@stella-studio/ck 1.0.0

package/.claude/hooks/scout-block/pattern-matcher.cjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+/**
+ * pattern-matcher.cjs - Gitignore-spec compliant pattern matching
+ *
+ * Uses 'ignore' package for .ckignore parsing and path matching.
+ * Supports negation patterns (!) for allowlisting.
+ */
+
+const Ignore = require('./vendor/ignore.cjs');
+const fs = require('fs');
+const path = require('path');
+
+// Default patterns if .ckignore doesn't exist or is empty
+// Only includes directories with HEAVY file counts (1000+ files typical)
+const DEFAULT_PATTERNS = [
+  // JavaScript/TypeScript - package dependencies & build outputs
+  'node_modules',
+  'dist',
+  'build',
+  '.next',
+  '.nuxt',
+  // Python - virtualenvs & cache
+  '__pycache__',
+  '.venv',
+  'venv',
+  // Go/PHP - vendor dependencies
+  'vendor',
+  // Rust/Java - compiled outputs
+  'target',
+  // Version control
+  '.git',
+  // Test coverage (can be large with reports)
+  'coverage',
+];
+
+/**
+ * Load patterns from .ckignore file
+ * Falls back to DEFAULT_PATTERNS if file doesn't exist or is empty
+ *
+ * @param {string} ckignorePath - Path to .ckignore file
+ * @returns {string[]} Array of patterns
+ */
+function loadPatterns(ckignorePath) {
+  if (!ckignorePath || !fs.existsSync(ckignorePath)) {
+    return DEFAULT_PATTERNS;
+  }
+
+  try {
+    const content = fs.readFileSync(ckignorePath, 'utf-8');
+    const patterns = content
+      .split('\n')
+      .map(line => line.trim())
+      .filter(line => line && !line.startsWith('#'));
+
+    return patterns.length > 0 ? patterns : DEFAULT_PATTERNS;
+  } catch (error) {
+    console.error('WARN: Failed to read .ckignore:', error.message);
+    return DEFAULT_PATTERNS;
+  }
+}
+
+/**
+ * Create a matcher from patterns
+ * Normalizes patterns to match anywhere in the path tree
+ *
+ * @param {string[]} patterns - Array of patterns from .ckignore
+ * @returns {Object} Matcher object with ig instance and pattern info
+ */
+function createMatcher(patterns) {
+  const ig = Ignore();
+
+  // Normalize patterns to match anywhere in path tree
+  // e.g., "node_modules" becomes "**\/node_modules" and "**\/node_modules/**"
+  const normalizedPatterns = [];
+
+  for (const p of patterns) {
+    if (p.startsWith('!')) {
+      // Negation pattern - un-ignore
+      const inner = p.slice(1);
+      if (inner.includes('/') || inner.includes('*')) {
+        // Already has path or glob - use as-is
+        normalizedPatterns.push(p);
+      } else {
+        // Simple dir name - match anywhere
+        normalizedPatterns.push(`!**/${inner}`);
+        normalizedPatterns.push(`!**/${inner}/**`);
+      }
+    } else {
+      // Block pattern
+      if (p.includes('/') || p.includes('*')) {
+        // Already has path or glob - use as-is
+        normalizedPatterns.push(p);
+      } else {
+        // Simple dir name - match the dir and contents anywhere
+        normalizedPatterns.push(`**/${p}`);
+        normalizedPatterns.push(`**/${p}/**`);
+        // Also match at root
+        normalizedPatterns.push(p);
+        normalizedPatterns.push(`${p}/**`);
+      }
+    }
+  }
+
+  ig.add(normalizedPatterns);
+
+  return {
+    ig,
+    patterns: normalizedPatterns,
+    original: patterns
+  };
+}
+
+/**
+ * Check if a path should be blocked
+ *
+ * @param {Object} matcher - Matcher object from createMatcher
+ * @param {string} testPath - Path to test
+ * @returns {Object} { blocked: boolean, pattern?: string }
+ */
+function matchPath(matcher, testPath) {
+  if (!testPath || typeof testPath !== 'string') {
+    return { blocked: false };
+  }
+
+  // Normalize path separators (Windows backslash to forward slash)
+  let normalized = testPath.replace(/\\/g, '/');
+
+  // Remove leading ./ if present
+  if (normalized.startsWith('./')) {
+    normalized = normalized.slice(2);
+  }
+
+  // Check if path is ignored (blocked)
+  const blocked = matcher.ig.ignores(normalized);
+
+  if (blocked) {
+    // Find which original pattern matched for error message
+    const matchedPattern = findMatchingPattern(matcher.original, normalized);
+    return { blocked: true, pattern: matchedPattern };
+  }
+
+  return { blocked: false };
+}
+
+/**
+ * Find which original pattern matched (for error messages)
+ *
+ * @param {string[]} originalPatterns - Original patterns from .ckignore
+ * @param {string} path - The path that was blocked
+ * @returns {string} The pattern that matched
+ */
+function findMatchingPattern(originalPatterns, path) {
+  for (const p of originalPatterns) {
+    if (p.startsWith('!')) continue; // Skip negations
+
+    // Simple substring check for common cases
+    const pattern = p.replace(/\*\*/g, '').replace(/\*/g, '');
+    if (pattern && path.includes(pattern)) {
+      return p;
+    }
+
+    // For more complex patterns, use ignore to test individually
+    const tempIg = Ignore();
+    if (p.includes('/') || p.includes('*')) {
+      tempIg.add(p);
+    } else {
+      tempIg.add([`**/${p}`, `**/${p}/**`, p, `${p}/**`]);
+    }
+
+    if (tempIg.ignores(path)) {
+      return p;
+    }
+  }
+
+  return originalPatterns.find(p => !p.startsWith('!')) || 'unknown';
+}
+
+module.exports = {
+  loadPatterns,
+  createMatcher,
+  matchPath,
+  findMatchingPattern,
+  DEFAULT_PATTERNS
+};

package/.claude/hooks/scout-block/tests/test-broad-pattern-detector.cjs

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+/**
+ * test-broad-pattern-detector.cjs - Unit tests for broad pattern detection
+ *
+ * Tests the detection of overly broad glob patterns that would fill context.
+ */
+
+const {
+  isBroadPattern,
+  hasSpecificDirectory,
+  isHighLevelPath,
+  detectBroadPatternIssue,
+  suggestSpecificPatterns
+} = require('../broad-pattern-detector.cjs');
+
+// === isBroadPattern tests ===
+const broadPatternTests = [
+  // Should be detected as broad - TypeScript/JavaScript
+  { pattern: '**/*', expected: true, desc: 'all files everywhere' },
+  { pattern: '**', expected: true, desc: 'double star alone' },
+  { pattern: '*', expected: true, desc: 'single star alone' },
+  { pattern: '**/.*', expected: true, desc: 'all dotfiles' },
+
+  // Should NOT be detected as broad (specific)
+  { pattern: 'package.json', expected: false, desc: 'specific file' },
+  { pattern: 'src/index.ts', expected: false, desc: 'specific file path' },
+  { pattern: null, expected: false, desc: 'null pattern' },
+  { pattern: '', expected: false, desc: 'empty pattern' },
+];
+
+// === isHighLevelPath tests ===
+const highLevelPathTests = [
+  // High level (risky)
+  { path: null, expected: true, desc: 'null path (uses CWD)' },
+  { path: undefined, expected: true, desc: 'undefined path' },
+  { path: '.', expected: true, desc: 'current directory' },
+  { path: './', expected: true, desc: 'current directory with slash' },
+  { path: '', expected: true, desc: 'empty path' },
+  { path: '/home/user/worktrees/myproject', expected: true, desc: 'worktree root' },
+  { path: 'myproject', expected: true, desc: 'single directory' },
+
+  // Specific (OK)
+  { path: 'src/components', expected: false, desc: 'nested in src' },
+  { path: 'lib/utils', expected: false, desc: 'nested in lib' },
+  { path: 'packages/web/src', expected: false, desc: 'monorepo src' },
+  { path: '/home/user/project/src', expected: false, desc: 'absolute with src' },
+];
+
+// === detectBroadPatternIssue integration tests ===
+const integrationTests = [
+  // Should BLOCK
+  {
+    input: { pattern: '**/*.ts' },
+    expected: true,
+    desc: 'broad pattern, no path'
+  },
+  {
+    input: { pattern: '**/*.{ts,tsx}', path: '/home/user/worktrees/myproject' },
+    expected: true,
+    desc: 'broad pattern at worktree'
+  },
+  {
+    input: { pattern: '**/*', path: '.' },
+    expected: true,
+    desc: 'all files at current dir'
+  },
+  {
+    input: { pattern: '**/index.ts', path: 'myproject' },
+    expected: true,
+    desc: 'all index.ts at shallow path'
+  },
+
+  // Should ALLOW
+  {
+    input: { pattern: 'src/**/*.ts' },
+    expected: false,
+    desc: 'scoped to src'
+  },
+  {
+    input: { pattern: '**/*.ts', path: 'src/components' },
+    expected: false,
+    desc: 'broad pattern but specific path'
+  },
+  {
+    input: { pattern: 'package.json' },
+    expected: false,
+    desc: 'specific file'
+  },
+  {
+    input: { pattern: 'lib/**/*.js', path: '/home/user/project' },
+    expected: false,
+    desc: 'scoped pattern'
+  },
+  {
+    input: {},
+    expected: false,
+    desc: 'no pattern'
+  },
+  {
+    input: null,
+    expected: false,
+    desc: 'null input'
+  },
+];
+
+// Run tests
+console.log('Testing broad-pattern-detector module...\n');
+let passed = 0;
+let failed = 0;
+
+// Test isBroadPattern
+console.log('\x1b[1m--- isBroadPattern ---\x1b[0m');
+for (const test of broadPatternTests) {
+  const result = isBroadPattern(test.pattern);
+  const success = result === test.expected;
+  if (success) {
+    console.log(`\x1b[32m✓\x1b[0m ${test.desc}: "${test.pattern}" -> ${result ? 'BROAD' : 'OK'}`);
+    passed++;
+  } else {
+    console.log(`\x1b[31m✗\x1b[0m ${test.desc}: expected ${test.expected ? 'BROAD' : 'OK'}, got ${result ? 'BROAD' : 'OK'}`);
+    failed++;
+  }
+}
+
+// Test isHighLevelPath
+console.log('\n\x1b[1m--- isHighLevelPath ---\x1b[0m');
+for (const test of highLevelPathTests) {
+  const result = isHighLevelPath(test.path);
+  const success = result === test.expected;
+  if (success) {
+    console.log(`\x1b[32m✓\x1b[0m ${test.desc}: "${test.path}" -> ${result ? 'HIGH_LEVEL' : 'SPECIFIC'}`);
+    passed++;
+  } else {
+    console.log(`\x1b[31m✗\x1b[0m ${test.desc}: expected ${test.expected ? 'HIGH_LEVEL' : 'SPECIFIC'}, got ${result ? 'HIGH_LEVEL' : 'SPECIFIC'}`);
+    failed++;
+  }
+}
+
+// Test integration
+console.log('\n\x1b[1m--- detectBroadPatternIssue (integration) ---\x1b[0m');
+for (const test of integrationTests) {
+  const result = detectBroadPatternIssue(test.input);
+  const success = result.blocked === test.expected;
+  if (success) {
+    console.log(`\x1b[32m✓\x1b[0m ${test.desc} -> ${result.blocked ? 'BLOCKED' : 'ALLOWED'}`);
+    passed++;
+  } else {
+    console.log(`\x1b[31m✗\x1b[0m ${test.desc}: expected ${test.expected ? 'BLOCKED' : 'ALLOWED'}, got ${result.blocked ? 'BLOCKED' : 'ALLOWED'}`);
+    failed++;
+  }
+}
+
+// Test suggestions
+console.log('\n\x1b[1m--- suggestSpecificPatterns ---\x1b[0m');
+const suggestions = suggestSpecificPatterns('**/*.ts');
+if (suggestions.length > 0 && suggestions.some(s => s.includes('src/'))) {
+  console.log(`\x1b[32m✓\x1b[0m suggestions for **/*.ts include src-scoped patterns`);
+  passed++;
+} else {
+  console.log(`\x1b[31m✗\x1b[0m suggestions should include src-scoped patterns`);
+  failed++;
+}
+
+console.log(`\n\x1b[1mResults:\x1b[0m ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/.claude/hooks/scout-block/tests/test-build-command-allowlist.cjs

@@ -0,0 +1,137 @@
+#!/usr/bin/env node
+/**
+ * test-build-command-allowlist.cjs - Tests for build command allowlist patterns
+ *
+ * Tests that build commands from various languages/tools are properly recognized
+ * and allowed (bypassing path blocking).
+ */
+
+// Replicate the patterns from scout-block.cjs
+const BUILD_COMMAND_PATTERN = /^(npm|pnpm|yarn|bun)\s+([^\s]+\s+)*(run\s+)?(build|test|lint|dev|start|install|ci|add|remove|update|publish|pack|init|create|exec)/;
+const TOOL_COMMAND_PATTERN = /^(\.\/)?(npx|pnpx|bunx|tsc|esbuild|vite|webpack|rollup|turbo|nx|jest|vitest|mocha|eslint|prettier|go|cargo|make|mvn|mvnw|gradle|gradlew|dotnet|docker|podman|kubectl|helm|terraform|ansible|bazel|cmake|sbt|flutter|swift|ant|ninja|meson)/;
+
+function isBuildCommand(command) {
+  if (!command || typeof command !== 'string') return false;
+  const trimmed = command.trim();
+  return BUILD_COMMAND_PATTERN.test(trimmed) || TOOL_COMMAND_PATTERN.test(trimmed);
+}
+
+const tests = [
+  // JS/Node package managers - should be allowed
+  { cmd: 'npm run build', expected: true, desc: 'npm run build' },
+  { cmd: 'npm build', expected: true, desc: 'npm build' },
+  { cmd: 'pnpm build', expected: true, desc: 'pnpm build' },
+  { cmd: 'yarn build', expected: true, desc: 'yarn build' },
+  { cmd: 'bun build', expected: true, desc: 'bun build' },
+  { cmd: 'npm install', expected: true, desc: 'npm install' },
+  { cmd: 'pnpm --filter web run build', expected: true, desc: 'pnpm with filter' },
+  { cmd: 'yarn workspace app build', expected: true, desc: 'yarn workspace build' },
+
+  // JS tools - should be allowed
+  { cmd: 'npx tsc', expected: true, desc: 'npx tsc' },
+  { cmd: 'tsc --build', expected: true, desc: 'tsc --build' },
+  { cmd: 'esbuild src/index.ts', expected: true, desc: 'esbuild' },
+  { cmd: 'vite build', expected: true, desc: 'vite build' },
+  { cmd: 'webpack', expected: true, desc: 'webpack' },
+  { cmd: 'turbo run build', expected: true, desc: 'turbo run build' },
+  { cmd: 'nx build app', expected: true, desc: 'nx build' },
+
+  // Go - should be allowed (THE BUG FIX)
+  { cmd: 'go build ./...', expected: true, desc: 'go build ./...' },
+  { cmd: 'go build -o app main.go', expected: true, desc: 'go build with flags' },
+  { cmd: 'go test ./...', expected: true, desc: 'go test' },
+  { cmd: 'go run main.go', expected: true, desc: 'go run' },
+  { cmd: 'go mod tidy', expected: true, desc: 'go mod tidy' },
+  { cmd: 'go install', expected: true, desc: 'go install' },
+
+  // Rust/Cargo - should be allowed
+  { cmd: 'cargo build', expected: true, desc: 'cargo build' },
+  { cmd: 'cargo build --release', expected: true, desc: 'cargo build --release' },
+  { cmd: 'cargo test', expected: true, desc: 'cargo test' },
+  { cmd: 'cargo run', expected: true, desc: 'cargo run' },
+
+  // Make - should be allowed
+  { cmd: 'make', expected: true, desc: 'make' },
+  { cmd: 'make build', expected: true, desc: 'make build' },
+  { cmd: 'make clean', expected: true, desc: 'make clean' },
+  { cmd: 'make -j4', expected: true, desc: 'make -j4' },
+
+  // Java/Maven/Gradle - should be allowed
+  { cmd: 'mvn clean install', expected: true, desc: 'mvn clean install' },
+  { cmd: 'mvn package', expected: true, desc: 'mvn package' },
+  { cmd: 'gradle build', expected: true, desc: 'gradle build' },
+  { cmd: 'gradle test', expected: true, desc: 'gradle test' },
+
+  // Maven/Gradle wrappers - should be allowed (NEW)
+  { cmd: './gradlew build', expected: true, desc: './gradlew build' },
+  { cmd: './gradlew clean test', expected: true, desc: './gradlew clean test' },
+  { cmd: 'gradlew build', expected: true, desc: 'gradlew build (no ./)' },
+  { cmd: './mvnw clean install', expected: true, desc: './mvnw clean install' },
+  { cmd: './mvnw package', expected: true, desc: './mvnw package' },
+  { cmd: 'mvnw clean install', expected: true, desc: 'mvnw clean install (no ./)' },
+
+  // .NET - should be allowed
+  { cmd: 'dotnet build', expected: true, desc: 'dotnet build' },
+  { cmd: 'dotnet run', expected: true, desc: 'dotnet run' },
+  { cmd: 'dotnet test', expected: true, desc: 'dotnet test' },
+
+  // Docker/Container tools - should be allowed
+  { cmd: 'docker build .', expected: true, desc: 'docker build' },
+  { cmd: 'docker build -t myapp .', expected: true, desc: 'docker build with tag' },
+  { cmd: 'docker compose up', expected: true, desc: 'docker compose' },
+  { cmd: 'podman build .', expected: true, desc: 'podman build' },
+
+  // Kubernetes/Infrastructure - should be allowed
+  { cmd: 'kubectl apply -f deploy/', expected: true, desc: 'kubectl apply' },
+  { cmd: 'kubectl get pods', expected: true, desc: 'kubectl get' },
+  { cmd: 'helm install myapp ./chart', expected: true, desc: 'helm install' },
+  { cmd: 'terraform apply', expected: true, desc: 'terraform apply' },
+  { cmd: 'terraform plan', expected: true, desc: 'terraform plan' },
+  { cmd: 'ansible-playbook site.yml', expected: true, desc: 'ansible playbook' },
+
+  // Additional build systems - should be allowed (NEW)
+  { cmd: 'bazel build //...', expected: true, desc: 'bazel build' },
+  { cmd: 'bazel test //...', expected: true, desc: 'bazel test' },
+  { cmd: 'cmake --build .', expected: true, desc: 'cmake build' },
+  { cmd: 'cmake -B build', expected: true, desc: 'cmake configure' },
+  { cmd: 'sbt compile', expected: true, desc: 'sbt compile' },
+  { cmd: 'sbt test', expected: true, desc: 'sbt test' },
+  { cmd: 'flutter build apk', expected: true, desc: 'flutter build apk' },
+  { cmd: 'flutter run', expected: true, desc: 'flutter run' },
+  { cmd: 'swift build', expected: true, desc: 'swift build' },
+  { cmd: 'swift test', expected: true, desc: 'swift test' },
+  { cmd: 'ant build', expected: true, desc: 'ant build' },
+  { cmd: 'ant clean', expected: true, desc: 'ant clean' },
+  { cmd: 'ninja', expected: true, desc: 'ninja' },
+  { cmd: 'ninja -C build', expected: true, desc: 'ninja -C build' },
+  { cmd: 'meson compile', expected: true, desc: 'meson compile' },
+  { cmd: 'meson setup build', expected: true, desc: 'meson setup' },
+
+  // Directory access - should be BLOCKED (not recognized as build commands)
+  { cmd: 'cd build', expected: false, desc: 'cd build (blocked)' },
+  { cmd: 'ls build', expected: false, desc: 'ls build (blocked)' },
+  { cmd: 'cat build/output.js', expected: false, desc: 'cat build file (blocked)' },
+  { cmd: 'cd node_modules', expected: false, desc: 'cd node_modules (blocked)' },
+  { cmd: 'rm -rf dist', expected: false, desc: 'rm -rf dist (blocked)' },
+];
+
+console.log('Testing build command allowlist...\n');
+
+let passed = 0;
+let failed = 0;
+
+for (const test of tests) {
+  const result = isBuildCommand(test.cmd);
+  const success = result === test.expected;
+
+  if (success) {
+    console.log(`\x1b[32m✓\x1b[0m ${test.desc}: ${result}`);
+    passed++;
+  } else {
+    console.log(`\x1b[31m✗\x1b[0m ${test.desc}: expected ${test.expected}, got ${result}`);
+    failed++;
+  }
+}
+
+console.log(`\nResults: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/.claude/hooks/scout-block/tests/test-error-formatter.cjs

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * test-error-formatter.cjs - Unit tests for error-formatter module
+ */
+
+const {
+  formatBlockedError,
+  formatSimpleError,
+  formatMachineError,
+  formatWarning,
+  formatConfigPath,
+  supportsColor,
+  colorize,
+  COLORS
+} = require('../error-formatter.cjs');
+
+let passed = 0;
+let failed = 0;
+
+function test(name, condition) {
+  if (condition) {
+    console.log(`\x1b[32m✓\x1b[0m ${name}`);
+    passed++;
+  } else {
+    console.log(`\x1b[31m✗\x1b[0m ${name}`);
+    failed++;
+  }
+}
+
+console.log('Testing error-formatter module...\n');
+
+// formatConfigPath tests
+console.log('--- formatConfigPath Tests ---');
+test('formatConfigPath with claudeDir', formatConfigPath('/home/user/.claude').includes('.ckignore'));
+test('formatConfigPath without claudeDir', formatConfigPath(null) === '.claude/.ckignore');
+test('formatConfigPath empty string', formatConfigPath('') === '.claude/.ckignore');
+
+// formatBlockedError tests
+console.log('\n--- formatBlockedError Tests ---');
+const blockError = formatBlockedError({
+  path: 'packages/web/node_modules/react',
+  pattern: 'node_modules',
+  tool: 'Bash',
+  claudeDir: '/home/user/project/.claude'
+});
+test('formatBlockedError contains BLOCKED', blockError.includes('BLOCKED'));
+test('formatBlockedError contains path', blockError.includes('packages/web/node_modules/react'));
+test('formatBlockedError contains pattern', blockError.includes('node_modules'));
+test('formatBlockedError contains tool', blockError.includes('Bash'));
+test('formatBlockedError contains fix hint', blockError.includes('!node_modules'));
+
+// Test long path truncation
+const longPath = 'a/'.repeat(50) + 'node_modules/package/index.js';
+const longPathError = formatBlockedError({
+  path: longPath,
+  pattern: 'node_modules',
+  tool: 'Read',
+  claudeDir: '.claude'
+});
+test('formatBlockedError truncates long path', longPathError.includes('...'));
+
+// formatSimpleError tests
+console.log('\n--- formatSimpleError Tests ---');
+const simpleError = formatSimpleError('node_modules', 'packages/web/node_modules');
+test('formatSimpleError contains ERROR', simpleError.includes('ERROR'));
+test('formatSimpleError contains pattern', simpleError.includes('node_modules'));
+test('formatSimpleError contains path', simpleError.includes('packages/web/node_modules'));
+
+// formatMachineError tests
+console.log('\n--- formatMachineError Tests ---');
+const machineError = formatMachineError({
+  path: 'dist/bundle.js',
+  pattern: 'dist',
+  tool: 'Read',
+  claudeDir: '.claude'
+});
+const parsed = JSON.parse(machineError);
+test('formatMachineError is valid JSON', typeof parsed === 'object');
+test('formatMachineError has error field', parsed.error === 'BLOCKED');
+test('formatMachineError has path field', parsed.path === 'dist/bundle.js');
+test('formatMachineError has pattern field', parsed.pattern === 'dist');
+test('formatMachineError has tool field', parsed.tool === 'Read');
+test('formatMachineError has fix field', parsed.fix.includes('!dist'));
+
+// formatWarning tests
+console.log('\n--- formatWarning Tests ---');
+const warning = formatWarning('Test warning message');
+test('formatWarning contains WARN', warning.includes('WARN'));
+test('formatWarning contains message', warning.includes('Test warning message'));
+
+// colorize tests (with forced NO_COLOR)
+console.log('\n--- colorize Tests ---');
+const originalNoColor = process.env.NO_COLOR;
+process.env.NO_COLOR = '1';
+test('colorize respects NO_COLOR', colorize('test', 'red') === 'test');
+delete process.env.NO_COLOR;
+
+// Test COLORS constant exists
+test('COLORS constant has expected keys',
+  'red' in COLORS && 'yellow' in COLORS && 'blue' in COLORS && 'reset' in COLORS
+);
+
+// Restore original NO_COLOR
+if (originalNoColor !== undefined) {
+  process.env.NO_COLOR = originalNoColor;
+}
+
+console.log(`\nResults: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/.claude/hooks/scout-block/tests/test-full-flow-edge-cases.cjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * test-full-flow-edge-cases.cjs - Edge case validation for full hook flow
+ */
+
+const BUILD_COMMAND_PATTERN = /^(npm|pnpm|yarn|bun)\s+([^\s]+\s+)*(run\s+)?(build|test|lint|dev|start|install|ci|add|remove|update|publish|pack|init|create|exec)/;
+const TOOL_COMMAND_PATTERN = /^(npx|pnpx|bunx|tsc|esbuild|vite|webpack|rollup|turbo|nx|jest|vitest|mocha|eslint|prettier|go|cargo|make|mvn|gradle|dotnet)/;
+
+function isBuildCommand(command) {
+  if (!command || typeof command !== 'string') return false;
+  const trimmed = command.trim();
+  return BUILD_COMMAND_PATTERN.test(trimmed) || TOOL_COMMAND_PATTERN.test(trimmed);
+}
+
+console.log('=== FULL FLOW EDGE CASE VALIDATION ===\n');
+
+const tests = [
+  // Should be ALLOWED (bypass path extraction)
+  { cmd: 'go build ./...', expect: true, desc: 'go build basic' },
+  { cmd: 'cargo build', expect: true, desc: 'cargo build basic' },
+  { cmd: 'make build', expect: true, desc: 'make build' },
+  { cmd: 'make -j4', expect: true, desc: 'make with flags' },
+  { cmd: 'mvn clean install', expect: true, desc: 'maven' },
+  { cmd: 'gradle build', expect: true, desc: 'gradle' },
+  { cmd: 'dotnet build', expect: true, desc: 'dotnet' },
+  { cmd: 'npm run build', expect: true, desc: 'npm run build' },
+  { cmd: 'go test ./...', expect: true, desc: 'go test' },
+
+  // Should be BLOCKED (goes through path extraction)
+  { cmd: 'docker build .', expect: false, desc: 'docker build (not in allowlist)' },
+  { cmd: 'cd proj && go build', expect: false, desc: 'chained with cd first' },
+  { cmd: 'GOOS=linux go build', expect: false, desc: 'env var prefix' },
+  { cmd: 'sudo go build', expect: false, desc: 'sudo prefix' },
+  { cmd: 'time go build', expect: false, desc: 'time prefix' },
+  { cmd: 'ls build', expect: false, desc: 'ls build dir' },
+  { cmd: 'cd build', expect: false, desc: 'cd build dir' },
+];
+
+let passed = 0;
+let failed = 0;
+
+for (const t of tests) {
+  const result = isBuildCommand(t.cmd);
+  const success = result === t.expect;
+
+  if (success) {
+    console.log(`\x1b[32m✓\x1b[0m ${t.desc}: "${t.cmd}" → ${result}`);
+    passed++;
+  } else {
+    console.log(`\x1b[31m✗\x1b[0m ${t.desc}: "${t.cmd}" → ${result} (expected ${t.expect})`);
+    failed++;
+  }
+}
+
+console.log(`\nResults: ${passed} passed, ${failed} failed`);
+
+// Additional edge case analysis
+console.log('\n=== EDGE CASES REQUIRING ATTENTION ===\n');
+
+const edgeCases = [
+  { cmd: 'docker build .', issue: 'docker not in TOOL_COMMAND_PATTERN - should it be?' },
+  { cmd: 'cd proj && go build', issue: 'Chained commands: first segment checked, not individual commands' },
+  { cmd: 'GOOS=linux go build', issue: 'Env var prefix breaks regex start anchor' },
+  { cmd: 'php artisan build', issue: 'php/artisan not in patterns' },
+  { cmd: 'bundle exec build', issue: 'ruby bundler not in patterns' },
+];
+
+console.log('Known edge cases that may cause UX issues:\n');
+for (const ec of edgeCases) {
+  const allowed = isBuildCommand(ec.cmd);
+  console.log(`  ${allowed ? '✓' : '⚠'} "${ec.cmd}"`);
+  console.log(`     Issue: ${ec.issue}\n`);
+}
+
+process.exit(failed > 0 ? 1 : 0);