blockmine 1.20.0 → 1.22.0

package/.claude/hooks/post-tool-use-tracker.ps1

@@ -0,0 +1,174 @@
+# PowerShell Post-tool-use hook that tracks edited files and their repos
+# Windows users: Use this instead of post-tool-use-tracker.sh
+
+$ErrorActionPreference = "Stop"
+
+# Read tool information from stdin
+$toolInfo = $input | ConvertFrom-Json
+
+# Extract relevant data
+$toolName = $toolInfo.tool_name
+$filePath = $toolInfo.tool_input.file_path
+$sessionId = if ($toolInfo.session_id) { $toolInfo.session_id } else { "default" }
+
+# Skip if not an edit tool or no file path
+if ($toolName -notmatch '^(Edit|MultiEdit|Write)$' -or [string]::IsNullOrEmpty($filePath)) {
+    exit 0
+}
+
+# Skip markdown files
+if ($filePath -match '\.(md|markdown)$') {
+    exit 0
+}
+
+# Create cache directory in project
+$cacheDir = Join-Path $env:CLAUDE_PROJECT_DIR ".claude\tsc-cache\$sessionId"
+New-Item -ItemType Directory -Force -Path $cacheDir | Out-Null
+
+# Function to detect repo from file path
+function Detect-Repo {
+    param([string]$file)
+
+    $projectRoot = $env:CLAUDE_PROJECT_DIR
+    $relativePath = $file.Replace("$projectRoot\", "").Replace("$projectRoot/", "")
+
+    # Extract first directory component
+    $firstDir = $relativePath.Split('\')[0].Split('/')[0]
+
+    switch -Regex ($firstDir) {
+        # Frontend variations
+        '^(frontend|client|web|app|ui)$' { return $firstDir }
+
+        # Backend variations
+        '^(backend|server|api|src|services)$' { return $firstDir }
+
+        # Database
+        '^(database|prisma|migrations)$' { return $firstDir }
+
+        # Package/monorepo structure
+        '^packages$' {
+            $parts = $relativePath.Split('\')[0..1]
+            if ($parts.Length -ge 2) {
+                return "packages\$($parts[1])"
+            }
+            return $firstDir
+        }
+
+        # Examples directory
+        '^examples$' {
+            $parts = $relativePath.Split('\')[0..1]
+            if ($parts.Length -ge 2) {
+                return "examples\$($parts[1])"
+            }
+            return $firstDir
+        }
+
+        default {
+            # Check if it's a source file in root
+            if ($relativePath -notmatch '[\\/]') {
+                return "root"
+            }
+            return "unknown"
+        }
+    }
+}
+
+# Function to get build command for repo
+function Get-BuildCommand {
+    param([string]$repo)
+
+    $projectRoot = $env:CLAUDE_PROJECT_DIR
+    $repoPath = Join-Path $projectRoot $repo
+    $packageJson = Join-Path $repoPath "package.json"
+
+    # Check if package.json exists and has a build script
+    if (Test-Path $packageJson) {
+        $packageContent = Get-Content $packageJson -Raw
+        if ($packageContent -match '"build"') {
+            # Detect package manager (prefer pnpm, then npm, then yarn)
+            if (Test-Path (Join-Path $repoPath "pnpm-lock.yaml")) {
+                return "cd $repoPath && pnpm build"
+            } elseif (Test-Path (Join-Path $repoPath "package-lock.json")) {
+                return "cd $repoPath && npm run build"
+            } elseif (Test-Path (Join-Path $repoPath "yarn.lock")) {
+                return "cd $repoPath && yarn build"
+            } else {
+                return "cd $repoPath && npm run build"
+            }
+        }
+    }
+
+    # Special case for database with Prisma
+    if ($repo -match '^(database|.*prisma.*)$') {
+        if ((Test-Path (Join-Path $repoPath "schema.prisma")) -or
+            (Test-Path (Join-Path $repoPath "prisma\schema.prisma"))) {
+            return "cd $repoPath && npx prisma generate"
+        }
+    }
+
+    return ""
+}
+
+# Function to get TSC command for repo
+function Get-TscCommand {
+    param([string]$repo)
+
+    $projectRoot = $env:CLAUDE_PROJECT_DIR
+    $repoPath = Join-Path $projectRoot $repo
+    $tsconfig = Join-Path $repoPath "tsconfig.json"
+
+    # Check if tsconfig.json exists
+    if (Test-Path $tsconfig) {
+        # Check for Vite/React-specific tsconfig
+        $tsconfigApp = Join-Path $repoPath "tsconfig.app.json"
+        if (Test-Path $tsconfigApp) {
+            return "cd $repoPath && npx tsc --project tsconfig.app.json --noEmit"
+        } else {
+            return "cd $repoPath && npx tsc --noEmit"
+        }
+    }
+
+    return ""
+}
+
+# Detect repo
+$repo = Detect-Repo $filePath
+
+# Skip if unknown repo
+if ($repo -eq "unknown" -or [string]::IsNullOrEmpty($repo)) {
+    exit 0
+}
+
+# Log edited file
+$timestamp = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
+Add-Content -Path (Join-Path $cacheDir "edited-files.log") -Value "${timestamp}:${filePath}:${repo}"
+
+# Update affected repos list
+$affectedReposFile = Join-Path $cacheDir "affected-repos.txt"
+$existingRepos = if (Test-Path $affectedReposFile) { Get-Content $affectedReposFile } else { @() }
+if ($existingRepos -notcontains $repo) {
+    Add-Content -Path $affectedReposFile -Value $repo
+}
+
+# Store build commands
+$commandsTmp = Join-Path $cacheDir "commands.txt.tmp"
+$buildCmd = Get-BuildCommand $repo
+$tscCmd = Get-TscCommand $repo
+
+if (![string]::IsNullOrEmpty($buildCmd)) {
+    Add-Content -Path $commandsTmp -Value "${repo}:build:${buildCmd}"
+}
+
+if (![string]::IsNullOrEmpty($tscCmd)) {
+    Add-Content -Path $commandsTmp -Value "${repo}:tsc:${tscCmd}"
+}
+
+# Remove duplicates from commands
+$commandsFile = Join-Path $cacheDir "commands.txt"
+if (Test-Path $commandsTmp) {
+    Get-Content $commandsTmp | Sort-Object -Unique | Set-Content $commandsFile
+    Remove-Item $commandsTmp -Force
+}
+
+# Exit cleanly
+exit 0

package/.claude/hooks/post-tool-use-tracker.sh

@@ -0,0 +1,183 @@
+#!/bin/bash
+set -e
+
+# Set default CLAUDE_PROJECT_DIR if not set
+if [ -z "$CLAUDE_PROJECT_DIR" ]; then
+    export CLAUDE_PROJECT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+fi
+
+# Post-tool-use hook that tracks edited files and their repos
+# This runs after Edit, MultiEdit, or Write tools complete successfully
+
+
+# Read tool information from stdin
+tool_info=$(cat)
+
+
+# Extract relevant data
+tool_name=$(echo "$tool_info" | jq -r '.tool_name // empty')
+file_path=$(echo "$tool_info" | jq -r '.tool_input.file_path // empty')
+session_id=$(echo "$tool_info" | jq -r '.session_id // empty')
+
+
+# Skip if not an edit tool or no file path
+if [[ ! "$tool_name" =~ ^(Edit|MultiEdit|Write)$ ]] || [[ -z "$file_path" ]]; then
+    exit 0  # Exit 0 for skip conditions
+fi
+
+# Skip markdown files
+if [[ "$file_path" =~ \.(md|markdown)$ ]]; then
+    exit 0  # Exit 0 for skip conditions
+fi
+
+# Create cache directory in project
+cache_dir="$CLAUDE_PROJECT_DIR/.claude/tsc-cache/${session_id:-default}"
+mkdir -p "$cache_dir"
+
+# Function to detect repo from file path
+detect_repo() {
+    local file="$1"
+    local project_root="$CLAUDE_PROJECT_DIR"
+
+    # Remove project root from path
+    local relative_path="${file#$project_root/}"
+
+    # Extract first directory component
+    local repo=$(echo "$relative_path" | cut -d'/' -f1)
+
+    # Common project directory patterns
+    case "$repo" in
+        # Frontend variations
+        frontend|client|web|app|ui)
+            echo "$repo"
+            ;;
+        # Backend variations
+        backend|server|api|src|services)
+            echo "$repo"
+            ;;
+        # Database
+        database|prisma|migrations)
+            echo "$repo"
+            ;;
+        # Package/monorepo structure
+        packages)
+            # For monorepos, get the package name
+            local package=$(echo "$relative_path" | cut -d'/' -f2)
+            if [[ -n "$package" ]]; then
+                echo "packages/$package"
+            else
+                echo "$repo"
+            fi
+            ;;
+        # Examples directory
+        examples)
+            local example=$(echo "$relative_path" | cut -d'/' -f2)
+            if [[ -n "$example" ]]; then
+                echo "examples/$example"
+            else
+                echo "$repo"
+            fi
+            ;;
+        *)
+            # Check if it's a source file in root
+            if [[ ! "$relative_path" =~ / ]]; then
+                echo "root"
+            else
+                echo "unknown"
+            fi
+            ;;
+    esac
+}
+
+# Function to get build command for repo
+get_build_command() {
+    local repo="$1"
+    local project_root="$CLAUDE_PROJECT_DIR"
+    local repo_path="$project_root/$repo"
+
+    # Check if package.json exists and has a build script
+    if [[ -f "$repo_path/package.json" ]]; then
+        if grep -q '"build"' "$repo_path/package.json" 2>/dev/null; then
+            # Detect package manager (prefer pnpm, then npm, then yarn)
+            if [[ -f "$repo_path/pnpm-lock.yaml" ]]; then
+                echo "cd $repo_path && pnpm build"
+            elif [[ -f "$repo_path/package-lock.json" ]]; then
+                echo "cd $repo_path && npm run build"
+            elif [[ -f "$repo_path/yarn.lock" ]]; then
+                echo "cd $repo_path && yarn build"
+            else
+                echo "cd $repo_path && npm run build"
+            fi
+            return
+        fi
+    fi
+
+    # Special case for database with Prisma
+    if [[ "$repo" == "database" ]] || [[ "$repo" =~ prisma ]]; then
+        if [[ -f "$repo_path/schema.prisma" ]] || [[ -f "$repo_path/prisma/schema.prisma" ]]; then
+            echo "cd $repo_path && npx prisma generate"
+            return
+        fi
+    fi
+
+    # No build command found
+    echo ""
+}
+
+# Function to get TSC command for repo
+get_tsc_command() {
+    local repo="$1"
+    local project_root="$CLAUDE_PROJECT_DIR"
+    local repo_path="$project_root/$repo"
+
+    # Check if tsconfig.json exists
+    if [[ -f "$repo_path/tsconfig.json" ]]; then
+        # Check for Vite/React-specific tsconfig
+        if [[ -f "$repo_path/tsconfig.app.json" ]]; then
+            echo "cd $repo_path && npx tsc --project tsconfig.app.json --noEmit"
+        else
+            echo "cd $repo_path && npx tsc --noEmit"
+        fi
+        return
+    fi
+
+    # No TypeScript config found
+    echo ""
+}
+
+# Detect repo
+repo=$(detect_repo "$file_path")
+
+# Skip if unknown repo
+if [[ "$repo" == "unknown" ]] || [[ -z "$repo" ]]; then
+    exit 0  # Exit 0 for skip conditions
+fi
+
+# Log edited file
+echo "$(date +%s):$file_path:$repo" >> "$cache_dir/edited-files.log"
+
+# Update affected repos list
+if ! grep -q "^$repo$" "$cache_dir/affected-repos.txt" 2>/dev/null; then
+    echo "$repo" >> "$cache_dir/affected-repos.txt"
+fi
+
+# Store build commands
+build_cmd=$(get_build_command "$repo")
+tsc_cmd=$(get_tsc_command "$repo")
+
+if [[ -n "$build_cmd" ]]; then
+    echo "$repo:build:$build_cmd" >> "$cache_dir/commands.txt.tmp"
+fi
+
+if [[ -n "$tsc_cmd" ]]; then
+    echo "$repo:tsc:$tsc_cmd" >> "$cache_dir/commands.txt.tmp"
+fi
+
+# Remove duplicates from commands
+if [[ -f "$cache_dir/commands.txt.tmp" ]]; then
+    sort -u "$cache_dir/commands.txt.tmp" > "$cache_dir/commands.txt"
+    rm -f "$cache_dir/commands.txt.tmp"
+fi
+
+# Exit cleanly
+exit 0

package/.claude/hooks/security-policy-check.sh

@@ -0,0 +1,247 @@
+#!/bin/bash
+#
+# Security Policy Check Hook
+# Checks for hardcoded secrets, insecure configurations, and security violations
+# Hook: Stop (runs before tool execution)
+#
+
+set -e
+
+# Get the directory of this script
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+# Colors for output
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+# Exit codes
+EXIT_SUCCESS=0
+EXIT_WARNING=1
+EXIT_ERROR=2
+
+# Counters
+CRITICAL_ISSUES=0
+WARNING_ISSUES=0
+
+echo "🔒 Running security policy checks..."
+
+# Function to check for secrets in files
+check_secrets() {
+    local file="$1"
+    local issues=0
+
+    # Skip binary files and known safe files
+    if file "$file" | grep -q "text"; then
+        # Check for AWS keys
+        if grep -qE "AKIA[0-9A-Z]{16}" "$file"; then
+            echo -e "${RED}❌ CRITICAL: AWS Access Key found in $file${NC}"
+            ((CRITICAL_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for private keys
+        if grep -qE "BEGIN.*PRIVATE KEY" "$file"; then
+            echo -e "${RED}❌ CRITICAL: Private key found in $file${NC}"
+            ((CRITICAL_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for password patterns
+        if grep -qiE "(password|passwd|pwd)\s*=\s*['\"][^'\"]{3,}" "$file"; then
+            echo -e "${RED}❌ CRITICAL: Hardcoded password found in $file${NC}"
+            ((CRITICAL_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for API keys/tokens
+        if grep -qiE "(api[_-]?key|api[_-]?token|auth[_-]?token)\s*=\s*['\"][^'\"]{10,}" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Possible API key/token in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for database connection strings
+        if grep -qiE "(mysql|postgresql|mongodb)://[^@]+:[^@]+@" "$file"; then
+            echo -e "${RED}❌ CRITICAL: Database connection string with credentials in $file${NC}"
+            ((CRITICAL_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for JWT tokens
+        if grep -qE "eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Possible JWT token in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+    fi
+
+    return $issues
+}
+
+# Function to check infrastructure files for insecure configurations
+check_infrastructure() {
+    local file="$1"
+    local issues=0
+
+    # Terraform files
+    if [[ "$file" == *.tf ]]; then
+        # Check for public S3 buckets
+        if grep -q "acl.*=.*\"public" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Public S3 bucket ACL in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for open security groups (0.0.0.0/0)
+        if grep -q "0.0.0.0/0" "$file" && grep -q "ingress" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Security group allows ingress from 0.0.0.0/0 in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for disabled encryption
+        if grep -qiE "encrypt.*=.*false" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Encryption disabled in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+    fi
+
+    # Kubernetes manifests
+    if [[ "$file" == *.yaml ]] || [[ "$file" == *.yml ]]; then
+        # Check for privileged containers
+        if grep -q "privileged: true" "$file"; then
+            echo -e "${RED}❌ CRITICAL: Privileged container in $file${NC}"
+            ((CRITICAL_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for hostPath volumes
+        if grep -q "hostPath:" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: hostPath volume in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for containers running as root
+        if grep -q "runAsUser: 0" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Container running as root (UID 0) in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for missing resource limits
+        if grep -q "kind: Deployment" "$file" && ! grep -q "resources:" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Missing resource limits in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+    fi
+
+    # Docker files
+    if [[ "$file" == *Dockerfile* ]]; then
+        # Check for running as root
+        if ! grep -q "USER" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Dockerfile doesn't specify USER (will run as root) in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+
+        # Check for latest tag
+        if grep -qE "FROM.*:latest" "$file"; then
+            echo -e "${YELLOW}⚠️  WARNING: Using :latest tag in $file${NC}"
+            ((WARNING_ISSUES++))
+            ((issues++))
+        fi
+    fi
+
+    return $issues
+}
+
+# Function to check environment files
+check_env_files() {
+    local file="$1"
+
+    if [[ "$file" == *.env* ]] || [[ "$file" == *credentials* ]]; then
+        echo -e "${RED}❌ CRITICAL: Environment/credentials file should not be committed: $file${NC}"
+        ((CRITICAL_ISSUES++))
+        return 1
+    fi
+
+    return 0
+}
+
+# Get list of changed files (if in git repo)
+if git rev-parse --git-dir > /dev/null 2>&1; then
+    # Check staged files
+    CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || echo "")
+
+    if [ -z "$CHANGED_FILES" ]; then
+        # If no staged files, check modified files
+        CHANGED_FILES=$(git diff --name-only --diff-filter=ACM 2>/dev/null || echo "")
+    fi
+
+    # Check files
+    while IFS= read -r file; do
+        if [ -f "$file" ]; then
+            # Skip certain directories
+            if [[ "$file" == *node_modules* ]] || [[ "$file" == *vendor* ]] || [[ "$file" == *.git* ]]; then
+                continue
+            fi
+
+            # Run checks
+            check_env_files "$file" || true
+            check_secrets "$file" || true
+            check_infrastructure "$file" || true
+        fi
+    done <<< "$CHANGED_FILES"
+else
+    echo "⚠️  Not a git repository, skipping file checks"
+fi
+
+# Report results
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "Security Policy Check Results:"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo -e "Critical Issues: ${RED}$CRITICAL_ISSUES${NC}"
+echo -e "Warnings: ${YELLOW}$WARNING_ISSUES${NC}"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+# Exit with appropriate code
+if [ $CRITICAL_ISSUES -gt 0 ]; then
+    echo ""
+    echo -e "${RED}❌ BLOCKED: Critical security issues found!${NC}"
+    echo ""
+    echo "Please fix the critical issues before proceeding:"
+    echo "  • Remove hardcoded secrets (use environment variables or secret managers)"
+    echo "  • Do not commit .env or credentials files"
+    echo "  • Do not commit private keys or certificates"
+    echo "  • Use secure configurations for infrastructure"
+    echo ""
+    echo "If you believe this is a false positive, you can:"
+    echo "  1. Add '# security: ignore' comment on the line"
+    echo "  2. Add file to .securityignore"
+    echo "  3. Disable this hook temporarily (not recommended)"
+    echo ""
+    exit $EXIT_ERROR
+elif [ $WARNING_ISSUES -gt 0 ]; then
+    echo ""
+    echo -e "${YELLOW}⚠️  Security warnings found. Please review.${NC}"
+    echo ""
+    echo "Consider fixing warnings:"
+    echo "  • Avoid overly permissive security groups"
+    echo "  • Enable encryption where applicable"
+    echo "  • Avoid privileged containers"
+    echo "  • Run containers as non-root user"
+    echo "  • Specify resource limits"
+    echo ""
+    # Allow to proceed with warnings
+    exit $EXIT_SUCCESS
+else
+    echo -e "${GREEN}✅ No security issues found!${NC}"
+    exit $EXIT_SUCCESS
+fi

package/.claude/hooks/skill-activation-prompt.ps1

@@ -0,0 +1,10 @@
+# PowerShell wrapper for skill-activation-prompt hook
+# Windows users: Use this instead of skill-activation-prompt.sh
+
+$ErrorActionPreference = "Stop"
+
+# Change to hooks directory
+Set-Location "$env:CLAUDE_PROJECT_DIR\.claude\hooks"
+
+# Pipe stdin to npx tsx
+$input | npx tsx skill-activation-prompt.ts

package/.claude/hooks/skill-activation-prompt.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -e
+
+# Set default CLAUDE_PROJECT_DIR if not set
+if [ -z "$CLAUDE_PROJECT_DIR" ]; then
+    export CLAUDE_PROJECT_DIR="$(cd "$(dirname "$0")/../.." && pwd)"
+fi
+
+cd "$CLAUDE_PROJECT_DIR/.claude/hooks"
+cat | npx tsx skill-activation-prompt.ts