@ngockhoale/ukit 1.1.6

package/src/render/renderTemplate.js

@@ -0,0 +1,44 @@
+const TOKEN_PATTERN = /\{\{\s*([a-zA-Z0-9_.-]+)\s*\}\}/g;
+
+function flattenObject(input, prefix = '', output = {}) {
+  if (input === null || input === undefined) {
+    return output;
+  }
+
+  if (typeof input !== 'object' || Array.isArray(input)) {
+    output[prefix] = input;
+    return output;
+  }
+
+  for (const [key, value] of Object.entries(input)) {
+    const nextKey = prefix ? `${prefix}.${key}` : key;
+    if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+      flattenObject(value, nextKey, output);
+    } else {
+      output[nextKey] = value;
+    }
+  }
+
+  return output;
+}
+
+export function renderTemplateString(templateString, variables) {
+  const flattened = flattenObject(variables);
+
+  return templateString.replace(TOKEN_PATTERN, (fullMatch, token) => {
+    if (!(token in flattened)) {
+      return fullMatch;
+    }
+
+    const value = flattened[token];
+    if (value === undefined || value === null) {
+      return '';
+    }
+
+    if (typeof value === 'boolean') {
+      return value ? 'true' : 'false';
+    }
+
+    return String(value);
+  });
+}

package/src/stack/detectStack.js

@@ -0,0 +1,213 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { pathExists, readJsonIfExists } from '../core/fileOps.js';
+
+const FRONTEND_DEPENDENCIES = ['react', 'vue', 'nuxt', 'next', 'svelte', '@angular/core', 'vite'];
+const BACKEND_API_DEPENDENCIES = ['express', 'fastify', '@nestjs/core', 'koa', 'hapi', 'hono'];
+const POSTGRES_DEPENDENCIES = ['pg', 'postgres', 'prisma', 'typeorm', 'sequelize', 'drizzle-orm', 'knex'];
+const TESTING_DEPENDENCIES = ['jest', 'vitest', 'mocha', 'jasmine', '@playwright/test', 'cypress', '@testing-library/react'];
+const REACT_NATIVE_DEPENDENCIES = ['react-native', 'expo', '@expo/cli', '@react-native-community/cli'];
+const DURAONE_SCAN_IGNORE_DIRS = new Set([
+  '.cache',
+  '.claude',
+  '.codex',
+  '.git',
+  'build',
+  'coverage',
+  'dist',
+  'node_modules',
+]);
+const DURAONE_SCAN_MAX_DEPTH = 3;
+
+function collectDependencySet(packageJson) {
+  const dependencies = packageJson?.dependencies ?? {};
+  const devDependencies = packageJson?.devDependencies ?? {};
+  return new Set([...Object.keys(dependencies), ...Object.keys(devDependencies)]);
+}
+
+function collectDependencySignals(dependencySet, names) {
+  return names.filter((name) => dependencySet.has(name));
+}
+
+function detectTypeScriptFromPackageJson(packageJson, dependencySet) {
+  // explicit typescript dep or ts-specific config in scripts
+  if (dependencySet.has('typescript')) return true;
+  const scripts = packageJson?.scripts ?? {};
+  return Object.values(scripts).some((s) => typeof s === 'string' && (s.includes('tsc') || s.includes('ts-node')));
+}
+
+async function detectNuxt(projectRoot) {
+  // nuxt.config.ts/js is the canonical marker; also check .nuxt build dir
+  const [hasConfigTs, hasConfigJs, hasNuxtDir] = await Promise.all([
+    pathExists(path.join(projectRoot, 'nuxt.config.ts')),
+    pathExists(path.join(projectRoot, 'nuxt.config.js')),
+    pathExists(path.join(projectRoot, '.nuxt')),
+  ]);
+  return hasConfigTs || hasConfigJs || hasNuxtDir;
+}
+
+async function detectFlutter(projectRoot) {
+  // Flutter projects always have pubspec.yaml with a flutter dependency
+  const pubspecPath = path.join(projectRoot, 'pubspec.yaml');
+  if (!(await pathExists(pubspecPath))) return false;
+  // Confirm it's actually a Flutter project (not just plain Dart)
+  const [hasMainDart, hasAndroid, hasIos] = await Promise.all([
+    pathExists(path.join(projectRoot, 'lib', 'main.dart')),
+    pathExists(path.join(projectRoot, 'android')),
+    pathExists(path.join(projectRoot, 'ios')),
+  ]);
+  return hasMainDart || hasAndroid || hasIos;
+}
+
+async function detectMonorepo(projectRoot, packageJson) {
+  // yarn/npm workspaces, lerna, nx, turborepo, pnpm-workspace
+  if (Array.isArray(packageJson?.workspaces) && packageJson.workspaces.length > 0) return true;
+  if (typeof packageJson?.workspaces === 'object' && Array.isArray(packageJson.workspaces?.packages)) return true;
+  const markers = ['lerna.json', 'nx.json', 'pnpm-workspace.yaml', 'turbo.json'];
+  const checks = await Promise.all(markers.map((f) => pathExists(path.join(projectRoot, f))));
+  return checks.some(Boolean);
+}
+
+function pushUnique(target, value) {
+  if (!target.includes(value)) {
+    target.push(value);
+  }
+}
+
+async function safeReadDir(dirPath) {
+  try {
+    return await fs.readdir(dirPath, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+
+async function detectDuraOne(projectRoot) {
+  const signals = [];
+
+  async function scanCandidateParents(currentAbsDir, currentRelDir = '', depth = 0) {
+    const entries = await safeReadDir(currentAbsDir);
+    const directoryNames = new Set(
+      entries
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => entry.name),
+    );
+    const prefix = currentRelDir ? `${currentRelDir}/` : '';
+
+    if (directoryNames.has('FE_DuraOne')) pushUnique(signals, `${prefix}FE_DuraOne`);
+    if (directoryNames.has('BE_DuraOne')) pushUnique(signals, `${prefix}BE_DuraOne`);
+    if (directoryNames.has('SQL')) {
+      const hasSqlRoot = await pathExists(path.join(currentAbsDir, 'SQL', 'duraone'));
+      if (hasSqlRoot) {
+        pushUnique(signals, `${prefix}SQL/duraone`);
+      }
+    }
+
+    if (depth >= DURAONE_SCAN_MAX_DEPTH) {
+      return;
+    }
+
+    const childDirs = entries.filter((entry) => (
+      entry.isDirectory()
+      && !DURAONE_SCAN_IGNORE_DIRS.has(entry.name)
+      && entry.name !== 'FE_DuraOne'
+      && entry.name !== 'BE_DuraOne'
+      && entry.name !== 'SQL'
+    ));
+
+    await Promise.all(
+      childDirs.map((entry) => scanCandidateParents(
+        path.join(currentAbsDir, entry.name),
+        currentRelDir ? `${currentRelDir}/${entry.name}` : entry.name,
+        depth + 1,
+      )),
+    );
+  }
+
+  await scanCandidateParents(projectRoot);
+
+  return signals;
+}
+
+export async function detectStack(projectRoot) {
+  const packageJsonPath = path.join(projectRoot, 'package.json');
+  const packageJson = await readJsonIfExists(packageJsonPath);
+  const dependencySet = collectDependencySet(packageJson);
+
+  const frontendSignals = collectDependencySignals(dependencySet, FRONTEND_DEPENDENCIES);
+  const backendApiSignals = collectDependencySignals(dependencySet, BACKEND_API_DEPENDENCIES);
+  const postgresSignals = collectDependencySignals(dependencySet, POSTGRES_DEPENDENCIES);
+  const testingSignals = collectDependencySignals(dependencySet, TESTING_DEPENDENCIES);
+  const reactNativeSignals = collectDependencySignals(dependencySet, REACT_NATIVE_DEPENDENCIES);
+
+  // Run all file-system checks in parallel
+  const [
+    hasPrismaSchema,
+    hasSrcPages,
+    hasSrcApi,
+    hasTsConfig,
+    hasDockerfile,
+    hasDockerCompose,
+    hasGitDir,
+    isMonorepo,
+    isFlutter,
+    isNuxt,
+    duraoneSignals,
+  ] = await Promise.all([
+    pathExists(path.join(projectRoot, 'prisma', 'schema.prisma')),
+    pathExists(path.join(projectRoot, 'src', 'pages')),
+    pathExists(path.join(projectRoot, 'src', 'api')),
+    pathExists(path.join(projectRoot, 'tsconfig.json')),
+    pathExists(path.join(projectRoot, 'Dockerfile')),
+    pathExists(path.join(projectRoot, 'docker-compose.yml')).then(
+      (a) => a || pathExists(path.join(projectRoot, 'docker-compose.yaml')),
+    ),
+    pathExists(path.join(projectRoot, '.git')),
+    detectMonorepo(projectRoot, packageJson),
+    detectFlutter(projectRoot),
+    detectNuxt(projectRoot),
+    detectDuraOne(projectRoot),
+  ]);
+
+  if (hasPrismaSchema) postgresSignals.push('prisma/schema.prisma');
+  if (hasSrcPages) frontendSignals.push('src/pages');
+  if (hasSrcApi) backendApiSignals.push('src/api');
+  if (isNuxt) frontendSignals.push('nuxt');
+
+  const isTypeScript = hasTsConfig || detectTypeScriptFromPackageJson(packageJson, dependencySet);
+
+  const flags = {
+    frontend: frontendSignals.length > 0,
+    backendApi: backendApiSignals.length > 0,
+    postgres: postgresSignals.length > 0,
+    typescript: isTypeScript,
+    testing: testingSignals.length > 0,
+    nuxt: isNuxt,
+    next: dependencySet.has('next'),
+    flutter: isFlutter,
+    reactNative: reactNativeSignals.length > 0,
+    duraone: duraoneSignals.length > 0,
+    docker: hasDockerfile || hasDockerCompose,
+    monorepo: isMonorepo,
+    git: hasGitDir,
+  };
+
+  const detectedPacks = ['core'];
+  if (flags.frontend) detectedPacks.push('frontend');
+  if (flags.backendApi) detectedPacks.push('backend-api');
+  if (flags.postgres) detectedPacks.push('postgres');
+  if (flags.duraone) detectedPacks.push('duraone');
+
+  return {
+    detectedPacks,
+    flags,
+    signals: {
+      frontend: frontendSignals,
+      backendApi: backendApiSignals,
+      postgres: postgresSignals,
+      testing: testingSignals,
+      reactNative: reactNativeSignals,
+      duraone: duraoneSignals,
+    },
+  };
+}

package/templates/.claude/agents/bug-debugger.md

@@ -0,0 +1,57 @@
+---
+name: bug-debugger
+description: "Debugging specialist for reproducible errors, failing tests, and unexpected behavior. Use proactively when investigation will involve noisy logs, stack traces, or a self-contained reproduce-trace-fix-verify loop. Do not use for trivial obvious fixes or broad architecture ideation."
+model: inherit
+color: red
+tools: ["Read", "Grep", "Glob", "Bash", "Edit", "TodoWrite"]
+---
+
+Systematic debugging — understand before fixing.
+
+## Workflow
+
+### 1. Reproduce (required)
+
+- Run the failing command/action
+- Capture exact error message and stack trace
+- If not reproducible → document conditions and ask user
+
+### 2. Trace Root Cause
+
+- Read error location and surrounding code
+- Trace data flow: input → processing → failure point
+- Identify: is this a logic error, state error, or integration error?
+
+### 3. Fix
+
+- Apply smallest reliable fix at the root cause
+- Do NOT patch symptoms — fix the cause
+
+### 4. Verify
+
+- Re-run the original failing command → must pass
+- Run related tests: `yarn test [relevant-file]`
+- Check no regression in adjacent functionality
+
+### 5. Report
+
+```
+STATUS: DONE | BLOCKED | PARTIAL
+SUMMARY: [1-2 sentences — root cause and fix]
+ROOT_CAUSE: [what caused the bug]
+FILES_CHANGED:
+  - [file path]: [what changed]
+VERIFIED: [original failing command now passes + test output]
+ISSUES: [any remaining risks or edge cases, or "none"]
+NEXT: [follow-up needed, or "nothing — bug fixed"]
+```
+
+## Rules
+
+- Don't patch blindly — confirm root cause with evidence
+- For bug triage, use graduated doc budget:
+  - obvious/simple bug: `docs/MEMORY.md` only
+  - non-trivial bug: `docs/MEMORY.md` + `docs/PROJECT.md` + `docs/CODE_MAP.md`
+  - read `docs/WORKLOG.md` only recent relevant entries
+- Keep fix scope minimal — no drive-by refactors
+- If root cause is unclear after 5 minutes of tracing → ask user for more context

package/templates/.claude/agents/feature-implementer.md

@@ -0,0 +1,55 @@
+---
+name: feature-implementer
+description: "Implementation specialist for clear, self-contained coding tasks. Use proactively when the approach is clear and the work can be completed in a bounded pass with a concise summary. Do not use for trivial one-file tweaks or tightly coupled exploratory work."
+model: inherit
+color: green
+tools: ["Read", "Edit", "Write", "Grep", "Glob", "Bash", "TodoWrite"]
+---
+
+Implement requested behavior with minimal scope drift.
+
+## Workflow
+
+### 1. Understand (< 30 seconds)
+
+- Infer intent directly from user request (build/test/docs flow)
+- Apply graduated doc budget:
+  - trivial: no docs
+  - simple: `docs/MEMORY.md` only
+  - non-trivial: `docs/MEMORY.md` + `docs/PROJECT.md` + `docs/CODE_MAP.md`
+- Identify target files and existing patterns
+- If confidence is low or risk is high, ask one short clarifying question before deeper analysis
+
+### 2. Plan Approach (< 1 minute)
+
+- List files to create/modify (max diff)
+- Implement directly
+
+### 3. Implement
+
+- Smallest correct change set
+- Reuse existing code before creating new
+- No unrelated changes or speculative refactors
+- Follow project conventions (check `.claude/skills/` for patterns)
+
+### 4. Verify
+
+- Run existing tests if touched behavior has coverage: `yarn test` or project-specific
+- For SQL changes: verify with `EXPLAIN ANALYZE` on non-trivial queries
+- Check no lint errors introduced
+
+### 5. Report
+
+```
+STATUS: DONE | BLOCKED | PARTIAL
+SUMMARY: [1-2 sentences of what was implemented]
+FILES_CHANGED:
+  - [file path]: [what changed]
+VERIFIED: [test output / manual check result]
+ISSUES: [any problems or edge cases, or "none"]
+NEXT: [follow-up needed, or "nothing — task complete"]
+```
+
+## Rules
+
+- Add/update tests only when touched behavior already has coverage

package/templates/.claude/config/providers.md

@@ -0,0 +1,25 @@
+# Model Provider
+
+Provider: **UNIC**
+
+## Endpoints
+
+| Protocol | Base URL |
+|---|---|
+| OpenAI-compatible | `https://openai.unicjsc.com` |
+| Anthropic-compatible | `https://anthropic.unicjsc.com` |
+
+## API Key
+
+```
+anh-khoa-rat-dep-trai
+```
+
+## Available Models
+
+| Model | Use case |
+|---|---|
+| `unic-code` | Code generation and editing |
+| `unic-smart` | Complex reasoning and analysis |
+| `unic-fast` | Quick responses, low latency |
+| `unic-ask` | General Q&A and conversation |

package/templates/.claude/hooks/auto-allow-bash.sh

@@ -0,0 +1,155 @@
+#!/bin/bash
+# PreToolUse hook: auto-add Bash(<binary>:*) allow rules for frequently used commands.
+# Optimized: fast-path grep to skip Node.js when rule already exists.
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+if [ -z "$COMMAND" ]; then
+  exit 0
+fi
+
+BIN=""
+for token in $COMMAND; do
+  case "$token" in
+    *=*) continue ;;
+    time|command|env) continue ;;
+    '|'|'||'|'&&'|';') break ;;
+  esac
+  BIN="$token"
+  break
+done
+
+if [ -z "$BIN" ]; then
+  exit 0
+fi
+
+if [[ ! "$BIN" =~ ^[a-zA-Z0-9._/-]+$ ]]; then
+  exit 0
+fi
+
+BIN_BASENAME=$(basename "$BIN")
+
+if [[ "$BIN" =~ ^(rm|sudo|dd|mkfs|shutdown|reboot|halt|poweroff|chown|killall|pkill)$ ]]; then
+  exit 0
+fi
+
+if [[ "$BIN_BASENAME" =~ ^(bash|sh|zsh|fish|dash|ksh|node|nodejs|bun|deno|python|python3|python2|ruby|perl|php|pwsh|powershell|cmd|wscript|cscript|osascript)$ ]]; then
+  exit 0
+fi
+
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+SETTINGS_LOCAL="$PROJECT_ROOT/.claude/settings.local.json"
+USAGE_FILE="$PROJECT_ROOT/.claude/ukit/permission-usage.json"
+AUDIT_FILE="$PROJECT_ROOT/.claude/ukit/permission-audit.log"
+RULE="Bash(${BIN}:*)"
+NOW_UTC=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+MAX_RULES="${CLAUDE_AUTO_ALLOW_MAX_RULES:-150}"
+
+# Fast path: if rule already exists in allow list, just update usage and exit
+if [ -f "$SETTINGS_LOCAL" ] && grep -Fq -- "\"$RULE\"" "$SETTINGS_LOCAL" 2>/dev/null; then
+  # Only update usage timestamp (lighter than full Node.js logic)
+  node -e '
+    const fs = require("fs");
+    const usagePath = process.argv[1];
+    const rule = process.argv[2];
+    const nowUtc = process.argv[3];
+    if (!fs.existsSync(usagePath)) {
+      fs.mkdirSync(require("path").dirname(usagePath), { recursive: true });
+      fs.writeFileSync(usagePath, "{}");
+    }
+    try {
+      const usage = JSON.parse(fs.readFileSync(usagePath, "utf8"));
+      if (!usage.managedRules) usage.managedRules = {};
+      const prev = usage.managedRules[rule] || {};
+      usage.managedRules[rule] = { firstSeen: prev.firstSeen || nowUtc, lastSeen: nowUtc };
+      fs.writeFileSync(usagePath, JSON.stringify(usage, null, 2) + "\n");
+    } catch {}
+  ' "$USAGE_FILE" "$RULE" "$NOW_UTC" >/dev/null 2>&1 || true
+  exit 0
+fi
+
+# Slow path: rule is new, need full Node.js processing
+node -e '
+const fs = require("fs");
+const path = require("path");
+
+const settingsPath = process.argv[1];
+const usagePath = process.argv[2];
+const auditPath = process.argv[3];
+const rule = process.argv[4];
+const nowUtc = process.argv[5];
+const maxRules = Math.max(1, Number(process.argv[6]) || 150);
+
+function readJson(filePath, fallback) {
+  if (!fs.existsSync(filePath)) return fallback;
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function appendAudit(event, payload) {
+  fs.appendFileSync(auditPath, JSON.stringify({ ts: nowUtc, event, ...payload }) + "\n");
+}
+
+const settingsDir = path.dirname(settingsPath);
+const usageDir = path.dirname(usagePath);
+fs.mkdirSync(settingsDir, { recursive: true });
+fs.mkdirSync(usageDir, { recursive: true });
+
+const settings = readJson(settingsPath, {});
+if (!settings.permissions || typeof settings.permissions !== "object") {
+  settings.permissions = {};
+}
+if (!Array.isArray(settings.permissions.allow)) {
+  settings.permissions.allow = [];
+}
+
+const usage = readJson(usagePath, {});
+if (!usage.managedRules || typeof usage.managedRules !== "object") {
+  usage.managedRules = {};
+}
+
+const allow = settings.permissions.allow;
+let changed = false;
+
+if (!allow.includes(rule)) {
+  allow.push(rule);
+  changed = true;
+  appendAudit("auto_add", { rule });
+}
+
+const prevMeta = usage.managedRules[rule] || {};
+usage.managedRules[rule] = {
+  firstSeen: prevMeta.firstSeen || nowUtc,
+  lastSeen: nowUtc,
+};
+
+const managedSorted = Object.entries(usage.managedRules).sort((a, b) => {
+  const ta = Date.parse(a[1]?.lastSeen || "") || 0;
+  const tb = Date.parse(b[1]?.lastSeen || "") || 0;
+  return tb - ta;
+});
+
+if (managedSorted.length > maxRules) {
+  const evict = managedSorted.slice(maxRules);
+  for (const [evictRule] of evict) {
+    delete usage.managedRules[evictRule];
+    const idx = allow.indexOf(evictRule);
+    if (idx !== -1) {
+      allow.splice(idx, 1);
+      changed = true;
+    }
+    appendAudit("auto_prune_cap", { rule: evictRule, maxRules });
+  }
+}
+
+if (changed) {
+  fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+}
+fs.writeFileSync(usagePath, JSON.stringify(usage, null, 2) + "\n");
+' "$SETTINGS_LOCAL" "$USAGE_FILE" "$AUDIT_FILE" "$RULE" "$NOW_UTC" "$MAX_RULES" >/dev/null 2>&1 || true
+
+exit 0

package/templates/.claude/hooks/auto-prune-bash.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# SessionStart hook: prune stale Bash auto-allow rules from settings.local.json.
+
+PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+SETTINGS_LOCAL="$PROJECT_ROOT/.claude/settings.local.json"
+USAGE_FILE="$PROJECT_ROOT/.claude/ukit/permission-usage.json"
+AUDIT_FILE="$PROJECT_ROOT/.claude/ukit/permission-audit.log"
+TTL_DAYS="${CLAUDE_AUTO_ALLOW_TTL_DAYS:-30}"
+
+if [ ! -f "$SETTINGS_LOCAL" ] || [ ! -f "$USAGE_FILE" ]; then
+  exit 0
+fi
+
+NOW_UTC=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+node -e '
+const fs = require("fs");
+
+const settingsPath = process.argv[1];
+const usagePath = process.argv[2];
+const auditPath = process.argv[3];
+const ttlDays = Math.max(1, Number(process.argv[4]) || 30);
+const nowUtc = process.argv[5];
+const cutoff = Date.now() - ttlDays * 24 * 60 * 60 * 1000;
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function appendAudit(event, payload) {
+  fs.appendFileSync(auditPath, JSON.stringify({ ts: nowUtc, event, ...payload }) + "\n");
+}
+
+const settings = readJson(settingsPath);
+const usage = readJson(usagePath);
+if (!settings || !usage) process.exit(0);
+if (!settings.permissions || typeof settings.permissions !== "object") process.exit(0);
+if (!Array.isArray(settings.permissions.allow)) process.exit(0);
+if (!usage.managedRules || typeof usage.managedRules !== "object") process.exit(0);
+
+const allow = settings.permissions.allow;
+let changedSettings = false;
+let prunedCount = 0;
+
+for (const [rule, meta] of Object.entries(usage.managedRules)) {
+  const lastSeen = Date.parse(meta?.lastSeen || "");
+  if (!Number.isFinite(lastSeen) || lastSeen >= cutoff) continue;
+
+  const idx = allow.indexOf(rule);
+  if (idx !== -1) {
+    allow.splice(idx, 1);
+    changedSettings = true;
+  }
+  delete usage.managedRules[rule];
+  prunedCount += 1;
+  appendAudit("auto_prune_ttl", { rule, ttlDays });
+}
+
+usage.lastPruneAt = nowUtc;
+
+if (changedSettings) {
+  fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+}
+fs.writeFileSync(usagePath, JSON.stringify(usage, null, 2) + "\n");
+
+if (prunedCount > 0) {
+  appendAudit("auto_prune_summary", { prunedCount, ttlDays });
+}
+' "$SETTINGS_LOCAL" "$USAGE_FILE" "$AUDIT_FILE" "$TTL_DAYS" "$NOW_UTC" >/dev/null 2>&1 || true
+
+exit 0

package/templates/.claude/hooks/block-dangerous.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+# PreToolUse hook: Block dangerous bash commands
+# Matched on: Bash
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+if [ -z "$COMMAND" ]; then
+  exit 0
+fi
+
+# Dangerous patterns to block
+DANGEROUS_PATTERNS=(
+  "rm -rf /"
+  "rm -rf ~"
+  "rm -rf \\.?\\.([[:space:]]|$)"
+  "git push --force"
+  "git push -f "
+  "git reset --hard"
+  "git clean -fd"
+  "git checkout \."
+  "git restore \."
+  "> /dev/sda"
+  "mkfs\."
+  ":(){ :|:& };:"
+  "dd if=/dev/"
+)
+
+for pattern in "${DANGEROUS_PATTERNS[@]}"; do
+  if echo "$COMMAND" | grep -qE "$pattern"; then
+    echo "BLOCKED: Dangerous command detected matching pattern '$pattern'. This command could cause irreversible damage. Ask the user to run it manually if truly needed." >&2
+    exit 2
+  fi
+done
+
+# Handle rm commands: allow safe cleanup targets, block risky recursive force-deletes
+if echo "$COMMAND" | grep -qE "(^|[;&|[:space:]])rm([[:space:]]|$)"; then
+  if echo "$COMMAND" | grep -qE "rm\s+(-[a-zA-Z]*r[a-zA-Z]*f|-[a-zA-Z]*f[a-zA-Z]*r|--recursive\s+--force|--force\s+--recursive|--recursive\s+-f|-f\s+--recursive)"; then
+    SAFE_DELETE_REGEX='(^|[[:space:]])(\./)?(dist|build|coverage|\.next|\.nuxt|\.turbo|tmp|temp|\.cache|node_modules)(/|[[:space:]]|$)'
+    UNSAFE_TARGET_REGEX='(^|[[:space:]])(/|~|\.\.?($|/)|\.($|/))'
+
+    if echo "$COMMAND" | grep -qE "$UNSAFE_TARGET_REGEX"; then
+      echo "BLOCKED: Unsafe delete target detected. Refusing recursive force-delete." >&2
+      exit 2
+    fi
+
+    if ! echo "$COMMAND" | grep -qE "$SAFE_DELETE_REGEX"; then
+      echo "BLOCKED: 'rm -rf' is only auto-allowed for safe cleanup targets (dist/build/coverage/.next/.nuxt/.turbo/tmp/.cache/node_modules)." >&2
+      exit 2
+    fi
+  fi
+fi
+
+exit 0