add-coder 0.2.8 → 0.2.10

package/templates/adapters/vscode/hooks/prompt-submit.sh

@@ -8,6 +8,7 @@ export CURRENT_MAGIC=$(basename "$(dirname "$HOOK_DIR")")
 
 COMMON_LIB="$HOOK_DIR/lib/common.sh"
 [ -f "$COMMON_LIB" ] && source "$COMMON_LIB"
+[ -f "$HOOK_DIR/lib/notify.sh" ] && source "$HOOK_DIR/lib/notify.sh" 2>/dev/null || true
 
 export PROJECT_DIR="$PWD"
 
@@ -56,6 +57,7 @@ if [ -z "$state" ]; then
   Step 8: 收敛判断
 如果 add-paradigm SKILL 尚未激活，请先调用它。
 EOF
+  write_hook_event "prompt-submit" "deny" "$prompt" "无活跃 ADD Plan 下检测到开发任务" "no-active-plan" "none" 2>/dev/null || true
   exit 2
 fi
 
@@ -69,6 +71,20 @@ cat <<EOF
   handoff: ${handoff}
 EOF
 
+# ─── Hook 治理日报（注入 AI 上下文）───
+HOOK_JSONL="${MAGIC_DIR:-.qoder}/reports/hook-events.jsonl"
+if [ -f "$HOOK_JSONL" ]; then
+  TODAY="$(date +%Y-%m-%d)"
+  TOTAL=$(grep -c "\"ts\":\"${TODAY}" "$HOOK_JSONL" 2>/dev/null || echo 0)
+  NO_PLAN=$(grep "\"ts\":\"${TODAY}" "$HOOK_JSONL" 2>/dev/null | grep -c '"planKeyword":"no-active-plan"' || echo 0)
+  if [ "$TOTAL" -gt 0 ] 2>/dev/null; then
+    echo "[Hook 治理] 今日拦截: ${TOTAL} 次 | 无 Plan 违规: ${NO_PLAN} 次"
+    if [ "$NO_PLAN" -ge 10 ] 2>/dev/null; then
+      echo "[Hook ⚠️] 无 Plan 违规已达 ${NO_PLAN} 次（≥10），建议创建 Plan"
+    fi
+  fi
+fi
+
 # 模板全文注入（tpl-injected 去重）
 TPL_SCRIPT="$HOOK_DIR/lib/preload-templates.sh"
 if [ -f "$TPL_SCRIPT" ]; then

package/templates/core/hooks/doc-format-guard.sh

@@ -8,6 +8,18 @@ input=$(cat)
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
 PARENT_DIR="$(dirname "$HOOK_DIR")"
 MAGIC_DIR="$(basename "$PARENT_DIR")"
+PROJECT_DIR="$PWD"
+
+# ── Hook 通知: 拦截事件写入 jsonl（旁路，失败不阻断 exit 2）──
+source "${HOOK_DIR}/lib/notify.sh" 2>/dev/null || true
+ACTIVE_PLAN=$(detect_active_add 2>/dev/null || true)
+if [ -n "$ACTIVE_PLAN" ]; then
+  PLAN_KEYWORD="${ACTIVE_PLAN%%::*}"
+  PLAN_STATUS="active"
+else
+  PLAN_KEYWORD="no-active-plan"
+  PLAN_STATUS="none"
+fi
 
 # DEBUG: dump stdin for investigation
 mkdir -p "$MAGIC_DIR/debug-dump"
@@ -44,6 +56,7 @@ CONTENT=$(echo "$input" | jq -r '
 if [ -z "$CONTENT" ]; then
   echo "⛔ 拒绝：Write 工具未传 file_content，无法校验手写文档格式" >&2
   echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"Write 工具未传 file_content，无法校验手写文档。请用 SearchReplace 改写已有文件，或用 Write 工具重试。"}}'
+  write_hook_event "doc-format-guard" "deny" "Write" "Write 工具未传 file_content" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
   exit 2
 fi
 
@@ -93,6 +106,7 @@ if [ -z "$TEMPLATE_NAME" ]; then
         else
           echo "⛔ handoff 文件内容无法识别模板类型（缺 '## 全局元信息' 或 '## 1. 交接前状态'），拒绝写入" >&2
           echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"handoff 内容不符合 single/multi 模板规范"}}'
+          write_hook_event "doc-format-guard" "deny" "$file_path" "handoff 模板类型无法识别" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
           exit 2
         fi
         ;;
@@ -113,6 +127,7 @@ if [ -z "$TEMPLATE_NAME" ]; then
         fi
         echo "⛔ 拒绝：无法识别文档类型 (file_path: $file_path)，缺少模板匹配规则" >&2
         echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"无法识别 ADD 文档类型，请联系管理员更新 doc-format-guard.sh"}}'
+        write_hook_event "doc-format-guard" "deny" "$file_path" "无法识别文档类型" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
         exit 2
         ;;
     esac
@@ -124,6 +139,7 @@ SCHEMA_FILE="$TEMPLATES_DIR/${TEMPLATE_NAME%.md}.schema.json"
 if [ ! -f "$SCHEMA_FILE" ]; then
   echo "⛔ 阻断：模板 ${TEMPLATE_NAME} 缺少对应的 .schema.json 校验规则" >&2
   echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"缺少 .schema.json 校验规则文件，禁止无规则放行"}}'
+  write_hook_event "doc-format-guard" "deny" "$file_path" "缺少 .schema.json 校验规则" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
   exit 2
 fi
 
@@ -230,6 +246,7 @@ if [ -n "$ISSUES" ]; then
   echo "⛔ $TEMPLATE_NAME 校验不通过:
 $ISSUES" >&2
   echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"文档格式校验不通过，请对照模板修正\"}}"
+  write_hook_event "doc-format-guard" "deny" "$file_path" "文档格式校验不通过" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
   exit 2
 fi
 

package/templates/core/hooks/lib/notify.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# notify.sh — Hook 拦截事件写入 jsonl（零外部依赖，bash 原生）
+# 用法: source 后在 exit 2 前调用 write_hook_event
+#
+# 写入格式（7 字段 jsonl）:
+#   {"ts":"ISO8601","hook":"...","decision":"deny","cmd":"...","reason":"...","planKeyword":"...","planStatus":"..."}
+#
+# 磁盘管理:
+#   - 单文件 ≤256KB，超限轮转为 .old（覆盖，不累积多份）
+#   - 总量 ≤512KB（当前 + 一个 .old）
+#   - MCP Server 宕机不丢事件，重启后从文件恢复消费
+
+write_hook_event() {
+  local hook="$1" decision="$2" cmd="$3" reason="$4" plan="${5:-unknown}" status="${6:-none}"
+  local dir="${MAGIC_DIR:-.qoder}/reports"
+  mkdir -p "$dir" 2>/dev/null || true
+  local file="$dir/hook-events.jsonl"
+
+  # 超过 256KB 自动轮转（262144 bytes）
+  if [ -f "$file" ]; then
+    local sz
+    sz=$(stat -c%s "$file" 2>/dev/null || echo 0)
+    [ "$sz" -gt 262144 ] && mv "$file" "${file}.old" 2>/dev/null || true
+  fi
+
+  printf '{"ts":"%s","hook":"%s","decision":"%s","cmd":"%s","reason":"%s","planKeyword":"%s","planStatus":"%s"}\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    "$hook" \
+    "$decision" \
+    "$cmd" \
+    "$reason" \
+    "$plan" \
+    "$status" >> "$file"
+}

package/templates/core/hooks/pre-tool-use.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # pre-tool-use.sh — PreToolUse §A§B（阻断模式，通用适配版）
 # §A: Bash 裸写保护 — 拦截所有绕过 IDE 追踪的文件写操作
-# §B: 源码 Plan 关联检查 — 无 Plan 的 src/**/*.ts 编辑阻断
+# §B: Write/Edit 写入前置守卫 — Plan/Spec/Review 需要活跃 ADD Plan + 敏感文件保护
 # 治理卡位 #4: 危险命令拦截 / 模板路径兜底 / 写入前置守卫 / 敏感文件保护
 set -euo pipefail
 
@@ -13,6 +13,17 @@ PARENT="$(dirname "$HOOK_DIR")"
 MAGIC_DIR="$(basename "$PARENT")"
 PROJECT_DIR="$PWD"
 
+# ── Hook 通知: 拦截事件写入 jsonl（旁路，失败不阻断 exit 2）──
+source "${HOOK_DIR}/lib/notify.sh" 2>/dev/null || true
+ACTIVE_PLAN=$(detect_active_add 2>/dev/null || true)
+if [ -n "$ACTIVE_PLAN" ]; then
+  PLAN_KEYWORD="${ACTIVE_PLAN%%::*}"
+  PLAN_STATUS="active"
+else
+  PLAN_KEYWORD="no-active-plan"
+  PLAN_STATUS="none"
+fi
+
 # ── §A 辅助函数: 阻断日志 ──
 _log_block() {
   local rule="$1" cmd="$2"
@@ -32,7 +43,7 @@ command=$(echo "$input" | jq -r '.tool_input.command // empty')
 if [ -n "$command" ]; then
 
   # 检测 1: 脚本解释器 — 可写任意文件，无法解析脚本内容做细粒度拦截
-  if echo "$command" | grep -qE '^\s*(python3?|node|ruby|perl|php)(\s|$)'; then
+  if echo "$command" | grep -qE '(^|;|\|\||&&|\|)\s*(python3?|node|ruby|perl|php)(\s|$)'; then
     _reason="禁止通过脚本解释器直接修改文件。请使用 Write 或 SearchReplace 工具操作文件。"
     cat >&2 <<'EOF'
 ⛔ [ADD PreToolUse §A] 阻断: 禁止通过脚本解释器直接修改文件。
@@ -47,6 +58,7 @@ if [ -n "$command" ]; then
 EOF
     echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"${_reason}\"}}"
     _log_block "脚本解释器" "$command"
+    write_hook_event "pre-tool-use" "deny" "$command" "禁止通过脚本解释器直接修改文件" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
     exit 2
   fi
 
@@ -61,6 +73,7 @@ EOF
 EOF
     echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"${_reason}\"}}"
     _log_block "sed -i" "$command"
+    write_hook_event "pre-tool-use" "deny" "$command" "禁止通过 sed -i 原地编辑" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
     exit 2
   fi
 
@@ -75,6 +88,7 @@ EOF
 EOF
     echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"${_reason}\"}}"
     _log_block "重定向" "$command"
+    write_hook_event "pre-tool-use" "deny" "$command" "禁止通过重定向写入文件" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
     exit 2
   fi
 
@@ -88,11 +102,12 @@ EOF
 EOF
     echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"${_reason}\"}}"
     _log_block "tee/dd" "$command"
+    write_hook_event "pre-tool-use" "deny" "$command" "禁止通过 tee/dd 写入文件" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
     exit 2
   fi
 
   # 检测 5: cp / mv / touch — 可创建或覆盖文件
-  if echo "$command" | grep -qE '^\s*(cp|mv|touch)\b'; then
+  if echo "$command" | grep -qE '(^|;|\|\||&&|\|)\s*(cp|mv|touch)\b'; then
     _reason="禁止通过 cp/mv/touch 操作文件。请使用 Write 或 SearchReplace 工具。"
     cat >&2 <<'EOF'
 ⛔ [ADD PreToolUse §A] 阻断: 禁止通过 cp/mv/touch 操作文件。
@@ -101,6 +116,7 @@ EOF
 EOF
     echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"${_reason}\"}}"
     _log_block "cp/mv/touch" "$command"
+    write_hook_event "pre-tool-use" "deny" "$command" "禁止通过 cp/mv/touch 操作文件" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
     exit 2
   fi
 
@@ -109,23 +125,37 @@ EOF
   exit 0
 fi
 
-# ═══════════════ §B: 源码 Plan 关联检查 ═══════════════
-file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
-[ -z "$file_path" ] && exit 0
-
-if ! echo "$file_path" | grep -qE '(src/|/src/).*\.(ts|tsx)$'; then
-  exit 0
-fi
-
-MOD=$(basename "$file_path" | sed 's/\.[jt]sx\?$//')
+# ═══════════════ §B: Write/Edit 文件写入前置守卫 ═══════════════
+# 非 Bash 工具（Write/Edit）的文件写入需要经过:
+#   1. Plan/Spec/Review 文档写入 → 需要活跃 ADD Plan
+#   2. 敏感文件保护 → 阻断写入
+#   3. Dev Action 标记 → 用于 Stop 检查
+# 注意: 不再对 src/**/*.ts 做 Plan 白名单放行，避免绕过 skill/rules 规定的 HITL。
+tool_name=$(echo "$input" | jq -r '.tool_name // empty')
+if [ "$tool_name" = "Write" ] || [ "$tool_name" = "Edit" ]; then
+  file_path=$(echo "$input" | jq -r '.tool_input.file_path // empty')
+  [ -z "$file_path" ] && exit 0
+
+  if echo "$file_path" | grep -qE '\.(qoder|claude|add)/(plans|specs|reviews)/'; then
+    if type detect_active_add >/dev/null 2>&1; then
+      state=$(detect_active_add 2>/dev/null || true)
+      if [ -z "$state" ]; then
+        echo "⛔ 正在写入 Plan/Spec/Review 文档但无活跃 ADD Plan——请先执行 add-paradigm" >&2
+        echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Plan/Spec/Review 写入需要活跃 ADD Plan，请先执行 add-paradigm\"}}"
+        write_hook_event "pre-tool-use" "deny" "$tool_name $file_path" "Plan/Spec/Review 写入需活跃 ADD Plan" "$PLAN_KEYWORD" "$PLAN_STATUS" 2>/dev/null || true
+        exit 2
+      fi
+    fi
+  fi
 
-MATCHES=$(grep -rl "$MOD" "$PROJECT_DIR/$MAGIC_DIR/plans" "$PROJECT_DIR/$MAGIC_DIR/specs" "$PROJECT_DIR/$MAGIC_DIR/reports" 2>/dev/null | wc -l)
+  if echo "$file_path" | grep -qE '\.env$|\.env\.production$|\.env\.local$|credentials|secrets'; then
+    echo "⛔ 敏感文件受保护，禁止写入: $file_path" >&2
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"敏感文件受保护\"}}"
+    exit 2
+  fi
 
-if [ "$MATCHES" -gt 0 ]; then
-  echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"permissionDecisionReason\":\"相关 ADD Plan 已存在\"}}"
+  mark_dev_action 2>/dev/null || true
   exit 0
 fi
 
-echo "⛔ 阻断: ${file_path} 无相关 ADD Plan。请先创建 Plan（plan-template / simple-plan-template）。" >&2
-echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"ask\",\"permissionDecisionReason\":\"无相关 ADD Plan。请用 AskUserQuestion 询问用户选择 plan-template 或 simple-plan-template 创建 Plan。\"}}"
-exit 2
+exit 0

package/templates/core/hooks/prompt-submit.sh

@@ -10,6 +10,7 @@ prompt=$(echo "$input" | jq -r '.prompt // empty')
 HOOK_DIR="$(cd "$(dirname "$0")" && pwd)"
 source "$HOOK_DIR/lib/vocabulary.sh" 2>/dev/null || true
 source "$HOOK_DIR/lib/state-detect.sh" 2>/dev/null || true
+source "$HOOK_DIR/lib/notify.sh" 2>/dev/null || true
 
 # ─── Layer 1: 精准 P0 触发词 ───
 matched=$(match_trigger "$prompt" 2>/dev/null || true)
@@ -63,6 +64,7 @@ if [ -z "$state" ]; then
   Step 8: 收敛判断
 如果 add-paradigm SKILL 尚未激活，请先调用它。
 EOF
+  write_hook_event "prompt-submit" "deny" "$prompt" "无活跃 ADD Plan 下检测到开发任务" "no-active-plan" "none" 2>/dev/null || true
   exit 2
 fi
 
@@ -72,4 +74,18 @@ step=$(echo "$state" | awk -F'::' '{print $2}')
 rounds=$(echo "$state" | awk -F'::' '{print $3}')
 handoff=$(echo "$state" | awk -F'::' '{print $4}')
 echo "[ADD 状态] Plan: ${plan}, 轮次: ${rounds}, Step: ${step}, handoff: ${handoff}"
+
+# ─── Hook 治理日报（注入 AI 上下文）───
+HOOK_JSONL="${MAGIC_DIR:-.qoder}/reports/hook-events.jsonl"
+if [ -f "$HOOK_JSONL" ]; then
+  TODAY="$(date +%Y-%m-%d)"
+  TOTAL=$(grep -c "\"ts\":\"${TODAY}" "$HOOK_JSONL" 2>/dev/null || echo 0)
+  NO_PLAN=$(grep "\"ts\":\"${TODAY}" "$HOOK_JSONL" 2>/dev/null | grep -c '"planKeyword":"no-active-plan"' || echo 0)
+  if [ "$TOTAL" -gt 0 ] 2>/dev/null; then
+    echo "[Hook 治理] 今日拦截: ${TOTAL} 次 | 无 Plan 违规: ${NO_PLAN} 次"
+    if [ "$NO_PLAN" -ge 10 ] 2>/dev/null; then
+      echo "[Hook ⚠️] 无 Plan 违规已达 ${NO_PLAN} 次（≥10），建议创建 Plan 或检查 hooks 误报"
+    fi
+  fi
+fi
 exit 0

package/templates/core/scripts/mcp-server/elicitation/confirm.ts

@@ -0,0 +1,30 @@
+import { inputRequired, type InputRequiredResult, type InputRequest } from "@modelcontextprotocol/server"
+
+function buildConfirmElicit(message: string, actions: readonly string[]): InputRequest {
+  return inputRequired.elicit({
+    message,
+    requestedSchema: {
+      type: "object" as const,
+      properties: {
+        action: {
+          type: "string" as const,
+          enum: [...actions],
+          description: "选择操作"
+        }
+      },
+      required: ["action"]
+    }
+  })
+}
+
+export function elicitHitlConfirm(message: string): InputRequiredResult {
+  return inputRequired({
+    inputRequests: { elicit: buildConfirmElicit(message, ["accept", "reject", "modify"]) }
+  })
+}
+
+export function elicitRiskPrompt(risk: string, suggestion: string): InputRequiredResult {
+  return inputRequired({
+    inputRequests: { elicit: buildConfirmElicit(`⚠️ 风险提示: ${risk}\n建议: ${suggestion}`, ["proceed", "abort"]) }
+  })
+}

package/templates/core/scripts/mcp-server/elicitation/index.ts

@@ -0,0 +1 @@
+export { elicitHitlConfirm, elicitRiskPrompt } from "./confirm.js"

package/templates/core/scripts/mcp-server/index.ts

@@ -0,0 +1,15 @@
+import type { McpServer } from "@modelcontextprotocol/server"
+import { registerAllTools } from "./tools/index.js"
+import { registerAllResources } from "./resources/index.js"
+import { registerAllNotifications } from "./notifications/index.js"
+// v2: Sampling/Elicitation 通过 inputRequired 在 handler 内触发，不作为独立能力注册
+// v2: Tasks 通过 protocol tasks/create 请求处理
+
+export function registerAll(server: McpServer) {
+  registerAllTools(server)
+  registerAllResources(server)
+  registerAllNotifications(server)
+  // Sampling/Elicitation: 导出 builder 函数 (createReviewRequest, elicitHitlConfirm 等)
+  //   供 tools handler 内部使用: return createReviewRequest(planKeyword)
+  // Tasks: 导出工具函数 (enqueueTask, runTask 等)，在 handler 内调用
+}

package/templates/core/scripts/mcp-server/notifications/hitl.ts

@@ -0,0 +1,49 @@
+import type { McpServer } from "@modelcontextprotocol/server"
+import { join } from "path"
+import { existsSync } from "fs"
+import { readFileSafe, readdirRecursive, PROJECT_ROOT, MAGIC_DIR } from "../shared/fs.js"
+import { prisma } from "../shared/prisma.js"
+
+export function registerHitlNotifications(server: McpServer) {
+  // ── HITL 表扫描 ──
+  const scanHitl = async () => {
+    const plansDir = join(PROJECT_ROOT, MAGIC_DIR, "plans")
+    if (!existsSync(plansDir)) return
+    const files = await readdirRecursive(plansDir)
+    const planFiles = files.filter(f => f.endsWith(".md") && f.includes("-plan-v"))
+    for (const pf of planFiles.slice(0, 3)) {
+      const content = await readFileSafe(join(plansDir, pf)) || ""
+      if (content.includes("## HITL 计划总览") && !content.includes("同意") && content.includes("同意/调整")) {
+        await server.sendLoggingMessage({
+          level: "notice" as const,
+          data: `HITL 表待确认: ${pf.replace(/-plan-v\d+\.md$/, "")}`
+        })
+      }
+    }
+  }
+
+  // ── Hook 阈值告警: no-active-plan ≥ 10 次/天 ──
+  let lastWarnedCount = 0
+  const checkThreshold = async () => {
+    try {
+      const ops = prisma.devOperation as Record<string, (...a: unknown[]) => unknown>
+      const since = new Date(Date.now() - 24 * 60 * 60 * 1000)
+      const count = await ops.count({
+        where: { action: "HOOK_INTERCEPT", planKeyword: "no-active-plan", createdAt: { gte: since } },
+      }) as number
+      if (count >= 10 && count !== lastWarnedCount) {
+        lastWarnedCount = count
+        await server.sendLoggingMessage({
+          level: "warning" as const,
+          data: `⚠️ Hook 阈值告警: 过去 24h 内无 Plan 违规 ${count} 次（≥10）。建议创建 Plan 或检查 hooks 误报。`
+        })
+      }
+    } catch { /* DB 不可用，静默 */ }
+  }
+
+  // 周期扫描: 30s HITL + 300s 阈值
+  setInterval(() => { void scanHitl() }, 30000)
+  setInterval(() => { void checkThreshold() }, 300000)
+  // 启动后立即执行一次阈值检查
+  void checkThreshold()
+}

package/templates/core/scripts/mcp-server/notifications/hook.ts

@@ -0,0 +1,268 @@
+import type { McpServer } from "@modelcontextprotocol/server"
+import { join } from "path"
+import { existsSync, watch, readFileSync, statSync } from "fs"
+import { readFile } from "fs/promises"
+import { PROJECT_ROOT, MAGIC_DIR } from "../shared/fs.js"
+import { prisma } from "../shared/prisma.js"
+
+// ── 类型定义 ──
+interface HookEvent {
+  ts: string
+  hook: string
+  decision: string
+  cmd: string
+  reason: string
+  planKeyword: string
+  planStatus: string
+}
+
+interface QueueState {
+  events: HookEvent[]
+  /** 文件 inode（检测轮转） */
+  inode: number
+  /** 文件已读字节数 */
+  bytesRead: number
+  /** flush 定时器 */
+  timer: ReturnType<typeof setTimeout> | null
+}
+
+const REPORT_DIR = join(PROJECT_ROOT, MAGIC_DIR, "reports")
+const JSONL_FILE = join(REPORT_DIR, "hook-events.jsonl")
+const OVERFLOW_FILE = join(REPORT_DIR, "hook-events-overflow.jsonl")
+
+// ── 内存缓冲队列 ──
+const MAX_QUEUE = 50
+let serverRef: McpServer | null = null
+
+function createQueueState(): QueueState {
+  const st = statSync(JSONL_FILE, { throwIfNoEntry: false })
+  return {
+    events: [],
+    inode: st?.ino ?? 0,
+    bytesRead: st?.size ?? 0,
+    timer: null,
+  }
+}
+
+const q: QueueState = createQueueState()
+
+// ── jsonl 解析 ──
+function parseJsonlLine(line: string): HookEvent | null {
+  const trimmed = line.trim()
+  if (!trimmed) return null
+  try {
+    const obj = JSON.parse(trimmed) as HookEvent
+    if (!obj.ts || !obj.hook) return null
+    return obj
+  } catch {
+    return null
+  }
+}
+
+// ── 去重 key ──
+function dedupKey(e: HookEvent): string {
+  return `${e.hook}::${e.ts}::${e.planKeyword}`
+}
+
+// ── 批量落库 ──
+async function flushToDB(events: HookEvent[]): Promise<number> {
+  if (events.length === 0) return 0
+  const seen = new Set<string>()
+  const unique = events.filter(e => {
+    const k = dedupKey(e)
+    if (seen.has(k)) return false
+    seen.add(k)
+    return true
+  })
+  if (unique.length === 0) return 0
+
+  try {
+    // 获取或创建 ai-assistant 用户
+    const au = prisma.addUser as Record<string, (...a: unknown[]) => unknown>
+    let userId: string
+    try {
+      const existing = await au.findUnique({ where: { username: "ai-assistant" }, select: { id: true } }) as { id: string } | null
+      if (existing) {
+        userId = existing.id
+      } else {
+        const created = await au.create({
+          data: { id: "ai-assistant", username: "ai-assistant", email: "ai-assistant@internal" },
+          select: { id: true },
+        }) as { id: string }
+        userId = created.id
+      }
+    } catch {
+      userId = "ai-assistant"
+    }
+
+    const ops = prisma.devOperation as Record<string, (...a: unknown[]) => unknown>
+    const data = unique.map(e => ({
+      userId,
+      action: "HOOK_INTERCEPT",
+      targetType: e.hook,
+      targetId: e.cmd.substring(0, 500),
+      planKeyword: e.planKeyword,
+      reason: `[${e.decision}] ${e.reason}`,
+      afterState: JSON.stringify({ planStatus: e.planStatus }),
+    }))
+
+    await ops.createMany({ data })
+    return unique.length
+  } catch (err) {
+    console.error("[hook-notify] flushToDB 失败:", err instanceof Error ? err.message : String(err))
+    return 0
+  }
+}
+
+// ── 消费溢出文件 ──
+async function drainOverflowFile(): Promise<HookEvent[]> {
+  const events: HookEvent[] = []
+  try {
+    if (!existsSync(OVERFLOW_FILE)) return events
+    const content = await readFile(OVERFLOW_FILE, "utf-8")
+    for (const line of content.split("\n")) {
+      const ev = parseJsonlLine(line)
+      if (ev) events.push(ev)
+    }
+    // 清空溢出文件
+    const { writeFileSync } = await import("fs")
+    writeFileSync(OVERFLOW_FILE, "", "utf-8")
+  } catch {
+    // 忽略，下次 flush 重试
+  }
+  return events
+}
+
+// ── 核心: flush ──
+async function doFlush(): Promise<void> {
+  // 1) drain 内存队列
+  const memEvents = q.events.splice(0)
+  // 2) drain 溢出文件
+  const overflowEvents = await drainOverflowFile()
+  // 3) 合并
+  const allEvents = [...memEvents, ...overflowEvents]
+  if (allEvents.length === 0) return
+
+  const count = await flushToDB(allEvents)
+  if (count > 0 && serverRef) {
+    const noPlanCount = allEvents.filter(e => e.planKeyword === "no-active-plan").length
+    const msg = `[Hook] ${count} 条拦截事件已审计落库（计划: ${[...new Set(allEvents.map(e => e.planKeyword))].join(", ")}）`
+    serverRef.sendLoggingMessage({ level: "warning" as const, data: msg }).catch(() => {})
+  }
+}
+
+// ── 入队 + 触发策略 ──
+function enqueue(event: HookEvent): void {
+  if (q.events.length >= MAX_QUEUE) {
+    // 降级写入溢出文件
+    try {
+      const { appendFileSync } = require("fs") as typeof import("fs")
+      appendFileSync(OVERFLOW_FILE, JSON.stringify(event) + "\n", "utf-8")
+    } catch { /* 静默 */ }
+    return
+  }
+  q.events.push(event)
+
+  if (q.events.length >= MAX_QUEUE) {
+    // 满 50 条立即 flush
+    if (q.timer) { clearTimeout(q.timer); q.timer = null }
+    void doFlush()
+  } else if (!q.timer) {
+    // 调度 2s 后 flush
+    q.timer = setTimeout(() => {
+      q.timer = null
+      void doFlush()
+    }, 2000)
+  }
+}
+
+// ── fs.watch 回调 ──
+function readNewLines(): void {
+  try {
+    const st = statSync(JSONL_FILE, { throwIfNoEntry: false })
+    if (!st) return
+
+    // 检测文件轮转（inode 变化或文件变小）
+    if (st.ino !== q.inode || st.size < q.bytesRead) {
+      q.inode = st.ino
+      q.bytesRead = 0
+    }
+
+    if (st.size <= q.bytesRead) return
+
+    // 只读增量部分
+    const fd = require("fs").openSync(JSONL_FILE, "r")
+    const buf = Buffer.alloc(st.size - q.bytesRead)
+    require("fs").readSync(fd, buf, 0, buf.length, q.bytesRead)
+    require("fs").closeSync(fd)
+
+    const text = buf.toString("utf-8")
+    for (const line of text.split("\n")) {
+      const ev = parseJsonlLine(line)
+      if (ev) enqueue(ev)
+    }
+    q.bytesRead = st.size
+  } catch {
+    // 文件可能被轮转删除，下次重试
+  }
+}
+
+// ── 启动时全量扫描已有文件 ──
+async function initialScan(): Promise<void> {
+  const files = [JSONL_FILE, `${JSONL_FILE}.old`]
+  for (const f of files) {
+    if (!existsSync(f)) continue
+    try {
+      const content = await readFile(f, "utf-8")
+      for (const line of content.split("\n")) {
+        const ev = parseJsonlLine(line)
+        if (ev) enqueue(ev)
+      }
+    } catch { /* skip */ }
+  }
+  // 初始化消费位点
+  const st = statSync(JSONL_FILE, { throwIfNoEntry: false })
+  if (st) {
+    q.inode = st.ino
+    q.bytesRead = st.size
+  }
+}
+
+// ── 注册 ──
+export function registerHookNotifications(server: McpServer) {
+  serverRef = server
+
+  // 启动通知
+  server.sendLoggingMessage({
+    level: "notice" as const,
+    data: "ADD Hooks 治理卡位已激活，拦截事件将自动审计落库"
+  }).catch(() => {})
+
+  // 启动时扫描 + 建立 fs.watch
+  void initialScan().then(() => {
+    // 确保 jsonl 文件存在（fs.watch 要求文件已存在）
+    try {
+      const { mkdirSync, writeFileSync } = require("fs") as typeof import("fs")
+      mkdirSync(REPORT_DIR, { recursive: true })
+      if (!existsSync(JSONL_FILE)) writeFileSync(JSONL_FILE, "", "utf-8")
+    } catch { /* ok */ }
+
+    // 立即消费启动前已有事件
+    void doFlush()
+
+    // fs.watch 监听目录变化（文件可能后来才创建）
+    try {
+      watch(REPORT_DIR, (_event, filename) => {
+        if (filename === "hook-events.jsonl" || filename === "hook-events.jsonl.old") {
+          readNewLines()
+        }
+      })
+    } catch { /* watch 可能不支持 */ }
+  })
+
+  // 进程退出时清空剩余队列
+  const cleanup = () => { void doFlush() }
+  process.on("exit", cleanup)
+  process.on("SIGTERM", cleanup)
+  process.on("SIGINT", cleanup)
+}