claude-code-starter 0.14.1 → 0.15.0

package/dist/cli.js

@@ -2,8 +2,8 @@
 
 // src/cli.ts
 import { execSync, spawn } from "child_process";
-import fs3 from "fs";
-import path3 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import { fileURLToPath } from "url";
 import ora from "ora";
 import pc from "picocolors";
@@ -599,6 +599,239 @@ function writeSettings(rootDir, stack) {
   fs2.writeFileSync(fullPath, content);
 }
 
+// src/hooks.ts
+import fs3 from "fs";
+import path3 from "path";
+var HOOK_SCRIPT = String.raw`#!/usr/bin/env node
+/**
+ * Block Dangerous Commands - PreToolUse Hook for Bash
+ * Blocks dangerous patterns before execution.
+ *
+ * SAFETY_LEVEL: 'critical' | 'high' | 'strict'
+ *   critical - Only catastrophic: rm -rf ~, dd to disk, fork bombs
+ *   high     - + risky: force push main, secrets exposure, git reset --hard
+ *   strict   - + cautionary: any force push, sudo rm, docker prune
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SAFETY_LEVEL = 'high';
+
+const PATTERNS = [
+  // CRITICAL — Catastrophic, unrecoverable
+
+  // Filesystem destruction
+  { level: 'critical', id: 'rm-home',          regex: /\brm\s+(-.+\s+)*["']?~\/?["']?(\s|$|[;&|])/,                        reason: 'rm targeting home directory' },
+  { level: 'critical', id: 'rm-home-var',      regex: /\brm\s+(-.+\s+)*["']?\$HOME["']?(\s|$|[;&|])/,                      reason: 'rm targeting $HOME' },
+  { level: 'critical', id: 'rm-home-trailing', regex: /\brm\s+.+\s+["']?(~\/?|\$HOME)["']?(\s*$|[;&|])/,                   reason: 'rm with trailing ~/ or $HOME' },
+  { level: 'critical', id: 'rm-root',          regex: /\brm\s+(-.+\s+)*\/(\*|\s|$|[;&|])/,                                 reason: 'rm targeting root filesystem' },
+  { level: 'critical', id: 'rm-system',        regex: /\brm\s+(-.+\s+)*\/(etc|usr|var|bin|sbin|lib|boot|dev|proc|sys)(\/|\s|$)/, reason: 'rm targeting system directory' },
+  { level: 'critical', id: 'rm-cwd',           regex: /\brm\s+(-.+\s+)*(\.\/?|\*|\.\/\*)(\s|$|[;&|])/,                     reason: 'rm deleting current directory contents' },
+
+  // Disk operations
+  { level: 'critical', id: 'dd-disk',          regex: /\bdd\b.+of=\/dev\/(sd[a-z]|nvme|hd[a-z]|vd[a-z]|xvd[a-z])/,         reason: 'dd writing to disk device' },
+  { level: 'critical', id: 'mkfs',             regex: /\bmkfs(\.\w+)?\s+\/dev\/(sd[a-z]|nvme|hd[a-z]|vd[a-z])/,            reason: 'mkfs formatting disk' },
+  { level: 'critical', id: 'fdisk',            regex: /\b(fdisk|wipefs|parted)\s+\/dev\//,                                   reason: 'disk partitioning/wiping operation' },
+
+  // Shell exploits
+  { level: 'critical', id: 'fork-bomb',        regex: /:\(\)\s*\{.*:\s*\|\s*:.*&/,                                         reason: 'fork bomb detected' },
+
+  // Git — history destruction
+  { level: 'critical', id: 'git-filter',       regex: /\bgit\s+(filter-branch|filter-repo)\b/,                              reason: 'git history rewriting blocked' },
+  { level: 'critical', id: 'git-reflog-exp',   regex: /\bgit\s+(reflog\s+expire|gc\s+--prune|prune)\b/,                     reason: 'removes git recovery safety net' },
+
+  // HIGH — Significant risk, data loss, security exposure
+
+  // Remote code execution
+  { level: 'high', id: 'curl-pipe-sh',         regex: /\b(curl|wget)\b.+\|\s*(ba)?sh\b/,                                   reason: 'piping URL to shell (RCE risk)' },
+
+  // Git — destructive operations
+  { level: 'high', id: 'git-force-main',       regex: /\bgit\s+push\b(?!.+--force-with-lease).+(--force|-f)\b.+\b(main|master)\b/, reason: 'force push to main/master' },
+  { level: 'high', id: 'git-reset-hard',       regex: /\bgit\s+reset\s+--hard/,                                            reason: 'git reset --hard loses uncommitted work' },
+  { level: 'high', id: 'git-clean-f',          regex: /\bgit\s+clean\s+(-\w*f|-f)/,                                        reason: 'git clean -f deletes untracked files' },
+  { level: 'high', id: 'git-no-verify',        regex: /\bgit\b.+--no-verify/,                                              reason: '--no-verify skips safety hooks' },
+  { level: 'high', id: 'git-stash-destruct',   regex: /\bgit\s+stash\s+(drop|clear|pop)\b/,                                reason: 'destructive git stash operation' },
+  { level: 'high', id: 'git-branch-D',         regex: /\bgit\s+branch\s+(-D|--delete\s+--force)\b/,                        reason: 'git branch -D force-deletes branch' },
+  { level: 'high', id: 'git-checkout-force',   regex: /\bgit\s+checkout\s+(-f|--\s+\.)/,                                   reason: 'git checkout -f/-- . discards changes' },
+  { level: 'high', id: 'git-restore-destruct', regex: /\bgit\s+restore\s+(--staged\s+--worktree|\.)/,                      reason: 'git restore discards changes' },
+  { level: 'high', id: 'git-update-ref',       regex: /\bgit\s+(update-ref|symbolic-ref|replace)\b/,                       reason: 'git ref manipulation blocked' },
+  { level: 'high', id: 'git-config-global',    regex: /\bgit\s+config\s+--(global|system)\b/,                              reason: 'git global/system config blocked' },
+  { level: 'high', id: 'git-tag-delete',       regex: /\bgit\s+tag\s+(-d|--delete)\b/,                                    reason: 'git tag deletion blocked' },
+
+  // Git — write operations (user handles manually)
+  { level: 'high', id: 'git-push',             regex: /\bgit\s+push\b/,                                                    reason: 'git push blocked — user handles manually' },
+  { level: 'high', id: 'git-pull',             regex: /\bgit\s+pull\b/,                                                    reason: 'git pull blocked — user handles manually' },
+  { level: 'high', id: 'git-fetch',            regex: /\bgit\s+fetch\b/,                                                   reason: 'git fetch blocked — user handles manually' },
+  { level: 'high', id: 'git-clone',            regex: /\bgit\s+clone\b/,                                                   reason: 'git clone blocked — user handles manually' },
+  { level: 'high', id: 'git-add',              regex: /\bgit\s+(add|stage)\b/,                                             reason: 'git add/stage blocked — user handles manually' },
+  { level: 'high', id: 'git-commit',           regex: /\bgit\s+commit\b/,                                                  reason: 'git commit blocked — user handles manually' },
+  { level: 'high', id: 'git-merge',            regex: /\bgit\s+merge\b/,                                                   reason: 'git merge blocked — user handles manually' },
+  { level: 'high', id: 'git-rebase',           regex: /\bgit\s+rebase\b/,                                                  reason: 'git rebase blocked — user handles manually' },
+  { level: 'high', id: 'git-reset',            regex: /\bgit\s+reset\b/,                                                   reason: 'git reset blocked — user handles manually' },
+  { level: 'high', id: 'git-remote-mod',       regex: /\bgit\s+remote\s+(add|set-url|remove)\b/,                           reason: 'git remote modification blocked' },
+  { level: 'high', id: 'git-submodule',        regex: /\bgit\s+submodule\s+(add|update)\b/,                                reason: 'git submodule operation blocked' },
+
+  // Credentials & secrets
+  { level: 'high', id: 'chmod-777',            regex: /\bchmod\b.+\b777\b/,                                                reason: 'chmod 777 is a security risk' },
+  { level: 'high', id: 'cat-env',              regex: /\b(cat|less|head|tail|more)\s+\.env\b/,                             reason: 'reading .env file exposes secrets' },
+  { level: 'high', id: 'cat-secrets',          regex: /\b(cat|less|head|tail|more)\b.+(credentials|secrets?|\.pem|\.key|id_rsa|id_ed25519)/i, reason: 'reading secrets file' },
+  { level: 'high', id: 'env-dump',             regex: /\b(printenv|^env)\s*([;&|]|$)/,                                     reason: 'env dump may expose secrets' },
+  { level: 'high', id: 'echo-secret',          regex: /\becho\b.+\$\w*(SECRET|KEY|TOKEN|PASSWORD|API_|PRIVATE)/i,          reason: 'echoing secret variable' },
+  { level: 'high', id: 'rm-ssh',               regex: /\brm\b.+\.ssh\/(id_|authorized_keys|known_hosts)/,                  reason: 'deleting SSH keys' },
+  { level: 'high', id: 'security-keychain',    regex: /\bsecurity\s+find-generic-password\b/,                              reason: 'keychain access blocked' },
+  { level: 'high', id: 'gpg-export-secret',    regex: /\bgpg\s+--export-secret-keys\b/,                                   reason: 'GPG secret key export blocked' },
+  { level: 'high', id: 'history-cmd',          regex: /\bhistory\b/,                                                       reason: 'history may expose secrets' },
+
+  // Destructive system commands
+  { level: 'high', id: 'elevated-priv',        regex: /\b(sudo|doas|pkexec)\b/,                                            reason: 'elevated privilege command blocked' },
+  { level: 'high', id: 'su-cmd',               regex: /\bsu\b/,                                                            reason: 'su (switch user) blocked' },
+  { level: 'high', id: 'chmod-R',              regex: /\bchmod\s+(-\w*R|-R)/,                                              reason: 'recursive chmod blocked' },
+  { level: 'high', id: 'chown-R',              regex: /\bchown\s+(-\w*R|-R)/,                                              reason: 'recursive chown blocked' },
+  { level: 'high', id: 'kill-all',             regex: /\bkill\s+-9\s+-1\b/,                                                reason: 'kill all processes blocked' },
+  { level: 'high', id: 'killall',              regex: /\b(killall|pkill\s+-9)\b/,                                          reason: 'mass process killing blocked' },
+  { level: 'high', id: 'truncate-zero',        regex: /\btruncate\s+-s\s*0\b/,                                             reason: 'truncating file to zero blocked' },
+  { level: 'high', id: 'empty-file',           regex: /\bcat\s+\/dev\/null\s*>/,                                           reason: 'emptying file via /dev/null blocked' },
+  { level: 'high', id: 'crontab-r',            regex: /\bcrontab\s+-r/,                                                    reason: 'removes all cron jobs' },
+
+  // Docker
+  { level: 'high', id: 'docker-vol-rm',        regex: /\bdocker\s+volume\s+(rm|prune)/,                                    reason: 'docker volume deletion loses data' },
+  { level: 'high', id: 'docker-push',          regex: /\bdocker\s+push\b/,                                                 reason: 'docker push blocked' },
+  { level: 'high', id: 'docker-rm-all',        regex: /\bdocker\s+rm\s+-f\b.+\$\(docker\s+ps/,                             reason: 'docker rm all containers blocked' },
+  { level: 'high', id: 'docker-sys-prune-a',   regex: /\bdocker\s+system\s+prune\s+-a/,                                    reason: 'docker system prune -a blocked' },
+  { level: 'high', id: 'docker-compose-destr', regex: /\bdocker[\s-]compose\s+down\s+(-v|--rmi)/,                           reason: 'docker-compose destructive down blocked' },
+
+  // Publishing & deployment
+  { level: 'high', id: 'npm-publish',          regex: /\bnpm\s+(publish|unpublish|deprecate)\b/,                            reason: 'npm publishing blocked' },
+  { level: 'high', id: 'npm-audit-force',      regex: /\bnpm\s+audit\s+fix\s+--force\b/,                                   reason: 'npm audit fix --force can break deps' },
+  { level: 'high', id: 'cargo-publish',        regex: /\bcargo\s+publish\b/,                                               reason: 'cargo publish blocked' },
+  { level: 'high', id: 'pip-twine-upload',     regex: /\b(pip|twine)\s+upload\b/,                                          reason: 'Python package upload blocked' },
+  { level: 'high', id: 'gem-push',             regex: /\bgem\s+push\b/,                                                    reason: 'gem push blocked' },
+  { level: 'high', id: 'pod-push',             regex: /\bpod\s+trunk\s+push\b/,                                            reason: 'pod trunk push blocked' },
+  { level: 'high', id: 'vercel-prod',          regex: /\bvercel\b.+--prod/,                                                reason: 'vercel production deploy blocked' },
+  { level: 'high', id: 'netlify-prod',         regex: /\bnetlify\s+deploy\b.+--prod/,                                      reason: 'netlify production deploy blocked' },
+  { level: 'high', id: 'fly-deploy',           regex: /\bfly\s+deploy\b/,                                                  reason: 'fly deploy blocked' },
+  { level: 'high', id: 'firebase-deploy',      regex: /\bfirebase\s+deploy\b/,                                             reason: 'firebase deploy blocked' },
+  { level: 'high', id: 'terraform',            regex: /\bterraform\s+(apply|destroy)\b/,                                   reason: 'terraform apply/destroy blocked' },
+  { level: 'high', id: 'pulumi-cdktf',         regex: /\b(pulumi|cdktf)\s+destroy\b/,                                      reason: 'infrastructure destroy blocked' },
+  { level: 'high', id: 'kubectl-mutate',       regex: /\bkubectl\s+(apply|delete|drain)\b/,                                reason: 'kubectl mutating operation blocked' },
+  { level: 'high', id: 'kubectl-scale-zero',   regex: /\bkubectl\s+scale\b.+--replicas=0/,                                 reason: 'kubectl scale to zero blocked' },
+  { level: 'high', id: 'helm-ops',             regex: /\bhelm\s+(install|uninstall|upgrade)\b/,                             reason: 'helm operation blocked' },
+  { level: 'high', id: 'heroku',               regex: /\bheroku\b/,                                                        reason: 'heroku command blocked' },
+  { level: 'high', id: 'eb-terminate',         regex: /\beb\s+terminate\b/,                                                reason: 'eb terminate blocked' },
+  { level: 'high', id: 'serverless-remove',    regex: /\bserverless\s+remove\b/,                                           reason: 'serverless remove blocked' },
+  { level: 'high', id: 'cap-prod-deploy',      regex: /\bcap\s+production\s+deploy\b/,                                     reason: 'production deploy blocked' },
+  { level: 'high', id: 'cloud-delete',         regex: /\b(aws\s+cloudformation\s+delete-stack|gcloud\s+projects\s+delete|az\s+group\s+delete)\b/, reason: 'cloud resource deletion blocked' },
+
+  // Network & infrastructure
+  { level: 'high', id: 'curl-mutating',        regex: /\bcurl\b.+-X\s*(POST|PUT|DELETE|PATCH)\b/,                          reason: 'mutating HTTP request blocked' },
+  { level: 'high', id: 'ssh-remote',           regex: /\bssh\s/,                                                           reason: 'SSH remote connection blocked' },
+  { level: 'high', id: 'scp-remote',           regex: /\bscp\s/,                                                           reason: 'SCP remote copy blocked' },
+  { level: 'high', id: 'rsync-delete',         regex: /\brsync\b.+--delete/,                                               reason: 'rsync --delete blocked' },
+  { level: 'high', id: 'firewall',             regex: /\b(iptables\s+-F|ufw\s+disable)\b/,                                 reason: 'firewall manipulation blocked' },
+  { level: 'high', id: 'network-kill',         regex: /\bifconfig\s+\w+\s+down\b/,                                         reason: 'network interface down blocked' },
+  { level: 'high', id: 'route-delete',         regex: /\broute\s+del\s+default\b/,                                         reason: 'default route deletion blocked' },
+
+  // Database
+  { level: 'high', id: 'sql-drop',             regex: /\b(DROP\s+(DATABASE|TABLE)|TRUNCATE\s+TABLE)\b/i,                   reason: 'SQL drop/truncate blocked' },
+  { level: 'high', id: 'sql-mass-delete',      regex: /\bDELETE\s+FROM\b.+\bWHERE\s+1\s*=\s*1/i,                          reason: 'SQL mass delete blocked' },
+  { level: 'high', id: 'redis-flush',          regex: /\bredis-cli\s+(FLUSHALL|FLUSHDB)\b/,                                reason: 'redis flush blocked' },
+  { level: 'high', id: 'orm-reset',            regex: /\b(prisma\s+migrate\s+reset|rails\s+db:(drop|reset)|django\s+flush)\b/, reason: 'ORM database reset blocked' },
+  { level: 'high', id: 'alembic-downgrade',    regex: /\balembic\s+downgrade\s+base\b/,                                    reason: 'alembic downgrade base blocked' },
+  { level: 'high', id: 'mongo-drop',           regex: /\bmongosh\b.+dropDatabase/,                                         reason: 'MongoDB drop database blocked' },
+
+  // STRICT — Cautionary, context-dependent
+  { level: 'strict', id: 'git-checkout-dot',    regex: /\bgit\s+checkout\s+\./,                                             reason: 'git checkout . discards changes' },
+  { level: 'strict', id: 'docker-prune',        regex: /\bdocker\s+(system|image)\s+prune/,                                 reason: 'docker prune removes images' },
+];
+
+const LEVELS = { critical: 1, high: 2, strict: 3 };
+const EMOJIS = { critical: '\u{1F6A8}', high: '\u26D4', strict: '\u26A0\uFE0F' };
+const LOG_DIR = path.join(process.env.HOME || '/tmp', '.claude', 'hooks-logs');
+
+function log(data) {
+  try {
+    if (!fs.existsSync(LOG_DIR)) fs.mkdirSync(LOG_DIR, { recursive: true });
+    const file = path.join(LOG_DIR, new Date().toISOString().slice(0, 10) + '.jsonl');
+    fs.appendFileSync(file, JSON.stringify({ ts: new Date().toISOString(), ...data }) + '\n');
+  } catch {}
+}
+
+function checkCommand(cmd, safetyLevel) {
+  safetyLevel = safetyLevel || SAFETY_LEVEL;
+  const threshold = LEVELS[safetyLevel] || 2;
+  for (const p of PATTERNS) {
+    if (LEVELS[p.level] <= threshold && p.regex.test(cmd)) {
+      return { blocked: true, pattern: p };
+    }
+  }
+  return { blocked: false, pattern: null };
+}
+
+async function main() {
+  let input = '';
+  for await (const chunk of process.stdin) input += chunk;
+
+  try {
+    const data = JSON.parse(input);
+    const { tool_name, tool_input, session_id, cwd, permission_mode } = data;
+    if (tool_name !== 'Bash') return console.log('{}');
+
+    const cmd = tool_input?.command || '';
+    const result = checkCommand(cmd);
+
+    if (result.blocked) {
+      const p = result.pattern;
+      log({ level: 'BLOCKED', id: p.id, priority: p.level, cmd, session_id, cwd, permission_mode });
+      return console.log(JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          permissionDecisionReason: EMOJIS[p.level] + ' [' + p.id + '] ' + p.reason
+        }
+      }));
+    }
+    console.log('{}');
+  } catch (e) {
+    log({ level: 'ERROR', error: e.message });
+    console.log('{}');
+  }
+}
+
+if (require.main === module) {
+  main();
+} else {
+  module.exports = { PATTERNS, LEVELS, SAFETY_LEVEL, checkCommand };
+}
+`;
+function installHook(rootDir) {
+  const hooksDir = path3.join(rootDir, ".claude", "hooks");
+  const hookPath = path3.join(hooksDir, "block-dangerous-commands.js");
+  const settingsPath = path3.join(rootDir, ".claude", "settings.json");
+  fs3.mkdirSync(hooksDir, { recursive: true });
+  fs3.writeFileSync(hookPath, HOOK_SCRIPT);
+  fs3.chmodSync(hookPath, 493);
+  try {
+    const existing = fs3.existsSync(settingsPath) ? JSON.parse(fs3.readFileSync(settingsPath, "utf-8")) : {};
+    existing.hooks = {
+      ...existing.hooks,
+      PreToolUse: [
+        {
+          matcher: "Bash",
+          hooks: [
+            {
+              type: "command",
+              command: "node .claude/hooks/block-dangerous-commands.js"
+            }
+          ]
+        }
+      ]
+    };
+    fs3.writeFileSync(settingsPath, JSON.stringify(existing, null, 2));
+  } catch {
+  }
+}
+
 // src/prompt.ts
 function getAnalysisPrompt(projectInfo) {
   const context = buildContextSection(projectInfo);
@@ -1272,10 +1505,154 @@ Body: This command delegates to the code-reviewer agent for thorough review.
 3. If the agent is unavailable, perform a lightweight review: run the linter and check for obvious issues
 Do NOT duplicate the code-reviewer agent's checklist here \u2014 the agent has the full review criteria.`;
 
+// src/validator.ts
+import fs4 from "fs";
+import path4 from "path";
+function extractCommands(claudeMd) {
+  const commands = [];
+  const match = claudeMd.match(/## Common Commands[\s\S]*?```(?:bash)?\n([\s\S]*?)```/);
+  if (!match) return commands;
+  for (const line of match[1].split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const cmd = trimmed.split(/\s+#/)[0].trim();
+    if (cmd.length > 3) commands.push(cmd);
+  }
+  return commands;
+}
+function extractConventionFingerprints(claudeMd) {
+  const fingerprints = [];
+  const startIdx = claudeMd.indexOf("## Code Conventions");
+  if (startIdx === -1) return fingerprints;
+  const rest = claudeMd.slice(startIdx + "## Code Conventions".length);
+  const nextHeading = rest.match(/\n## [A-Z]/);
+  const section = nextHeading ? claudeMd.slice(startIdx, startIdx + "## Code Conventions".length + nextHeading.index) : claudeMd.slice(startIdx);
+  for (const kw of ["camelCase", "PascalCase", "kebab-case", "snake_case"]) {
+    if (section.includes(kw)) fingerprints.push(kw);
+  }
+  if (/\bnamed exports?\b/i.test(section)) fingerprints.push("named export");
+  if (/\bdefault exports?\b/i.test(section)) fingerprints.push("default export");
+  if (section.includes("import type")) fingerprints.push("import type");
+  for (const kw of [".skip()", ".only()", "console.log"]) {
+    if (section.includes(kw)) fingerprints.push(kw);
+  }
+  return fingerprints;
+}
+var RULE_WORDS = /\b(verify|check|ensure|always|never|must|should|avoid)\b/i;
+function isConventionDuplication(line, fingerprints) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#") || trimmed.includes("CLAUDE.md")) return false;
+  if (!/^[-*]\s/.test(trimmed)) return false;
+  const matchCount = fingerprints.filter((fp) => trimmed.includes(fp)).length;
+  if (matchCount >= 2) return true;
+  if (matchCount === 1 && RULE_WORDS.test(trimmed)) return true;
+  return false;
+}
+function findLiteralCommand(line, commands) {
+  const trimmed = line.trim();
+  if (!trimmed || trimmed.startsWith("#") || trimmed.includes("CLAUDE.md")) return null;
+  for (const cmd of commands) {
+    if (trimmed.includes(cmd)) return cmd;
+  }
+  return null;
+}
+function separateFrontmatter(content) {
+  const match = content.match(/^---\n[\s\S]*?\n---(?:\n|$)/);
+  if (!match) {
+    return { frontmatter: "", body: content };
+  }
+  return {
+    frontmatter: match[0],
+    body: content.slice(match[0].length)
+  };
+}
+function processFile(filePath, commands, fingerprints) {
+  const content = fs4.readFileSync(filePath, "utf-8");
+  const { frontmatter, body } = separateFrontmatter(content);
+  const lines = body.split("\n");
+  const changes = [];
+  const newLines = [];
+  let inCodeBlock = false;
+  for (const line of lines) {
+    if (line.trim().startsWith("```")) {
+      inCodeBlock = !inCodeBlock;
+      newLines.push(line);
+      continue;
+    }
+    if (inCodeBlock) {
+      newLines.push(line);
+      continue;
+    }
+    if (isConventionDuplication(line, fingerprints)) {
+      changes.push({ file: filePath, original: line.trim(), replacement: null });
+      continue;
+    }
+    const cmd = findLiteralCommand(line, commands);
+    if (cmd) {
+      const newLine = line.replace(cmd, "see Common Commands in CLAUDE.md");
+      changes.push({ file: filePath, original: line.trim(), replacement: newLine.trim() });
+      newLines.push(newLine);
+      continue;
+    }
+    newLines.push(line);
+  }
+  if (changes.length > 0) {
+    fs4.writeFileSync(filePath, frontmatter + newLines.join("\n"));
+  }
+  return changes;
+}
+function walkMdFiles(dir) {
+  const files = [];
+  if (!fs4.existsSync(dir)) return files;
+  const entries = fs4.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path4.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...walkMdFiles(fullPath));
+    } else if (entry.name.endsWith(".md")) {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
+function validateArtifacts(rootDir) {
+  const result = {
+    filesChecked: 0,
+    filesModified: 0,
+    duplicationsRemoved: 0,
+    changes: []
+  };
+  const claudeMdPath = path4.join(rootDir, ".claude", "CLAUDE.md");
+  if (!fs4.existsSync(claudeMdPath)) return result;
+  try {
+    const claudeMd = fs4.readFileSync(claudeMdPath, "utf-8");
+    const commands = extractCommands(claudeMd);
+    const fingerprints = extractConventionFingerprints(claudeMd);
+    if (commands.length === 0 && fingerprints.length === 0) return result;
+    const claudeDir = path4.join(rootDir, ".claude");
+    const files = walkMdFiles(claudeDir).filter((f) => !f.endsWith("CLAUDE.md"));
+    for (const filePath of files) {
+      result.filesChecked++;
+      const changes = processFile(filePath, commands, fingerprints);
+      if (changes.length > 0) {
+        result.filesModified++;
+        result.duplicationsRemoved += changes.length;
+        for (const change of changes) {
+          change.file = path4.relative(rootDir, filePath);
+        }
+        result.changes.push(...changes);
+      }
+    }
+  } catch {
+    return result;
+  }
+  return result;
+}
+
 // src/cli.ts
-var __dirname2 = path3.dirname(fileURLToPath(import.meta.url));
+var __dirname2 = path5.dirname(fileURLToPath(import.meta.url));
 var VERSION = JSON.parse(
-  fs3.readFileSync(path3.join(__dirname2, "..", "package.json"), "utf-8")
+  fs5.readFileSync(path5.join(__dirname2, "..", "package.json"), "utf-8")
 ).version;
 function parseArgs(args) {
   return {
@@ -1313,7 +1690,7 @@ ${pc.bold("WHAT IT DOES")}
      - Skills for your frameworks and workflows
      - Agents for code review and testing
      - Rules matching your code style
-     - Commands for task management
+     - Commands for analysis and code review
 
 ${pc.bold("REQUIREMENTS")}
   Claude CLI must be installed: https://claude.ai/download
@@ -1789,17 +2166,17 @@ function runClaudeAnalysis(projectDir, projectInfo) {
   });
 }
 function getGeneratedFiles(projectDir) {
-  const claudeDir = path3.join(projectDir, ".claude");
+  const claudeDir = path5.join(projectDir, ".claude");
   const files = [];
   function walk(dir) {
-    if (!fs3.existsSync(dir)) return;
-    const entries = fs3.readdirSync(dir, { withFileTypes: true });
+    if (!fs5.existsSync(dir)) return;
+    const entries = fs5.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path3.join(dir, entry.name);
+      const fullPath = path5.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
       } else {
-        files.push(path3.relative(projectDir, fullPath));
+        files.push(path5.relative(projectDir, fullPath));
       }
     }
   }
@@ -1856,7 +2233,7 @@ async function main() {
       const { proceed } = await prompts({
         type: "confirm",
         name: "proceed",
-        message: "Update existing configuration? (preserves task state)",
+        message: "Update existing configuration?",
         initial: true
       });
       if (!proceed) {
@@ -1883,6 +2260,14 @@ async function main() {
     console.error(pc.red("Claude analysis failed. Please try again."));
     process.exit(1);
   }
+  const validation = validateArtifacts(projectDir);
+  if (validation.duplicationsRemoved > 0) {
+    console.log(
+      pc.gray(
+        `  Deduplication: removed ${validation.duplicationsRemoved} redundancies from ${validation.filesModified} files`
+      )
+    );
+  }
   const generatedFiles = getGeneratedFiles(projectDir);
   console.log();
   console.log(pc.green(`Done! (${generatedFiles.length} files)`));
@@ -1897,12 +2282,12 @@ async function main() {
   }
   if (skills.length > 0) {
     console.log(
-      `  ${skills.length} skills (${skills.map((s) => path3.basename(s, ".md")).join(", ")})`
+      `  ${skills.length} skills (${skills.map((s) => path5.basename(s, ".md")).join(", ")})`
     );
   }
   if (agents.length > 0) {
     console.log(
-      `  ${agents.length} agents (${agents.map((a) => path3.basename(a, ".md")).join(", ")})`
+      `  ${agents.length} agents (${agents.map((a) => path5.basename(a, ".md")).join(", ")})`
     );
   }
   if (rules.length > 0) {
@@ -1912,6 +2297,21 @@ async function main() {
     console.log(`  ${commands.length} commands`);
   }
   console.log();
+  if (args.interactive) {
+    console.log();
+    const { installSafetyHook } = await prompts({
+      type: "confirm",
+      name: "installSafetyHook",
+      message: "Add a safety hook to block dangerous commands? (git push, rm -rf, etc.)",
+      initial: true
+    });
+    if (installSafetyHook) {
+      installHook(projectDir);
+      console.log(pc.green("  + .claude/hooks/block-dangerous-commands.js"));
+      console.log(pc.gray("    Blocks destructive Bash commands before execution"));
+    }
+  }
+  console.log();
   console.log(`${pc.cyan("Next step:")} Run ${pc.bold("claude")} to start working!`);
   console.log();
   console.log(
@@ -1921,7 +2321,7 @@ async function main() {
   );
 }
 try {
-  const isMain = process.argv[1] && fs3.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  const isMain = process.argv[1] && fs5.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
   if (isMain) {
     main().catch((err) => {
       console.error(pc.red("Error:"), err.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-starter",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "A lightweight starter kit for AI-assisted development with Claude Code",
   "keywords": [
     "claude",