add-coder 0.1.17 → 0.2.1

package/templates/adapters/claude/hooks/pre-compact.sh

@@ -1,14 +1,37 @@
 #!/bin/bash
-# PreCompact — 上下文压缩前检查（Claude Code 适配）
+# pre-compact.sh — 上下文压缩前 ADD 状态保存（Claude Code 适配）
+# 治理卡位 #9: ADD状态保存 + 恢复清单导出 + tpl标记清理
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-# 检查是否有未完成的 ADD 审计记录
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -d "$PROJECT_DIR/.qoder/plans" ] || exit 0
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-echo "[ADD PreCompact] 上下文压缩前，请确认 ADD-7 审计记录已落库。"
-exit 0
+# ── ① 获取 ADD 状态并保存到标记文件 ──
+if type detect_active_add >/dev/null 2>&1; then
+  state=$(detect_active_add 2>/dev/null || true)
+  if [ -n "$state" ]; then
+    IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+
+    # 写入恢复标记文件（SessionStart 恢复时读取）
+    RECOVERY_FILE="/tmp/add_recovery_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+    cat > "$RECOVERY_FILE" <<EOF
+plan=${plan}
+step=${step}
+rounds=${rounds}
+handoff=${handoff}
+add_route=${add_route}
+EOF
+
+    echo "[ADD PreCompact] ADD 状态已保存: Plan=${plan}, Step=${step}" >&2
+  fi
+fi
+
+# ── ② 清理 tpl-injected 标记（compact 后上下文丢失，下次需重注） ──
+TPL_FLAG="/tmp/add_tpl_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+rm -f "$TPL_FLAG" 2>/dev/null || true
+
+exit 0

package/templates/adapters/claude/hooks/pre-tool-use.sh

@@ -1,28 +1,78 @@
 #!/bin/bash
-# pre-tool-use.sh — Claude Code PreToolUse：源码 Plan 关联检查
-# 与 Qoder 版本共享核心逻辑，差异仅在工具名和环境变量
+# pre-tool-use.sh — Claude Code PreToolUse：四路守卫
+# 治理卡位 #4: 危险命令拦截 / 模板路径兜底 / 写入前置守卫 / 敏感文件保护
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
 input=$(parse_input)
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
 
-if ! echo "$file_path" | grep -qE '(src/|/src/).*\.(ts|tsx)$'; then
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# ── ① Bash matcher: 危险命令拦截 + 终端写文件拦截 ──
+if [ "$tool_name" = "Bash" ]; then
+  cmd=$(echo "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  # 危险命令
+  if echo "$cmd" | grep -qiE 'rm[[:space:]]+-rf[[:space:]]+/|DROP[[:space:]]+TABLE|git[[:space:]]+push[[:space:]]+--force|mkfs\.|dd[[:space:]]+if='; then
+    echo "⛔ 危险命令已被阻止: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # 终端写文件拦截（含 > / >> / << heredoc / mv / touch / python -c > file）
+  if echo "$cmd" | grep -qE '(cat|echo|tee|sed[[:space:]]+-i|awk|printf|cp|mv|dd|touch)[[:space:]]*.*([>]{1,2}|[|][[:space:]]*tee|<<)'; then
+    echo "⛔ 禁止通过终端命令直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  # mv 无重定向但仍操作文件
+  if echo "$cmd" | grep -qE '^[[:space:]]*mv[[:space:]]+/tmp/'; then
+    echo "⛔ 禁止通过 mv /tmp/ 绕过 IDE 工具: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # python/node 脚本写文件
+  if echo "$cmd" | grep -qE '(python3|python|node)[[:space:]].*[>]{1,2}'; then
+    echo "⛔ 禁止通过脚本语言直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  mark_dev_action
   exit 0
 fi
 
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
-MOD=$(basename "$file_path" | sed 's/\.[jt]sx\?$//')
+# ── ② Write/Edit matcher: 文件写入前置守卫 ──
+if [ "$tool_name" = "Write" ] || [ "$tool_name" = "Edit" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  # 检查是否写入 plans/specs/reviews 目录但无活跃 ADD Plan
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/plans/|\.(qoder|claude|add)/specs/|\.(qoder|claude|add)/reviews/'; then
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+      if [ -z "$state" ]; then
+        echo "[ADD PreToolUse] ⚠️ 正在写入 Plan/Spec/Review 文档但无活跃 ADD Plan——请先执行 add-paradigm" >&2
+      fi
+    fi
+  fi
+
+  # 敏感文件保护
+  if echo "$file_path" | grep -qE '\.env$|\.env\.production$|\.env\.local$|credentials|secrets'; then
+    echo "⛔ 敏感文件受保护，禁止写入: $file_path" >&2
+    exit $EXIT_BLOCK
+  fi
 
-MATCHES=$(grep -rl "$MOD" "$PROJECT_DIR/.qoder/plans" "$PROJECT_DIR/.qoder/specs" "$PROJECT_DIR/.qoder/reports" 2>/dev/null | wc -l)
+  mark_dev_action
+  exit 0
+fi
 
-if [ "$MATCHES" -gt 0 ]; then
+# ── ③ Read matcher: 模板路径兜底 ──
+if [ "$tool_name" = "Read" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  if echo "$file_path" | grep -q 'templates/'; then
+    echo "[ADD PreToolUse] 提示: 模板文件已通过 hook 预读到上下文，可跳过重复读取" >&2
+  fi
   exit 0
 fi
 
-echo "⛔ 阻断: ${file_path} 无相关 ADD Plan。请先创建 Plan。" >&2
-exit $EXIT_BLOCK
+exit 0

package/templates/adapters/claude/hooks/prompt-submit.sh

@@ -1,16 +1,78 @@
 #!/bin/bash
-# UserPromptSubmit — 用户输入提交前检查（ADD 关键词兜底）
+# UserPromptSubmit — 触发词路由 + 模板全文注入（Claude Code 适配）
+# 治理卡位 #3: Layer 1 精准触发 → Layer 2 阻断 → Layer 3 状态注入
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
 
 input=$(parse_input)
-prompt=$(echo "$input" | jq -r '.prompt // empty')
+prompt=$(echo "$input" | grep -o '"prompt"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+[ -z "$prompt" ] && exit 0
+
+# ─── Layer 1: 精准触发词路由 + 验收幂等保护 ───
+matched=$(match_trigger "$prompt")
+if [ -n "$matched" ]; then
+  if echo "$prompt" | grep -qiE '验收|收敛' 2>/dev/null; then
+    add_state=$(detect_active_add 2>/dev/null || true)
+    if [ -n "$add_state" ]; then
+      _handoff=$(echo "$add_state" | awk -F'::' '{print $4}')
+      _add_route=$(echo "$add_state" | awk -F'::' '{print $5}')
+      if is_already_accepted "$_add_route" "$_handoff" 2>/dev/null; then
+        cat <<EOF
+[ADD 验收] ⚠️ 已验收。进入 Review 模式:
+  ① 重新检查 checklist [T]/[R] 项
+  ② 审查 audit 记录完整性
+  ③ 如有差异 → Review 回流至 handoff（增量更新）
+  ④ 无差异 → 记录 'Review 已确认，无新发现'
+EOF
+        exit 0
+      fi
+    fi
+  fi
+  echo "$matched"
+  exit 0
+fi
 
-# 检测 ADD 关键词触发
-if echo "$prompt" | grep -qiE '开发|改功能|修.?bug|加需求|新增|重构|实施|验收|继续'; then
-  echo "[ADD PromptSubmit] 检测到开发关键词，请确认已加载 ADD 工作流上下文。"
+# ─── 开发关键词检测 ───
+if ! echo "$prompt" | grep -qiE '开发|改功能|修.?bug|加需求|新增|重构|实施|验收|继续|生成plan|生成计划'; then
+  exit 0
 fi
-exit 0
+
+echo "[ADD PromptSubmit] 检测到开发关键词" >&2
+
+# ─── Layer 2: 无活跃 ADD → 阻断 ───
+state=$(detect_active_add 2>/dev/null || true)
+if [ -z "$state" ]; then
+  cat <<'EOF'
+[ADD 强制规则] 检测到开发任务。你必须先执行 add-paradigm SKILL 完成 ADD 工作流:
+  Step 0: 文档先行 (Plan → Review → Specs)
+  Step 3: 代码实现 + 审计植入
+  Step 8: 收敛判断
+如果 add-paradigm SKILL 尚未激活，请先调用它。
+EOF
+  exit 2
+fi
+
+# ─── Layer 3: 有活跃 ADD → 注入状态 + 模板全文 ───
+IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+cat <<EOF
+[ADD 当前状态]
+  Plan: ${plan}
+  轮次: ${rounds}
+  当前 Step: ${step}
+  handoff: ${handoff}
+EOF
+
+# 模板全文注入（tpl-injected 去重）
+TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
+if [ -f "$TPL_SCRIPT" ]; then
+  bash "$TPL_SCRIPT" --full --top 5
+fi
+
+exit 0

package/templates/adapters/claude/hooks/session-end.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+###
+ # @Author       : xiaomingming wujixmm@gmail.com
+ # @Date         : 2026-07-17 13:35:03
+ # @LastEditors  : xiaomingming wujixmm@gmail.com
+ # @LastEditTime : 2026-07-17 13:35:04
+ # @FilePath     : /add-coder/templates/adapters/claude/hooks/session-end.sh
+ # @Description  : 
+### 
+# SessionEnd — Claude Code 适配（薄包装）
+# 治理卡位 #2: 标记清理 + 会话审计结算 + Stop未触发兜底
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# source 共享版本并自动执行 main()
+SHARED="$HOOK_DIR/lib/session-end.sh"
+if [ -f "$SHARED" ]; then
+  source "$SHARED"
+fi

package/templates/adapters/claude/hooks/session-start.sh

@@ -1,23 +1,36 @@
 #!/bin/bash
-# SessionStart — ADD 上下文恢复（Claude Code 适配）
+# SessionStart — ADD 上下文恢复 + 模板索引注入（Claude Code 适配）
+# 治理卡位 #1: ADD状态恢复 + 模板索引注入
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
 
-# 尝试加载 Qoder 的 state-detect 和 context-inject 库
-QODER_LIB="$HOOK_DIR/../../qoder/hooks/lib"
-[ -f "$QODER_LIB/state-detect.sh" ] && source "$QODER_LIB/state-detect.sh"
-[ -f "$QODER_LIB/context-inject.sh" ] && source "$QODER_LIB/context-inject.sh"
+# 加载四端通用函数（路径统一后: .claude/hooks/lib/common.sh）
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-export QODER_PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+# 设置项目目录
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
 
+# ── ① ADD 状态恢复 ──
 state=$(detect_active_add 2>/dev/null || true)
-if [ -z "$state" ]; then
-  exit 0
+if [ -n "$state" ]; then
+  IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+  cat <<EOF
+[ADD SessionStart] 检测到活跃 ADD Plan:
+  Plan: ${plan}
+  轮次: ${rounds}
+  当前 Step: ${step}
+  handoff: ${handoff}
+  恢复命令: query_audit_logs({ planKeyword: '${plan}' })
+EOF
 fi
 
-IFS='::' read -r plan step rounds handoff <<< "$state"
-build_session_start_json "$plan" "$step" "$rounds" "$handoff"
-exit 0
+# ── ② 模板索引注入 ──
+TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
+if [ -f "$TPL_SCRIPT" ]; then
+  bash "$TPL_SCRIPT" --index
+fi
+
+exit 0

package/templates/adapters/claude/hooks/stop-check.sh

@@ -1,10 +1,45 @@
 #!/bin/bash
-# Stop — 停止前合规检查（Claude Code 适配）
+# stop-check.sh — Claude Code Stop：四象限分流 + 验收检查（few-shot 上下文注入）
+# 治理卡位 #7: 验收检查 + devlog + 阻断
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-echo "[ADD Stop] 会话结束前，请确认所有 checklist 项已勾选、ADD-7 审计已落库。"
-exit 0
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+state=$(detect_active_add 2>/dev/null || true)
+has_dev=$(has_dev_action 2>/dev/null && echo "true" || echo "false")
+
+# ═══════ Q1: 无 ADD + 无 dev → 正常停 ═══════
+if [ -z "$state" ] && [ "$has_dev" != "true" ]; then
+  exit 0
+fi
+
+# ═══════ Q2: 无 ADD + 有 dev → 严重违规，few-shot 注入 ═══════
+if [ -z "$state" ] && [ "$has_dev" = "true" ]; then
+  build_stop_context "no_add_has_dev" >&2
+  exit $EXIT_BLOCK
+fi
+
+IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+
+# ═══════ Q3: 有 ADD + 无 dev → 注入状态 ═══════
+if [ "$has_dev" != "true" ]; then
+  echo "[ADD Stop] Plan: ${plan}, 轮次: ${rounds}, Step: ${step}"
+  echo "本次无代码改动。下次继续时执行 session-init 恢复上下文。"
+  exit 0
+fi
+
+# ═══════ Q4: 有 ADD + 有 dev → 验收检查 ═══════
+issues=$(check_add_completeness "$handoff" "$add_route" 2>/dev/null || true)
+if [ -n "$issues" ]; then
+  build_stop_context "has_add_dev_unclosed" "$issues" >&2
+  exit $EXIT_BLOCK
+fi
+
+clear_dev_action 2>/dev/null || true
+echo "[ADD Stop] ✅ 验收通过——checklist 全部勾选，devlog 已记录。"
+exit 0

package/templates/adapters/claude/hooks/stop-failure.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+###
+ # @Author       : xiaomingming wujixmm@gmail.com
+ # @Date         : 2026-07-17 13:35:41
+ # @LastEditors  : xiaomingming wujixmm@gmail.com
+ # @LastEditTime : 2026-07-17 13:35:41
+ # @FilePath     : /add-coder/templates/adapters/claude/hooks/stop-failure.sh
+ # @Description  : 
+### 
+# stop-failure.sh — Claude Code StopFailure：紧急审计转储
+# 治理卡位 #8: 紧急审计转储 + 异常标记
+# Claude Code 独有事件
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+echo "[ADD StopFailure] ⚠️ Agent 异常退出 — $(date -Iseconds)" >&2
+
+# 尝试 dump 当前 ADD 状态
+if type detect_active_add >/dev/null 2>&1; then
+  state=$(detect_active_add 2>/dev/null || true)
+  if [ -n "$state" ]; then
+    IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+    cat >&2 <<EOF
+[ADD StopFailure] 异常退出时 ADD 状态:
+  Plan: ${plan}
+  Step: ${step}
+  轮次: ${rounds}
+  handoff: ${handoff}
+  add-route: ${add_route}
+EOF
+  fi
+fi
+
+# 标记异常终止（供 SessionEnd 兜底识别）
+FAILURE_FLAG="/tmp/add_failure_$(echo "${PROJECT_DIR}" | md5sum 2>/dev/null | cut -c1-8 || echo "default")"
+touch "$FAILURE_FLAG" 2>/dev/null || true
+
+exit 0

package/templates/adapters/claude/hooks/subagent-guard.sh

@@ -1,15 +1,36 @@
 #!/bin/bash
-# SubagentStart/SubagentStop — 子代理门禁（Claude Code 适配）
+###
+ # @Author       : xiaomingming wujixmm@gmail.com
+ # @Date         : 2026-07-08 18:03:52
+ # @LastEditors  : xiaomingming wujixmm@gmail.com
+ # @LastEditTime : 2026-07-17 18:04:04
+ # @FilePath     : /add-coder/templates/adapters/claude/hooks/subagent-guard.sh
+ # @Description  : 
+### 
+# SubagentStart — 子代理 ADD 上下文注入（Claude Code 适配）
+# 治理卡位 #10: ADD上下文注入子agent + 审计初始化
 set -euo pipefail
 
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
-SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
-[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
 
-input=$(parse_input)
-event=$(echo "$input" | jq -r '.hook_event_name // empty')
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
 
-if [ "$event" = "SubagentStart" ]; then
-  echo "[ADD SubagentGuard] 子代理启动，请确认其遵循 ADD 规范。"
+if type detect_active_add >/dev/null 2>&1; then
+  state=$(detect_active_add 2>/dev/null || true)
+  if [ -n "$state" ]; then
+    IFS='::' read -r plan step rounds handoff add_route <<< "$state"
+    cat <<EOF
+[ADD SubagentStart] 子代理上下文注入:
+  Plan: ${plan}
+  Step: ${step}
+  轮次: ${rounds}
+  handoff: ${handoff}
+  遵循 ADD 规范，完成后请检查 checklist 对应项
+EOF
+  fi
 fi
-exit 0
+
+exit 0

package/templates/adapters/claude/hooks/subagent-stop.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+###
+ # @Author       : xiaomingming wujixmm@gmail.com
+ # @Date         : 2026-07-17 13:35:20
+ # @LastEditors  : xiaomingming wujixmm@gmail.com
+ # @LastEditTime : 2026-07-17 13:35:21
+ # @FilePath     : /add-coder/templates/adapters/claude/hooks/subagent-stop.sh
+ # @Description  : 
+### 
+# SubagentStop — Claude Code 适配（薄包装）
+# 治理卡位 #11: 子agent边界校验 + 审计聚合 + 阻断
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+SHARED="$HOOK_DIR/lib/subagent-stop.sh"
+if [ -f "$SHARED" ]; then
+  source "$SHARED"
+fi

package/templates/adapters/codex/hooks/notification.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Notification — Review 提醒 + Token 预警（Claude Code 适配）
+# 治理卡位 #12: 开发提醒/Token 预警
+set -euo pipefail
+
+input=$(cat)
+ntype=$(echo "$input" | jq -r '.notification_type // ""' 2>/dev/null || echo "")
+
+if [ "$ntype" != "result" ]; then
+  exit 0
+fi
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+export PROJECT_DIR="$PWD"
+
+state=$(detect_active_add 2>/dev/null || true)
+[ -z "$state" ] && exit 0
+
+IFS='::' read -r plan _ _ _ _ <<< "$state"
+
+reviews_dir="${PROJECT_DIR}/.qoder/reviews"
+if ls "$reviews_dir"/*.md >/dev/null 2>&1; then
+  echo "[ADD Notification] Plan: ${plan} — 请检查 Review 文档: ${reviews_dir}"
+fi
+exit 0
+#!/bin/bash
+# Notification — 通知事件处理（Claude Code 适配）
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+SHARED_LIB="$HOOK_DIR/../../shared/hooks-lib/common.sh"
+[ -f "$SHARED_LIB" ] && source "$SHARED_LIB"
+
+exit 0

package/templates/adapters/codex/hooks/post-tool-use.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# post-tool-use.sh — Claude Code PostToolUse：格式化 + 文档守卫 + 审计提醒
+# 治理卡位 #5: 格式化 + ADD文档守卫 + 审计落库 + 结果增强
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+input=$(parse_input)
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+
+# ── Edit/Write matcher: 格式化 + ADD文档守卫 ──
+if [ "$tool_name" = "Edit" ] || [ "$tool_name" = "Write" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  # ADD 文档结构守卫：写入 plans/specs/reviews 后提示
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/(plans|specs|reviews)/'; then
+    echo "[ADD PostToolUse] ADD 文档已写入: ${file_path}。请确保章节完整、双向链接齐全、增量修订格式正确。" >&2
+  fi
+
+  # 审计提醒（所有文件写入）
+  echo "[ADD PostToolUse] 文件已写入: ${file_path}。请执行 record_dev_operation 落库审计（ADD-7）。" >&2
+  exit 0
+fi
+
+# ── Bash matcher: 结果增强 ──
+if [ "$tool_name" = "Bash" ]; then
+  echo "[ADD PostToolUse] 命令执行完成。如有 lint/tsc 错误请修复。" >&2
+  exit 0
+fi
+
+exit 0

package/templates/adapters/codex/hooks/pre-tool-use.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# pre-tool-use.sh — Claude Code PreToolUse：四路守卫
+# 治理卡位 #4: 危险命令拦截 / 模板路径兜底 / 写入前置守卫 / 敏感文件保护
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
+export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
+COMMON_LIB="$HOOK_DIR/lib/common.sh"
+[ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+
+input=$(parse_input)
+tool_name=$(json_get "$input" "tool_name")
+[ -z "$tool_name" ] && tool_name=$(echo "$input" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+
+export PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$PWD}"
+
+# ── ① Bash matcher: 危险命令拦截 + 终端写文件拦截 ──
+if [ "$tool_name" = "Bash" ]; then
+  cmd=$(echo "$input" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  # 危险命令
+  if echo "$cmd" | grep -qiE 'rm[[:space:]]+-rf[[:space:]]+/|DROP[[:space:]]+TABLE|git[[:space:]]+push[[:space:]]+--force|mkfs\.|dd[[:space:]]+if='; then
+    echo "⛔ 危险命令已被阻止: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # 终端写文件拦截（含 > / >> / << heredoc / mv / touch / python -c > file）
+  if echo "$cmd" | grep -qE '(cat|echo|tee|sed[[:space:]]+-i|awk|printf|cp|mv|dd|touch)[[:space:]]*.*([>]{1,2}|[|][[:space:]]*tee|<<)'; then
+    echo "⛔ 禁止通过终端命令直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  # mv 无重定向但仍操作文件
+  if echo "$cmd" | grep -qE '^[[:space:]]*mv[[:space:]]+/tmp/'; then
+    echo "⛔ 禁止通过 mv /tmp/ 绕过 IDE 工具: $cmd" >&2
+    exit $EXIT_BLOCK
+  fi
+  # python/node 脚本写文件
+  if echo "$cmd" | grep -qE '(python3|python|node)[[:space:]].*[>]{1,2}'; then
+    echo "⛔ 禁止通过脚本语言直接写文件: $cmd。请使用 Write/Edit/SearchReplace 工具。" >&2
+    exit $EXIT_BLOCK
+  fi
+  mark_dev_action
+  exit 0
+fi
+
+# ── ② Write/Edit matcher: 文件写入前置守卫 ──
+if [ "$tool_name" = "Write" ] || [ "$tool_name" = "Edit" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  [ -z "$file_path" ] && exit 0
+
+  # 检查是否写入 plans/specs/reviews 目录但无活跃 ADD Plan
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/plans/|\.(qoder|claude|add)/specs/|\.(qoder|claude|add)/reviews/'; then
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+      if [ -z "$state" ]; then
+        echo "[ADD PreToolUse] ⚠️ 正在写入 Plan/Spec/Review 文档但无活跃 ADD Plan——请先执行 add-paradigm" >&2
+      fi
+    fi
+  fi
+
+  # 敏感文件保护
+  if echo "$file_path" | grep -qE '\.env$|\.env\.production$|\.env\.local$|credentials|secrets'; then
+    echo "⛔ 敏感文件受保护，禁止写入: $file_path" >&2
+    exit $EXIT_BLOCK
+  fi
+
+  mark_dev_action
+  exit 0
+fi
+
+# ── ③ Read matcher: 模板路径兜底 ──
+if [ "$tool_name" = "Read" ]; then
+  file_path=$(echo "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | sed 's/.*: *"\([^"]*\)".*/\1/' || echo "")
+  if echo "$file_path" | grep -q 'templates/'; then
+    echo "[ADD PreToolUse] 提示: 模板文件已通过 hook 预读到上下文，可跳过重复读取" >&2
+  fi
+  exit 0
+fi
+
+exit 0