@relipa/ai-flow-kit 0.0.8-beta.0 → 0.0.8

package/custom/skills/generate-spec/SKILL.md

@@ -50,10 +50,6 @@ Create a detailed step-by-step plan based on the requirement document:
 | 3 | Write test for [scenario] | [test file] | ✅ | Task 2 |
 | ... | ... | ... | ... | ... |
 
-### Commit Strategy
-- Commit after each test+implementation pair
-- Keep commits small and focused
-
 ### Test Commands
 ```bash
 [specific test commands for this project]
@@ -71,7 +67,6 @@ Based on the approved requirement document, here is the coding plan:
 [Show task breakdown summary]
 
 **Total tasks:** [N]
-**Estimated commits:** [N]
 **Test-first tasks:** [N]
 
 Ready to start coding?
@@ -101,4 +96,4 @@ Type feedback to adjust the plan.
 - ✅ **MUST** use TDD order: test first, then implementation
 - ✅ **MUST** invoke `superpowers:writing-plans` for plan creation
 - ✅ **MUST** show clear task breakdown before getting approval
-- ✅ **MUST** plan small, focused commits
+- ❌ **DO NOT** include `git commit`, `git add`, or any git operations in the plan. The developer manages commits manually.

package/docs/common/CHANGELOG.md

@@ -7,6 +7,16 @@ Versioning follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [0.0.8-beta.1] - 2026-05-14
+
+### Fixed
+
+- **Auto-commit bug — actually fixed this time.** v0.0.7 claimed to remove "all automatic `git commit` and `git add` instructions from key AI skills" but the commit (`d490dab`) only added documentation/warning lines and left the active instructions in place. This release does the real work:
+  - Removed `4. Commit your work` from [.claude/skills/subagent-driven-development/implementer-prompt.md](.claude/skills/subagent-driven-development/implementer-prompt.md) (synced from upstream which had already been fixed).
+  - Removed the `### Commit Strategy` section, `Estimated commits: [N]` line, and `MUST plan small, focused commits` rule from [custom/skills/generate-spec/SKILL.md](custom/skills/generate-spec/SKILL.md) — these were active in Gate 2 every run.
+  - Removed `Commit the design document to git` and "and commit"/"committed to" wording from [upstream/skills/brainstorming/SKILL.md](upstream/skills/brainstorming/SKILL.md).
+- **Hard guarantee via PreToolUse hook.** Added [scripts/hooks/block-git-write.js](scripts/hooks/block-git-write.js) that intercepts every Bash tool call and blocks `git commit`, `git add`, `git push`, `git tag`, `git reset`, `git rebase`, `git revert`, `git cherry-pick`, `git am`, and `git merge`. Read operations (`git status`, `git rev-parse`, `git log`, `git diff`) and worktree operations (`git worktree add/list/remove`) remain allowed. `aiflow init`/`update` auto-installs the hook into `.claude/settings.json`. Override with `AIFLOW_ALLOW_GIT_WRITE=1` for kit maintenance scripts. Defense-in-depth: even if a future skill smuggles a commit instruction, the harness blocks it before it reaches git.
+
 ## [0.0.8] - 2026-05-14
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@relipa/ai-flow-kit",
-  "version": "0.0.8-beta.0",
+  "version": "0.0.8",
   "description": "All-in-one AI Flow Kit for team development with Claude AI - skills, templates, and MCP adapters",
   "author": "Example Team",
   "publishConfig": {

package/scripts/hooks/block-git-write.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook for ai-flow-kit
+ *
+ * Hard-blocks AI from running git-write operations (commit/add/push/tag) via the
+ * Bash tool. The developer always controls commits manually in their own terminal.
+ *
+ * Stdin payload (from Claude Code):
+ *   { tool_name: "Bash", tool_input: { command: "..." }, ... }
+ *
+ * Exit codes:
+ *   0 — allow (stdout empty)
+ *   2 — block (stderr message is fed back to Claude as feedback)
+ *
+ * Override (for the kit's own maintenance scripts):
+ *   export AIFLOW_ALLOW_GIT_WRITE=1
+ */
+
+let raw = '';
+process.stdin.setEncoding('utf-8');
+process.stdin.on('data', (chunk) => { raw += chunk; });
+process.stdin.on('end', () => {
+    try {
+        if (process.env.AIFLOW_ALLOW_GIT_WRITE === '1') process.exit(0);
+
+        const payload = raw ? JSON.parse(raw) : {};
+        if (payload.tool_name !== 'Bash') process.exit(0);
+
+        const command = (payload.tool_input && payload.tool_input.command) || '';
+        if (!command) process.exit(0);
+
+        // Match `git <subcommand>` where subcommand is a write operation.
+        // Tolerates leading args (e.g. `git -C path commit`, `git --no-pager add`).
+        // Captures occurrences inside compound shells: `&&`, `||`, `;`, `|`, `$(...)`, backticks, newline.
+        const BLOCK_RE = /(^|[\s;&|`(){}])git(\s+-[^\s]+)*\s+(commit|add|push|tag|reset|rebase|revert|cherry-pick|am|merge)\b/i;
+        const match = command.match(BLOCK_RE);
+        if (!match) process.exit(0);
+
+        const verb = match[3].toLowerCase();
+        process.stderr.write(
+            `[aiflow] BLOCKED: \`git ${verb}\` is not allowed for AI.\n` +
+            `Reason: ai-flow-kit forbids AI-driven commits/pushes. The developer manages git state manually.\n` +
+            `If this is a legitimate maintenance task (running the kit's own CI), set AIFLOW_ALLOW_GIT_WRITE=1 in the environment.\n` +
+            `Otherwise, finish the task without committing; the developer will run \`git ${verb}\` themselves at Gate 5.\n`
+        );
+        process.exit(2);
+    } catch (err) {
+        // On parsing error, fail open (don't block) but log to stderr for visibility.
+        process.stderr.write(`[aiflow] block-git-write hook error: ${err.message}\n`);
+        process.exit(0);
+    }
+});

package/scripts/init.js

@@ -185,6 +185,10 @@ async function setupSuperpowersHook(_projectDir, claudeDir) {
     const hookStopDest = path.join(hooksDir, 'session-stop.js');
     await fs.copy(hookStopSrc, hookStopDest, { overwrite: true });
 
+    const hookBlockGitSrc  = path.join(PKG_DIR, 'scripts', 'hooks', 'block-git-write.js');
+    const hookBlockGitDest = path.join(hooksDir, 'block-git-write.js');
+    await fs.copy(hookBlockGitSrc, hookBlockGitDest, { overwrite: true });
+
     const settingsFile = path.join(claudeDir, 'settings.json');
     let settings = {};
     if (await fs.pathExists(settingsFile)) {
@@ -194,6 +198,7 @@ async function setupSuperpowersHook(_projectDir, claudeDir) {
     if (!settings.hooks) settings.hooks = {};
     if (!settings.hooks.SessionStart) settings.hooks.SessionStart = [];
     if (!settings.hooks.SessionStop) settings.hooks.SessionStop = [];
+    if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
 
     settings.hooks.SessionStart = settings.hooks.SessionStart.filter(
         h => !(h._aiflowKit)
@@ -221,8 +226,22 @@ async function setupSuperpowersHook(_projectDir, claudeDir) {
         ]
     });
 
+    settings.hooks.PreToolUse = settings.hooks.PreToolUse.filter(
+        h => !(h._aiflowKitBlockGitWrite)
+    );
+    settings.hooks.PreToolUse.push({
+        _aiflowKitBlockGitWrite: true,
+        matcher: 'Bash',
+        hooks: [
+            {
+                type: 'command',
+                command: `node "${hookBlockGitDest.replace(/\\/g, '/')}"`,
+            }
+        ]
+    });
+
     await fs.writeJson(settingsFile, settings, { spaces: 2 });
-    console.log(chalk.green(`✓ Superpowers hooks (SessionStart, SessionStop) configured`));
+    console.log(chalk.green(`✓ Superpowers hooks (SessionStart, SessionStop, PreToolUse:block-git-write) configured`));
 }
 
 async function verifySuperpowersSkills(versionDir) {

package/upstream/skills/brainstorming/SKILL.md

@@ -26,7 +26,7 @@ You MUST create a task for each of these items and complete them in order:
 3. **Ask clarifying questions** — one at a time, understand purpose/constraints/success criteria
 4. **Propose 2-3 approaches** — with trade-offs and your recommendation
 5. **Present design** — in sections scaled to their complexity, get user approval after each section
-6. **Write design doc** — save to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md` and commit
+6. **Write design doc** — save to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md`
 7. **Spec self-review** — quick inline check for placeholders, contradictions, ambiguity, scope (see below)
 8. **User reviews written spec** — ask user to review the spec file before proceeding
 9. **Transition to implementation** — invoke writing-plans skill to create implementation plan
@@ -111,7 +111,7 @@ digraph brainstorming {
 - Write the validated design (spec) to `docs/superpowers/specs/YYYY-MM-DD-<topic>-design.md`
   - (User preferences for spec location override this default)
 - Use elements-of-style:writing-clearly-and-concisely skill if available
-- Commit the design document to git
+- Do NOT run `git add` or `git commit` for the design document — the developer commits manually.
 
 **Spec Self-Review:**
 After writing the spec document, look at it with fresh eyes:
@@ -126,7 +126,7 @@ Fix any issues inline. No need to re-review — just fix and move on.
 **User Review Gate:**
 After the spec review loop passes, ask the user to review the written spec before proceeding:
 
-> "Spec written and committed to `<path>`. Please review it and let me know if you want to make any changes before we start writing out the implementation plan."
+> "Spec written to `<path>`. Please review it and let me know if you want to make any changes before we start writing out the implementation plan."
 
 Wait for the user's response. If they request changes, make them and re-run the spec review loop. Only proceed once the user approves.