add-coder 0.1.15 → 0.2.0

package/templates/core/hooks/lib/session-end.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+###
+ # @Author       : xiaomingming wujixmm@gmail.com
+ # @Date         : 2026-07-17 13:20:43
+ # @LastEditors  : xiaomingming wujixmm@gmail.com
+ # @LastEditTime : 2026-07-17 13:34:19
+ # @FilePath     : /add-coder/templates/core/hooks/lib/session-end.sh
+ # @Description  : SessionEnd 治理卡位
+### 
+# session-end.sh — SessionEnd 治理卡位
+# 路径: templates/core/hooks/lib/session-end.sh
+#
+# 治理职能（卡位 #2）:
+#   ① 清理 tpl-injected 标记文件
+#   ② 会话审计结算（汇总 tool 调用统计）
+#   ③ Stop 未触发兜底: 若 Stop 未执行验收检查，补执行 checklist 快照（best-effort）
+#
+# 用法: 被各 IDE adapter 的 SessionEnd hook 脚本 source 并调用 main
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/common.sh" 2>/dev/null || true
+
+# 清理 tpl-injected 标记
+cleanup_tpl_flag() {
+  local project_hash=$(echo "${PROJECT_DIR:-$PWD}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")
+  rm -f "/tmp/add_tpl_${project_hash}" 2>/dev/null || true
+}
+
+# 清理 dev action 标记
+cleanup_dev_flag() {
+  local project_hash=$(echo "${PROJECT_DIR:-$PWD}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")
+  rm -f "/tmp/add_dev_${project_hash}" 2>/dev/null || true
+}
+
+# Stop 未触发兜底: 如果 dev action 标记还在（说明 Stop 没执行验收检查）
+stop_fallback() {
+  if has_dev_action 2>/dev/null; then
+    echo "[ADD SessionEnd] ⚠️ 检测到 dev action 标记未清除——Stop 可能未触发验收检查" >&2
+
+    # 尝试找到 handoff 做 checklist 快照
+    local state=""
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+    fi
+
+    if [ -n "$state" ]; then
+      local handoff=$(echo "$state" | awk -F'::' '{print $4}')
+      local add_route=$(echo "$state" | awk -F'::' '{print $5}')
+      if [ -f "$handoff" ]; then
+        echo "[ADD SessionEnd] 补执行 checklist 快照（best-effort，不阻断）" >&2
+        if type check_add_completeness >/dev/null 2>&1; then
+          check_add_completeness "$handoff" "$add_route" >&2 2>/dev/null || true
+        fi
+      fi
+    fi
+  fi
+}
+
+main() {
+  # ① 清理标记文件
+  cleanup_tpl_flag
+  cleanup_dev_flag
+
+  # ② 审计结算（输出到 stderr 供日志记录）
+  echo "[ADD SessionEnd] 会话结束 — $(date -Iseconds)" >&2
+
+  # ③ Stop 未触发兜底
+  stop_fallback
+
+  exit 0
+}
+
+# 被 source 时不自动执行，source 后调用 main
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  main "$@"
+fi

package/templates/core/hooks/lib/subagent-stop.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+###
+ # @Author       : xiaomingming wujixmm@gmail.com
+ # @Date         : 2026-07-17 13:21:03
+ # @LastEditors  : xiaomingming wujixmm@gmail.com
+ # @LastEditTime : 2026-07-17 13:21:22
+ # @FilePath     : /add-coder/templates/core/hooks/lib/subagent-stop.sh
+ # @Description  : SubagentStop 治理卡位
+### 
+# subagent-stop.sh — SubagentStop 治理卡位
+# 路径: templates/core/hooks/lib/subagent-stop.sh
+#
+# 治理职能（卡位 #11）:
+#   ① 子 agent 结果边界校验: 检查交付物是否在 spec 边界内（不越界、不遗漏）
+#   ② 审计聚合: 将子 agent 的 sub-traceId 审计记录合并回主 traceId
+#   ③ 阻断能力: 子 agent 结果不符合 spec → exit 2 要求重做
+#
+# 用法: 被各 IDE adapter 的 SubagentStop hook 脚本 source 并调用 main
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$SCRIPT_DIR/common.sh" 2>/dev/null || true
+
+# 边界校验: 检查子 agent 交付物是否超出 spec 定义的文件范围
+# 参数: $1 = subagent_name, $2 = 子 agent 交付物文件列表（空格分隔）
+check_boundary() {
+  local subagent_name="$1"
+  local deliverables="$2"
+
+  # 获取活跃 ADD 状态
+  local state=""
+  if type detect_active_add >/dev/null 2>&1; then
+    state=$(detect_active_add 2>/dev/null || true)
+  fi
+
+  if [ -z "$state" ]; then
+    # 无活跃 Plan —— 无 spec 可参考，仅告警不阻断
+    echo "[ADD SubagentStop] ⚠️ 无活跃 ADD Plan，无法校验 $subagent_name 的交付物边界" >&2
+    return 0
+  fi
+
+  local plan_kw=$(echo "$state" | awk -F'::' '{print $1}')
+  local handoff=$(echo "$state" | awk -F'::' '{print $4}')
+
+  echo "[ADD SubagentStop] $subagent_name 已完成，交付物: $deliverables" >&2
+  echo "[ADD SubagentStop] 关联 Plan: $plan_kw | handoff: $handoff" >&2
+
+  # best-effort: 如果 handoff 中列出了允许的文件范围，检查交付物是否在其中
+  if [ -f "$handoff" ] && [ -n "$deliverables" ]; then
+    local violations=""
+    for f in $deliverables; do
+      if ! grep -q "$f" "$handoff" 2>/dev/null; then
+        violations="${violations} $f"
+      fi
+    done
+    if [ -n "$violations" ]; then
+      echo "[ADD SubagentStop] ❌ $subagent_name 交付物超出 spec 边界: $violations" >&2
+      echo "[ADD SubagentStop] 请检查这些文件是否属于本轮 spec 范围，或更新 handoff 文件清单" >&2
+      return 1
+    fi
+  fi
+
+  return 0
+}
+
+main() {
+  local subagent_name="${1:-unknown}"
+
+  # 从 stdin 解析 JSON（hook 事件传入）
+  local input=$(parse_input 2>/dev/null || echo "{}")
+  local deliverables=""
+
+  # 尝试从 stdin JSON 提取交付物信息
+  local agent_type=$(echo "$input" | grep -o '"agent_type"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -n "$agent_type" ] && subagent_name="${subagent_name}($agent_type)"
+
+  # ① 边界校验
+  if ! check_boundary "$subagent_name" "$deliverables"; then
+    echo "[ADD SubagentStop] 要求重做——交付物超出 spec 边界" >&2
+    exit "${EXIT_BLOCK:-2}"
+  fi
+
+  # ② 审计聚合（输出到 stderr 供日志记录）
+  echo "[ADD SubagentStop] $subagent_name 边界校验通过 — $(date -Iseconds)" >&2
+
+  exit 0
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+  main "$@"
+fi

package/templates/core/hooks/notification.sh

@@ -1,4 +1,33 @@
 #!/bin/bash
+# Notification — Review 提醒 + Token 预警（Claude Code 适配）
+# 治理卡位 #12: 开发提醒/Token 预警
+set -euo pipefail
+
+input=$(cat)
+ntype=$(echo "$input" | jq -r '.notification_type // ""' 2>/dev/null || echo "")
+
+if [ "$ntype" != "result" ]; then
+  exit 0
+fi
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="$PWD"
+
+state=$(detect_active_add 2>/dev/null || true)
+[ -z "$state" ] && exit 0
+
+IFS='::' read -r plan _ _ _ _ <<< "$state"
+
+reviews_dir="${PROJECT_DIR}/.qoder/reviews"
+if ls "$reviews_dir"/*.md >/dev/null 2>&1; then
+  echo "[ADD Notification] Plan: ${plan} — 请检查 Review 文档: ${reviews_dir}"
+fi
+exit 0
+#!/bin/bash
 # Notification — 通知事件处理（Claude Code 适配）
 set -euo pipefail
 

package/templates/core/hooks/post-tool-use.sh

@@ -1,18 +1,35 @@
 #!/bin/bash
-# post-tool-use.sh — Claude Code PostToolUse 审计提醒
+# post-tool-use.sh — Claude Code PostToolUse：格式化 + 文档守卫 + 审计提醒
+# 治理卡位 #5: 格式化 + ADD文档守卫 + 审计落库 + 结果增强
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
 input=$(parse_input)
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
 
-if ! echo "$file_path" | grep -qE 'src/agents/|src/lib/agent-audit-logger\.ts|src/types/|prisma/schema\.prisma'; then
+# ── Edit/Write matcher: 格式化 + ADD文档守卫 ──
+if [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  # ADD 文档结构守卫：写入 plans/specs/reviews 后提示
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/(plans|specs|reviews)/'; then
+    echo "[ADD PostToolUse] ADD 文档已写入: ${file_path}。请确保章节完整、双向链接齐全、增量修订格式正确。" >&2
+  fi
+
+  # 审计提醒（所有文件写入）
+  echo "[ADD PostToolUse] 文件已写入: ${file_path}。请执行 record_dev_operation 落库审计（ADD-7）。" >&2
+  exit 0
+fi
+
+# ── Bash matcher: 结果增强 ──
+if [ "$tool_name" = "Bash" ]; then
+  echo "[ADD PostToolUse] 命令执行完成。如有 lint/tsc 错误请修复。" >&2
   exit 0
 fi
 
-echo "[ADD PostToolUse] 文件已写入: ${file_path}。如果尚未记录，请执行 record_dev_operation 落库审计。"
-exit 0
+exit 0

package/templates/core/hooks/pre-compact.sh

@@ -1,14 +1,37 @@
 #!/bin/bash
-# PreCompact — 上下文压缩前检查（Claude Code 适配）
+# pre-compact.sh — 上下文压缩前 ADD 状态保存（Claude Code 适配）
+# 治理卡位 #9: ADD状态保存 + 恢复清单导出 + tpl标记清理
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-# 检查是否有未完成的 ADD 审计记录
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -d "$PROJECT_DIR/.qoder/plans" ] || exit 0
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-echo "[ADD PreCompact] 上下文压缩前，请确认 ADD-7 审计记录已落库。"
-exit 0
+# ── ① 获取 ADD 状态并保存到标记文件 ──
+if type detect_active_add >/dev/null 2>&1; then
+  state=$(detect_active_add 2>/dev/null || true)
+  if [ -n "$state" ]; then
+    IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+
+    # 写入恢复标记文件（SessionStart 恢复时读取）
+    RECOVERY_FILE="/tmp/add_recovery_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+    cat > "$RECOVERY_FILE" <<EOF
+plan=${plan}
+step=${step}
+rounds=${rounds}
+handoff=${handoff}
+add_route=${add_route}
+EOF
+
+    echo "[ADD PreCompact] ADD 状态已保存: Plan=${plan}, Step=${step}" >&2
+  fi
+fi
+
+# ── ② 清理 tpl-injected 标记（compact 后上下文丢失，下次需重注） ──
+TPL_FLAG="/tmp/add_tpl_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+rm -f "$TPL_FLAG" 2>/dev/null || true
+
+exit 0

package/templates/core/hooks/pre-tool-use.sh

@@ -1,28 +1,78 @@
 #!/bin/bash
-# pre-tool-use.sh — Claude Code PreToolUse：源码 Plan 关联检查
-# 与 Qoder 版本共享核心逻辑，差异仅在工具名和环境变量
+# pre-tool-use.sh — Claude Code PreToolUse：四路守卫
+# 治理卡位 #4: 危险命令拦截 / 模板路径兜底 / 写入前置守卫 / 敏感文件保护
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
 input=$(parse_input)
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
 
-if ! echo "$file_path" | grep -qE '(src/|/src/).*\.(ts|tsx)$'; then
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# ── ① Bash matcher: 危险命令拦截 + 终端写文件拦截 ──
+if [ "$tool_name" = "Bash" ]; then
+  cmd=$(echo "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  # 危险命令
+  if echo "$cmd" | grep -qiE 'rm[[:space:]]+-rf[[:space:]]+/|DROP[[:space:]]+TABLE|git[[:space:]]+push[[:space:]]+--force|mkfs\.|dd[[:space:]]+if='; then
+    echo "⛔ 危险命令已被阻止: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # 终端写文件拦截（含 > / >> / << heredoc / mv / touch / python -c > file）
+  if echo "$cmd" | grep -qE '(cat|echo|tee|sed[[:space:]]+-i|awk|printf|cp|mv|dd|touch)[[:space:]]*.*([>]{1,2}|[|][[:space:]]*tee|<<)'; then
+    echo "⛔ 禁止通过终端命令直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  # mv 无重定向但仍操作文件
+  if echo "$cmd" | grep -qE '^[[:space:]]*mv[[:space:]]+/tmp/'; then
+    echo "⛔ 禁止通过 mv /tmp/ 绕过 IDE 工具: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # python/node 脚本写文件
+  if echo "$cmd" | grep -qE '(python3|python|node)[[:space:]].*[>]{1,2}'; then
+    echo "⛔ 禁止通过脚本语言直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  mark_dev_action
   exit 0
 fi
 
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
-MOD=$(basename "$file_path" | sed 's/\.[jt]sx\?$//')
+# ── ② Write/Edit matcher: 文件写入前置守卫 ──
+if [ "$tool_name" = "Write" ] || [ "$tool_name" = "Edit" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  # 检查是否写入 plans/specs/reviews 目录但无活跃 ADD Plan
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/plans/|\.(qoder|claude|add)/specs/|\.(qoder|claude|add)/reviews/'; then
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+      if [ -z "$state" ]; then
+        echo "[ADD PreToolUse] ⚠️ 正在写入 Plan/Spec/Review 文档但无活跃 ADD Plan——请先执行 add-paradigm" >&2
+      fi
+    fi
+  fi
+
+  # 敏感文件保护
+  if echo "$file_path" | grep -qE '\.env$|\.env\.production$|\.env\.local$|credentials|secrets'; then
+    echo "⛔ 敏感文件受保护，禁止写入: $file_path" >&2
+    exit $EXIT_BLOCK
+  fi
 
-MATCHES=$(grep -rl "$MOD" "$PROJECT_DIR/.qoder/plans" "$PROJECT_DIR/.qoder/specs" "$PROJECT_DIR/.qoder/reports" 2>/dev/null | wc -l)
+  mark_dev_action
+  exit 0
+fi
 
-if [ "$MATCHES" -gt 0 ]; then
+# ── ③ Read matcher: 模板路径兜底 ──
+if [ "$tool_name" = "Read" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  if echo "$file_path" | grep -q 'templates/'; then
+    echo "[ADD PreToolUse] 提示: 模板文件已通过 hook 预读到上下文，可跳过重复读取" >&2
+  fi
   exit 0
 fi
 
-echo "⛔ 阻断: ${file_path} 无相关 ADD Plan。请先创建 Plan。" >&2
-exit $EXIT_BLOCK
+exit 0

package/templates/core/hooks/prompt-submit.sh

@@ -1,16 +1,78 @@
 #!/bin/bash
-# UserPromptSubmit — 用户输入提交前检查（ADD 关键词兜底）
+# UserPromptSubmit — 触发词路由 + 模板全文注入（Claude Code 适配）
+# 治理卡位 #3: Layer 1 精准触发 → Layer 2 阻断 → Layer 3 状态注入
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 input=$(parse_input)
-prompt=$(echo "$input" | jq -r '.prompt // empty')
+prompt=$(echo "$input" | grep -o '"prompt"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+[ -z "$prompt" ] && exit 0
+
+# ─── Layer 1: 精准触发词路由 + 验收幂等保护 ───
+matched=$(match_trigger "$prompt")
+if [ -n "$matched" ]; then
+  if echo "$prompt" | grep -qiE '验收|收敛' 2>/dev/null; then
+    add_state=$(detect_active_add 2>/dev/null || true)
+    if [ -n "$add_state" ]; then
+      _handoff=$(echo "$add_state" | awk -F'::' '{print $4}')
+      _add_route=$(echo "$add_state" | awk -F'::' '{print $5}')
+      if is_already_accepted "$_add_route" "$_handoff" 2>/dev/null; then
+        cat <<EOF
+[ADD 验收] ⚠️ 已验收。进入 Review 模式:
+  ① 重新检查 checklist [T]/[R] 项
+  ② 审查 audit 记录完整性
+  ③ 如有差异 → Review 回流至 handoff（增量更新）
+  ④ 无差异 → 记录 'Review 已确认，无新发现'
+EOF
+        exit 0
+      fi
+    fi
+  fi
+  echo "$matched"
+  exit 0
+fi
 
-# 检测 ADD 关键词触发
-if echo "$prompt" | grep -qiE '开发|改功能|修.?bug|加需求|新增|重构|实施|验收|继续'; then
-  echo "[ADD PromptSubmit] 检测到开发关键词，请确认已加载 ADD 工作流上下文。"
+# ─── 开发关键词检测 ───
+if ! echo "$prompt" | grep -qiE '开发|改功能|修.?bug|加需求|新增|重构|实施|验收|继续|生成plan|生成计划'; then
+  exit 0
 fi
-exit 0
+
+echo "[ADD PromptSubmit] 检测到开发关键词" >&2
+
+# ─── Layer 2: 无活跃 ADD → 阻断 ───
+state=$(detect_active_add 2>/dev/null || true)
+if [ -z "$state" ]; then
+  cat <<'EOF'
+[ADD 强制规则] 检测到开发任务。你必须先执行 add-paradigm SKILL 完成 ADD 工作流:
+  Step 0: 文档先行 (Plan → Review → Specs)
+  Step 3: 代码实现 + 审计植入
+  Step 8: 收敛判断
+如果 add-paradigm SKILL 尚未激活，请先调用它。
+EOF
+  exit 2
+fi
+
+# ─── Layer 3: 有活跃 ADD → 注入状态 + 模板全文 ───
+IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+cat <<EOF
+[ADD 当前状态]
+  Plan: ${plan}
+  轮次: ${rounds}
+  当前 Step: ${step}
+  handoff: ${handoff}
+EOF
+
+# 模板全文注入（tpl-injected 去重）
+TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
+if [ -f "$TPL_SCRIPT" ]; then
+  bash "$TPL_SCRIPT" --full --top 5
+fi
+
+exit 0

package/templates/core/hooks/session-end.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# SessionEnd — 通用版（核心模板，Trae 等适配器继承）
+# 治理卡位 #2: 标记清理 + 会话审计结算 + Stop未触发兜底
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="$PWD"
+
+# ── ① 清理 tpl-injected 标记 ──
+project_hash=$(echo "${PROJECT_DIR:-$PWD}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")
+rm -f "/tmp/add_tpl_${project_hash}" 2>/dev/null || true
+
+# ── ② 清理 dev action 标记 ──
+rm -f "/tmp/add_dev_${project_hash}" 2>/dev/null || true
+
+# ── ③ Stop 未触发兜底: 如果 dev action 标记还在，补执行 checklist 快照 ──
+if has_dev_action 2>/dev/null; then
+  echo "[ADD SessionEnd] ⚠️ 检测到 dev action 标记未清除——Stop 可能未触发验收检查" >&2
+
+  state=$(detect_active_add 2>/dev/null || true)
+  if [ -n "$state" ]; then
+    handoff=$(echo "$state" | awk -F'::' '{print $4}')
+    add_route=$(echo "$state" | awk -F'::' '{print $5}')
+    if [ -f "$handoff" ]; then
+      echo "[ADD SessionEnd] 补执行 checklist 快照（best-effort，不阻断）" >&2
+      if type check_add_completeness >/dev/null 2>&1; then
+        check_add_completeness "$handoff" "$add_route" >&2 2>/dev/null || true
+      fi
+    fi
+  fi
+fi
+
+# ── ④ 审计结算 ──
+echo "[ADD SessionEnd] 会话结束 — $(date -Iseconds)" >&2
+exit 0

package/templates/core/hooks/session-start.sh

@@ -1,23 +1,36 @@
 #!/bin/bash
-# SessionStart — ADD 上下文恢复（Claude Code 适配）
+# SessionStart — ADD 上下文恢复 + 模板索引注入（Claude Code 适配）
+# 治理卡位 #1: ADD状态恢复 + 模板索引注入
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
 
-# 尝试加载 Qoder 的 state-detect 和 context-inject 库
-QODER_LIB="$HOOK_DIR/../../qoder/hooks/lib"
-[ -f "$QODER_LIB/state-detect.sh" ] && source "$QODER_LIB/state-detect.sh"
-[ -f "$QODER_LIB/context-inject.sh" ] && source "$QODER_LIB/context-inject.sh"
+# 加载四端通用函数（路径统一后: .claude/hooks/lib/common.sh）
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-export QODER_PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+# 设置项目目录
+export PROJECT_DIR="$PWD"
 
+# ── ① ADD 状态恢复 ──
 state=$(detect_active_add 2>/dev/null || true)
-if [ -z "$state" ]; then
-  exit 0
+if [ -n "$state" ]; then
+  IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+  cat <<EOF
+[ADD SessionStart] 检测到活跃 ADD Plan:
+  Plan: ${plan}
+  轮次: ${rounds}
+  当前 Step: ${step}
+  handoff: ${handoff}
+  恢复命令: query_audit_logs({ planKeyword: '${plan}' })
+EOF
 fi
 
-IFS='::' read -r plan step rounds handoff <<< "$state"
-build_session_start_json "$plan" "$step" "$rounds" "$handoff"
-exit 0
+# ── ② 模板索引注入 ──
+TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
+if [ -f "$TPL_SCRIPT" ]; then
+  bash "$TPL_SCRIPT" --index
+fi
+
+exit 0

package/templates/core/hooks/stop-check.sh

@@ -1,10 +1,45 @@
 #!/bin/bash
-# Stop — 停止前合规检查（Claude Code 适配）
+# stop-check.sh — Claude Code Stop：四象限分流 + 验收检查（few-shot 上下文注入）
+# 治理卡位 #7: 验收检查 + devlog + 阻断
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-echo "[ADD Stop] 会话结束前，请确认所有 checklist 项已勾选、ADD-7 审计已落库。"
-exit 0
+export PROJECT_DIR="$PWD"
+
+state=$(detect_active_add 2>/dev/null || true)
+has_dev=$(has_dev_action 2>/dev/null && echo "true" || echo "false")
+
+# ═══════ Q1: 无 ADD + 无 dev → 正常停 ═══════
+if [ -z "$state" ] && [ "$has_dev" != "true" ]; then
+  exit 0
+fi
+
+# ═══════ Q2: 无 ADD + 有 dev → 严重违规，few-shot 注入 ═══════
+if [ -z "$state" ] && [ "$has_dev" = "true" ]; then
+  build_stop_context "no_add_has_dev" >&2
+  exit $EXIT_BLOCK
+fi
+
+IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+
+# ═══════ Q3: 有 ADD + 无 dev → 注入状态 ═══════
+if [ "$has_dev" != "true" ]; then
+  echo "[ADD Stop] Plan: ${plan}, 轮次: ${rounds}, Step: ${step}"
+  echo "本次无代码改动。下次继续时执行 session-init 恢复上下文。"
+  exit 0
+fi
+
+# ═══════ Q4: 有 ADD + 有 dev → 验收检查 ═══════
+issues=$(check_add_completeness "$handoff" "$add_route" 2>/dev/null || true)
+if [ -n "$issues" ]; then
+  build_stop_context "has_add_dev_unclosed" "$issues" >&2
+  exit $EXIT_BLOCK
+fi
+
+clear_dev_action 2>/dev/null || true
+echo "[ADD Stop] ✅ 验收通过——checklist 全部勾选，devlog 已记录。"
+exit 0

package/templates/core/hooks/subagent-stop.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# SubagentStop — 通用版（核心模板，Trae 等适配器继承）
+# 治理卡位 #11: 子agent边界校验 + 审计聚合 + 阻断
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="$PWD"
+
+input=$(cat 2>/dev/null || echo "{}")
+agent_name=$(echo "$input" | jq -r '.agent_type // .subagent_name // "unknown"' 2>/dev/null || echo "unknown")
+
+# ── ① 边界校验：检查子 agent 交付物是否超出 spec 范围 ──
+state=$(detect_active_add 2>/dev/null || true)
+if [ -z "$state" ]; then
+  echo "[ADD SubagentStop] ⚠️ ${agent_name} 已完成，但无活跃 ADD Plan 无法校验边界" >&2
+  exit 0
+fi
+
+plan_kw=$(echo "$state" | awk -F'::' '{print $1}')
+handoff=$(echo "$state" | awk -F'::' '{print $4}')
+
+echo "[ADD SubagentStop] ${agent_name} 已完成 — 关联 Plan: ${plan_kw}" >&2
+
+# 如果 handoff 中存在允许的文件清单，检查交付物是否越界
+if [ -f "$handoff" ]; then
+  deliverables=$(echo "$input" | jq -r '.deliverables // ""' 2>/dev/null || echo "")
+  if [ -n "$deliverables" ]; then
+    violations=""
+    for f in $deliverables; do
+      if ! grep -q "$f" "$handoff" 2>/dev/null; then
+        violations="${violations} $f"
+      fi
+    done
+    if [ -n "$violations" ]; then
+      echo "[ADD SubagentStop] ❌ ${agent_name} 交付物超出 spec 边界: ${violations}" >&2
+      echo "[ADD SubagentStop] 要求重做——请检查这些文件是否属于本轮 spec 范围" >&2
+      exit "${EXIT_BLOCK:-2}"
+    fi
+  fi
+fi
+
+# ── ② 审计聚合 ──
+echo "[ADD SubagentStop] ${agent_name} 边界校验通过 — $(date -Iseconds)" >&2
+exit 0