@hivehub/rulebook 5.8.2 → 6.0.0

package/templates/hooks/enforce-pre-tool.sh

@@ -1,20 +1,40 @@
 #!/usr/bin/env bash
-# PreToolUse hook (v5.6.0): consolidated deny rules.
+# PreToolUse hook (v5.9.0): consolidated deny rules — perf-optimized.
 #
-# Replaces three legacy hooks (enforce-no-deferred / enforce-no-shortcuts /
-# enforce-mcp-for-tasks) with a single bash + node invocation. Each rule's
-# permissionDecisionReason is preserved verbatim so existing user guidance
-# is unchanged.
+# Matcher is Edit|Write only (Bash excluded) so it never fires on the
+# most frequent tool. A pure-bash trigger pre-filter short-circuits to
+# "allow" without spawning node for the overwhelming majority of edits;
+# node is only invoked when the raw payload contains a suspicious token,
+# keeping per-call cost at ~one bash spawn for normal work.
+#
+# Rules enforced (unchanged semantics):
+#   mcp-for-tasks  — block manual creation of task proposal.md/.metadata.json
+#   no-deferred    — tasks.md must not contain deferred/skip/later/TODO
+#   no-shortcuts   — source files must not contain TODO/FIXME/HACK or stub/placeholder
 set -euo pipefail
 input="$(cat)"
 
+allow() {
+  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
+  exit 0
+}
+
+# Fast path: if the raw payload contains no trigger token at all, allow
+# immediately without spawning node. deferred/skip/later only matter inside
+# tasks.md, which is already caught by the "tasks.md" path token below.
+shopt -s nocasematch
+case "$input" in
+  *TODO*|*FIXME*|*HACK*|*placeholder*|*stub*|*tasks.md*|*proposal.md*|*.metadata.json*) ;;
+  *) allow ;;
+esac
+shopt -u nocasematch
+
 result="$(node -e "
 const input = JSON.parse(process.argv[1]);
 const tool = input.tool_name || '';
 const ti = input.tool_input || {};
 const file = (ti.file_path || ti.filePath || '').replace(/\\\\/g, '/');
 const content = ti.new_string || ti.content || '';
-const cmd = ti.command || '';
 
 // Rule: mcp-for-tasks — manual creation of task scaffolding is forbidden.
 if (tool === 'Write' || tool === 'Edit') {
@@ -24,9 +44,6 @@ if (tool === 'Write' || tool === 'Edit') {
     catch { console.log('DENY_MCP'); process.exit(0); }
   }
 }
-if (tool === 'Bash' && /mkdir.*\\.rulebook\\/tasks\\//.test(cmd)) {
-  console.log('DENY_MCP'); process.exit(0);
-}
 
 // Rule: no-deferred — tasks.md must not contain deferred / skip / later / TODO.
 if ((tool === 'Edit' || tool === 'Write') && file.endsWith('tasks.md')) {

package/templates/hooks/update-check.ps1

@@ -1,84 +1,84 @@
-# Claude Code SessionStart hook — rulebook update check (Windows).
-#
-# Mirrors templates/hooks/update-check.sh: compares the project's installed
-# rulebook version (.rulebook/rulebook.json -> version) against the latest
-# @hivehub/rulebook on npm, cached 24h in .rulebook/.update-check. Emits an
-# additionalContext advisory when a newer version exists, else `{}`.
-
-$ErrorActionPreference = 'SilentlyContinue'
-
-function Emit-None { Write-Output '{}'; exit 0 }
-
-# Resolve project root from stdin JSON cwd, else env, else pwd.
-$inputRaw = $null
-if ([Console]::IsInputRedirected) { try { $inputRaw = [Console]::In.ReadToEnd() } catch { } }
-$projectRoot = $null
-if ($inputRaw) { try { $projectRoot = (ConvertFrom-Json $inputRaw).cwd } catch { } }
-if (-not $projectRoot) {
-  if ($env:CLAUDE_PROJECT_DIR) { $projectRoot = $env:CLAUDE_PROJECT_DIR }
-  else { $projectRoot = (Get-Location).Path }
-}
-
-$configFile = Join-Path $projectRoot '.rulebook/rulebook.json'
-$cacheFile  = Join-Path $projectRoot '.rulebook/.update-check'
-$pkg = '@hivehub/rulebook'
-$cacheTtl = 86400
-
-if (-not (Test-Path $configFile)) { Emit-None }
-
-$config = $null
-try { $config = Get-Content -Raw $configFile | ConvertFrom-Json } catch { Emit-None }
-$installed = $config.version
-if (-not $installed) { Emit-None }
-if ($config.updateCheck -and $config.updateCheck.enabled -eq $false) { Emit-None }
-
-$now = [int][double]::Parse((Get-Date -UFormat %s))
-$latest = $null
-$cacheTs = 0
-if (Test-Path $cacheFile) {
-  try {
-    $cache = Get-Content -Raw $cacheFile | ConvertFrom-Json
-    $cacheTs = [int]$cache.checkedAt
-    $latest = $cache.latest
-  } catch { }
-}
-
-$age = $now - $cacheTs
-if (-not $latest -or $age -ge $cacheTtl) {
-  $fetched = $null
-  try {
-    $job = Start-Job { param($p) npm view $p version 2>$null } -ArgumentList $pkg
-    if (Wait-Job $job -Timeout 5) { $fetched = (Receive-Job $job) }
-    Remove-Job $job -Force
-  } catch { }
-  if ($fetched) {
-    $latest = ("$fetched").Trim()
-    try {
-      [IO.File]::WriteAllText($cacheFile, (@{ latest = $latest; checkedAt = $now } | ConvertTo-Json -Compress))
-    } catch { }
-  }
-}
-
-if (-not $latest) { Emit-None }
-
-function Ver-Gt([string]$a, [string]$b) {
-  $aa = ($a -split '-')[0]; $bb = ($b -split '-')[0]
-  $A = $aa -split '\.'; $B = $bb -split '\.'
-  for ($i = 0; $i -lt 3; $i++) {
-    $ai = 0; $bi = 0
-    if ($A[$i]) { [int]::TryParse(($A[$i] -replace '[^0-9]', ''), [ref]$ai) | Out-Null }
-    if ($B[$i]) { [int]::TryParse(($B[$i] -replace '[^0-9]', ''), [ref]$bi) | Out-Null }
-    if ($ai -gt $bi) { return $true }
-    if ($ai -lt $bi) { return $false }
-  }
-  return $false
-}
-
-if (Ver-Gt $latest $installed) {
-  $ctx = "## Rulebook update available`n`nThis project is on rulebook **$installed**, but **$latest** is published on npm.`n`nAsk the user whether they want to update. If they agree, run ``rulebook update`` (or ``npx $pkg@latest update``) to regenerate the rules to the latest version, then review the diff before committing. Do not update without the user's confirmation."
-  $out = @{ hookSpecificOutput = @{ hookEventName = 'SessionStart'; additionalContext = $ctx } }
-  Write-Output ($out | ConvertTo-Json -Compress -Depth 4)
-  exit 0
-}
-
-Emit-None
+# Claude Code SessionStart hook — rulebook update check (Windows).
+#
+# Mirrors templates/hooks/update-check.sh: compares the project's installed
+# rulebook version (.rulebook/rulebook.json -> version) against the latest
+# @hivehub/rulebook on npm, cached 24h in .rulebook/.update-check. Emits an
+# additionalContext advisory when a newer version exists, else `{}`.
+
+$ErrorActionPreference = 'SilentlyContinue'
+
+function Emit-None { Write-Output '{}'; exit 0 }
+
+# Resolve project root from stdin JSON cwd, else env, else pwd.
+$inputRaw = $null
+if ([Console]::IsInputRedirected) { try { $inputRaw = [Console]::In.ReadToEnd() } catch { } }
+$projectRoot = $null
+if ($inputRaw) { try { $projectRoot = (ConvertFrom-Json $inputRaw).cwd } catch { } }
+if (-not $projectRoot) {
+  if ($env:CLAUDE_PROJECT_DIR) { $projectRoot = $env:CLAUDE_PROJECT_DIR }
+  else { $projectRoot = (Get-Location).Path }
+}
+
+$configFile = Join-Path $projectRoot '.rulebook/rulebook.json'
+$cacheFile  = Join-Path $projectRoot '.rulebook/.update-check'
+$pkg = '@hivehub/rulebook'
+$cacheTtl = 86400
+
+if (-not (Test-Path $configFile)) { Emit-None }
+
+$config = $null
+try { $config = Get-Content -Raw $configFile | ConvertFrom-Json } catch { Emit-None }
+$installed = $config.version
+if (-not $installed) { Emit-None }
+if ($config.updateCheck -and $config.updateCheck.enabled -eq $false) { Emit-None }
+
+$now = [int][double]::Parse((Get-Date -UFormat %s))
+$latest = $null
+$cacheTs = 0
+if (Test-Path $cacheFile) {
+  try {
+    $cache = Get-Content -Raw $cacheFile | ConvertFrom-Json
+    $cacheTs = [int]$cache.checkedAt
+    $latest = $cache.latest
+  } catch { }
+}
+
+$age = $now - $cacheTs
+if (-not $latest -or $age -ge $cacheTtl) {
+  $fetched = $null
+  try {
+    $job = Start-Job { param($p) npm view $p version 2>$null } -ArgumentList $pkg
+    if (Wait-Job $job -Timeout 5) { $fetched = (Receive-Job $job) }
+    Remove-Job $job -Force
+  } catch { }
+  if ($fetched) {
+    $latest = ("$fetched").Trim()
+    try {
+      [IO.File]::WriteAllText($cacheFile, (@{ latest = $latest; checkedAt = $now } | ConvertTo-Json -Compress))
+    } catch { }
+  }
+}
+
+if (-not $latest) { Emit-None }
+
+function Ver-Gt([string]$a, [string]$b) {
+  $aa = ($a -split '-')[0]; $bb = ($b -split '-')[0]
+  $A = $aa -split '\.'; $B = $bb -split '\.'
+  for ($i = 0; $i -lt 3; $i++) {
+    $ai = 0; $bi = 0
+    if ($A[$i]) { [int]::TryParse(($A[$i] -replace '[^0-9]', ''), [ref]$ai) | Out-Null }
+    if ($B[$i]) { [int]::TryParse(($B[$i] -replace '[^0-9]', ''), [ref]$bi) | Out-Null }
+    if ($ai -gt $bi) { return $true }
+    if ($ai -lt $bi) { return $false }
+  }
+  return $false
+}
+
+if (Ver-Gt $latest $installed) {
+  $ctx = "## Rulebook update available`n`nThis project is on rulebook **$installed**, but **$latest** is published on npm.`n`nAsk the user whether they want to update. If they agree, run ``rulebook update`` (or ``npx $pkg@latest update``) to regenerate the rules to the latest version, then review the diff before committing. Do not update without the user's confirmation."
+  $out = @{ hookSpecificOutput = @{ hookEventName = 'SessionStart'; additionalContext = $ctx } }
+  Write-Output ($out | ConvertTo-Json -Compress -Depth 4)
+  exit 0
+}
+
+Emit-None

package/templates/hooks/update-check.sh

@@ -9,14 +9,42 @@
 #
 # Emits `{}` (no-op) on any of: no config, no network/npm, already current,
 # cache still fresh with no known update, or any error. Never blocks startup.
+#
+# JSON is parsed/emitted with `node` (always present for a node CLI tool) so
+# the hook does not depend on `jq` being installed.
 
 set -euo pipefail
 
+emit_none() { printf '%s' '{}'; exit 0; }
+
+# node is required for JSON handling; without it, no-op gracefully.
+command -v node &>/dev/null || emit_none
+
+# Read a dotted field from a JSON file via node. Prints empty string on any
+# error / missing key. Booleans print as `true`/`false`.
+json_get() {
+  node -e '
+    const fs = require("fs");
+    let raw = "";
+    try { raw = fs.readFileSync(process.argv[1], "utf8"); } catch { process.exit(0); }
+    try {
+      let v = JSON.parse(raw);
+      for (const k of process.argv[2].split(".")) v = v == null ? undefined : v[k];
+      if (v !== undefined && v !== null) process.stdout.write(String(v));
+    } catch {}
+  ' "$1" "$2"
+}
+
 # --- Resolve project root (from stdin JSON cwd, else env, else pwd) ----------
 input="$(cat || true)"
 PROJECT_ROOT=""
-if [[ -n "$input" ]] && command -v jq &>/dev/null; then
-  PROJECT_ROOT="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
+if [[ -n "$input" ]]; then
+  PROJECT_ROOT="$(printf '%s' "$input" | node -e '
+    let d = "";
+    process.stdin.on("data", (c) => (d += c)).on("end", () => {
+      try { process.stdout.write(JSON.parse(d).cwd || ""); } catch {}
+    });
+  ' 2>/dev/null || true)"
 fi
 [[ -z "$PROJECT_ROOT" ]] && PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 
@@ -25,28 +53,21 @@ CACHE_FILE="${PROJECT_ROOT}/.rulebook/.update-check"
 PKG="@hivehub/rulebook"
 CACHE_TTL=86400 # 24h in seconds
 
-emit_none() { printf '%s' '{}'; exit 0; }
-
-# Need jq + a config to do anything useful.
-command -v jq &>/dev/null || emit_none
 [[ -f "$CONFIG_FILE" ]] || emit_none
 
-installed="$(jq -r '.version // empty' "$CONFIG_FILE" 2>/dev/null || true)"
+installed="$(json_get "$CONFIG_FILE" version)"
 [[ -z "$installed" ]] && emit_none
 
 # Allow opt-out via config: { "updateCheck": { "enabled": false } }.
-# Note: jq's `//` treats `false` as empty, so `.updateCheck.enabled // true`
-# would wrongly yield true when explicitly disabled — test the value directly.
-enabled="$(jq -r 'if .updateCheck.enabled == false then "false" else "true" end' "$CONFIG_FILE" 2>/dev/null || echo true)"
-[[ "$enabled" == "false" ]] && emit_none
+[[ "$(json_get "$CONFIG_FILE" updateCheck.enabled)" == "false" ]] && emit_none
 
 # --- Determine latest version (cache-first) ---------------------------------
 now="$(date -u +%s)"
 latest=""
 cache_ts=0
 if [[ -f "$CACHE_FILE" ]]; then
-  cache_ts="$(jq -r '.checkedAt // 0' "$CACHE_FILE" 2>/dev/null || echo 0)"
-  latest="$(jq -r '.latest // empty' "$CACHE_FILE" 2>/dev/null || true)"
+  cache_ts="$(json_get "$CACHE_FILE" checkedAt)"; cache_ts="${cache_ts:-0}"
+  latest="$(json_get "$CACHE_FILE" latest)"
 fi
 
 age=$(( now - cache_ts ))
@@ -63,8 +84,12 @@ if [[ -z "$latest" || "$age" -ge "$CACHE_TTL" ]]; then
   if [[ -n "$fetched" ]]; then
     latest="$fetched"
     # Refresh cache (best-effort; ignore write failures).
-    jq -nc --arg l "$latest" --argjson t "$now" \
-      '{latest: $l, checkedAt: $t}' > "$CACHE_FILE" 2>/dev/null || true
+    node -e '
+      const fs = require("fs");
+      try {
+        fs.writeFileSync(process.argv[1], JSON.stringify({ latest: process.argv[2], checkedAt: Number(process.argv[3]) }));
+      } catch {}
+    ' "$CACHE_FILE" "$latest" "$now" 2>/dev/null || true
   fi
 fi
 
@@ -91,12 +116,11 @@ ver_gt() {
 
 if ver_gt "$latest" "$installed"; then
   ctx="## Rulebook update available\n\nThis project is on rulebook **${installed}**, but **${latest}** is published on npm.\n\nAsk the user whether they want to update. If they agree, run \`rulebook update\` (or \`npx ${PKG}@latest update\`) to regenerate the rules to the latest version, then review the diff before committing. Do not update without the user's confirmation."
-  jq -nc --arg ctx "$ctx" '{
-    hookSpecificOutput: {
-      hookEventName: "SessionStart",
-      additionalContext: $ctx
-    }
-  }'
+  node -e '
+    console.log(JSON.stringify({
+      hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: process.argv[1] },
+    }));
+  ' "$ctx"
   exit 0
 fi