bigpowers 2.86.4 → 2.86.6

package/.copilot/skills/guard-git/SKILL.md

@@ -0,0 +1,231 @@
+---
+name: guard-git
+model: haiku
+description: "Block dangerous git commands (push, force push, reset --hard, clean, branch -D, checkout/restore .) and enforce Conventional Commits & Branch Protection before an AI agent runs them. Installs hook scripts for Claude Code, Cursor, Cursor CLI, and Gemini CLI; documents Google Antigravity Terminal deny lists. Use when the user wants git safety hooks, to block git push or destructive git in agents, or to mirror the same policy across AI coding tools."
+---
+
+# Guard Git
+> **HARD GATE** — **HARD GATE** — Before committing, verify: branch is not main/master, author is correct, git user is configured. Bad commits are hard to fix.
+
+
+Installs a shared hook that blocks destructive git operations and enforces workflow discipline. **Requires `jq` on the agent's PATH** when the hook runs.
+
+## What gets blocked/enforced
+
+- **Safety**: `git push --force`, `git reset --hard`, `git clean -f`, `git branch -D`, `git checkout .`, `git restore .`.
+- **Discipline**: Blocks direct commits or pushes to protected branches (`main`, `master`) unless `GIT_BIGPOWERS_LAND=1` (set only by `scripts/land-branch.sh`).
+- **Allows**: `git push origin <feature-branch>` for backup/CI; solo land push to `main` only inside `land-branch.sh`.
+- **Standardization**: Enforces [Conventional Commits](https://www.conventionalcommits.org/) for all `git commit` commands.
+- **Secrets**: Blocks commits containing common secret patterns (`sk-`, `ghp_`, `AKIA`, `xoxb-`, `-----BEGIN` private keys) — see [REFERENCE.md](REFERENCE.md).
+
+## Quick start
+
+1. **Scope**: ask project-only vs global (paths differ per product).
+2. **Write the hook bundle** from [REFERENCE.md](REFERENCE.md) into the client's hooks directory.
+3. **Run `chmod +x`** on `pre-tool-use.sh`.
+4. **Merge** the hook snippet from [REFERENCE.md](REFERENCE.md) into the right settings file — do not wipe unrelated keys.
+5. **Verify** with the tests in [REFERENCE.md](REFERENCE.md).
+
+| Client | Mechanism | Config |
+|--------|-----------|--------|
+| Claude Code | `PreToolUse` (Bash) | `.claude/settings.json` or `~/.claude/settings.json` |
+| Cursor / Cursor CLI | `beforeShellExecution` | `.cursor/hooks.json` or `~/.cursor/hooks.json` |
+| Gemini CLI | `BeforeTool` + `run_shell_command` | `.gemini/settings.json` or `~/.gemini/settings.json` |
+| Google Antigravity | Built-in Terminal **Deny list** | Settings UI (no shell hook) |
+
+**Modes (env on the hook command):** `GIT_GUARDRAILS_MODE` is `claude` (default) or `cursor` → stderr + exit `2` on block. Set `gemini` for Gemini CLI → JSON `decision` on stdout.
+
+## Customization
+
+To add or remove patterns or protected branches, edit `pre-tool-use.sh`.
+
+## Advanced
+
+Full JSON examples, merge rules, Antigravity deny-list entries, and test commands: [REFERENCE.md](REFERENCE.md).
+
+
+
+<!-- story: e01s03 -->
+
+---
+
+# Git guardrails — reference
+
+## Navigation
+
+| Lines | Section |
+|-------|---------|
+| 1 | Title |
+| 3–14 | Navigation |
+| 16–24 | Secret patterns |
+| 26–44 | Copy layout |
+| 46–72 | Claude Code |
+| 74–92 | Cursor and Cursor CLI |
+| 94–120 | Gemini CLI |
+| 122–135 | Google Antigravity |
+| 137–178 | Verify (local tests) |
+
+## Secret patterns (audit + pre-commit)
+
+Agents must not commit files containing:
+
+- `sk-` (OpenAI API keys)
+- `ghp_` / `gho_` (GitHub tokens)
+- `AKIA` (AWS access key id)
+- `xoxb-` (Slack bot tokens)
+- `-----BEGIN` private keys
+
+Use `audit-code` supply-chain checklist before commit. Consider `git-secrets` or custom pre-commit hook in target projects.
+
+## Copy layout
+
+The main script is `pre-tool-use.sh`.
+
+```text
+<hooks-dir>/pre-tool-use.sh
+```
+
+Example project locations:
+
+- Claude: `.claude/hooks/`
+- Cursor: `.cursor/hooks/`
+- Gemini: `.gemini/hooks/`
+
+Use the same layout for user-level hooks (`~/.claude/hooks`, `~/.cursor/hooks`, `~/.gemini/hooks`).
+
+---
+
+## Claude Code
+
+Hook command does **not** need `GIT_GUARDRAILS_MODE` (defaults to `claude`).
+
+**Project** (`.claude/settings.json`):
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/pre-tool-use.sh"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+---
+
+## Cursor and Cursor CLI
+
+Use `beforeShellExecution`. Set `GIT_GUARDRAILS_MODE=cursor`.
+
+**Project** (`.cursor/hooks.json`):
+
+```json
+{
+  "version": 1,
+  "hooks": {
+    "beforeShellExecution": [
+      {
+        "command": "GIT_GUARDRAILS_MODE=cursor .cursor/hooks/pre-tool-use.sh",
+        "matcher": "git"
+      }
+    ]
+  }
+}
+```
+
+---
+
+## Gemini CLI
+
+Use `BeforeTool` with matcher `run_shell_command`. Set **`GIT_GUARDRAILS_MODE=gemini`**.
+
+**Project** (`.gemini/settings.json`):
+
+```json
+{
+  "hooks": {
+    "BeforeTool": [
+      {
+        "matcher": "run_shell_command",
+        "hooks": [
+          {
+            "name": "git-guardrails",
+            "type": "command",
+            "command": "GIT_GUARDRAILS_MODE=gemini \"$GEMINI_PROJECT_DIR\"/.gemini/hooks/pre-tool-use.sh",
+            "timeout": 5000
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+---
+
+## Google Antigravity
+
+Add **Deny list** entries in **Antigravity → Settings → Terminal**:
+
+- `git push --force`
+- `git push origin main`
+- `git push origin master`
+- `git reset --hard`
+- `git clean`
+- `git branch -D`
+- `git checkout .`
+- `git restore .`
+
+---
+
+## Verify (local tests)
+
+**1. Block push to main without land mode (Claude mode):**
+```bash
+echo '{"tool_input":{"command":"git push origin main"}}' | ./pre-tool-use.sh
+# Expected: exit 2, protected branch message
+```
+
+**2. Allow push to main with GIT_BIGPOWERS_LAND=1:**
+```bash
+GIT_BIGPOWERS_LAND=1 echo '{"tool_input":{"command":"git push origin main"}}' | ./pre-tool-use.sh
+# Expected: exit 0 (when on main)
+```
+
+**3. Allow push to feature branch:**
+```bash
+echo '{"tool_input":{"command":"git push -u origin feat/my-task"}}' | ./pre-tool-use.sh
+# Expected: exit 0
+```
+
+**4. Conventional Commits (Gemini mode):**
+```bash
+echo '{"tool_input":{"command":"git commit -m \"bad message\""}}' | GIT_GUARDRAILS_MODE=gemini ./pre-tool-use.sh
+# Expected: exit 0, {"decision":"deny", "reason":"..."}
+```
+
+**5. Protected Branch commit (Cursor mode):**
+```bash
+# Run on 'main' branch
+echo '{"command":"git commit -m \"feat: valid message\""}' | GIT_GUARDRAILS_MODE=cursor ./pre-tool-use.sh
+# Expected: exit 2, "Direct commits to protected branch 'main' are forbidden"
+```
+
+**6. Land script exists:**
+```bash
+test -x scripts/land-branch.sh && echo OK
+```
+
+**7. Allow (Gemini mode):**
+```bash
+echo '{"tool_input":{"command":"git status"}}' | GIT_GUARDRAILS_MODE=gemini ./pre-tool-use.sh
+# Expected: exit 0, {"decision":"allow"}
+```

package/.copilot/skills/harden-vps/SKILL.md

@@ -0,0 +1,291 @@
+---
+name: harden-vps
+model: haiku
+description: "Harden a production Linux VPS for your application across three layers — application (systemd hardening, monitoring alerts, backup automation), Ubuntu OS (UFW firewall, fail2ban SSH, unattended-upgrades, SSH hardening), and VPS provider (health checks, daily backups, monthly snapshots). Use when the user wants to secure a production server, harden a VPS, audit server security, or mentions production hardening, VPS security, or harden the server."
+---
+
+# Harden VPS
+
+Three-layer production hardening for a self-hosted app on any VPS. Each layer independently verifiable. Apply OS first (firewall blocks attacks immediately), then your application (alerts + backups), then your VPS provider (snapshots). See [REFERENCE.md](REFERENCE.md) for full script bodies, systemd unit template, and gotchas.
+
+## Quick start
+
+SSH as root into the VPS. Find credentials in the your VPS provider Customer Control Panel.
+
+> **HARD GATE** — Run `ufw status` first. No firewall = layer 1 takes priority over everything.
+
+## Layer 1 — Ubuntu OS
+
+```bash
+# UFW
+ufw default deny incoming && ufw default allow outgoing
+ufw allow 22/tcp && ufw allow 80/tcp && ufw allow 443/tcp && ufw enable
+# → verify: ufw status | grep -q active
+
+# fail2ban
+apt install -y fail2ban
+# Configure /etc/fail2ban/jail.local: sshd, maxretry=3, bantime=3600, findtime=600
+systemctl restart fail2ban
+# → verify: fail2ban-client status sshd
+
+# unattended-upgrades
+apt install -y unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades
+# → verify: systemctl is-active unattended-upgrades | grep -q active
+
+# SSH: PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes
+# → verify: sshd -T | grep -E 'permitrootlogin no|passwordauthentication no'
+
+# Deploy healthcheck.sh → /opt/your-app/scripts/healthcheck.sh
+# Crontab: */5 * * * * /opt/your-app/scripts/healthcheck.sh
+```
+
+## Layer 2 — applicationlication
+
+```bash
+# systemd: User=your-app, NoNewPrivileges=yes, ProtectSystem=full,
+#   ProtectKernelTunables=yes, ProtectKernelModules=yes,
+#   ProtectControlGroups=yes, RestrictAddressFamilies=AF_INET AF_INET6,
+#   RestrictRealtime=yes, PrivateTmp=yes, LimitNOFILE=65536
+# → verify: systemctl show your-app -p NoNewPrivileges -p ProtectSystem -p User
+
+# Alerts (your application requires auth; insert via SQLite)
+sqlite3 /opt/your-app/data/your-app.db "
+INSERT INTO monitoring_alerts (id,name,metric,threshold,operator,enabled,duration_seconds)
+VALUES ('a1','Disk >80%','disk_used_percent',80,'gt',1,300);
+INSERT INTO monitoring_alerts (id,name,metric,threshold,operator,enabled,duration_seconds)
+VALUES ('a2','CPU >90%','cpu_percent',90,'gt',1,60);
+INSERT INTO monitoring_alerts (id,name,metric,threshold,operator,enabled,duration_seconds)
+VALUES ('a3','RAM >85%','mem_used_percent',85,'gt',1,120);
+"
+systemctl restart your-app
+
+# Backup crontab (root):
+# 0 2 * * * cp /opt/your-app/data/your-app.db /backup/your-app-$(date +\%Y\%m\%d).db
+# 0 3 * * * find /backup/ -name "your-app-*.db" -mtime +90 -delete
+```
+
+## Layer 3 — VPS provider
+
+```bash
+# cntb CLI
+curl -sL "$(curl -sL https://api.github.com/repos/contabo/cntb/releases/latest \
+  | grep browser_download_url.*linux_amd64.tar.gz | head -1 | cut -d'"' -f4)" \
+  | tar xz -C /usr/local/bin
+
+# Snapshot script → /opt/your-app/scripts/contabo-snapshot.sh (reads from /opt/your-app/.env)
+# Credentials as env vars in /opt/your-app/.env (deployed by GitHub Actions):
+#   CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD
+# Crontab: 0 4 1 * * /opt/your-app/scripts/contabo-snapshot.sh
+
+# > HARD GATE — Snapshot cron silently fails until env vars are set in .env.
+# Credentials source: your VPS provider Customer Panel → API Details.
+# Local dev: add to .envrc. Production: GitHub Secrets → deploy → /opt/your-app/.env
+```
+
+## CRITICAL GOTCHAS
+
+1. **Shell escaping in Orca terminals:** `$VAR`, `$(…)`, and `%` get eaten by the local shell. Always use base64: `echo '<base64>' | base64 -d > script.sh`
+2. **Crontab `%`:** cron interprets `%` as newline. Escape as `\%` in `$(date +\%Y\%m\%d)`
+3. **fail2ban exit 255:** means a jail references a missing log file. Remove the broken jail, restart.
+4. **your application alerts need auth:** POST to `/api/monitoring/alerts` requires Bearer token. Workaround: insert directly into SQLite, then restart your application.
+
+## Verify all 8 gates
+
+```bash
+ufw status|grep -q active||echo FAIL:ufw
+fail2ban-client status sshd>/dev/null 2>&1||echo FAIL:fail2ban
+systemctl is-active unattended-upgrades|grep -q active||echo FAIL:unattended
+sshd -T|grep -q 'permitrootlogin no'||echo FAIL:sshd
+systemctl show your-app -p NoNewPrivileges|grep -q yes||echo FAIL:systemd
+systemctl is-active your-app|grep -q active||echo FAIL:your-app
+sqlite3 /opt/your-app/data/your-app.db "SELECT count(*) FROM monitoring_alerts"|grep -q 3||echo FAIL:alerts
+crontab -l|grep -q healthcheck&&crontab -l|grep -q your-app.db&&crontab -l|grep -q contabo-snapshot||echo FAIL:crontab
+echo ALL 8 GATES PASSED
+```
+
+→ verify: # requires VPS SSH — run the 8-gate one-liner on the VPS manually
+
+---
+
+# Harden VPS — Reference
+
+## Health check script
+
+Deploy to `/opt/your-app/scripts/healthcheck.sh`:
+
+```bash
+#!/bin/bash
+LOG=/var/log/your-app/health.log
+mkdir -p /var/log/your-app
+DISK=$(df / | awk 'NR==2 {print $5}' | tr -d '%')
+RAM=$(free | awk '/Mem:/ {printf "%.0f", $3/$2*100}')
+NOW=$(date -Iseconds)
+[ "$DISK" -gt 85 ] && echo "$NOW ALERT: Disk ${DISK}%" >> "$LOG"
+[ "$RAM" -gt 90 ]   && echo "$NOW ALERT: RAM ${RAM}%" >> "$LOG"
+systemctl is-active --quiet your-app || { echo "$NOW ALERT: your application DOWN" >> "$LOG"; systemctl restart your-app; }
+[ -f /var/run/reboot-required ] && echo "$NOW WARN: kernel reboot pending" >> "$LOG"
+```
+
+Make executable: `chmod +x /opt/your-app/scripts/healthcheck.sh`
+
+## your application systemd unit
+
+Full hardened unit at `/etc/systemd/system/your-app.service`:
+
+```ini
+[Unit]
+Description=your application BaaS Platform
+Documentation=https://github.com/example-org/example-app
+After=network.target caddy.service
+Wants=caddy.service
+
+[Service]
+Type=simple
+User=your-app
+Group=your-app
+WorkingDirectory=/opt/your-app
+ExecStart=/opt/your-app/bin/your-app serve \
+    --port 8080 \
+    --db /opt/your-app/data/your-app.db \
+    --sites-domain <your-domain.example.com>
+EnvironmentFile=-/opt/your-app/.env
+Environment=APP_HOME=/opt/your-app
+Environment=HOME=/opt/your-app
+Environment=NPM_CONFIG_CACHE=/opt/your-app/.npm
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+Restart=always
+RestartSec=5
+StartLimitIntervalSec=60
+StartLimitBurst=3
+TimeoutStopSec=30
+KillSignal=SIGTERM
+NoNewPrivileges=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictRealtime=yes
+ReadWritePaths=/opt/your-app/data
+ReadWritePaths=/opt/your-app/backups
+ReadWritePaths=/opt/your-app/secrets
+ReadWritePaths=/opt/your-app/.npm
+ReadWritePaths=/opt/your-app/logs
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target
+```
+
+## fail2ban jail.local
+
+```ini
+[sshd]
+enabled = true
+port = ssh
+filter = sshd
+logpath = /var/log/auth.log
+maxretry = 3
+bantime = 3600
+findtime = 600
+```
+
+Note: your application auth jail deferred — your application logs to journald, not a file. To enable, use `backend = systemd` with a journald filter.
+
+## provider-snapshot.sh — worked example (Contabo API)
+
+> Snapshot APIs are provider-specific. This is one worked example, not a
+> bigpowers default; swap the auth and endpoint calls for your own provider.
+
+Deploy to `/opt/your-app/scripts/contabo-snapshot.sh`. Reads credentials from `/opt/your-app/.env` (same file used by your application systemd unit):
+
+```bash
+#!/bin/bash
+set -e
+LOG=/var/log/your-app/snapshot.log
+ENVFILE=/opt/your-app/.env
+INSTANCE_ID=<your-contabo-instance-id>
+
+[ -f "$ENVFILE" ] || { echo "$(date -Iseconds) ERROR: $ENVFILE missing" >> "$LOG"; exit 1; }
+set -a; source "$ENVFILE"; set +a
+
+[ -z "$CONTABO_CLIENT_ID" ] && { echo "$(date -Iseconds) ERROR: CONTABO_CLIENT_ID not set" >> "$LOG"; exit 1; }
+
+TOKEN=$(curl -s -d "client_id=$CONTABO_CLIENT_ID" \
+  -d "client_secret=$CONTABO_CLIENT_SECRET" \
+  --data-urlencode "username=$CONTABO_API_USER" \
+  --data-urlencode "password=$CONTABO_API_PASSWORD" \
+  -d 'grant_type=password' \
+  'https://auth.contabo.com/auth/realms/contabo/protocol/openid-connect/token' \
+  | jq -r '.access_token')
+
+[ -z "$TOKEN" ] || [ "$TOKEN" = "null" ] && { echo "$(date -Iseconds) ERROR: auth failed" >> "$LOG"; exit 1; }
+
+curl -s -X POST \
+  -H "Authorization: Bearer $TOKEN" \
+  -H "Content-Type: application/json" \
+  -H "x-request-id: $(uuidgen 2>/dev/null || echo $RANDOM)" \
+  "https://api.contabo.com/v1/compute/instances/${INSTANCE_ID}/snapshots" \
+  | tee -a "$LOG"
+
+echo >> "$LOG"
+echo "$(date -Iseconds) Snapshot requested for $INSTANCE_ID" >> "$LOG"
+```
+
+## your VPS provider credentials
+
+Add to `/opt/your-app/.env` (same file used by your application systemd unit, deployed by GitHub Actions):
+
+```
+CONTABO_CLIENT_ID=
+CONTABO_CLIENT_SECRET=
+CONTABO_API_USER=
+CONTABO_API_PASSWORD=
+```
+
+Source: your VPS provider Customer Control Panel → API Details. ClientId and ClientSecret are generated there. API User is your email. API Password is set separately in the panel.
+
+**Pipeline:** GitHub Secrets → deploy workflow → `/opt/your-app/.env` on VPS. For local dev (`cntb get instances`), add to `.envrc`.
+
+## your VPS provider instance info template
+
+Fill in your instance details from the your VPS provider Customer Control Panel:
+
+```
+IP:           <your-instance-ip>
+IPv6:         <your-instance-ipv6>
+Region:       <your-region>
+OS:           <your-os-version>
+Disk:         <your-disk-size>
+Default user: root
+Customer ID:  <your-customer-id>
+```
+
+## your application monitoring alert SQL
+
+```sql
+INSERT INTO monitoring_alerts (id, name, metric, threshold, operator, enabled, duration_seconds)
+VALUES ('alert-001', 'VPS Disk above 80%', 'disk_used_percent', 80, 'gt', 1, 300);
+
+INSERT INTO monitoring_alerts (id, name, metric, threshold, operator, enabled, duration_seconds)
+VALUES ('alert-002', 'VPS CPU above 90%', 'cpu_percent', 90, 'gt', 1, 60);
+
+INSERT INTO monitoring_alerts (id, name, metric, threshold, operator, enabled, duration_seconds)
+VALUES ('alert-003', 'VPS RAM above 85%', 'mem_used_percent', 85, 'gt', 1, 120);
+```
+
+Alerts are loaded at your application startup. Restart with `systemctl restart your-app` after inserting.
+
+## Base64 encoding workaround
+
+When sending scripts through Orca terminal `--text`, the local bash shell interprets `$`, `(`, and `%`. Encode locally and decode remotely:
+
+```bash
+# Local
+cat script.sh | base64
+
+# Remote terminal
+echo '<base64-output>' | base64 -d > script.sh
+```

package/.copilot/skills/hook-commits/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: hook-commits
+model: haiku
+description: "Set up pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing."
+---
+
+# Hook Commits
+> **HARD GATE** — **HARD GATE** — Pre-commit and commit-msg hooks must run before any commit lands. Skipping hooks (`--no-verify`) is forbidden unless explicitly authorized for a specific commit and documented.
+
+
+## What This Sets Up
+
+- **Husky** pre-commit hook
+- **lint-staged** running Prettier on all staged files
+- **Prettier** config (if missing)
+- **typecheck** and **test** scripts in the pre-commit hook
+
+## Steps
+
+### 1. Detect package manager
+
+Check for `package-lock.json` (npm), `pnpm-lock.yaml` (pnpm), `yarn.lock` (yarn), `bun.lockb` (bun). Use whichever is present. Default to npm if unclear.
+
+### 2. Install dependencies
+
+Install as devDependencies:
+
+```
+husky lint-staged prettier
+```
+
+### 3. Initialize Husky
+
+```bash
+npx husky init
+```
+
+This creates `.husky/` dir and adds `prepare: "husky"` to package.json.
+
+### 4. Create `.husky/pre-commit`
+
+Write this file (no shebang needed for Husky v9+):
+
+```
+npx lint-staged
+npm run typecheck
+npm run test
+```
+
+**Adapt**: Replace `npm` with detected package manager. If repo has no `typecheck` or `test` script in package.json, omit those lines and tell the user.
+
+### 5. Create `.lintstagedrc`
+
+```json
+{
+  "*": "prettier --ignore-unknown --write"
+}
+```
+
+### 6. Create `.prettierrc` (if missing)
+
+Only create if no Prettier config exists. Use these defaults:
+
+```json
+{
+  "useTabs": false,
+  "tabWidth": 2,
+  "printWidth": 80,
+  "singleQuote": false,
+  "trailingComma": "es5",
+  "semi": true,
+  "arrowParens": "always"
+}
+```
+
+### 7. Verify
+
+- [ ] `.husky/pre-commit` exists and is executable
+- [ ] `.lintstagedrc` exists
+- [ ] `prepare` script in package.json is `"husky"`
+- [ ] `prettier` config exists
+- [ ] Run `npx lint-staged` to verify it works
+
+### 8. Commit
+
+Stage all changed/created files and commit with message: `chore: add pre-commit hooks (husky + lint-staged + prettier)`
+
+This will run through the new pre-commit hooks — a good smoke test that everything works.
+
+## Notes
+
+- Husky v9+ doesn't need shebangs in hook files
+- `prettier --ignore-unknown` skips files Prettier can't parse (images, etc.)
+- The pre-commit runs lint-staged first (fast, staged-only), then full typecheck and tests