+# project.yaml — custom forbidden patterns + enterprise mode
+# ---------------------------------------------------------------------------
+
+def check_project_yaml_patterns(file_path, content, project):
+    """Check project.yaml forbidden_patterns if present."""
+    try:
+        rules = project.get("rules", {})
+        forbidden = rules.get("forbidden_patterns", [])
+        if not isinstance(forbidden, list):
+            return None
+        for pattern in forbidden:
+            if re.search(pattern, content):
+                return (
+                    f"forge: patrón prohibido detectado en {file_path} "
+                    f"(regla: {pattern!r})"
+                )
+    except Exception as e:
+        dbg(f"project.yaml patterns error: {e}")
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+
+def main():
+    try:
+        raw = sys.stdin.read()
+        if not raw.strip():
+            dbg("empty stdin, allowing")
+            sys.exit(0)
+
+        data = json.loads(raw)
+    except Exception as e:
+        dbg(f"stdin parse error: {e}")
+        sys.exit(0)
+
+    try:
+        tool_name = data.get("tool_name", "")
+        tool_input = data.get("tool_input", {})
+
+        file_path = tool_input.get("file_path", "")
+        if not file_path:
+            sys.exit(0)
+
+        # Determine new content being written
+        if tool_name == "Write":
+            new_content = tool_input.get("content", "")
+        elif tool_name == "Edit":
+            new_content = tool_input.get("new_string", "")
+        else:
+            sys.exit(0)
+
+        dbg(f"tool={tool_name} file={file_path} content_len={len(new_content)}")
+
+        project = load_project_yaml()
+        enterprise_mode = project.get("mode", "") == "enterprise"
+
+        # Check 1 — Branch guard
+        block_msg = check_branch_guard(file_path)
+        if block_msg:
+            print(block_msg, flush=True)
+            sys.exit(2)
+
+        # Check 2 — Debug statements
+        warn_msg = check_debug_statements(file_path, new_content)
+        if warn_msg:
+            if enterprise_mode:
+                print(warn_msg, flush=True)
+                sys.exit(2)
+            else:
+                print(warn_msg, flush=True)
+                # fall through — warning only
+
+        # Check 3 — Secret detection
+        block_msg = check_secret_detection(file_path, new_content)
+        if block_msg:
+            print(block_msg, flush=True)
+            sys.exit(2)
+
+        # project.yaml forbidden patterns
+        block_msg = check_project_yaml_patterns(file_path, new_content, project)
+        if block_msg:
+            print(block_msg, flush=True)
+            sys.exit(2)
+
+    except Exception as e:
+        dbg(f"unexpected error: {e}")
+        sys.exit(0)
+
+    sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

package/assets/core/hooks/session-start.sh

@@ -0,0 +1,184 @@
+#!/usr/bin/env bash
+# Forge v2 — SessionStart hook: verifica ambiente antes de cada sesión.
+#
+# Evento recomendado: UserPromptSubmit (primer mensaje) — Claude Code aún no
+# expone SessionStart como evento de hook; UserPromptSubmit es el equivalente
+# más cercano para verificaciones al inicio de sesión.
+#
+# Diferente del slash command /session-start: este hook es automático y
+# determinístico — no requiere intervención del usuario.
+
+set -euo pipefail
+
+CHECKS_PASSED=0
+CHECKS_TOTAL=0
+OUTPUT=""
+HAS_ERROR=false
+
+check() {
+    local name="$1"
+    local result="$2"   # "ok" | "warn: <msg>" | "error: <msg>"
+    CHECKS_TOTAL=$((CHECKS_TOTAL + 1))
+    if [[ "$result" == "ok" ]]; then
+        CHECKS_PASSED=$((CHECKS_PASSED + 1))
+    elif [[ "$result" == error:* ]]; then
+        HAS_ERROR=true
+        local msg="${result#error: }"
+        OUTPUT+="  error: ${msg}\n"
+    else
+        local msg="${result#warn: }"
+        OUTPUT+="  warn: ${msg}\n"
+    fi
+}
+
+# ---------------------------------------------------------------------------
+# Check 1 — Herramientas básicas disponibles
+# ---------------------------------------------------------------------------
+if ! command -v git &>/dev/null; then
+    check "git" "error: git no está instalado o no está en PATH"
+else
+    check "git" "ok"
+fi
+
+if ! command -v python3 &>/dev/null; then
+    check "python3" "error: python3 no está instalado o no está en PATH"
+else
+    check "python3" "ok"
+fi
+
+# Si faltan herramientas críticas, salir ya con error
+if [[ "$HAS_ERROR" == "true" ]]; then
+    printf "forge session: ERROR — herramientas críticas faltantes:\n"
+    printf "%b" "$OUTPUT"
+    exit 2
+fi
+
+# ---------------------------------------------------------------------------
+# Check 2 — Branch actual no es main/master
+# ---------------------------------------------------------------------------
+CURRENT_BRANCH="$(git branch --show-current 2>/dev/null || true)"
+if [[ "$CURRENT_BRANCH" == "main" || "$CURRENT_BRANCH" == "master" ]]; then
+    check "branch" "warn: branch '${CURRENT_BRANCH}' — considera trabajar en una feature branch"
+else
+    check "branch" "ok"
+fi
+
+# ---------------------------------------------------------------------------
+# Check 3 — Cambios sin commitear
+# ---------------------------------------------------------------------------
+GIT_STATUS="$(git status --short 2>/dev/null || true)"
+if [[ -n "$GIT_STATUS" ]]; then
+    check "uncommitted" "warn: cambios sin commitear en el worktree"
+else
+    check "uncommitted" "ok"
+fi
+
+# ---------------------------------------------------------------------------
+# Check 4 — project.yaml existe
+# ---------------------------------------------------------------------------
+PROJECT_YAML=""
+SEARCH_PATH="$(pwd)"
+for _i in 1 2 3 4 5 6; do
+    if [[ -f "${SEARCH_PATH}/project.yaml" ]]; then
+        PROJECT_YAML="${SEARCH_PATH}/project.yaml"
+        break
+    fi
+    PARENT="$(dirname "$SEARCH_PATH")"
+    [[ "$PARENT" == "$SEARCH_PATH" ]] && break
+    SEARCH_PATH="$PARENT"
+done
+
+if [[ -z "$PROJECT_YAML" ]]; then
+    check "project.yaml" "warn: project.yaml no encontrado — ejecutar forge-wizard.py"
+else
+    check "project.yaml" "ok"
+
+    # ---------------------------------------------------------------------------
+    # Check 5 — project.yaml tiene project.name y project.mode
+    # ---------------------------------------------------------------------------
+    YAML_VALID="$(python3 - "$PROJECT_YAML" <<'PYEOF'
+import sys, yaml
+path = sys.argv[1]
+try:
+    with open(path) as f:
+        data = yaml.safe_load(f)
+    if not isinstance(data, dict):
+        print("invalid")
+        sys.exit(0)
+    missing = []
+    project = data.get("project", {})
+    if not project.get("name"):
+        missing.append("project.name")
+    if not project.get("mode"):
+        missing.append("project.mode")
+    if missing:
+        print("missing:" + ",".join(missing))
+    else:
+        print("ok")
+except Exception as e:
+    print(f"error:{e}")
+PYEOF
+)"
+    if [[ "$YAML_VALID" == "ok" ]]; then
+        check "project.yaml.fields" "ok"
+    elif [[ "$YAML_VALID" == missing:* ]]; then
+        MISSING_FIELDS="${YAML_VALID#missing:}"
+        check "project.yaml.fields" "warn: project.yaml faltan campos: ${MISSING_FIELDS}"
+    else
+        check "project.yaml.fields" "warn: project.yaml no se pudo parsear — verificar sintaxis"
+    fi
+
+    # ---------------------------------------------------------------------------
+    # Check 6 — Variables de entorno de producción activas en sesión local
+    # ---------------------------------------------------------------------------
+    HAS_DEPLOY="$(python3 - "$PROJECT_YAML" <<'PYEOF'
+import sys, yaml
+path = sys.argv[1]
+try:
+    with open(path) as f:
+        data = yaml.safe_load(f)
+    if isinstance(data, dict) and data.get("deploy"):
+        print("yes")
+    else:
+        print("no")
+except Exception:
+    print("no")
+PYEOF
+)"
+    if [[ "$HAS_DEPLOY" == "yes" ]]; then
+        PROD_VARS=""
+        while IFS='=' read -r key _value; do
+            if [[ "$key" =~ ^(PROD_|PRODUCTION_|PROD$|PRODUCTION$) ]]; then
+                PROD_VARS+="${key} "
+            fi
+        done < <(env)
+        if [[ -n "$PROD_VARS" ]]; then
+            check "prod-env" "warn: variables de producción activas en sesión: ${PROD_VARS// /, } — verificar que es intencional"
+        else
+            check "prod-env" "ok"
+        fi
+    else
+        check "prod-env" "ok"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# Salida
+# ---------------------------------------------------------------------------
+WARNINGS=$((CHECKS_TOTAL - CHECKS_PASSED))
+
+if [[ $WARNINGS -eq 0 ]]; then
+    # Silencioso — todo OK
+    exit 0
+fi
+
+# Construir etiquetas para el resumen
+LABELS=""
+[[ "$CURRENT_BRANCH" == "main" || "$CURRENT_BRANCH" == "master" ]] && LABELS+="[branch ${CURRENT_BRANCH}] "
+[[ -n "$GIT_STATUS" ]] && LABELS+="[cambios sin commitear] "
+[[ -z "$PROJECT_YAML" ]] && LABELS+="[sin project.yaml] "
+
+printf "forge session: %d advertencia(s) — %s\n" "$WARNINGS" "${LABELS%% }"
+printf "%b" "$OUTPUT"
+
+exit 0