add-coder 0.1.17 → 0.2.0

package/templates/adapters/codex/hooks/pre-tool-use.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# pre-tool-use.sh — Claude Code PreToolUse：四路守卫
+# 治理卡位 #4: 危险命令拦截 / 模板路径兜底 / 写入前置守卫 / 敏感文件保护
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+input=$(parse_input)
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# ── ① Bash matcher: 危险命令拦截 + 终端写文件拦截 ──
+if [ "$tool_name" = "Bash" ]; then
+  cmd=$(echo "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  # 危险命令
+  if echo "$cmd" | grep -qiE 'rm[[:space:]]+-rf[[:space:]]+/|DROP[[:space:]]+TABLE|git[[:space:]]+push[[:space:]]+--force|mkfs\.|dd[[:space:]]+if='; then
+    echo "⛔ 危险命令已被阻止: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # 终端写文件拦截（含 > / >> / << heredoc / mv / touch / python -c > file）
+  if echo "$cmd" | grep -qE '(cat|echo|tee|sed[[:space:]]+-i|awk|printf|cp|mv|dd|touch)[[:space:]]*.*([>]{1,2}|[|][[:space:]]*tee|<<)'; then
+    echo "⛔ 禁止通过终端命令直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  # mv 无重定向但仍操作文件
+  if echo "$cmd" | grep -qE '^[[:space:]]*mv[[:space:]]+/tmp/'; then
+    echo "⛔ 禁止通过 mv /tmp/ 绕过 IDE 工具: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # python/node 脚本写文件
+  if echo "$cmd" | grep -qE '(python3|python|node)[[:space:]].*[>]{1,2}'; then
+    echo "⛔ 禁止通过脚本语言直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  mark_dev_action
+  exit 0
+fi
+
+# ── ② Write/Edit matcher: 文件写入前置守卫 ──
+if [ "$tool_name" = "Write" ] || [ "$tool_name" = "Edit" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  # 检查是否写入 plans/specs/reviews 目录但无活跃 ADD Plan
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/plans/|\.(qoder|claude|add)/specs/|\.(qoder|claude|add)/reviews/'; then
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+      if [ -z "$state" ]; then
+        echo "[ADD PreToolUse] ⚠️ 正在写入 Plan/Spec/Review 文档但无活跃 ADD Plan——请先执行 add-paradigm" >&2
+      fi
+    fi
+  fi
+
+  # 敏感文件保护
+  if echo "$file_path" | grep -qE '\.env$|\.env\.production$|\.env\.local$|credentials|secrets'; then
+    echo "⛔ 敏感文件受保护，禁止写入: $file_path" >&2
+    exit $EXIT_BLOCK
+  fi
+
+  mark_dev_action
+  exit 0
+fi
+
+# ── ③ Read matcher: 模板路径兜底 ──
+if [ "$tool_name" = "Read" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  if echo "$file_path" | grep -q 'templates/'; then
+    echo "[ADD PreToolUse] 提示: 模板文件已通过 hook 预读到上下文，可跳过重复读取" >&2
+  fi
+  exit 0
+fi
+
+exit 0

package/templates/adapters/codex/hooks/prompt-submit.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# UserPromptSubmit — 触发词路由 + 模板全文注入（Claude Code 适配）
+# 治理卡位 #3: Layer 1 精准触发 → Layer 2 阻断 → Layer 3 状态注入
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+input=$(parse_input)
+prompt=$(echo "$input" | grep -o '"prompt"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+[ -z "$prompt" ] && exit 0
+
+# ─── Layer 1: 精准触发词路由 + 验收幂等保护 ───
+matched=$(match_trigger "$prompt")
+if [ -n "$matched" ]; then
+  if echo "$prompt" | grep -qiE '验收|收敛' 2>/dev/null; then
+    add_state=$(detect_active_add 2>/dev/null || true)
+    if [ -n "$add_state" ]; then
+      _handoff=$(echo "$add_state" | awk -F'::' '{print $4}')
+      _add_route=$(echo "$add_state" | awk -F'::' '{print $5}')
+      if is_already_accepted "$_add_route" "$_handoff" 2>/dev/null; then
+        cat <<EOF
+[ADD 验收] ⚠️ 已验收。进入 Review 模式:
+  ① 重新检查 checklist [T]/[R] 项
+  ② 审查 audit 记录完整性
+  ③ 如有差异 → Review 回流至 handoff（增量更新）
+  ④ 无差异 → 记录 'Review 已确认，无新发现'
+EOF
+        exit 0
+      fi
+    fi
+  fi
+  echo "$matched"
+  exit 0
+fi
+
+# ─── 开发关键词检测 ───
+if ! echo "$prompt" | grep -qiE '开发|改功能|修.?bug|加需求|新增|重构|实施|验收|继续|生成plan|生成计划'; then
+  exit 0
+fi
+
+echo "[ADD PromptSubmit] 检测到开发关键词" >&2
+
+# ─── Layer 2: 无活跃 ADD → 阻断 ───
+state=$(detect_active_add 2>/dev/null || true)
+if [ -z "$state" ]; then
+  cat <<'EOF'
+[ADD 强制规则] 检测到开发任务。你必须先执行 add-paradigm SKILL 完成 ADD 工作流:
+  Step 0: 文档先行 (Plan → Review → Specs)
+  Step 3: 代码实现 + 审计植入
+  Step 8: 收敛判断
+如果 add-paradigm SKILL 尚未激活，请先调用它。
+EOF
+  exit 2
+fi
+
+# ─── Layer 3: 有活跃 ADD → 注入状态 + 模板全文 ───
+IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+cat <<EOF
+[ADD 当前状态]
+  Plan: ${plan}
+  轮次: ${rounds}
+  当前 Step: ${step}
+  handoff: ${handoff}
+EOF
+
+# 模板全文注入（tpl-injected 去重）
+TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
+if [ -f "$TPL_SCRIPT" ]; then
+  bash "$TPL_SCRIPT" --full --top 5
+fi
+
+exit 0

package/templates/adapters/codex/hooks/session-start.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# SessionStart — ADD 上下文恢复 + 模板索引注入（Claude Code 适配）
+# 治理卡位 #1: ADD状态恢复 + 模板索引注入
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+
+# 加载四端通用函数（路径统一后: .claude/hooks/lib/common.sh）
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+# 设置项目目录
+export PROJECT_DIR="$PWD"
+
+# ── ① ADD 状态恢复 ──
+state=$(detect_active_add 2>/dev/null || true)
+if [ -n "$state" ]; then
+  IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+  cat <<EOF
+[ADD SessionStart] 检测到活跃 ADD Plan:
+  Plan: ${plan}
+  轮次: ${rounds}
+  当前 Step: ${step}
+  handoff: ${handoff}
+  恢复命令: query_audit_logs({ planKeyword: '${plan}' })
+EOF
+fi
+
+# ── ② 模板索引注入 ──
+TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
+if [ -f "$TPL_SCRIPT" ]; then
+  bash "$TPL_SCRIPT" --index
+fi
+
+exit 0

package/templates/adapters/codex/hooks/stop-check.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# stop-check.sh — Claude Code Stop：四象限分流 + 验收检查（few-shot 上下文注入）
+# 治理卡位 #7: 验收检查 + devlog + 阻断
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="$PWD"
+
+state=$(detect_active_add 2>/dev/null || true)
+has_dev=$(has_dev_action 2>/dev/null && echo "true" || echo "false")
+
+# ═══════ Q1: 无 ADD + 无 dev → 正常停 ═══════
+if [ -z "$state" ] && [ "$has_dev" != "true" ]; then
+  exit 0
+fi
+
+# ═══════ Q2: 无 ADD + 有 dev → 严重违规，few-shot 注入 ═══════
+if [ -z "$state" ] && [ "$has_dev" = "true" ]; then
+  build_stop_context "no_add_has_dev" >&2
+  exit $EXIT_BLOCK
+fi
+
+IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+
+# ═══════ Q3: 有 ADD + 无 dev → 注入状态 ═══════
+if [ "$has_dev" != "true" ]; then
+  echo "[ADD Stop] Plan: ${plan}, 轮次: ${rounds}, Step: ${step}"
+  echo "本次无代码改动。下次继续时执行 session-init 恢复上下文。"
+  exit 0
+fi
+
+# ═══════ Q4: 有 ADD + 有 dev → 验收检查 ═══════
+issues=$(check_add_completeness "$handoff" "$add_route" 2>/dev/null || true)
+if [ -n "$issues" ]; then
+  build_stop_context "has_add_dev_unclosed" "$issues" >&2
+  exit $EXIT_BLOCK
+fi
+
+clear_dev_action 2>/dev/null || true
+echo "[ADD Stop] ✅ 验收通过——checklist 全部勾选，devlog 已记录。"
+exit 0

package/templates/adapters/codex/hooks.json

@@ -0,0 +1 @@
+{"hooks":{"SessionStart":[{"command":"bash .codex/hooks/session-start.sh"}],"UserPromptSubmit":[{"command":"bash .codex/hooks/prompt-submit.sh"}],"PreToolUse":[{"command":"bash .codex/hooks/pre-tool-use.sh"}],"PostToolUse":[{"command":"bash .codex/hooks/post-tool-use.sh"}],"Stop":[{"command":"bash .codex/hooks/stop-check.sh"}],"Notification":[{"matcher":"result","command":"bash .codex/hooks/notification.sh"}]}}

package/templates/adapters/codex/settings.json

@@ -0,0 +1 @@
+{}

package/templates/adapters/qoder/hooks/doc-format-guard.sh

@@ -84,10 +84,18 @@ if [ -z "$TEMPLATE_NAME" ]; then
       *plan*)            TEMPLATE_NAME="standard-plan-template.md" ;;
       *add-route*heavy*) TEMPLATE_NAME="add-route-template-heavyweight.md" ;;
       *add-route*)       TEMPLATE_NAME="add-route-template.md" ;;
+      *tasks*)           TEMPLATE_NAME="tasks-template.md" ;;
+      *spec*)            TEMPLATE_NAME="spec-template.md" ;;
+      *checklist*)       TEMPLATE_NAME="checklist-template.md" ;;
       *report*runtime*)  TEMPLATE_NAME="runtime-report-template.md" ;;
       *report*)          TEMPLATE_NAME="report-template.md" ;;
       *fix-verif*)       TEMPLATE_NAME="fix-verification-template.md" ;;
       *) 
+        # 增量修订识别：包含 ~~删除线~~ / → 新增标记 / [修订日期] 任意一个 → 视为增量更新，放行
+        if echo "$CONTENT" | grep -qE '~~.+~~|→|\[[0-9]{4}-[0-9]{2}-[0-9]{2}\s+修订'; then
+          echo "[doc-format-guard] 检测到增量修订格式，跳过完整章节校验" >&2
+          exit 0
+        fi
         echo "⛔ 拒绝：无法识别文档类型 (file_path: $file_path)，缺少模板匹配规则" >&2
         echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"无法识别 ADD 文档类型，请联系管理员更新 doc-format-guard.sh"}}'
         exit 2
@@ -96,7 +104,7 @@ if [ -z "$TEMPLATE_NAME" ]; then
   fi
 fi
 
-SCHEMA_FILE="$TEMPLATES_DIR/${TEMPLATE_NAME%.md}.schema.json"
+SCHEMA_FILE="$TEMPLATES_DIR/$(echo "${TEMPLATE_NAME%.md}" | sed 's/-template$//').schema.json"
 # L84: schema 文件不存在 → 无校验规则，阻断（不允许无规则放行）
 if [ ! -f "$SCHEMA_FILE" ]; then
   echo "⛔ 阻断：模板 ${TEMPLATE_NAME} 缺少对应的 .schema.json 校验规则" >&2

package/templates/adapters/qoder/hooks/lib/vocabulary.sh

@@ -2,7 +2,7 @@
 # vocabulary.sh — 从 vocabulary markdown 表格加载触发词
 # 单一数据源: .qoder/vocabulary/add-governance-vocabulary.md §类别 A-F 表格
 
-VOCABULARY_FILE="$PWD/.qoder/vocabulary/add-governance-vocabulary.md"
+VOCABULARY_FILE="${PROJECT_DIR:-$PWD}/.qoder/vocabulary/add-governance-vocabulary.md"
 
 # 输出格式: 优先级::触发词正则::响应文本（:: 避免与触发词内的 | 冲突）
 load_triggers() {

package/templates/adapters/qoder/hooks/notification.sh

@@ -1,21 +1,24 @@
 #!/bin/bash
-# notification.sh — Notification Review 提醒
+# notification.sh — Qoder CN Notification：Review 提醒
+# 治理卡位 #12: 开发提醒/Token 预警
 set -euo pipefail
+
 input=$(cat)
-ntype=$(echo "$input" | jq -r '.notification_type // ""')
+ntype=$(echo "$input" | jq -r '.notification_type // ""' 2>/dev/null || echo "")
 
 if [ "$ntype" != "result" ]; then
   exit 0
 fi
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$HOOK_DIR/lib/state-detect.sh"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+export PROJECT_DIR="${QODER_PROJECT_DIR:-${QODERCN_PROJECT_DIR:-$PWD}}"
+source "$HOOK_DIR/lib/common.sh" 2>/dev/null || true
 
 state=$(detect_active_add 2>/dev/null || true)
 [ -z "$state" ] && exit 0
 
-# 检查是否有未读 Review
-reviews_dir="${QODER_DIR:-.qoder}/reviews"
+reviews_dir="${PROJECT_DIR}/.qoder/reviews"
 if ls "$reviews_dir"/*.md >/dev/null 2>&1; then
   echo "[ADD Notification] 请检查 Review 文档: ${reviews_dir}"
 fi

package/templates/adapters/qoder/hooks/post-tool-use.sh

@@ -1,20 +1,30 @@
 #!/bin/bash
-# post-tool-use.sh — PostToolUse 审计提醒
+# post-tool-use.sh — Qoder CN PostToolUse：格式化 + 文档守卫 + 审计提醒
+# 治理卡位 #5: 格式化 + ADD文档守卫 + 审计落库 + 结果增强
 set -euo pipefail
+
 input=$(cat)
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "$HOOK_DIR/lib/common.sh" 2>/dev/null || true
+
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+
+if [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/(plans|specs|reviews)/'; then
+    echo "[ADD PostToolUse] ADD 文档已写入: ${file_path}。请确保章节完整、双向链接齐全、增量修订格式正确。" >&2
+  fi
 
-# 只在写入核心文件时提醒
-if ! echo "$file_path" | grep -qE 'src/agents/|src/lib/agent-audit-logger\.ts|src/types/|prisma/schema\.prisma'; then
+  echo "[ADD PostToolUse] 文件已写入: ${file_path}。请执行 record_dev_operation 落库审计（ADD-7）。" >&2
   exit 0
 fi
 
-HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$HOOK_DIR/lib/state-detect.sh"
-
-state=$(detect_active_add 2>/dev/null || true)
-[ -z "$state" ] && exit 0
+if [ "$tool_name" = "Bash" ]; then
+  echo "[ADD PostToolUse] 命令执行完成。如有 lint/tsc 错误请修复。" >&2
+  exit 0
+fi
 
-echo "[ADD PostToolUse] 文件已写入: ${file_path}。如果尚未记录，请执行 record_dev_operation({ targetId: '${file_path}' }) 落库审计。"
 exit 0

package/templates/adapters/qoder/hooks/pre-compact.sh

@@ -1,12 +1,37 @@
 #!/bin/bash
-# pre-compact.sh — PreCompact ADD 状态快照
+# pre-compact.sh — 上下文压缩前 ADD 状态保存（Claude Code 适配）
+# 治理卡位 #9: ADD状态保存 + 恢复清单导出 + tpl标记清理
 set -euo pipefail
+
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-source "$HOOK_DIR/lib/state-detect.sh"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# ── ① 获取 ADD 状态并保存到标记文件 ──
+if type detect_active_add >/dev/null 2>&1; then
+  state=$(detect_active_add 2>/dev/null || true)
+  if [ -n "$state" ]; then
+    IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+
+    # 写入恢复标记文件（SessionStart 恢复时读取）
+    RECOVERY_FILE="/tmp/add_recovery_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+    cat > "$RECOVERY_FILE" <<EOF
+plan=${plan}
+step=${step}
+rounds=${rounds}
+handoff=${handoff}
+add_route=${add_route}
+EOF
+
+    echo "[ADD PreCompact] ADD 状态已保存: Plan=${plan}, Step=${step}" >&2
+  fi
+fi
 
-state=$(detect_active_add 2>/dev/null || true)
-[ -z "$state" ] && exit 0
+# ── ② 清理 tpl-injected 标记（compact 后上下文丢失，下次需重注） ──
+TPL_FLAG="/tmp/add_tpl_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+rm -f "$TPL_FLAG" 2>/dev/null || true
 
-IFS='::' read -r plan step rounds handoff add_route <<< "$state"
-echo "[ADD PreCompact] 压缩前状态: Plan=${plan}, 轮次=${rounds}, Step=${step}"
 exit 0

package/templates/adapters/qoder/hooks/pre-tool-use.sh

@@ -1,77 +1,79 @@
 #!/bin/bash
-# pre-tool-use.sh — PreToolUse §B：源码 Plan 关联检查（阻断模式 v3）
+# pre-tool-use.sh — Qoder CN PreToolUse：四路守卫
+# 治理卡位 #4: 危险命令拦截 / 模板路径兜底 / 写入前置守卫 / 敏感文件保护
 set -euo pipefail
 
 input=$(cat)
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
-
-if ! echo "$file_path" | grep -qE '(src/|/src/).*\.(ts|tsx)$'; then
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+export PROJECT_DIR="${QODER_PROJECT_DIR:-${QODERCN_PROJECT_DIR:-$PWD}}"
+source "$HOOK_DIR/lib/common.sh" 2>/dev/null || true
+
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+
+# ── ① Bash matcher: 危险命令拦截 + 终端写文件拦截 ──
+if [ "$tool_name" = "Bash" ]; then
+  cmd=$(echo "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  # 危险命令
+  if echo "$cmd" | grep -qiE 'rm[[:space:]]+-rf[[:space:]]+/|DROP[[:space:]]+TABLE|git[[:space:]]+push[[:space:]]+--force|mkfs\.|dd[[:space:]]+if='; then
+    echo "⛔ 危险命令已被阻止: $cmd" >&2
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"危险命令已被阻止\"}}"
+    exit 2
+  fi
+  # 终端写文件拦截（含 > / >> / << heredoc / mv / touch / python -c > file）
+  if echo "$cmd" | grep -qE '(cat|echo|tee|sed[[:space:]]+-i|awk|printf|cp|mv|dd|touch)[[:space:]]*.*([>]{1,2}|[|][[:space:]]*tee|<<)'; then
+    echo "⛔ 禁止通过终端命令直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"禁止通过终端直接写文件，请使用 IDE 工具\"}}"
+    exit 2
+  fi
+  # mv 无重定向但仍操作文件
+  if echo "$cmd" | grep -qE '^[[:space:]]*mv[[:space:]]+/tmp/'; then
+    echo "⛔ 禁止通过 mv /tmp/ 绕过 IDE 工具: $cmd" >&2
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"禁止通过 mv 绕过 IDE 工具\"}}"
+    exit 2
+  fi
+  # python/node 脚本写文件
+  if echo "$cmd" | grep -qE '(python3|python|node)[[:space:]].*[>]{1,2}'; then
+    echo "⛔ 禁止通过脚本语言直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"禁止通过脚本语言直接写文件，请使用 IDE 工具\"}}"
+    exit 2
+  fi
+  mark_dev_action 2>/dev/null || true
   exit 0
 fi
 
-PROJECT_DIR="${QODER_PROJECT_DIR:-${QODERCN_PROJECT_DIR:-$PWD}}"
-MOD=$(basename "$file_path" | sed 's/\.[jt]sx\?$//')
-
-MATCHES=$(grep -rl "$MOD" "$PROJECT_DIR/.qoder/plans" "$PROJECT_DIR/.qoder/specs" "$PROJECT_DIR/.qoder/reports" 2>/dev/null | wc -l)
-
-if [ "$MATCHES" -gt 0 ]; then
-  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"相关 ADD Plan 已存在"}}'
+# ── ② Write/Edit matcher: 文件写入前置守卫 ──
+if [ "$tool_name" = "Write" ] || [ "$tool_name" = "Edit" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/(plans|specs|reviews)/'; then
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+      if [ -z "$state" ]; then
+        echo "[ADD PreToolUse] ⚠️ 正在写入 Plan/Spec/Review 文档但无活跃 ADD Plan——请先执行 add-paradigm" >&2
+      fi
+    fi
+  fi
+
+  if echo "$file_path" | grep -qE '\.env$|\.env\.production$|\.env\.local$|credentials|secrets'; then
+    echo "⛔ 敏感文件受保护，禁止写入: $file_path" >&2
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"敏感文件受保护\"}}"
+    exit 2
+  fi
+
+  mark_dev_action 2>/dev/null || true
   exit 0
 fi
 
-echo "⛔ 阻断: ${file_path} 无相关 ADD Plan。请先创建 Plan（plan-template / simple-plan-template）。" >&2
-echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"无相关 ADD Plan。请用 AskUserQuestion 询问用户选择 plan-template 或 simple-plan-template 创建 Plan。"}}'
-exit 2
-#!/bin/bash
-# pre-tool-use.sh — PreToolUse §B：源码 Plan 关联检查（阻断模式）
-set -euo pipefail
-
-input=$(cat)
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
-
-# 只处理 src/**/*.ts / src/**/*.tsx
-if ! echo "$file_path" | grep -qE '^src/.*\.(ts|tsx)$' && ! echo "$file_path" | grep -qE '^/home/.*/src/.*\.(ts|tsx)$'; then
+# ── ③ Read matcher: 模板路径兜底 ──
+if [ "$tool_name" = "Read" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  if echo "$file_path" | grep -q 'templates/'; then
+    echo "[ADD PreToolUse] 提示: 模板文件已通过 hook 预读到上下文，可跳过重复读取" >&2
+  fi
   exit 0
 fi
 
-PROJECT_DIR="${QODER_PROJECT_DIR:-${QODERCN_PROJECT_DIR:-$PWD}}"
-PLANS_DIR="$PROJECT_DIR/.qoder/plans"
-SPECS_DIR="$PROJECT_DIR/.qoder/specs"
-REPORTS_DIR="$PROJECT_DIR/.qoder/reports"
-
-MOD=$(basename "$file_path" | sed 's/\.[jt]sx\?$//')
-
-MATCHES=$(grep -rl "$MOD" "$PLANS_DIR" "$SPECS_DIR" "$REPORTS_DIR" 2>/dev/null \
-  | sed "s|$PROJECT_DIR/||" \
-  | grep -oE '[^/]*-(plan|handoff|review|report)-v[0-9]+' \
-  | sed 's/\(plan\|handoff\|review\|report\)-v[0-9]\+\.md//' \
-  | sort -u | head -10 2>/dev/null || true)
-
-if [ -n "$MATCHES" ]; then
-  cat >&2 <<EOF
-[ADD PreToolUse] 📋 相关文档:
-$(echo "$MATCHES" | sed 's/^/  - /')
-允许编辑 $file_path。
-EOF
-  exit 0
-fi
-
-cat >&2 <<EOF
-[ADD PreToolUse] ⛔ 阻断：${file_path} 无相关 ADD 文档。
-
-必须先生成 Plan 后才能修改源码。请执行：
-  ① 用 AskUserQuestion 询问用户：要创建 Plan 吗？
-     A) plan-template     — 复杂改动，含架构设计 + 独立 Spec
-     B) simple-plan-template — 单一修复，Tasks 内联于 Plan 体
-  ② 按模板创建 Plan → Plan 中引用此文件路径
-  ③ 重新执行修改操作
-
-JSON 输出格式（阻断时必须）:
-{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"无相关 ADD Plan，请先生成 Plan 文档"}}
-EOF
-
-# 输出阻断 JSON 到 stdout，Qoder 会读它来展示阻断原因
-echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"无相关 ADD Plan，请先生成 Plan 文档"}}'
-exit 2
+exit 0

package/templates/adapters/qoder/hooks/prompt-submit.sh

@@ -1,13 +1,20 @@
 #!/bin/bash
 # prompt-submit.sh — UserPromptSubmit 触发词智能路由（★入口）
+# 治理卡位 #3: 触发词路由 + 模板全文注入（增量插入，保留 Layer 1/2/3）
 input=$(cat)
 prompt=$(echo "$input" | jq -r '.prompt // empty')
 [ -z "$prompt" ] && exit 0
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+export PROJECT_DIR="${QODER_PROJECT_DIR:-${QODERCN_PROJECT_DIR:-$PWD}}"
+source "$HOOK_DIR/lib/common.sh" 2>/dev/null || true
 source "$HOOK_DIR/lib/vocabulary.sh"
 source "$HOOK_DIR/lib/state-detect.sh"
 
+# ─── additionalContext 注入（Qoder CN IDE 通过 stdout JSON 注入模型上下文）───
+echo '{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"ADD workflow active. Templates preloaded. Use add-paradigm SKILL."}}'
+
 # ─── Layer 1: 精准 P0 触发词 ───
 matched=$(match_trigger "$prompt")
 if [ -n "$matched" ]; then
@@ -27,6 +34,7 @@ if [ -n "$matched" ]; then
           "  ★ 同步检查: 如 checklist 有新 cuid 但 handoff 审计表缺失 → 更新 handoff ADD-7 表 + query_audit_logs 命令"
         # 执行 checklist 质量检查
         HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
         "$HOOK_DIR/review-checklist.sh" "$_handoff" "$_add_route" 2>/dev/null
         exit 0
       fi
@@ -46,7 +54,7 @@ if ! echo "$prompt" | grep -qiE "$dev_kw"; then
   exit 0
 fi
 
-# ─── Layer 2/3: 按活跃 ADD 分流 ───
+# ─── Layer 2/3: 按活跃 ADD 分流（原 Layer 2/3，不修改） ───
 state=$(detect_active_add 2>/dev/null || true)
 if [ -z "$state" ]; then
   # Layer 2: 无活跃 ADD → 强制启动
@@ -68,5 +76,7 @@ plan=$(echo "$state" | awk -F'::' '{print $1}')
 step=$(echo "$state" | awk -F'::' '{print $2}')
 rounds=$(echo "$state" | awk -F'::' '{print $3}')
 handoff=$(echo "$state" | awk -F'::' '{print $4}')
-echo "[ADD 状态] Plan: ${plan}, 轮次: ${rounds}, Step: ${step}, handoff: ${handoff}"
+add_route=$(echo "$state" | awk -F'::' '{print $5}')
+echo "{\"hookSpecificOutput\":{\"hookEventName\":\"UserPromptSubmit\",\"additionalContext\":\"[ADD 状态] Plan: ${plan}, 轮次: ${rounds}, Step: ${step}, handoff: ${handoff}\"}}"
 exit 0
+

package/templates/adapters/qoder/hooks/session-end.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# SessionEnd — Qoder CN 专用（独立实现，stdout JSON additionalContext 注入）
+# 治理卡位 #2: 标记清理 + 会话审计结算 + Stop未触发兜底
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+export PROJECT_DIR="${QODER_PROJECT_DIR:-${QODERCN_PROJECT_DIR:-$PWD}}"
+source "$HOOK_DIR/lib/common.sh" 2>/dev/null || true
+
+# ── ① 清理标记文件 ──
+project_hash=$(echo "${PROJECT_DIR:-$PWD}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")
+rm -f "/tmp/add_tpl_${project_hash}" 2>/dev/null || true
+rm -f "/tmp/add_dev_${project_hash}" 2>/dev/null || true
+
+# ── ② Stop 未触发兜底 ──
+fallback_msg=""
+if has_dev_action 2>/dev/null; then
+  fallback_msg="⚠️ 检测到 dev action 标记未清除——Stop 可能未触发验收检查"
+fi
+
+# ── ③ stdout JSON additionalContext ──
+echo "{\"hookSpecificOutput\":{\"hookEventName\":\"SessionEnd\",\"additionalContext\":\"[ADD SessionEnd] 会话结束 — $(date -Iseconds)。标记已清理。${fallback_msg}\"}}"
+exit 0