@phuc1403/musketeer 0.8.0 → 0.10.0

package/template/.claude/hooks/inject-adr-flags.cjs

@@ -1,94 +1,94 @@
-#!/usr/bin/env node
-// PreToolUse guard: add the one flag every `adr new` call needs, so the agent
-// can write a bare `adr new -- "Title"` and still get a safe command.
-//
-//   -q / --quiet — without it, an `-s` pattern matching more than one file
-//     opens an interactive prompt on stdin and hangs the session. With it,
-//     the ambiguous case throws instead, so the wrong ADR is never superseded
-//     by a silent guess.
-//
-// Nothing else is injected. The template no longer needs an env var: `adr`
-// resolves `<adr-dir>/templates/template.md` on its own, and init-adr-dir.cjs
-// puts musketeer's template there. There is no editor to suppress either —
-// `adr` only opens one on an explicit `--open`.
-//
-// Uses PreToolUse's `updatedInput` (not just allow/deny) to rewrite the
-// command before it runs. A `-q` the agent already wrote is left alone, and
-// the call is a silent no-op.
-//
-// Safety: a title that happens to contain the literal text "adr new" could
-// make the matching regex fire inside a quoted string. Guarded by counting
-// quote characters before each match — an odd count means "inside an open
-// string", and that occurrence is left untouched rather than risk corrupting
-// the title.
-
-const fs = require('fs');
-const {
-  invocationRe,
-  isInsideQuotes,
-  isInsideHeredoc,
-  invokesAdr,
-} = require('./lib/adr/command-scan.cjs');
-
-const QUIET = /(?:^|\s)(?:-q|--quiet)(?=\s|$)/;
-
-// Everything between `adr new` and either the `--` option terminator or the end
-// of this command segment, whichever comes first.
-//
-// The title lives after `--` and may legitimately contain the text "-q"
-// ("Use -q for quiet builds"). Scanning it would make the hook believe the flag
-// was already supplied and skip an invocation that genuinely needs it, so the
-// title is never part of the region searched.
-function flagsRegion(command, from) {
-  const rest = command.slice(from);
-  let end = rest.length;
-
-  const terminator = rest.search(/\s--(\s|$)/);
-  if (terminator !== -1) end = terminator;
-
-  for (let i = 0; i < end; i++) {
-    if (';&|\n'.includes(rest[i]) && !isInsideQuotes(command, from + i)) {
-      end = i;
-      break;
-    }
-  }
-  return rest.slice(0, end);
-}
-
-function main() {
-  const payload = JSON.parse(fs.readFileSync(0, 'utf8'));
-  const command = payload?.tool_input?.command || '';
-  if (!invokesAdr(command, 'new')) return;
-
-  let changed = false;
-  const updated = command.replace(invocationRe('new'), (whole, boundary, ws, envPrefix, adrNew, offset) => {
-    // Both guards, for the same reason the deny hooks use them: a heredoc body
-    // is documentation being written, and injecting a flag into it would
-    // rewrite the file's contents rather than the command.
-    // `offset` is the boundary character; step past it to the word `adr`.
-    const at = offset + boundary.length + ws.length + envPrefix.length;
-    if (isInsideQuotes(command, at) || isInsideHeredoc(command, at)) return whole;
-    if (QUIET.test(flagsRegion(command, at + adrNew.length))) return whole;
-    changed = true;
-    return `${boundary}${ws}${envPrefix}${adrNew} -q`;
-  });
-  if (!changed) return;
-
-  process.stdout.write(
-    JSON.stringify({
-      systemMessage: 'Added -q to `adr new` — without it an ambiguous -s prompts on stdin and hangs.',
-      hookSpecificOutput: {
-        hookEventName: 'PreToolUse',
-        permissionDecision: 'allow',
-        updatedInput: { command: updated },
-      },
-    })
-  );
-}
-
-try {
-  main();
-} catch {
-  /* fail open: leave the command untouched */
-}
-process.exit(0);
+#!/usr/bin/env node
+// PreToolUse guard: add the one flag every `adr new` call needs, so the agent
+// can write a bare `adr new -- "Title"` and still get a safe command.
+//
+//   -q / --quiet — without it, an `-s` pattern matching more than one file
+//     opens an interactive prompt on stdin and hangs the session. With it,
+//     the ambiguous case throws instead, so the wrong ADR is never superseded
+//     by a silent guess.
+//
+// Nothing else is injected. The template no longer needs an env var: `adr`
+// resolves `<adr-dir>/templates/template.md` on its own, and init-adr-dir.cjs
+// puts musketeer's template there. There is no editor to suppress either —
+// `adr` only opens one on an explicit `--open`.
+//
+// Uses PreToolUse's `updatedInput` (not just allow/deny) to rewrite the
+// command before it runs. A `-q` the agent already wrote is left alone, and
+// the call is a silent no-op.
+//
+// Safety: a title that happens to contain the literal text "adr new" could
+// make the matching regex fire inside a quoted string. Guarded by counting
+// quote characters before each match — an odd count means "inside an open
+// string", and that occurrence is left untouched rather than risk corrupting
+// the title.
+
+const fs = require('fs');
+const {
+  invocationRe,
+  isInsideQuotes,
+  isInsideHeredoc,
+  invokesAdr,
+} = require('./lib/adr/command-scan.cjs');
+
+const QUIET = /(?:^|\s)(?:-q|--quiet)(?=\s|$)/;
+
+// Everything between `adr new` and either the `--` option terminator or the end
+// of this command segment, whichever comes first.
+//
+// The title lives after `--` and may legitimately contain the text "-q"
+// ("Use -q for quiet builds"). Scanning it would make the hook believe the flag
+// was already supplied and skip an invocation that genuinely needs it, so the
+// title is never part of the region searched.
+function flagsRegion(command, from) {
+  const rest = command.slice(from);
+  let end = rest.length;
+
+  const terminator = rest.search(/\s--(\s|$)/);
+  if (terminator !== -1) end = terminator;
+
+  for (let i = 0; i < end; i++) {
+    if (';&|\n'.includes(rest[i]) && !isInsideQuotes(command, from + i)) {
+      end = i;
+      break;
+    }
+  }
+  return rest.slice(0, end);
+}
+
+function main() {
+  const payload = JSON.parse(fs.readFileSync(0, 'utf8'));
+  const command = payload?.tool_input?.command || '';
+  if (!invokesAdr(command, 'new')) return;
+
+  let changed = false;
+  const updated = command.replace(invocationRe('new'), (whole, boundary, ws, envPrefix, adrNew, offset) => {
+    // Both guards, for the same reason the deny hooks use them: a heredoc body
+    // is documentation being written, and injecting a flag into it would
+    // rewrite the file's contents rather than the command.
+    // `offset` is the boundary character; step past it to the word `adr`.
+    const at = offset + boundary.length + ws.length + envPrefix.length;
+    if (isInsideQuotes(command, at) || isInsideHeredoc(command, at)) return whole;
+    if (QUIET.test(flagsRegion(command, at + adrNew.length))) return whole;
+    changed = true;
+    return `${boundary}${ws}${envPrefix}${adrNew} -q`;
+  });
+  if (!changed) return;
+
+  process.stdout.write(
+    JSON.stringify({
+      systemMessage: 'Added -q to `adr new` — without it an ambiguous -s prompts on stdin and hangs.',
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'allow',
+        updatedInput: { command: updated },
+      },
+    })
+  );
+}
+
+try {
+  main();
+} catch {
+  /* fail open: leave the command untouched */
+}
+process.exit(0);

package/template/.claude/hooks/lib/adr/command-scan.cjs

@@ -1,115 +1,115 @@
-'use strict';
-
-// Tells a real `adr` invocation apart from a command that merely mentions one.
-//
-// Three PreToolUse hooks key off `adr new` and `adr init`. Matching those words
-// anywhere in the command string is too loose: a commit message explaining ADR
-// work, a grep for the phrase, or a heredoc of documentation all contain them
-// and none of them run the tool. Denying those commands leaves the user staring
-// at an error about a command they never wrote.
-//
-// Three tests must all pass before an occurrence counts:
-//
-//   1. It sits at a command position — the start of the string, or just after a
-//      separator such as `;` `&&` `||` `|` `(` or a newline — allowing for any
-//      KEY=value assignments in front of it.
-//   2. It is not inside an open quote.
-//   3. It is not inside a heredoc body, which is data being written rather than
-//      a command being run.
-//
-// Where the two disagree with each other, the answer is "not an invocation".
-// A missed invocation makes a hook skip work the user will notice at once; a
-// false one blocks an unrelated command for a reason nobody can guess.
-
-// boundary/start, whitespace, any existing KEY=value prefix, then `adr <sub>`.
-//
-// The subcommand must not run straight into a word character or a hyphen. `\b`
-// alone is not enough: it sits happily between the `w` of `new` and the `-` of
-// `adr new-thing`, so that string would count as an `adr new` invocation. A hook
-// that only reads the command could shrug that off, but inject-adr-flags writes
-// the flag directly after the subcommand and would turn it into `adr new -q-thing`.
-// A trailing `;` or `|` still has to count, so this is a negated class rather
-// than a required space.
-function invocationRe(sub) {
-  return new RegExp(
-    `(^|[;&|\\n(){}])([ \\t]*)((?:[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\\S*)[ \\t]+)*)(adr[ \\t]+${sub})(?![\\w-])`,
-    'g'
-  );
-}
-
-// An odd number of quote characters before this point means the point is inside
-// a string that is still open.
-function isInsideQuotes(command, index) {
-  const before = command.slice(0, index);
-  const dq = (before.match(/"/g) || []).length;
-  const sq = (before.match(/'/g) || []).length;
-  return dq % 2 === 1 || sq % 2 === 1;
-}
-
-const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-
-// `<<TAG`, `<<-TAG`, `<<'TAG'`, `<<"TAG"`. `<<<` is a herestring, not a heredoc,
-// and does not match here because `<` is neither a quote nor a word character.
-const HEREDOC_OPEN = /<<(-?)[ \t]*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/g;
-
-// Offset ranges covering heredoc bodies.
-//
-// A heredoc body is data being written, not commands being run. Writing install
-// docs that show `adr new -- "Use X"` is an ordinary thing to do in this repo,
-// and the line sits at the start of its own line with balanced quotes in front
-// of it, so both of the other tests would wave it through.
-//
-// Known limit: several heredocs opened on one line share the first body start,
-// so the ranges merge. That errs toward treating more text as data, which only
-// ever makes this scanner quieter.
-function heredocRanges(command) {
-  const ranges = [];
-  const re = new RegExp(HEREDOC_OPEN.source, 'g');
-  let m;
-
-  while ((m = re.exec(command))) {
-    const tag = m[2] || m[3] || m[4];
-    const newline = command.indexOf('\n', m.index);
-    if (newline === -1) continue; // an opener with no body on this command
-
-    const start = newline + 1;
-    // `<<-` lets the terminator be indented with tabs.
-    const terminator = new RegExp(`^${m[1] === '-' ? '[ \\t]*' : ''}${escapeRe(tag)}[ \\t]*$`, 'm');
-    const hit = command.slice(start).match(terminator);
-    ranges.push([start, hit ? start + hit.index : command.length]);
-  }
-
-  return ranges;
-}
-
-function isInsideHeredoc(command, index) {
-  return heredocRanges(command).some(([start, end]) => index >= start && index < end);
-}
-
-// Where the word `adr` itself starts. The match begins at the boundary
-// character before it, which is close enough for counting quotes but one
-// position short of the heredoc body it may sit in.
-function adrOffsetOf(match) {
-  return match.index + match[1].length + match[2].length + match[3].length;
-}
-
-// True when the command really runs `adr <sub>` at least once.
-function invokesAdr(command, sub) {
-  const re = invocationRe(sub);
-  const bodies = heredocRanges(command);
-  const inBody = (i) => bodies.some(([start, end]) => i >= start && i < end);
-  let m;
-  while ((m = re.exec(command))) {
-    const at = adrOffsetOf(m);
-    if (!isInsideQuotes(command, at) && !inBody(at)) return true;
-  }
-  return false;
-}
-
-module.exports = {
-  invokesAdr,
-  isInsideQuotes,
-  isInsideHeredoc,
-  heredocRanges,
-  invocationRe,
-};
+'use strict';
+
+// Tells a real `adr` invocation apart from a command that merely mentions one.
+//
+// Three PreToolUse hooks key off `adr new` and `adr init`. Matching those words
+// anywhere in the command string is too loose: a commit message explaining ADR
+// work, a grep for the phrase, or a heredoc of documentation all contain them
+// and none of them run the tool. Denying those commands leaves the user staring
+// at an error about a command they never wrote.
+//
+// Three tests must all pass before an occurrence counts:
+//
+//   1. It sits at a command position — the start of the string, or just after a
+//      separator such as `;` `&&` `||` `|` `(` or a newline — allowing for any
+//      KEY=value assignments in front of it.
+//   2. It is not inside an open quote.
+//   3. It is not inside a heredoc body, which is data being written rather than
+//      a command being run.
+//
+// Where the two disagree with each other, the answer is "not an invocation".
+// A missed invocation makes a hook skip work the user will notice at once; a
+// false one blocks an unrelated command for a reason nobody can guess.
+
+// boundary/start, whitespace, any existing KEY=value prefix, then `adr <sub>`.
+//
+// The subcommand must not run straight into a word character or a hyphen. `\b`
+// alone is not enough: it sits happily between the `w` of `new` and the `-` of
+// `adr new-thing`, so that string would count as an `adr new` invocation. A hook
+// that only reads the command could shrug that off, but inject-adr-flags writes
+// the flag directly after the subcommand and would turn it into `adr new -q-thing`.
+// A trailing `;` or `|` still has to count, so this is a negated class rather
+// than a required space.
+function invocationRe(sub) {
+  return new RegExp(
+    `(^|[;&|\\n(){}])([ \\t]*)((?:[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\\S*)[ \\t]+)*)(adr[ \\t]+${sub})(?![\\w-])`,
+    'g'
+  );
+}
+
+// An odd number of quote characters before this point means the point is inside
+// a string that is still open.
+function isInsideQuotes(command, index) {
+  const before = command.slice(0, index);
+  const dq = (before.match(/"/g) || []).length;
+  const sq = (before.match(/'/g) || []).length;
+  return dq % 2 === 1 || sq % 2 === 1;
+}
+
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+// `<<TAG`, `<<-TAG`, `<<'TAG'`, `<<"TAG"`. `<<<` is a herestring, not a heredoc,
+// and does not match here because `<` is neither a quote nor a word character.
+const HEREDOC_OPEN = /<<(-?)[ \t]*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/g;
+
+// Offset ranges covering heredoc bodies.
+//
+// A heredoc body is data being written, not commands being run. Writing install
+// docs that show `adr new -- "Use X"` is an ordinary thing to do in this repo,
+// and the line sits at the start of its own line with balanced quotes in front
+// of it, so both of the other tests would wave it through.
+//
+// Known limit: several heredocs opened on one line share the first body start,
+// so the ranges merge. That errs toward treating more text as data, which only
+// ever makes this scanner quieter.
+function heredocRanges(command) {
+  const ranges = [];
+  const re = new RegExp(HEREDOC_OPEN.source, 'g');
+  let m;
+
+  while ((m = re.exec(command))) {
+    const tag = m[2] || m[3] || m[4];
+    const newline = command.indexOf('\n', m.index);
+    if (newline === -1) continue; // an opener with no body on this command
+
+    const start = newline + 1;
+    // `<<-` lets the terminator be indented with tabs.
+    const terminator = new RegExp(`^${m[1] === '-' ? '[ \\t]*' : ''}${escapeRe(tag)}[ \\t]*$`, 'm');
+    const hit = command.slice(start).match(terminator);
+    ranges.push([start, hit ? start + hit.index : command.length]);
+  }
+
+  return ranges;
+}
+
+function isInsideHeredoc(command, index) {
+  return heredocRanges(command).some(([start, end]) => index >= start && index < end);
+}
+
+// Where the word `adr` itself starts. The match begins at the boundary
+// character before it, which is close enough for counting quotes but one
+// position short of the heredoc body it may sit in.
+function adrOffsetOf(match) {
+  return match.index + match[1].length + match[2].length + match[3].length;
+}
+
+// True when the command really runs `adr <sub>` at least once.
+function invokesAdr(command, sub) {
+  const re = invocationRe(sub);
+  const bodies = heredocRanges(command);
+  const inBody = (i) => bodies.some(([start, end]) => i >= start && i < end);
+  let m;
+  while ((m = re.exec(command))) {
+    const at = adrOffsetOf(m);
+    if (!isInsideQuotes(command, at) && !inBody(at)) return true;
+  }
+  return false;
+}
+
+module.exports = {
+  invokesAdr,
+  isInsideQuotes,
+  isInsideHeredoc,
+  heredocRanges,
+  invocationRe,
+};