@triflux/core 10.0.3 → 10.25.1

package/hooks/keyword-rules.json

@@ -11,12 +11,7 @@
       "skill": null,
       "action": "suppress_all",
       "priority": 0,
-      "supersedes": [
-        "tfx-multi",
-        "tfx-unified",
-        "tfx-codex",
-        "tfx-gemini"
-      ],
+      "supersedes": ["tfx-multi", "tfx-unified", "tfx-codex", "tfx-gemini"],
       "exclusive": true,
       "state": null,
       "mcp_route": null
@@ -29,7 +24,7 @@
           "flags": "i"
         }
       ],
-      "skill": "tfx-multi",
+      "skill": "tfx-auto",
       "priority": 1,
       "supersedes": [],
       "exclusive": false,
@@ -62,9 +57,7 @@
       ],
       "skill": "tfx-swarm",
       "priority": 1,
-      "supersedes": [
-        "tfx-codex"
-      ],
+      "supersedes": ["tfx-codex"],
       "exclusive": false,
       "state": null,
       "mcp_route": null
@@ -72,15 +65,54 @@
     {
       "id": "tfx-unified",
       "patterns": [
-        { "source": "\\btfx[\\s-]?auto\\b", "flags": "i" },
-        { "source": "\\btfx[\\s-]?auto[\\s-]?codex\\b", "flags": "i" },
-        { "source": "(?:만들어|고쳐|구현해|짜줘|수정해|바꿔)", "flags": "i" },
-        { "source": "(?:리뷰해|검토해|봐줘|괜찮아)", "flags": "i" },
-        { "source": "(?:테스트|검증|돌려봐|QA)", "flags": "i" },
-        { "source": "(?:분석해|계획|설계해)", "flags": "i" },
-        { "source": "(?:찾아봐|조사해|검색해)", "flags": "i" },
-        { "source": "(?:정리해|슬롭|클린업)", "flags": "i" },
-        { "source": "\\b(?:implement|build|fix|review|test|plan|analyze)\\b", "flags": "i" }
+        {
+          "source": "\\btfx[\\s-]?auto\\b",
+          "flags": "i"
+        },
+        {
+          "source": "\\btfx[\\s-]?auto[\\s-]?codex\\b",
+          "flags": "i"
+        },
+        {
+          "source": "(?:만들어|고쳐|구현해|짜줘|수정해|바꿔)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:리뷰해|검토해|봐줘|괜찮아)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:테스트|검증|돌려봐|QA)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:분석해|계획|설계해)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:찾아봐|조사해|검색해)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:정리해|슬롭|클린업)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:병렬|동시에|parallel|concurrent)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:점검|진단|확인해)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:계속해|이어서|진행해)",
+          "flags": "i"
+        },
+        {
+          "source": "\\b(?:implement|build|fix|review|test|plan|analyze)\\b",
+          "flags": "i"
+        }
       ],
       "skill": "tfx-auto",
       "priority": 2,
@@ -97,7 +129,7 @@
           "flags": "i"
         }
       ],
-      "skill": "tfx-codex",
+      "skill": "tfx-auto",
       "priority": 3,
       "supersedes": [],
       "exclusive": false,
@@ -112,7 +144,7 @@
           "flags": "i"
         }
       ],
-      "skill": "tfx-gemini",
+      "skill": "tfx-auto",
       "priority": 3,
       "supersedes": [],
       "exclusive": false,
@@ -172,7 +204,7 @@
           "flags": "i"
         }
       ],
-      "skill": "tfx-autoresearch",
+      "skill": "tfx-research",
       "priority": 2,
       "supersedes": [],
       "exclusive": false,
@@ -187,13 +219,101 @@
           "flags": "i"
         }
       ],
-      "skill": "tfx-deep-interview",
+      "skill": "tfx-interview",
       "priority": 2,
       "supersedes": [],
       "exclusive": false,
       "state": null,
       "mcp_route": null
     },
+    {
+      "id": "wt-tab-route",
+      "patterns": [
+        {
+          "source": "(?:새\\s*탭|탭\\s*(?:새로|추가|생성|열|띄|파|만들))",
+          "flags": "i"
+        },
+        {
+          "source": "(?:패인|화면|pane)\\s*(?:분할|나눠|스플릿|split)",
+          "flags": "i"
+        },
+        {
+          "source": "\\bwt\\b\\s*(?:에\\s*)?(?:탭|tab|열|띄|새)",
+          "flags": "i"
+        },
+        {
+          "source": "(?:터미널|terminal)\\s*(?:탭|새\\s*탭)",
+          "flags": "i"
+        },
+        {
+          "source": "\\b(?:new\\s+tab|split\\s+pane|open\\s+(?:new\\s+)?tab)\\b",
+          "flags": "i"
+        }
+      ],
+      "skill": "tfx-wt",
+      "priority": 1,
+      "supersedes": ["tfx-unified"],
+      "exclusive": false,
+      "state": null,
+      "mcp_route": null
+    },
+    {
+      "id": "wt-tab-rename",
+      "patterns": [
+        {
+          "source": "(?:탭\\s*(?:이름|제목)\\s*(?:바꿔|변경|rename))",
+          "flags": "i"
+        },
+        {
+          "source": "(?:rename\\s+tab|tab\\s+rename)",
+          "flags": "i"
+        }
+      ],
+      "skill": "tfx-wt",
+      "priority": 1,
+      "supersedes": ["tfx-unified"],
+      "exclusive": false,
+      "state": null,
+      "mcp_route": null
+    },
+    {
+      "id": "wt-tab-list",
+      "patterns": [
+        {
+          "source": "(?:탭\\s*(?:목록|리스트|열린|현재))",
+          "flags": "i"
+        },
+        {
+          "source": "(?:list\\s+tabs|tab\\s+list|열린\\s*탭)",
+          "flags": "i"
+        }
+      ],
+      "skill": "tfx-wt",
+      "priority": 1,
+      "supersedes": ["tfx-unified"],
+      "exclusive": false,
+      "state": null,
+      "mcp_route": null
+    },
+    {
+      "id": "wt-tab-close",
+      "patterns": [
+        {
+          "source": "(?:탭\\s*(?:닫아|닫기|종료|정리|close))",
+          "flags": "i"
+        },
+        {
+          "source": "(?:close\\s+tab|tab\\s+close|탭\\s*정리)",
+          "flags": "i"
+        }
+      ],
+      "skill": "tfx-wt",
+      "priority": 1,
+      "supersedes": ["tfx-unified"],
+      "exclusive": false,
+      "state": null,
+      "mcp_route": null
+    },
     {
       "id": "handoff-route",
       "patterns": [
@@ -432,6 +552,7 @@
     },
     {
       "id": "gstack-ship",
+      "disabled": true,
       "patterns": [
         {
           "source": "(?:배포해|PR\\s*만들|릴리스\\s*해|머지하고\\s*배포)",
@@ -555,6 +676,45 @@
       "exclusive": false,
       "state": null,
       "mcp_route": null
+    },
+    {
+      "id": "tfx-ship",
+      "patterns": [
+        {
+          "source": "\\btfx[\\s-]?ship\\b",
+          "flags": "i"
+        },
+        {
+          "source": "/ship\\b",
+          "flags": "i"
+        },
+        {
+          "source": "\\brelease\\b",
+          "flags": "i"
+        },
+        {
+          "source": "\\bpublish\\b",
+          "flags": "i"
+        },
+        {
+          "source": "배포(?!자|사|장|처)",
+          "flags": ""
+        },
+        {
+          "source": "릴리[즈스]",
+          "flags": ""
+        },
+        {
+          "source": "쉽\\s*(?:해|하자|가자|쳐)",
+          "flags": ""
+        }
+      ],
+      "skill": "tfx-ship",
+      "priority": 3,
+      "supersedes": ["gstack-ship"],
+      "exclusive": false,
+      "state": null,
+      "mcp_route": null
     }
   ]
 }

package/hooks/lib/resolve-root.mjs

@@ -51,7 +51,7 @@ export function resolvePluginRoot(callerUrl) {
 
   const moduleFallback = toPluginRootFromUrl(import.meta.url) || process.cwd();
   process.stderr.write(
-    `[resolve-root] warning: failed to resolve plugin root from breadcrumb/env/caller; fallback=${moduleFallback}\n`
+    `[resolve-root] warning: failed to resolve plugin root from breadcrumb/env/caller; fallback=${moduleFallback}\n`,
   );
   return moduleFallback;
 }

package/hooks/mcp-config-watcher.mjs

@@ -25,10 +25,14 @@ function buildSystemMessage(filePath, stdioServers, result) {
 
   if (result.modified) {
     const actionLabel = result.replacement ? "자동 치환" : "자동 제거";
-    lines.push(`[mcp-guard] stdio MCP ${actionLabel}: ${stdioServers.map((server) => server.name).join(", ")}`);
+    lines.push(
+      `[mcp-guard] stdio MCP ${actionLabel}: ${stdioServers.map((server) => server.name).join(", ")}`,
+    );
 
     if (result.replacement?.name && result.replacement?.url) {
-      lines.push(`[mcp-guard] 대체 서버: ${result.replacement.name} -> ${result.replacement.url}`);
+      lines.push(
+        `[mcp-guard] 대체 서버: ${result.replacement.name} -> ${result.replacement.url}`,
+      );
     }
 
     if (result.backupPath) {

package/hooks/permission-safe-allow.mjs

@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+
+import { stdin, stdout } from "node:process";
+
+const META_PATTERNS = [/&&/, /\|\|/, /[;|<>`]/, /\$\(/];
+const RISKY_PATTERNS = [
+  /(^|\s)rm(\s|$)/,
+  /(^|\s)mv(\s|$)/,
+  /(^|\s)cp(\s|$)/,
+  /(^|\s)curl(\s|$)/,
+  /(^|\s)wget(\s|$)/,
+  /(^|\s)sudo(\s|$)/,
+  /(^|\s)chmod(\s|$)/,
+  /(^|\s)chown(\s|$)/,
+  /(^|\s)git\s+push(\s|$)/,
+  /(^|\s)git\s+reset(\s|$)/,
+  /(^|\s)git\s+clean(\s|$)/,
+  /(^|\s)npm\s+publish(\s|$)/,
+  /(^|\s)pnpm\s+publish(\s|$)/,
+  /(^|\s)yarn\s+publish(\s|$)/,
+];
+
+function silentlyExit() {
+  process.exit(0);
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let input = "";
+    stdin.setEncoding("utf8");
+    stdin.on("data", (chunk) => {
+      input += chunk;
+    });
+    stdin.on("end", () => resolve(input));
+    stdin.resume();
+  });
+}
+
+function shellWords(command) {
+  const words = [];
+  const pattern = /"([^"]*)"|'([^']*)'|([^\s]+)/g;
+  let match;
+  while ((match = pattern.exec(command)) !== null) {
+    words.push(match[1] ?? match[2] ?? match[3]);
+  }
+  return words;
+}
+
+function isRepoRelativePath(value) {
+  if (!value || value.startsWith("/") || value.startsWith("~")) return false;
+  if (value === ".") return true;
+  if (value === ".." || value.startsWith("../") || value.includes("/../"))
+    return false;
+  return /^[A-Za-z0-9._/*?@{}+,:=-][A-Za-z0-9._/*?'@{}+,:=-]*$/.test(value);
+}
+
+function hasUnsafeSurface(command) {
+  return (
+    META_PATTERNS.some((pattern) => pattern.test(command)) ||
+    RISKY_PATTERNS.some((pattern) => pattern.test(command))
+  );
+}
+
+function allowGit(words, command) {
+  if (command === "git status" || command === "git status --short")
+    return "git status";
+  if (command === "git diff --stat" || command === "git diff --cached --stat")
+    return "git diff stat";
+  if (command === "git branch --show-current") return "git branch";
+  if (words[0] === "git" && words[1] === "log" && words[2] === "--oneline") {
+    const rest = words.slice(3);
+    if (
+      rest.every(
+        (word) =>
+          /^[A-Za-z0-9._/@{}~^:+,=-]+$/.test(word) && !word.startsWith("-"),
+      )
+    ) {
+      return "git log";
+    }
+  }
+  return null;
+}
+
+function allowListing(words) {
+  if (words[0] === "pwd" && words.length === 1) return "pwd";
+
+  if (words[0] === "ls") {
+    const args = words.slice(1);
+    if (
+      args.every(
+        (word) => /^-[A-Za-z0-9]+$/.test(word) || isRepoRelativePath(word),
+      )
+    ) {
+      return "ls";
+    }
+  }
+
+  if (words[0] === "find") {
+    const args = words.slice(1);
+    if (args.some((word) => word === "-delete" || word.startsWith("-exec")))
+      return null;
+    const firstOption = args.findIndex((word) => word.startsWith("-"));
+    const pathArgs = (
+      firstOption === -1 ? args : args.slice(0, firstOption)
+    ).filter(Boolean);
+    if (pathArgs.length === 0 || pathArgs.every(isRepoRelativePath)) {
+      return "find";
+    }
+  }
+
+  return null;
+}
+
+function allowSearch(words) {
+  if (words[0] !== "rg" && words[0] !== "grep") return null;
+  const args = words.slice(1);
+  if (args.length === 0) return null;
+  if (
+    args.some(
+      (word) =>
+        word.startsWith("/") ||
+        word === ".." ||
+        word.startsWith("../") ||
+        word.includes("/../"),
+    )
+  ) {
+    return null;
+  }
+  return `${words[0]} search`;
+}
+
+function allowTargetedTest(words) {
+  if (words[0] !== "node" || words[1] !== "scripts/test-lock.mjs") return null;
+  if (!words.includes("--test")) return null;
+  const args = words.slice(2);
+  const allowedFlags = new Set(["--test", "--test-force-exit"]);
+  const pathArgs = [];
+  for (const word of args) {
+    if (allowedFlags.has(word)) continue;
+    if (/^--test-concurrency=\d+$/.test(word)) continue;
+    if (word.startsWith("-")) return null;
+    pathArgs.push(word);
+  }
+  if (pathArgs.length === 0) return null;
+  if (
+    pathArgs.every(
+      (word) =>
+        word.startsWith("tests/") || word.startsWith("scripts/__tests__/"),
+    ) &&
+    pathArgs.every(isRepoRelativePath)
+  ) {
+    return "targeted test";
+  }
+  return null;
+}
+
+function allowNpm(command) {
+  // npm scripts are intentionally not auto-allowed: package.json can redefine
+  // them to perform arbitrary side effects. Prefer explicit node test commands.
+  void command;
+  return null;
+}
+
+function allowanceReason(command) {
+  const trimmed = command.trim().replace(/\s+/g, " ");
+  if (!trimmed || hasUnsafeSurface(trimmed)) return null;
+
+  const words = shellWords(trimmed);
+  if (words.length === 0) return null;
+
+  return (
+    allowGit(words, trimmed) ??
+    allowListing(words) ??
+    allowSearch(words) ??
+    allowTargetedTest(words) ??
+    allowNpm(trimmed)
+  );
+}
+
+function hasAskSuggestion(value) {
+  if (!value || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(hasAskSuggestion);
+  if (value.behavior === "ask") return true;
+  if (value.decision?.behavior === "ask") return true;
+  return Object.values(value).some(hasAskSuggestion);
+}
+
+function emitAllow(reason) {
+  stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PermissionRequest",
+        decision: { behavior: "allow" },
+        additionalContext: `[permission-safe-allow] allowed: ${reason}`,
+      },
+    }),
+  );
+}
+
+const input = await readStdin();
+let payload;
+try {
+  payload = JSON.parse(input || "{}");
+} catch {
+  silentlyExit();
+}
+
+if (
+  payload?.hook_event_name !== "PermissionRequest" ||
+  payload?.tool_name !== "Bash"
+) {
+  silentlyExit();
+}
+
+if (
+  hasAskSuggestion(
+    payload.permission_suggestions ?? payload.permissionSuggestions,
+  )
+) {
+  silentlyExit();
+}
+
+const command = payload?.tool_input?.command ?? payload?.command;
+if (typeof command !== "string") {
+  silentlyExit();
+}
+
+const reason = allowanceReason(command);
+if (!reason) {
+  silentlyExit();
+}
+
+emitAllow(reason);