@ryusenkei/conventions 0.0.0-stage → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RYUSENKEI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,76 @@
-# Temporary Holding Version
+# @ryusenkei/conventions
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Shared conventions for RYUSENKEI monorepos created from monorepo-template. Rules that a tool can enforce are enforced by hooks and settings. Only the rest are written in `rules.md`.
+
+| Part | What it does |
+| --- | --- |
+| [`rules.md`](rules.md) | Rules for Claude Code, imported from each repository's `CLAUDE.md` (Japanese) |
+| `dist/hook.js` | Claude Code hook: blocks tool calls that break the rules, and optionally runs lint and tests before Claude finishes |
+| `files/` | Master copies of the shared files, synced into each repository |
+| `ryusenkei-conventions` | CLI: `sync` writes the shared files, `check` reports drift |
+
+## Install
+
+```sh
+pnpm add -D @ryusenkei/conventions
+```
+
+Requires Node.js 24 or later.
+
+## Setup
+
+1. Import the rules at the end of the repository's `CLAUDE.md`:
+
+   ```markdown
+   # CLAUDE.md
+
+   One-line summary of the repository.
+
+   ## このリポの規約
+
+   - Repository-specific rules
+
+   @node_modules/@ryusenkei/conventions/rules.md
+   ```
+
+2. Write the shared files: `npx ryusenkei-conventions sync` (add `--stop` to run lint and tests before Claude finishes).
+3. Add `ryusenkei-conventions check` to the `lint` script.
+
+- Claude Code expands the import when a session starts. Run `pnpm install` first, or the rules are not loaded.
+- The import resolves inside the working directory, so Claude Code does not ask for approval of external imports.
+
+## Enforced rules
+
+The PreToolUse hook blocks the call and tells Claude why, so Claude can fix it and retry.
+
+| Rule | Enforcement |
+| --- | --- |
+| pnpm only | Blocks `npm install` (and other npm changes) and `yarn` |
+| Branch names `<type>/<name>` | Checks `git switch -c`, `git checkout -b`, `git branch`, `git worktree add -b` |
+| No skipped Git hooks | Blocks `git commit --no-verify` / `-n` and `git push --no-verify` |
+| PR title = squash commit message | Checks `gh pr create` / `gh pr edit` titles with prose-lint's commit rules |
+| No AI signature | `attribution` is empty, and the hook blocks PR bodies with an AI signature |
+| Squash merge only | Blocks `gh pr merge --merge` / `--rebase` |
+| Do not edit `node_modules` | Blocks Edit and Write under `node_modules` |
+| Secrets | `permissions.deny` blocks reading `.env` and `.dev.vars` with Claude's file tools (not Bash) |
+| Definition of done (`--stop`) | The Stop hook runs `pnpm lint` and `pnpm test` when the working tree has changes, and sends Claude back once on failure |
+
+Commit messages are checked by `.githooks/commit-msg`, and edited files by prose-lint's PostToolUse hook.
+
+## Synced files
+
+`sync` writes these files and `check` compares them, ignoring line endings:
+
+- `.editorconfig`, `.gitattributes`, `.gitignore`, `.gitleaks.toml`, `mise.toml`, `.github/dependabot.yaml`, `.githooks/commit-msg`
+- `.claude/settings.json`: only the hooks, `attribution`, and `permissions.deny` are managed. Other settings and hooks are kept
+- `pnpm-workspace.yaml`: `minimumReleaseAge` and `minimumReleaseAgeExclude`, matching the Dependabot `cooldown`
+
+`check` also reports a missing `rules.md` import in `CLAUDE.md`.
+
+Updates arrive as Dependabot PRs. The repository's `cooldown` excludes `@ryusenkei/*`, so new versions are picked up the next day. After an update, `check` fails until `sync` is run.
+
+## Versioning
+
+- major: a rule is removed or reversed, or a synced file changes incompatibly
+- minor: a rule, a hook check, or a synced file is added
+- patch: fixes and wording

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+// 共通の規約の CLI（リポのルートで実行）
+//   ryusenkei-conventions check         マスタとの差分の検査（差分あり → 終了コード1）
+//   ryusenkei-conventions sync [--stop]  マスタに合わせて書き込み
+//   --stop: 完了前の `pnpm lint`・`pnpm test` を Stop の hook に登録（省略時は現在の登録を維持）
+import { execFileSync } from 'node:child_process';
+import { parseArgs } from 'node:util';
+import { drifts, sync } from "./files.js";
+const { values, positionals } = parseArgs({ allowPositionals: true, options: { stop: { type: 'boolean' } } });
+const root = execFileSync('git', ['rev-parse', '--show-toplevel'], { encoding: 'utf8' }).trim();
+const options = values.stop === undefined ? {} : { stop: values.stop };
+switch (positionals[0]) {
+    case 'check': {
+        const found = drifts(root, options);
+        for (const d of found)
+            console.log(`${d.path}: ${d.message}`);
+        if (found.some((d) => d.expected !== undefined))
+            console.log('→ `ryusenkei-conventions sync` で修正');
+        process.exitCode = found.length ? 1 : 0;
+        break;
+    }
+    case 'sync': {
+        const rest = sync(root, options);
+        for (const d of rest)
+            console.log(`${d.path}: ${d.message}`);
+        process.exitCode = rest.length ? 1 : 0;
+        break;
+    }
+    default:
+        console.error('usage: ryusenkei-conventions <check|sync> [--stop]');
+        process.exitCode = 2;
+}

package/dist/files.d.ts

@@ -0,0 +1,16 @@
+/** CLAUDE.md で共通の規約を読み込む import */
+export declare const IMPORT = "@node_modules/@ryusenkei/conventions/rules.md";
+/** 差分のあるファイル（`expected` が `undefined` = 自動で修正できない → `message` に対処） */
+export type Drift = {
+    path: string;
+    expected?: string;
+    message: string;
+};
+/** マスタとの差分 */
+export declare function drifts(root: string, options?: {
+    stop?: boolean;
+}): Drift[];
+/** 自動で修正できる差分を書き込み、残りの差分を返却 */
+export declare function sync(root: string, options?: {
+    stop?: boolean;
+}): Drift[];

package/dist/files.js

@@ -0,0 +1,70 @@
+// 利用側のリポにある共通ファイルの同期・検査
+// - マスタ: パッケージの `files/`（npm は `.gitignore` を同梱しない → 先頭の `.` を除いた名前で格納）
+// - 比較は改行コードを LF に正規化（Windows の作業ツリーは CRLF になりうる）
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { hasStop, managedSettings } from "./settings.js";
+const FILES = [
+    { from: 'editorconfig', to: '.editorconfig' },
+    { from: 'gitattributes', to: '.gitattributes' },
+    { from: 'gitignore', to: '.gitignore' },
+    { from: 'gitleaks.toml', to: '.gitleaks.toml' },
+    { from: 'mise.toml', to: 'mise.toml' },
+    { from: 'dependabot.yaml', to: '.github/dependabot.yaml' },
+    { from: 'commit-msg', to: '.githooks/commit-msg', mode: 0o755 },
+];
+const SETTINGS = '.claude/settings.json';
+const WORKSPACE = 'pnpm-workspace.yaml';
+/** CLAUDE.md で共通の規約を読み込む import */
+export const IMPORT = '@node_modules/@ryusenkei/conventions/rules.md';
+// `.github/dependabot.yaml` の `cooldown` と同値
+const RELEASE_AGE = [
+    '# 公開から2日未満のバージョンは解決しない（`.github/dependabot.yaml` の `cooldown` と同値）',
+    'minimumReleaseAge: 2880',
+    'minimumReleaseAgeExclude:',
+    '  - "@ryusenkei/*"',
+];
+const lf = (s) => s.replaceAll('\r\n', '\n');
+const read = (path) => (existsSync(path) ? lf(readFileSync(path, 'utf8')) : undefined);
+/** マスタとの差分 */
+export function drifts(root, options = {}) {
+    const out = [];
+    for (const f of FILES) {
+        const expected = lf(readFileSync(new URL(`../files/${f.from}`, import.meta.url), 'utf8'));
+        if (read(join(root, f.to)) !== expected)
+            out.push({ path: f.to, expected, message: 'マスタと不一致' });
+    }
+    const raw = read(join(root, SETTINGS));
+    const current = raw === undefined ? {} : JSON.parse(raw);
+    const settings = `${JSON.stringify(managedSettings(current, { stop: options.stop ?? hasStop(current) }), null, 2)}\n`;
+    if (raw !== settings)
+        out.push({ path: SETTINGS, expected: settings, message: 'hook・`attribution`・`permissions.deny` が不一致' });
+    const workspace = read(join(root, WORKSPACE)) ?? '';
+    if (!workspace.includes(RELEASE_AGE.slice(1).join('\n'))) {
+        if (/^minimumReleaseAge/m.test(workspace))
+            out.push({ path: WORKSPACE, message: `\`minimumReleaseAge\`・\`minimumReleaseAgeExclude\` を次の値に修正\n${RELEASE_AGE.join('\n')}` });
+        else
+            out.push({ path: WORKSPACE, expected: `${workspace.trimEnd()}\n\n${RELEASE_AGE.join('\n')}\n`, message: '`minimumReleaseAge` が未設定' });
+    }
+    const claude = read(join(root, 'CLAUDE.md')) ?? '';
+    if (!claude.split('\n').some((l) => l.trim() === IMPORT))
+        out.push({ path: 'CLAUDE.md', message: `共通の規約の import（\`${IMPORT}\`）を追加` });
+    return out;
+}
+/** 自動で修正できる差分を書き込み、残りの差分を返却 */
+export function sync(root, options = {}) {
+    const rest = [];
+    for (const d of drifts(root, options)) {
+        if (d.expected === undefined) {
+            rest.push(d);
+            continue;
+        }
+        const path = join(root, d.path);
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, d.expected);
+        const mode = FILES.find((f) => f.to === d.path)?.mode;
+        if (mode)
+            chmodSync(path, mode);
+    }
+    return rest;
+}

package/dist/hook.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/hook.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// Claude Code の hook（`.claude/settings.json` から `node` で直接実行）
+// - PreToolUse: 規約に反するツールの実行を拒否 → 終了コード2・理由は stderr
+// - Stop: 変更があれば `pnpm lint`・`pnpm test` を実行し、失敗時は完了を差し戻し
+// - hook 自体の失敗は終了コード1（拒否にしない → 作業を継続）
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { denyReason } from "./policy.js";
+const input = JSON.parse(readFileSync(0, 'utf8'));
+const root = process.env.CLAUDE_PROJECT_DIR ?? input.cwd ?? process.cwd();
+// Windows の `pnpm` は `.cmd` → シェル経由でのみ起動可能
+const shell = process.platform === 'win32';
+if (input.hook_event_name === 'PreToolUse') {
+    const reason = denyReason(input, { titleIssues, readFile });
+    if (reason) {
+        process.stderr.write(`${reason}\n`);
+        process.exit(2);
+    }
+}
+else if (input.hook_event_name === 'Stop') {
+    stop();
+}
+// PR のタイトル = squash のコミットのメッセージ → prose-lint のコミットの規則で検査（リポの `prose-lint.json` を反映）
+function titleIssues(title) {
+    const dir = mkdtempSync(join(tmpdir(), 'conventions-'));
+    try {
+        const file = join(dir, 'title');
+        writeFileSync(file, `${title}\n`);
+        const cli = fileURLToPath(new URL('./cli.js', import.meta.resolve('@ryusenkei/prose-lint')));
+        const r = spawnSync(process.execPath, [cli, '--commit-msg', file], { cwd: root, encoding: 'utf8' });
+        return r.status === 0 ? [] : [`${r.stdout}${r.stderr}`.trim()];
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+function readFile(path) {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+// 差し戻しは1回まで（`stop_hook_active` = 差し戻し後の再実行）→ 解消できない失敗で停止しない状態を防止
+function stop() {
+    if (input.stop_hook_active)
+        return;
+    const status = spawnSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8' });
+    if (!status.stdout?.trim())
+        return;
+    for (const script of ['lint', 'test']) {
+        const r = spawnSync('pnpm', [script], { cwd: root, encoding: 'utf8', shell });
+        if (r.status === 0)
+            continue;
+        const tail = `${r.stdout}${r.stderr}`.trim().split('\n').slice(-40).join('\n');
+        console.log(JSON.stringify({ decision: 'block', reason: `\`pnpm ${script}\` が失敗。修正してから完了\n${tail}` }));
+        return;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1 @@
+export { drifts, sync, IMPORT, type Drift } from './files.ts';

package/dist/index.js

@@ -0,0 +1 @@
+export { drifts, sync, IMPORT } from "./files.js";

package/dist/policy.d.ts

@@ -0,0 +1,15 @@
+/** PreToolUse の入力（使用する項目のみ） */
+export type ToolUse = {
+    tool_name: string;
+    tool_input: Record<string, unknown>;
+    cwd?: string;
+};
+/** 判定に必要な外部の処理 */
+export type Context = {
+    /** PR のタイトルの指摘（なければ空配列） */
+    titleIssues: (title: string) => string[];
+    /** ファイルの内容（読み込みの失敗時は `undefined`） */
+    readFile: (path: string) => string | undefined;
+};
+/** 拒否の理由（許可する場合は `undefined`） */
+export declare function denyReason(use: ToolUse, ctx: Context): string | undefined;

package/dist/policy.js

@@ -0,0 +1,93 @@
+// PreToolUse で拒否するツールの実行
+// - 判定は純粋な関数 → 外部の処理（タイトルの検査・ファイルの読み込み）は `Context` で注入
+// - 拒否の理由は Claude に返却 → Claude が修正して再実行
+import { isAbsolute, join } from 'node:path';
+import { commands, option } from "./shell.js";
+const TYPES = ['build', 'chore', 'ci', 'docs', 'feat', 'fix', 'perf', 'refactor', 'revert', 'style', 'test'];
+const BRANCH = new RegExp(`^(${TYPES.join('|')})/[a-z0-9][a-z0-9._-]*$`);
+const EDIT_TOOLS = ['Edit', 'Write', 'MultiEdit', 'NotebookEdit'];
+// pnpm 以外のパッケージ管理の操作（`npm view`・`npm pack`・`npx` などの参照・実行は対象外）
+const NPM_CHANGES = ['install', 'i', 'add', 'ci', 'uninstall', 'un', 'remove', 'rm', 'update', 'up', 'link'];
+// AI の署名: trailer の値に AI の名前・生成元の表記（prose-lint のコミットの規則と同じ対象）
+const AI_TRAILER = /^[\w-]+:.*\b(claude|anthropic|openai|chatgpt|gpt-\d|copilot|gemini|codex|cursor)\b/im;
+const AI_NOTE = /generated (with|by) \[?(claude|chatgpt|copilot|gemini|codex|cursor)|🤖/i;
+// `git branch` の作成以外の操作
+const BRANCH_QUERY = ['-d', '-D', '--delete', '-l', '--list', '-a', '-r', '--all', '--remotes', '-v', '-vv', '--verbose', '--show-current', '--contains', '--no-contains', '--merged', '--no-merged', '-u', '--set-upstream-to', '--unset-upstream', '--edit-description'];
+/** 拒否の理由（許可する場合は `undefined`） */
+export function denyReason(use, ctx) {
+    if (EDIT_TOOLS.includes(use.tool_name)) {
+        const path = String(use.tool_input.file_path ?? use.tool_input.notebook_path ?? '');
+        if (/(^|[\\/])node_modules[\\/]/.test(path))
+            return '`node_modules` は直接編集しない。`@ryusenkei/*` の変更は toolkit のリポで実施';
+        return undefined;
+    }
+    if (use.tool_name !== 'Bash')
+        return undefined;
+    const reasons = commands(String(use.tool_input.command ?? '')).flatMap((words) => commandReasons(words, use.cwd, ctx));
+    return reasons.length ? reasons.join('\n') : undefined;
+}
+function commandReasons(words, cwd, ctx) {
+    const [cmd, ...args] = words;
+    if (cmd === 'yarn' || (cmd === 'npm' && NPM_CHANGES.includes(args[0] ?? '')))
+        return ['パッケージ管理は pnpm のみ（`pnpm add`・`pnpm install` など）'];
+    if (cmd === 'git')
+        return gitReasons(gitArgs(args));
+    if (cmd === 'gh' && args[0] === 'pr')
+        return prReasons(args[1], args.slice(2), cwd, ctx);
+    return [];
+}
+// git の全体のオプション（`-C <path>`・`-c <name=value>` など）を除去
+function gitArgs(args) {
+    let i = 0;
+    while (i < args.length && args[i].startsWith('-'))
+        i += args[i] === '-C' || args[i] === '-c' ? 2 : 1;
+    return args.slice(i);
+}
+function gitReasons([sub, ...args]) {
+    if ((sub === 'commit' || sub === 'push') && args.includes('--no-verify'))
+        return ['フックの省略（`--no-verify`）は禁止'];
+    // `git commit -n` = `--no-verify`（`git push -n` は dry run）
+    if (sub === 'commit' && args.some((a) => /^-[a-zA-Z]*n[a-zA-Z]*$/.test(a)))
+        return ['フックの省略（`-n`）は禁止'];
+    const name = newBranch(sub, args);
+    if (name !== undefined && !BRANCH.test(name))
+        return [`ブランチ名は \`<type>/<内容>\`（type = ${TYPES.join('・')}、内容 = 英小文字・数字・\`-\`）: \`${name}\``];
+    return [];
+}
+// 作成・リネームするブランチの名前
+function newBranch(sub, args) {
+    const positionals = args.filter((a) => !a.startsWith('-'));
+    switch (sub) {
+        case 'switch':
+            return option(args, ['-c', '-C', '--create', '--force-create']);
+        case 'checkout':
+            return option(args, ['-b', '-B']);
+        case 'worktree':
+            return args[0] === 'add' ? option(args, ['-b', '-B']) : undefined;
+        case 'branch':
+            if (args.some((a) => BRANCH_QUERY.includes(a)))
+                return undefined;
+            if (args.some((a) => ['-m', '-M', '--move', '-c', '-C', '--copy'].includes(a)))
+                return positionals.at(-1);
+            return positionals[0];
+        default:
+            return undefined;
+    }
+}
+function prReasons(sub, args, cwd, ctx) {
+    if (sub === 'merge' && args.some((a) => a === '--merge' || a === '--rebase' || a === '-m' || a === '-r'))
+        return ['マージは squash のみ（`--squash`）'];
+    if (sub !== 'create' && sub !== 'edit')
+        return [];
+    const reasons = [];
+    const title = option(args, ['--title', '-t']);
+    if (title === undefined && sub === 'create')
+        reasons.push('PR のタイトルを `--title` で指定（`main` のコミットのメッセージになるため検査）');
+    if (title !== undefined)
+        reasons.push(...ctx.titleIssues(title).map((i) => `PR のタイトル: ${i}`));
+    const file = option(args, ['--body-file', '-F']);
+    const body = [option(args, ['--body', '-b']), file && file !== '-' ? ctx.readFile(isAbsolute(file) || !cwd ? file : join(cwd, file)) : undefined].join('\n');
+    if (AI_TRAILER.test(body) || AI_NOTE.test(body))
+        reasons.push('PR の本文に AI の署名を付けない');
+    return reasons;
+}

package/dist/settings.d.ts

@@ -0,0 +1,27 @@
+type Hook = {
+    type: string;
+    command: string;
+    args?: string[];
+};
+type Group = {
+    matcher?: string;
+    hooks: Hook[];
+};
+/** `.claude/settings.json`（使用する項目のみ型付け） */
+export type Settings = {
+    hooks?: Record<string, Group[]>;
+    permissions?: {
+        deny?: string[];
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+/** hook の本体のパス（`node` で直接実行 → Windows でもシェルを経由しない） */
+export declare const HOOK_PATH = "${CLAUDE_PROJECT_DIR}/node_modules/@ryusenkei/conventions/dist/hook.js";
+/** Stop の hook（完了前の lint・test）が登録済みか */
+export declare const hasStop: (s: Settings) => boolean;
+/** 管理する項目を適用した設定 */
+export declare function managedSettings(current: Settings, options: {
+    stop: boolean;
+}): Settings;
+export {};

package/dist/settings.js

@@ -0,0 +1,32 @@
+// `.claude/settings.json` の管理する項目
+// - hook の登録・`attribution`・`permissions.deny`
+// - リポ独自の設定・hook は維持
+/** hook の本体のパス（`node` で直接実行 → Windows でもシェルを経由しない） */
+export const HOOK_PATH = '${CLAUDE_PROJECT_DIR}/node_modules/@ryusenkei/conventions/dist/hook.js';
+const HOOK = { type: 'command', command: 'node', args: [HOOK_PATH] };
+const PROSE_LINT = { type: 'command', command: 'npx --no -- prose-lint --hook' };
+// 秘密値のファイル（`.env.example` は対象外 → `.env.*` の指定は不可）
+const DENY = ['Read(./**/.env)', 'Read(./**/.dev.vars)'];
+const owned = (h) => (h.command === 'node' && h.args?.[0] === HOOK_PATH) || h.command.includes('prose-lint --hook');
+/** Stop の hook（完了前の lint・test）が登録済みか */
+export const hasStop = (s) => (s.hooks?.Stop ?? []).some((g) => g.hooks.some(owned));
+/** 管理する項目を適用した設定 */
+export function managedSettings(current, options) {
+    const hooks = {};
+    for (const [event, groups] of Object.entries(current.hooks ?? {})) {
+        const kept = groups.map((g) => ({ ...g, hooks: g.hooks.filter((h) => !owned(h)) })).filter((g) => g.hooks.length);
+        if (kept.length)
+            hooks[event] = kept;
+    }
+    hooks.PreToolUse = [...(hooks.PreToolUse ?? []), { matcher: 'Bash|Edit|Write|MultiEdit|NotebookEdit', hooks: [HOOK] }];
+    hooks.PostToolUse = [...(hooks.PostToolUse ?? []), { matcher: 'Edit|Write|MultiEdit', hooks: [PROSE_LINT] }];
+    if (options.stop)
+        hooks.Stop = [...(hooks.Stop ?? []), { hooks: [HOOK] }];
+    const deny = [...new Set([...(current.permissions?.deny ?? []), ...DENY])];
+    return {
+        ...current,
+        attribution: { commit: '', pr: '', sessionUrl: false },
+        permissions: { ...current.permissions, deny },
+        hooks,
+    };
+}

package/dist/shell.d.ts

@@ -0,0 +1,4 @@
+/** コマンド文字列をコマンドごとの語の配列に分解 */
+export declare function commands(line: string): string[][];
+/** オプションの値（`--name value`・`--name=value`・`-n value`）→ 指定がなければ `undefined` */
+export declare function option(words: string[], names: string[]): string | undefined;

package/dist/shell.js

@@ -0,0 +1,75 @@
+// シェルのコマンド文字列の簡易な分解（hook の判定用）
+// - 区切り: `&&`・`||`・`;`・`|`・`&`・改行 → コマンドごとの語の配列
+// - 解釈: 引用符（`'`・`"`）とバックスラッシュ → 変数・コマンド置換は展開しない
+// - 先頭の `NAME=value`（環境変数の指定）は除去
+/** コマンド文字列をコマンドごとの語の配列に分解 */
+export function commands(line) {
+    const out = [];
+    let words = [];
+    let word = '';
+    // 空の引用符（`""`）も1語
+    let has = false;
+    let quote;
+    const endWord = () => {
+        if (has)
+            words.push(word);
+        word = '';
+        has = false;
+    };
+    const endCommand = () => {
+        endWord();
+        const start = words.findIndex((w) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(w));
+        if (start !== -1)
+            out.push(words.slice(start));
+        words = [];
+    };
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (quote) {
+            if (c === quote)
+                quote = undefined;
+            else if (c === '\\' && quote === '"' && '"\\$`'.includes(line[i + 1] ?? ''))
+                word += line[++i];
+            else
+                word += c;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            quote = c;
+            has = true;
+        }
+        else if (c === '\\' && i + 1 < line.length) {
+            const next = line[++i];
+            if (next !== '\n') {
+                word += next;
+                has = true;
+            }
+        }
+        else if (c === ' ' || c === '\t') {
+            endWord();
+        }
+        else if (c === '\n' || c === ';' || c === '&' || c === '|') {
+            endCommand();
+            if ((c === '&' || c === '|') && line[i + 1] === c)
+                i++;
+        }
+        else {
+            word += c;
+            has = true;
+        }
+    }
+    endCommand();
+    return out;
+}
+/** オプションの値（`--name value`・`--name=value`・`-n value`）→ 指定がなければ `undefined` */
+export function option(words, names) {
+    for (let i = 0; i < words.length; i++) {
+        const w = words[i];
+        if (names.includes(w))
+            return words[i + 1];
+        const long = names.find((n) => n.startsWith('--') && w.startsWith(`${n}=`));
+        if (long)
+            return w.slice(long.length + 1);
+    }
+    return undefined;
+}

package/files/commit-msg

@@ -0,0 +1,3 @@
+#!/bin/sh
+# コミットメッセージの文体の検査（規則 = @ryusenkei/prose-lint）
+exec npx --no -- prose-lint --commit-msg "$1"

package/files/dependabot.yaml

@@ -0,0 +1,40 @@
+version: 2
+updates:
+  # npm（pnpm ワークスペース）。ルートの1件で apps/*・packages/* を横断
+  - package-ecosystem: npm
+    directory: "/"
+    # 毎日（自社のパッケージの新しいバージョンをすぐ取り込むため）
+    schedule:
+      interval: daily
+    # 公開直後のバージョンは配布ファイルの反映待ちでインストールに失敗しうる → 2日待つ。自社のパッケージは待たない
+    cooldown:
+      default-days: 2
+      exclude:
+        - "@ryusenkei/*"
+    commit-message:
+      prefix: build
+      include: scope
+    groups:
+      # 自社のパッケージは単独の PR（先に一致したグループに入る）
+      ryusenkei:
+        patterns:
+          - "@ryusenkei/*"
+      # minor・patch は1つの PR にまとめる（major は個別の PR でレビュー）
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 10
+
+  # GitHub Actions（.github/workflows のアクション）
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+      include: scope
+    groups:
+      actions:
+        patterns:
+          - "*"

package/files/editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

package/files/gitattributes

@@ -0,0 +1,2 @@
+# 改行は LF に統一（OS による差分・警告を防止。フックは CRLF だと sh で動かない）
+* text=auto eol=lf

package/files/gitignore

@@ -0,0 +1,46 @@
+# リポ全体の除外。パッケージ・アプリ固有のものは各階層の .gitignore（apps/site・infra）
+
+# ---- 依存 ----
+node_modules/
+.pnpm-store/
+
+# ---- ビルド・生成物 ----
+dist/
+build/
+coverage/
+*.tsbuildinfo
+.astro/
+.wrangler/
+
+# ---- 秘密値（コミット禁止。雛形の .env.example のみ追跡） ----
+.env
+.env.*
+!.env.example
+.dev.vars
+.dev.vars.*
+*.pem
+*.key
+
+# ---- ログ ----
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# ---- OS ----
+.DS_Store
+Thumbs.db
+desktop.ini
+
+# ---- エディタ・IDE ----
+.idea/
+.vscode/
+*.code-workspace
+*.swp
+*~
+
+# ---- Claude Code（skills は追跡） ----
+.claude/worktrees/
+.claude/settings.local.json
+
+# ---- 作業用の一時ファイル（一回限りのスクリプトなど） ----
+.tmp/

package/files/gitleaks.toml

@@ -0,0 +1,9 @@
+# gitleaks の設定。既定の規則に加え、公開してよい既知の値を除外
+[extend]
+useDefault = true
+
+[allowlist]
+description = "公開してよい雛形（秘密値ではない）"
+paths = [
+  '''.*\.example$''',
+]

package/files/mise.toml

@@ -0,0 +1,4 @@
+# ツールのバージョン（pnpm は package.json の packageManager で固定）
+[tools]
+node = "24"
+terraform = "1"

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@ryusenkei/conventions",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.2",
+  "description": "RYUSENKEI のモノリポの共通の規約（Claude Code の規約・hook、共通ファイルの同期）",
+  "license": "MIT",
+  "author": "RYUSENKEI",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ryusenkei-inc/toolkit.git",
+    "directory": "packages/conventions"
+  },
+  "homepage": "https://github.com/ryusenkei-inc/toolkit/tree/main/packages/conventions",
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "ryusenkei-conventions": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "files",
+    "rules.md"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@ryusenkei/prose-lint": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.1",
+    "typescript": "^5.9.3"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit"
+  }
 }

package/rules.md

@@ -0,0 +1,41 @@
+## コード
+
+- 構成: パッケージの責務・依存は README の構成の表に準拠
+- 共有: リポ内は `packages/*`、リポ間は toolkit（npm の `@ryusenkei/*`）。`@ryusenkei/*` の変更は toolkit で実施
+- エントリポイント: パッケージごとに `src/index.ts`。export は外部で使用するものだけ・他パッケージの再 export なし
+- TypeScript: ビルドせず Node で直接実行（`node scripts/x.ts`）
+- テスト: Vitest。対象と同じディレクトリに `*.test.ts`
+- 子プロセス: `scripts/lib/exec.ts` の `exec`（Windows の `.cmd` に対応）
+- 依存の更新: Dependabot の PR で実施
+
+## 設定・秘密値
+
+- 秘密値: ルート `.env` に集約。配信は `pnpm env:push` に一本化
+- `*.tfvars`・Terraform の state: コミット禁止
+- `.env.example`: 変数の追加時は `scripts/env.ts` の `TARGETS` にも定義
+- 環境変数を付けた実行: `node scripts/env.ts run NAME=value <cmd>`（`NAME=value cmd` は Windows で不可）
+- YAML の拡張子: `.yaml`（pnpm のファイルと統一）
+- 共通ファイル（`.editorconfig`・`.github/dependabot.yaml`・`.claude/settings.json` など）: `@ryusenkei/conventions` のマスタから同期。直接編集しない
+  - 変更は toolkit で実施し、`ryusenkei-conventions sync` で反映
+
+## 記述内容（コード・コメント・ドキュメント共通）
+
+- コメント: 非自明な理由・制約のみ。処理の内容はコードの名前で表現
+- 変更の経緯: コメントに書かず PR に記載
+- `export` する関数・型・定数: JSDoc
+- 個人名: 記載禁止（コード・コメント・ドキュメント・設定値すべて）
+
+## 文体（Markdown・コメント共通）
+
+- 散文より構造化（表・箇条書き・キー: 値）
+- ドメインの概念・説明・表示文字列は日本語
+- 文体の指摘（`prose-lint`）がドメインの用語に該当する場合: `prose-lint.json` の `allow`・`vocabulary` に追加
+
+## PR
+
+- 本文: 背景・変更・検証
+
+## 完了の条件
+
+- `pnpm lint`（型検査・prose-lint・共通ファイルの検査）と `pnpm test` が通過
+- README の構成・コマンドの記述が変更と一致