block-no-verify 1.1.2 → 1.1.5

package/README.md

@@ -1,26 +1,55 @@
 # block-no-verify
 
-A platform-agnostic security tool that blocks the `--no-verify` flag in git commands. Designed to prevent AI agents from bypassing git hooks.
+A platform-agnostic security tool that blocks ways AI agents can bypass local git hooks. It flags the `--no-verify` flag, `core.hooksPath` overrides, and GitHub MCP tool calls that write through the GitHub API.
 
 ## Why?
 
-When using AI coding assistants like Claude Code, Gemini CLI, Cursor, or others, you might have git hooks (pre-commit, pre-push) that enforce code quality, run tests, or perform security checks. The `--no-verify` flag allows bypassing these hooks, which could allow AI agents to skip important validations.
+When using AI coding assistants like Claude Code, Gemini CLI, Cursor, or others, you might have git hooks (pre-commit, pre-push) that enforce code quality, run tests, or perform security checks. Agents can side-step those hooks in three common ways:
 
-This package provides a CLI that can block any git commands that include `--no-verify`, working with any AI tool that supports command hooks.
+- passing `--no-verify` to a git command,
+- overriding `core.hooksPath` (e.g. `git -c core.hooksPath=/dev/null ...`),
+- calling GitHub MCP tools such as `mcp__github__push_files` that commit or merge directly through the GitHub API, skipping the local hook chain entirely.
+
+This package provides a CLI that can block all three, working with any AI tool that supports command / tool-use hooks.
 
 ## Used By
 
 <a href="https://github.com/langgenius/dify">
-  <img src="https://github.com/langgenius.png" width="50" height="50" alt="Dify" title="Dify - Open-source LLM app development platform">
+  <img src="https://github.com/langgenius.png" width="50" height="50" alt="Dify" title="Dify - Open-source LLM app development platform (133k★)">
+</a>
+<a href="https://github.com/nicolargo/glances">
+  <img src="https://github.com/nicolargo.png" width="50" height="50" alt="Glances" title="Glances - Cross-platform system monitoring tool (32k★)">
+</a>
+<a href="https://github.com/pubkey/rxdb">
+  <img src="https://github.com/pubkey.png" width="50" height="50" alt="RxDB" title="RxDB - Local-first database for JavaScript applications (23k★)">
+</a>
+<a href="https://github.com/promptfoo/promptfoo">
+  <img src="https://github.com/promptfoo.png" width="50" height="50" alt="Promptfoo" title="Promptfoo - LLM testing and evaluation framework (18k★)">
+</a>
+<a href="https://github.com/YFGaia/dify-plus">
+  <img src="https://github.com/YFGaia.png" width="50" height="50" alt="Dify Plus" title="Dify Plus - Enhanced Dify distribution (2k★)">
+</a>
+<a href="https://github.com/forcedotcom/salesforcedx-vscode">
+  <img src="https://github.com/forcedotcom.png" width="50" height="50" alt="Salesforce Extensions for VS Code" title="Salesforce Extensions for VS Code (1k★)">
+</a>
+<a href="https://centy.io">
+  <img src="https://github.com/centy-io.png" width="50" height="50" alt="Centy" title="Centy">
+</a>
+<a href="https://worktree.io">
+  <img src="https://github.com/worktree-io.png" width="50" height="50" alt="Worktree" title="Worktree">
 </a>
 
 ## Installation
 
+Add as a dev dependency to ensure a consistent, pinned version:
+
 ```bash
-pnpm add -g block-no-verify
+pnpm add -D block-no-verify
+# or
+npm install --save-dev block-no-verify
 ```
 
-Or use without installation via `pnpm dlx block-no-verify` or `npx block-no-verify`.
+Then use it with `pnpm exec block-no-verify` or `npm exec block-no-verify`.
 
 ## Quick Start
 
@@ -42,7 +71,7 @@ echo "git push --no-verify" | block-no-verify
 
 ### Claude Code
 
-Add to your `.claude/settings.json`:
+Add to your `.claude/settings.json`. The first matcher handles shell commands (`--no-verify`, `core.hooksPath`); the second matches any GitHub MCP tool so direct-to-API writes can also be blocked:
 
 ```json
 {
@@ -53,7 +82,16 @@ Add to your `.claude/settings.json`:
         "hooks": [
           {
             "type": "command",
-            "command": "pnpm dlx block-no-verify"
+            "command": "pnpm exec block-no-verify"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__github__.*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "pnpm exec block-no-verify"
           }
         ]
       }
@@ -78,7 +116,7 @@ Add to your `.gemini/settings.json`:
           {
             "name": "block-no-verify",
             "type": "command",
-            "command": "pnpm dlx block-no-verify",
+            "command": "pnpm exec block-no-verify",
             "description": "Block --no-verify flags in git commands",
             "timeout": 5000
           }
@@ -103,7 +141,7 @@ Create `.cursor/hooks.json` in your project root:
   "hooks": {
     "beforeShellExecution": [
       {
-        "command": "pnpm dlx block-no-verify"
+        "command": "pnpm exec block-no-verify"
       }
     ]
   }
@@ -157,6 +195,18 @@ The following git commands are monitored for `--no-verify`:
 - `git rebase`
 - `git am`
 
+## Blocked GitHub MCP Tools
+
+When a Claude Code / MCP-compatible payload includes a `tool_name`, the following GitHub MCP tools are blocked because they write through the GitHub API and therefore skip local git hooks:
+
+- `mcp__github__create_or_update_file`
+- `mcp__github__delete_file`
+- `mcp__github__push_files`
+- `mcp__github__merge_pull_request`
+- `mcp__github__update_pull_request_branch`
+
+Read-only GitHub MCP tools (e.g. `mcp__github__get_file_contents`, `mcp__github__list_pull_requests`) are not blocked.
+
 ## Behavior
 
 | Command                  | Blocked? | Notes                                         |

package/dist/blocked-github-mcp-tool.d.ts

@@ -0,0 +1,3 @@
+import { BLOCKED_GITHUB_MCP_TOOLS } from './github-mcp-tools.js';
+export type BlockedGithubMcpTool = (typeof BLOCKED_GITHUB_MCP_TOOLS)[number];
+//# sourceMappingURL=blocked-github-mcp-tool.d.ts.map

package/dist/blocked-github-mcp-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocked-github-mcp-tool.d.ts","sourceRoot":"","sources":["../src/blocked-github-mcp-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/blocked-github-mcp-tool.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=blocked-github-mcp-tool.js.map

package/dist/blocked-github-mcp-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocked-github-mcp-tool.js","sourceRoot":"","sources":["../src/blocked-github-mcp-tool.ts"],"names":[],"mappings":""}

package/dist/check-command-options.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Optional context for {@link checkCommand}.
+ */
+export interface CheckCommandOptions {
+    /**
+     * Name of the tool being invoked, when available. Used to detect GitHub
+     * MCP tool calls that would bypass local git hooks.
+     */
+    toolName?: string;
+}
+//# sourceMappingURL=check-command-options.d.ts.map

package/dist/check-command-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-command-options.d.ts","sourceRoot":"","sources":["../src/check-command-options.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB"}

package/dist/check-command-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=check-command-options.js.map

package/dist/check-command-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-command-options.js","sourceRoot":"","sources":["../src/check-command-options.ts"],"names":[],"mappings":""}

package/dist/check-command.d.ts

@@ -1,9 +1,14 @@
+import type { CheckCommandOptions } from './check-command-options.js';
 import type { CheckResult } from './check-result.js';
 /**
- * Checks a command input for --no-verify flag usage or hooks path override
+ * Checks a command input for --no-verify flag usage, hooks path override, or
+ * a direct GitHub MCP tool invocation that would bypass local git hooks.
  *
- * @param input - The command input to check (typically from stdin in Claude Code hooks)
- * @returns CheckResult indicating whether the command should be blocked
+ * @param input - The command input to check (typically from stdin in AI agent
+ *   hooks). May be an empty string when the invocation is a non-shell tool
+ *   call (e.g. an MCP tool).
+ * @param options - Optional context such as the invoked tool name.
+ * @returns CheckResult indicating whether the command should be blocked.
  */
-export declare function checkCommand(input: string): CheckResult;
+export declare function checkCommand(input: string, options?: CheckCommandOptions): CheckResult;
 //# sourceMappingURL=check-command.d.ts.map

package/dist/check-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-command.d.ts","sourceRoot":"","sources":["../src/check-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAKpD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAwBvD"}
+{"version":3,"file":"check-command.d.ts","sourceRoot":"","sources":["../src/check-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAMpD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,mBAAmB,GAC5B,WAAW,CAkCb"}

package/dist/check-command.js

@@ -1,13 +1,26 @@
 import { detectGitCommand } from './detect-git-command.js';
+import { detectBlockedGithubMcpTool } from './detect-github-mcp-tool.js';
 import { hasNoVerifyFlag } from './has-no-verify-flag.js';
 import { hasHooksPathOverride } from './has-hooks-path-override.js';
 /**
- * Checks a command input for --no-verify flag usage or hooks path override
+ * Checks a command input for --no-verify flag usage, hooks path override, or
+ * a direct GitHub MCP tool invocation that would bypass local git hooks.
  *
- * @param input - The command input to check (typically from stdin in Claude Code hooks)
- * @returns CheckResult indicating whether the command should be blocked
+ * @param input - The command input to check (typically from stdin in AI agent
+ *   hooks). May be an empty string when the invocation is a non-shell tool
+ *   call (e.g. an MCP tool).
+ * @param options - Optional context such as the invoked tool name.
+ * @returns CheckResult indicating whether the command should be blocked.
  */
-export function checkCommand(input) {
+export function checkCommand(input, options) {
+    const toolName = options === undefined || options === null ? undefined : options.toolName;
+    const blockedMcpTool = detectBlockedGithubMcpTool(toolName);
+    if (blockedMcpTool !== null) {
+        return {
+            blocked: true,
+            reason: `BLOCKED: ${blockedMcpTool} bypasses local git hooks by writing through the GitHub API. Use local git commands so hooks can run.`,
+        };
+    }
     const gitCommand = detectGitCommand(input);
     if (!gitCommand) {
         return { blocked: false };

package/dist/check-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-command.js","sourceRoot":"","sources":["../src/check-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAEnE;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAE1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,qDAAqD,UAAU,mCAAmC;YAC1G,UAAU;SACX,CAAA;IACH,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,8DAA8D,UAAU,mCAAmC;YACnH,UAAU;SACX,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;AACvC,CAAC"}
+{"version":3,"file":"check-command.js","sourceRoot":"","sources":["../src/check-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAEnE;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,OAA6B;IAE7B,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IAC1E,MAAM,cAAc,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAA;IAC3D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,YAAY,cAAc,uGAAuG;SAC1I,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAE1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC3B,CAAC;IAED,IAAI,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,qDAAqD,UAAU,mCAAmC;YAC1G,UAAU;SACX,CAAA;IACH,CAAC;IAED,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,8DAA8D,UAAU,mCAAmC;YACnH,UAAU;SACX,CAAA;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;AACvC,CAAC"}

package/dist/cli-help.d.ts

@@ -1,5 +1,5 @@
 /**
  * CLI help text
  */
-export declare const HELP_TEXT = "block-no-verify - Block --no-verify flags in git commands\n\nUSAGE:\n  block-no-verify [options] [command]\n\nOPTIONS:\n  --format <type>   Input format: auto, plain, claude-code, json (default: auto)\n  --help, -h        Show this help message\n  --version, -v     Show version number\n\nINPUT METHODS:\n  1. Command argument:\n     block-no-verify \"git commit --no-verify -m 'test'\"\n\n  2. Stdin (plain text):\n     echo \"git commit --no-verify\" | block-no-verify\n\n  3. Stdin (JSON - auto-detected):\n     echo '{\"command\":\"git commit --no-verify\"}' | block-no-verify\n\n  4. Stdin (Claude Code format):\n     echo '{\"tool_input\":{\"command\":\"git commit\"}}' | block-no-verify --format claude-code\n\nSUPPORTED JSON FIELDS:\n  When using JSON input, the following fields are recognized:\n  - tool_input.command  (Claude Code format)\n  - command\n  - cmd\n  - input\n  - shell\n  - script\n\nEXIT CODES:\n  0 - Command is allowed\n  2 - Command is blocked (contains --no-verify)\n  1 - An error occurred\n\nEXAMPLES:\n  # Claude Code hook (.claude/settings.json)\n  {\n    \"hooks\": {\n      \"PreToolUse\": [{\n        \"matcher\": \"Bash\",\n        \"hooks\": [{ \"type\": \"command\", \"command\": \"block-no-verify\" }]\n      }]\n    }\n  }\n\n  # Cursor hook (.cursor/hooks.json)\n  {\n    \"hooks\": {\n      \"beforeShellExecution\": [{\n        \"command\": \"pnpm dlx block-no-verify\"\n      }]\n    }\n  }\n\n  # Generic AI tool integration\n  block-no-verify --format plain \"git push --no-verify\"\n\n  # Pipe from another command\n  your-ai-tool get-command | block-no-verify";
+export declare const HELP_TEXT = "block-no-verify - Block ways to bypass local git hooks\n\nBlocks --no-verify flags, core.hooksPath overrides, and GitHub MCP tool calls\nthat write through the GitHub API (e.g. mcp__github__push_files).\n\nUSAGE:\n  block-no-verify [options] [command]\n\nOPTIONS:\n  --format <type>   Input format: auto, plain, claude-code, json (default: auto)\n  --help, -h        Show this help message\n  --version, -v     Show version number\n\nINPUT METHODS:\n  1. Command argument:\n     block-no-verify \"git commit --no-verify -m 'test'\"\n\n  2. Stdin (plain text):\n     echo \"git commit --no-verify\" | block-no-verify\n\n  3. Stdin (JSON - auto-detected):\n     echo '{\"command\":\"git commit --no-verify\"}' | block-no-verify\n\n  4. Stdin (Claude Code format):\n     echo '{\"tool_input\":{\"command\":\"git commit\"}}' | block-no-verify --format claude-code\n\nSUPPORTED JSON FIELDS:\n  When using JSON input, the following fields are recognized:\n  - tool_input.command  (Claude Code format)\n  - command\n  - cmd\n  - input\n  - shell\n  - script\n\nEXIT CODES:\n  0 - Command / tool call is allowed\n  2 - Command / tool call is blocked (bypasses git hooks)\n  1 - An error occurred\n\nEXAMPLES:\n  # Claude Code hook (.claude/settings.json)\n  {\n    \"hooks\": {\n      \"PreToolUse\": [{\n        \"matcher\": \"Bash\",\n        \"hooks\": [{ \"type\": \"command\", \"command\": \"block-no-verify\" }]\n      }]\n    }\n  }\n\n  # Cursor hook (.cursor/hooks.json)\n  {\n    \"hooks\": {\n      \"beforeShellExecution\": [{\n        \"command\": \"pnpm dlx block-no-verify\"\n      }]\n    }\n  }\n\n  # Generic AI tool integration\n  block-no-verify --format plain \"git push --no-verify\"\n\n  # Pipe from another command\n  your-ai-tool get-command | block-no-verify";
 //# sourceMappingURL=cli-help.d.ts.map

package/dist/cli-help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,SAAS,8kDA6DuB,CAAA"}
+{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,SAAS,qvDAgEuB,CAAA"}

package/dist/cli-help.js

@@ -1,7 +1,10 @@
 /**
  * CLI help text
  */
-export const HELP_TEXT = `block-no-verify - Block --no-verify flags in git commands
+export const HELP_TEXT = `block-no-verify - Block ways to bypass local git hooks
+
+Blocks --no-verify flags, core.hooksPath overrides, and GitHub MCP tool calls
+that write through the GitHub API (e.g. mcp__github__push_files).
 
 USAGE:
   block-no-verify [options] [command]
@@ -34,8 +37,8 @@ SUPPORTED JSON FIELDS:
   - script
 
 EXIT CODES:
-  0 - Command is allowed
-  2 - Command is blocked (contains --no-verify)
+  0 - Command / tool call is allowed
+  2 - Command / tool call is blocked (bypasses git hooks)
   1 - An error occurred
 
 EXAMPLES:

package/dist/cli-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CA6DoB,CAAA"}
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAgEoB,CAAA"}

package/dist/cli.js

@@ -56,8 +56,10 @@ async function main() {
         if (!rawInput.trim()) {
             process.exit(EXIT_CODES.ALLOWED);
         }
-        const { command } = parseInput(rawInput, args.format);
-        const result = checkCommand(command);
+        const { command, toolName } = parseInput(rawInput, args.format);
+        const result = toolName === undefined
+            ? checkCommand(command)
+            : checkCommand(command, { toolName });
         if (result.blocked) {
             console.error(result.reason);
             process.exit(EXIT_CODES.BLOCKED);

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAErD,MAAM,OAAO,GAAG,OAAO,CAAA;AAEvB,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAA;QAEb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAEjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YAC9B,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,CAAC,EAAE,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACtB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAC9D,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACjD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAE1D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACtB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,mCAAmC;QACnC,IAAI,QAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAA;QAC9B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACrD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QAEpC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAErD,MAAM,OAAO,GAAG,OAAO,CAAA;AAEvB,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAA;QAEb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAEjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YAC9B,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,CAAC,EAAE,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACtB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAC9D,OAAO,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAA;IACjD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAE1D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;YACtB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,mCAAmC;QACnC,IAAI,QAAgB,CAAA;QACpB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAA;QAC9B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;YACvB,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QAEzC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAChC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAA"}

package/dist/detect-github-mcp-tool.d.ts

@@ -0,0 +1,12 @@
+import type { BlockedGithubMcpTool } from './blocked-github-mcp-tool.js';
+/**
+ * Checks whether a tool name refers to a GitHub MCP tool that bypasses local
+ * git hooks.
+ *
+ * @param toolName - The tool name reported by the AI agent (e.g. from a
+ *   Claude Code `PreToolUse` payload).
+ * @returns The matched blocked tool name, or null when the tool is not a
+ *   blocked GitHub MCP tool.
+ */
+export declare function detectBlockedGithubMcpTool(toolName: string | undefined | null): BlockedGithubMcpTool | null;
+//# sourceMappingURL=detect-github-mcp-tool.d.ts.map

package/dist/detect-github-mcp-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-github-mcp-tool.d.ts","sourceRoot":"","sources":["../src/detect-github-mcp-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAGxE;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAClC,oBAAoB,GAAG,IAAI,CAiB7B"}

package/dist/detect-github-mcp-tool.js

@@ -0,0 +1,26 @@
+import { BLOCKED_GITHUB_MCP_TOOLS } from './github-mcp-tools.js';
+/**
+ * Checks whether a tool name refers to a GitHub MCP tool that bypasses local
+ * git hooks.
+ *
+ * @param toolName - The tool name reported by the AI agent (e.g. from a
+ *   Claude Code `PreToolUse` payload).
+ * @returns The matched blocked tool name, or null when the tool is not a
+ *   blocked GitHub MCP tool.
+ */
+export function detectBlockedGithubMcpTool(toolName) {
+    if (toolName === undefined || toolName === null) {
+        return null;
+    }
+    const trimmed = toolName.trim();
+    if (trimmed === '') {
+        return null;
+    }
+    for (const blocked of BLOCKED_GITHUB_MCP_TOOLS) {
+        if (trimmed === blocked) {
+            return blocked;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=detect-github-mcp-tool.js.map

package/dist/detect-github-mcp-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-github-mcp-tool.js","sourceRoot":"","sources":["../src/detect-github-mcp-tool.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmC;IAEnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,OAAO,CAAA;QAChB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/extract-from-json.d.ts

@@ -0,0 +1,6 @@
+import type { ExtractedJson } from './extracted-json.js';
+/**
+ * Attempts to parse input as JSON and extract the command + tool name.
+ */
+export declare function tryExtractFromJson(input: string): ExtractedJson | null;
+//# sourceMappingURL=extract-from-json.d.ts.map

package/dist/extract-from-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-from-json.d.ts","sourceRoot":"","sources":["../src/extract-from-json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAuDxD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CA6BtE"}

package/dist/extract-from-json.js

@@ -0,0 +1,73 @@
+import { getProperty } from './get-property.js';
+import { hasProperty } from './json-helpers.js';
+/**
+ * Extracts a `tool_name` field when present at the top level of the JSON
+ * payload (Claude Code / Gemini CLI shape).
+ */
+function extractToolName(parsed) {
+    if (!hasProperty(parsed, 'tool_name')) {
+        return null;
+    }
+    const value = getProperty(parsed, 'tool_name');
+    if (typeof value === 'string') {
+        return value;
+    }
+    return null;
+}
+function extractClaudeCodeCommand(parsed, toolName) {
+    if (!hasProperty(parsed, 'tool_input')) {
+        return null;
+    }
+    const toolInput = getProperty(parsed, 'tool_input');
+    if (typeof toolInput === 'object' && toolInput !== null) {
+        if (hasProperty(toolInput, 'command')) {
+            const command = getProperty(toolInput, 'command');
+            if (typeof command === 'string') {
+                return { command, toolName };
+            }
+        }
+    }
+    // tool_input present without a string command (e.g. MCP tool invocation).
+    return { command: null, toolName };
+}
+function extractGenericCommand(parsed, toolName) {
+    const genericKeys = ['command', 'cmd', 'input', 'shell', 'script'];
+    for (const key of genericKeys) {
+        if (hasProperty(parsed, key)) {
+            const value = getProperty(parsed, key);
+            if (typeof value === 'string') {
+                return { command: value, toolName };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Attempts to parse input as JSON and extract the command + tool name.
+ */
+export function tryExtractFromJson(input) {
+    try {
+        const parsed = JSON.parse(input);
+        if (typeof parsed !== 'object' || parsed === null) {
+            return null;
+        }
+        const toolName = extractToolName(parsed);
+        const claudeCode = extractClaudeCodeCommand(parsed, toolName);
+        if (claudeCode !== null) {
+            return claudeCode;
+        }
+        const generic = extractGenericCommand(parsed, toolName);
+        if (generic !== null) {
+            return generic;
+        }
+        // JSON parsed but no recognized command field. Still surface tool name.
+        if (toolName !== null) {
+            return { command: null, toolName };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=extract-from-json.js.map

package/dist/extract-from-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-from-json.js","sourceRoot":"","sources":["../src/extract-from-json.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAc,EACd,QAAuB;IAEvB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACnD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACpC,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAc,EACd,QAAuB;IAEvB,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAClE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAEzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;QAExC,MAAM,UAAU,GAAG,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC7D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,UAAU,CAAA;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,OAAO,CAAA;QAChB,CAAC;QAED,wEAAwE;QACxE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QACpC,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/extracted-json.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Extracted pieces from a JSON payload.
+ */
+export interface ExtractedJson {
+    command: string | null;
+    toolName: string | null;
+}
+//# sourceMappingURL=extracted-json.d.ts.map

package/dist/extracted-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extracted-json.d.ts","sourceRoot":"","sources":["../src/extracted-json.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB"}

package/dist/extracted-json.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=extracted-json.js.map

package/dist/extracted-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extracted-json.js","sourceRoot":"","sources":["../src/extracted-json.ts"],"names":[],"mappings":""}

package/dist/get-property.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Type-safe property access using Object.entries
+ */
+export declare function getProperty(obj: object, key: string): unknown;
+//# sourceMappingURL=get-property.d.ts.map

package/dist/get-property.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-property.d.ts","sourceRoot":"","sources":["../src/get-property.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQ7D"}

package/dist/get-property.js

@@ -0,0 +1,13 @@
+/**
+ * Type-safe property access using Object.entries
+ */
+export function getProperty(obj, key) {
+    const entries = Object.entries(obj);
+    for (const entry of entries) {
+        if (entry[0] === key) {
+            return entry[1];
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=get-property.js.map

package/dist/get-property.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-property.js","sourceRoot":"","sources":["../src/get-property.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/github-mcp-tools.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GitHub MCP tools that bypass local git hooks.
+ *
+ * These MCP tools communicate directly with the GitHub API, meaning they do
+ * not trigger local pre-commit, pre-push, commit-msg, or other client-side
+ * hooks. Blocking them prevents AI agents from side-stepping the validations
+ * enforced by those hooks.
+ */
+export declare const BLOCKED_GITHUB_MCP_TOOLS: readonly ["mcp__github__create_or_update_file", "mcp__github__delete_file", "mcp__github__push_files", "mcp__github__merge_pull_request", "mcp__github__update_pull_request_branch"];
+//# sourceMappingURL=github-mcp-tools.d.ts.map

package/dist/github-mcp-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-mcp-tools.d.ts","sourceRoot":"","sources":["../src/github-mcp-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,sLAQ3B,CAAA"}

package/dist/github-mcp-tools.js

@@ -0,0 +1,18 @@
+/**
+ * GitHub MCP tools that bypass local git hooks.
+ *
+ * These MCP tools communicate directly with the GitHub API, meaning they do
+ * not trigger local pre-commit, pre-push, commit-msg, or other client-side
+ * hooks. Blocking them prevents AI agents from side-stepping the validations
+ * enforced by those hooks.
+ */
+export const BLOCKED_GITHUB_MCP_TOOLS = [
+    // Content writes that bypass pre-commit / commit-msg hooks
+    'mcp__github__create_or_update_file',
+    'mcp__github__delete_file',
+    'mcp__github__push_files',
+    // Branch / merge operations that bypass pre-push hooks
+    'mcp__github__merge_pull_request',
+    'mcp__github__update_pull_request_branch',
+];
+//# sourceMappingURL=github-mcp-tools.js.map

package/dist/github-mcp-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-mcp-tools.js","sourceRoot":"","sources":["../src/github-mcp-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,2DAA2D;IAC3D,oCAAoC;IACpC,0BAA0B;IAC1B,yBAAyB;IACzB,uDAAuD;IACvD,iCAAiC;IACjC,yCAAyC;CACjC,CAAA"}

package/dist/index.d.ts

@@ -11,7 +11,11 @@ export { EXIT_CODES } from './exit-codes.js';
 export { detectGitCommand } from './detect-git-command.js';
 export { hasNoVerifyFlag } from './has-no-verify-flag.js';
 export { hasHooksPathOverride } from './has-hooks-path-override.js';
+export { detectBlockedGithubMcpTool } from './detect-github-mcp-tool.js';
+export { BLOCKED_GITHUB_MCP_TOOLS } from './github-mcp-tools.js';
+export type { BlockedGithubMcpTool } from './blocked-github-mcp-tool.js';
 export { checkCommand } from './check-command.js';
+export type { CheckCommandOptions } from './check-command-options.js';
 export { parseInput } from './parse-input.js';
 export type { InputFormat } from './input-format.js';
 export type { ParseResult } from './parse-result.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AACxD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AACxD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.js

@@ -9,6 +9,8 @@ export { EXIT_CODES } from './exit-codes.js';
 export { detectGitCommand } from './detect-git-command.js';
 export { hasNoVerifyFlag } from './has-no-verify-flag.js';
 export { hasHooksPathOverride } from './has-hooks-path-override.js';
+export { detectBlockedGithubMcpTool } from './detect-github-mcp-tool.js';
+export { BLOCKED_GITHUB_MCP_TOOLS } from './github-mcp-tools.js';
 export { checkCommand } from './check-command.js';
 export { parseInput } from './parse-input.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/json-helpers.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Type-safe property check
+ */
+export declare function hasProperty(obj: object, key: string): boolean;
+//# sourceMappingURL=json-helpers.d.ts.map

package/dist/json-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-helpers.d.ts","sourceRoot":"","sources":["../src/json-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7D"}

package/dist/json-helpers.js

@@ -0,0 +1,7 @@
+/**
+ * Type-safe property check
+ */
+export function hasProperty(obj, key) {
+    return Object.prototype.hasOwnProperty.call(obj, key);
+}
+//# sourceMappingURL=json-helpers.js.map

package/dist/json-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-helpers.js","sourceRoot":"","sources":["../src/json-helpers.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACvD,CAAC"}

package/dist/parse-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-input.d.ts","sourceRoot":"","sources":["../src/parse-input.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAyHpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,CAkB3E"}
+{"version":3,"file":"parse-input.d.ts","sourceRoot":"","sources":["../src/parse-input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AA8CpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,CAmB3E"}

package/dist/parse-input.js

@@ -1,111 +1,29 @@
-/**
- * Attempts to parse input as JSON and extract the command
- */
-function tryParseJson(input) {
-    try {
-        const parsed = JSON.parse(input);
-        if (typeof parsed !== 'object' || parsed === null) {
-            return null;
-        }
-        // Check for Claude Code format: { tool_input: { command: "..." } }
-        if (hasProperty(parsed, 'tool_input')) {
-            const toolInput = getProperty(parsed, 'tool_input');
-            if (typeof toolInput === 'object' && toolInput !== null) {
-                if (hasProperty(toolInput, 'command')) {
-                    const command = getProperty(toolInput, 'command');
-                    if (typeof command === 'string') {
-                        return command;
-                    }
-                }
-            }
-        }
-        // Generic JSON formats
-        const genericKeys = ['command', 'cmd', 'input', 'shell', 'script'];
-        for (const key of genericKeys) {
-            if (hasProperty(parsed, key)) {
-                const value = getProperty(parsed, key);
-                if (typeof value === 'string') {
-                    return value;
-                }
-            }
-        }
-        // If JSON but no recognized command field, return null
-        return null;
-    }
-    catch {
-        // Not valid JSON
-        return null;
+import { tryExtractFromJson } from './extract-from-json.js';
+function resolveExtracted(input) {
+    const extracted = tryExtractFromJson(input);
+    if (extracted === null) {
+        return { command: input, toolName: null };
     }
+    return {
+        command: extracted.command === null ? input : extracted.command,
+        toolName: extracted.toolName,
+    };
 }
-/**
- * Type-safe property check
- */
-function hasProperty(obj, key) {
-    return Object.prototype.hasOwnProperty.call(obj, key);
-}
-/**
- * Type-safe property access using Object.entries
- */
-function getProperty(obj, key) {
-    const entries = Object.entries(obj);
-    for (const entry of entries) {
-        if (entry[0] === key) {
-            return entry[1];
-        }
+function buildResult(command, format, toolName) {
+    if (toolName === null) {
+        return { command, format };
     }
-    return undefined;
+    return { command, format, toolName };
 }
-/**
- * Parses input in Claude Code format
- */
-function parseClaudeCode(input) {
-    try {
-        const parsed = JSON.parse(input);
-        if (typeof parsed !== 'object' || parsed === null) {
-            return input;
-        }
-        if (hasProperty(parsed, 'tool_input')) {
-            const toolInput = getProperty(parsed, 'tool_input');
-            if (typeof toolInput === 'object' && toolInput !== null) {
-                if (hasProperty(toolInput, 'command')) {
-                    const command = getProperty(toolInput, 'command');
-                    if (typeof command === 'string') {
-                        return command;
-                    }
-                }
-            }
-        }
-        return input;
-    }
-    catch {
-        // If not valid JSON, treat as plain text
-        return input;
-    }
-}
-/**
- * Parses input in generic JSON format
- */
-function parseJson(input) {
-    const command = tryParseJson(input);
-    if (command !== null) {
-        return command;
-    }
-    return input;
-}
-/**
- * Auto-detects format and parses input
- */
 function parseAuto(input) {
     const trimmed = input.trim();
-    // Try JSON first if it looks like JSON
     if (trimmed.startsWith('{')) {
-        const command = tryParseJson(trimmed);
-        if (command !== null) {
-            return { command, format: 'json' };
+        const extracted = tryExtractFromJson(trimmed);
+        if (extracted !== null) {
+            return buildResult(extracted.command === null ? input : extracted.command, 'json', extracted.toolName);
         }
     }
-    // Otherwise treat as plain text
-    return { command: input, format: 'plain' };
+    return buildResult(input, 'plain', null);
 }
 /**
  * Parses input according to the specified format
@@ -135,12 +53,13 @@ export function parseInput(input, format) {
         return { command: input, format: 'plain' };
     }
     if (resolvedFormat === 'claude-code') {
-        return { command: parseClaudeCode(input), format: 'claude-code' };
+        const extracted = resolveExtracted(input);
+        return buildResult(extracted.command, 'claude-code', extracted.toolName);
     }
     if (resolvedFormat === 'json') {
-        return { command: parseJson(input), format: 'json' };
+        const extracted = resolveExtracted(input);
+        return buildResult(extracted.command, 'json', extracted.toolName);
     }
-    // resolvedFormat === 'auto'
     return parseAuto(input);
 }
 //# sourceMappingURL=parse-input.js.map

package/dist/parse-input.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-input.js","sourceRoot":"","sources":["../src/parse-input.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAEzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,mEAAmE;QACnE,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YACnD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,IAAI,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;oBACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAChC,OAAO,OAAO,CAAA;oBAChB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;QAClE,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;gBACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,uDAAuD;QACvD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;YACnD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACxD,IAAI,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;oBACtC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;oBACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAChC,OAAO,OAAO,CAAA;oBAChB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;QACzC,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAE5B,uCAAuC;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QACpC,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,MAAoB;IAC5D,MAAM,cAAc,GAClB,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAE3D,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5C,CAAC;IAED,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IACnE,CAAC;IAED,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IACtD,CAAC;IAED,4BAA4B;IAC5B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC"}
+{"version":3,"file":"parse-input.js","sourceRoot":"","sources":["../src/parse-input.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAS3D,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3C,CAAC;IACD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO;QAC/D,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAClB,OAAe,EACf,MAAmB,EACnB,QAAuB;IAEvB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAC5B,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAE5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,WAAW,CAChB,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EACtD,MAAM,EACN,SAAS,CAAC,QAAQ,CACnB,CAAA;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,MAAoB;IAC5D,MAAM,cAAc,GAClB,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAE3D,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC5C,CAAC;IAED,IAAI,cAAc,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,OAAO,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,OAAO,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,CAAA;AACzB,CAAC"}

package/dist/parse-result.d.ts

@@ -5,5 +5,11 @@ import type { InputFormat } from './input-format.js';
 export interface ParseResult {
     command: string;
     format: InputFormat;
+    /**
+     * Name of the tool being invoked, when the input format exposes it (e.g.
+     * Claude Code's `tool_name` field). Used to detect direct GitHub MCP calls
+     * that would bypass local git hooks.
+     */
+    toolName?: string;
 }
 //# sourceMappingURL=parse-result.d.ts.map

package/dist/parse-result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-result.d.ts","sourceRoot":"","sources":["../src/parse-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,WAAW,CAAA;CACpB"}
+{"version":3,"file":"parse-result.d.ts","sourceRoot":"","sources":["../src/parse-result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,WAAW,CAAA;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "block-no-verify",
-  "version": "1.1.2",
+  "version": "1.1.5",
   "description": "CLI tool to block --no-verify flag in git commands. Prevents AI agents from bypassing git hooks.",
   "type": "module",
   "main": "./dist/index.js",
@@ -17,6 +17,22 @@
   "files": [
     "dist"
   ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest",
+    "test:watch": "vitest --watch",
+    "test:coverage": "vitest --coverage",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,md}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,md}\"",
+    "spell": "cspell lint '**/*.{ts,js,md,json}' --gitignore",
+    "spell:check": "cspell lint '**/*.{ts,js,md,json}' --gitignore",
+    "knip": "knip",
+    "prepare": "husky",
+    "release": "release-it"
+  },
   "keywords": [
     "git",
     "no-verify",
@@ -32,6 +48,7 @@
   "engines": {
     "node": ">=20.0.0"
   },
+  "packageManager": "pnpm@10.26.2",
   "publishConfig": {
     "access": "public"
   },
@@ -44,37 +61,23 @@
   },
   "homepage": "https://github.com/tupe12334/block-no-verify#readme",
   "devDependencies": {
-    "@commitlint/cli": "^20.3.1",
-    "@commitlint/config-conventional": "^20.3.1",
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
     "@cspell/dict-he": "^4.0.5",
-    "@types/node": "^25.0.3",
-    "@vitest/coverage-v8": "^4.0.16",
-    "cspell": "^9.4.0",
-    "eslint": "^9.39.2",
+    "@release-it/conventional-changelog": "^10.0.6",
+    "@types/node": "^25.5.0",
+    "@vitest/coverage-v8": "^4.1.1",
+    "cspell": "^9.7.0",
+    "eslint": "^9.39.4",
     "eslint-config-agent": "^1.9.3",
     "eslint-config-publishable-package-json": "^1.0.0",
     "eslint-import-resolver-typescript": "^4.4.4",
     "husky": "^9.1.7",
-    "knip": "^5.80.2",
-    "lint-staged": "^16.2.7",
-    "prettier": "^3.7.4",
-    "release-it": "^19.2.3",
+    "knip": "^5.88.1",
+    "lint-staged": "^16.4.0",
+    "prettier": "^3.8.1",
+    "release-it": "^19.2.4",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.16"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "test": "vitest",
-    "test:watch": "vitest --watch",
-    "test:coverage": "vitest --coverage",
-    "lint": "eslint .",
-    "lint:fix": "eslint . --fix",
-    "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,md}\"",
-    "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,md}\"",
-    "spell": "cspell lint '**/*.{ts,js,md,json}' --gitignore",
-    "spell:check": "cspell lint '**/*.{ts,js,md,json}' --gitignore",
-    "knip": "knip",
-    "release": "release-it"
+    "vitest": "^4.1.1"
   }
-}
+}