claude-code-workflow 7.2.26 → 7.2.28

package/.codex/skills/team-visual-a11y/specs/pipelines.md

@@ -0,0 +1,98 @@
+# Pipeline Definitions
+
+Visual accessibility pipeline modes and task registry.
+
+## Pipeline Modes
+
+| Mode | Description | Task Count |
+|------|-------------|------------|
+| audit-only | 3 parallel auditors -> remediation plan | 4 tasks |
+| full | 3 parallel auditors -> remediation -> fix -> 2 parallel re-auditors | 7 tasks |
+
+## Audit-Only Pipeline Task Registry
+
+| Task ID | Role | deps | Description |
+|---------|------|------|-------------|
+| COLOR-001 | color-auditor | [] | OKLCH color contrast audit: WCAG 2.1 + APCA ratios, color blindness simulation |
+| TYPO-001 | typo-auditor | [] | Typography readability: font size at breakpoints, line-height, reading width |
+| FOCUS-001 | focus-auditor | [] | Focus management: tab order, indicators, skip link, ARIA, keyboard |
+| REMED-001 | remediation-planner | [COLOR-001, TYPO-001, FOCUS-001] | Prioritized remediation plan with code-level fixes |
+
+**CRITICAL**: COLOR-001, TYPO-001, FOCUS-001 have NO deps -- they run in PARALLEL.
+
+## Full Pipeline Task Registry
+
+| Task ID | Role | deps | Description |
+|---------|------|------|-------------|
+| COLOR-001 | color-auditor | [] | OKLCH color contrast audit (initial) |
+| TYPO-001 | typo-auditor | [] | Typography readability audit |
+| FOCUS-001 | focus-auditor | [] | Focus management audit (initial) |
+| REMED-001 | remediation-planner | [COLOR-001, TYPO-001, FOCUS-001] | Prioritized remediation plan |
+| FIX-001 | fix-implementer | [REMED-001] | Implement a11y fixes from remediation plan |
+| COLOR-002 | color-auditor | [FIX-001] | Re-audit color contrast after fixes |
+| FOCUS-002 | focus-auditor | [FIX-001] | Re-audit focus management after fixes |
+
+**CRITICAL**: COLOR-002 and FOCUS-002 both blocked only by FIX-001 -- they run in PARALLEL.
+
+## Dependency Graphs
+
+### Audit-Only
+
+```
+COLOR-001 --+
+            |
+TYPO-001  --+--> REMED-001
+            |
+FOCUS-001 --+
+```
+
+### Full
+
+```
+COLOR-001 --+
+            |
+TYPO-001  --+--> REMED-001 --> FIX-001 --+--> COLOR-002
+            |                             |
+FOCUS-001 --+                             +--> FOCUS-002
+```
+
+## Fan-In Points
+
+| Point | Waiting For | Gate Task | Action |
+|-------|------------|-----------|--------|
+| Audit fan-in | COLOR-001 + TYPO-001 + FOCUS-001 (all 3) | REMED-001 | Unblock REMED-001 when all 3 complete |
+| Re-audit fan-in | COLOR-002 + FOCUS-002 (both) | Pipeline complete | Check GC convergence |
+
+## GC Loop Behavior (Full Mode)
+
+After re-audit fan-in (COLOR-002 + FOCUS-002 both complete):
+
+| Signal | Condition | Action |
+|--------|-----------|--------|
+| All pass | 0 critical + 0 high issues remaining | GC converged -> pipeline complete |
+| Issues remain | Critical or high issues found | gc_rounds < 2 -> create FIX-002 + re-audit tasks |
+| Max rounds | gc_rounds >= 2 | Escalate to user: accept / try one more / terminate |
+
+## Parallel Spawn Rules
+
+| Mode | Scenario | Spawn Behavior |
+|------|----------|---------------|
+| audit-only | Initial | Spawn COLOR-001 + TYPO-001 + FOCUS-001 in parallel |
+| audit-only | After 3 audits | Spawn REMED-001 |
+| full | Initial | Spawn COLOR-001 + TYPO-001 + FOCUS-001 in parallel |
+| full | After 3 audits | Spawn REMED-001 |
+| full | After REMED-001 | Spawn FIX-001 |
+| full | After FIX-001 | Spawn COLOR-002 + FOCUS-002 in parallel |
+| full (GC) | After re-audit fan-in | If issues: spawn FIX-002, then new re-audits |
+
+## Output Artifacts
+
+| Task | Output Path |
+|------|-------------|
+| COLOR-001 | <session>/audits/color/color-audit-001.md |
+| TYPO-001 | <session>/audits/typography/typo-audit-001.md |
+| FOCUS-001 | <session>/audits/focus/focus-audit-001.md |
+| REMED-001 | <session>/remediation/remediation-plan.md |
+| FIX-001 | Modified source files + <session>/fixes/fix-summary-001.md |
+| COLOR-002 | <session>/re-audit/color-audit-002.md |
+| FOCUS-002 | <session>/re-audit/focus-audit-002.md |

package/.codex/skills/team-visual-a11y/specs/team-config.json

@@ -0,0 +1,109 @@
+{
+  "team_name": "visual-a11y",
+  "team_display_name": "Visual Accessibility",
+  "description": "Visual accessibility QA team with parallel auditors, remediation planning, and fix implementation with re-audit verification",
+  "version": "1.0.0",
+
+  "roles": {
+    "coordinator": {
+      "task_prefix": null,
+      "responsibility": "Scope assessment (page/component/full site), pipeline orchestration, parallel fan-in coordination",
+      "message_types": ["task_unblocked", "fan_in_complete", "gc_check", "error", "shutdown"]
+    },
+    "color-auditor": {
+      "task_prefix": "COLOR",
+      "responsibility": "OKLCH lightness/chroma analysis, contrast ratio (WCAG 2.1 + APCA), color blindness simulation",
+      "message_types": ["audit_complete", "audit_progress", "error"]
+    },
+    "typo-auditor": {
+      "task_prefix": "TYPO",
+      "responsibility": "Typography readability: font size at breakpoints, line-height ratios, clamp() validation, reading width",
+      "message_types": ["audit_complete", "audit_progress", "error"]
+    },
+    "focus-auditor": {
+      "task_prefix": "FOCUS",
+      "responsibility": "Focus-visible completeness: tab-order, focus indicator visibility, skip-link, focus traps, ARIA live regions",
+      "message_types": ["audit_complete", "audit_progress", "error"]
+    },
+    "remediation-planner": {
+      "task_prefix": "REMED",
+      "responsibility": "Synthesize audit findings into prioritized remediation plan with code-level fix guidance",
+      "message_types": ["plan_ready", "plan_progress", "error"]
+    },
+    "fix-implementer": {
+      "task_prefix": "FIX",
+      "inner_loop": true,
+      "responsibility": "Implement a11y fixes: OKLCH color corrections, focus styles, ARIA attributes, reduced-motion queries",
+      "message_types": ["fix_complete", "fix_progress", "error"]
+    }
+  },
+
+  "pipelines": {
+    "audit-only": {
+      "description": "3 parallel auditors -> remediation plan",
+      "task_chain": [
+        "COLOR-001 || TYPO-001 || FOCUS-001",
+        "REMED-001"
+      ],
+      "fan_in_points": ["REMED-001"],
+      "complexity": "medium"
+    },
+    "full": {
+      "description": "3 parallel auditors -> remediation -> fix -> 2 parallel re-auditors",
+      "task_chain": [
+        "COLOR-001 || TYPO-001 || FOCUS-001",
+        "REMED-001",
+        "FIX-001",
+        "COLOR-002 || FOCUS-002"
+      ],
+      "fan_in_points": ["REMED-001"],
+      "gc_points": ["COLOR-002", "FOCUS-002"],
+      "complexity": "high"
+    }
+  },
+
+  "innovation_patterns": {
+    "parallel_fan_in": {
+      "pattern": "CP-3",
+      "description": "3 auditors run simultaneously, remediation waits for all 3",
+      "fan_in_count": 3,
+      "fan_in_roles": ["color-auditor", "typo-auditor", "focus-auditor"],
+      "gate_task": "REMED-001"
+    },
+    "generator_critic": {
+      "pattern": "CP-2",
+      "generator": "fix-implementer",
+      "critic": ["color-auditor", "focus-auditor"],
+      "max_rounds": 2,
+      "convergence": "re-audit finds 0 critical and 0 high issues",
+      "escalation": "Coordinator intervenes after max rounds"
+    },
+    "shared_memory": {
+      "file": ".msg/meta.json",
+      "fields": {
+        "color-auditor": ["total_combinations", "pass_count", "fail_count", "critical_count"],
+        "typo-auditor": ["total_rules", "pass_count", "fail_count", "breakpoints_tested"],
+        "focus-auditor": ["total_elements", "pass_count", "fail_count", "skip_link_present"],
+        "remediation-planner": ["total_issues", "critical", "high", "medium", "low"],
+        "fix-implementer": ["total_fixes", "critical_fixed", "high_fixed", "files_modified"]
+      }
+    },
+    "chrome_devtools": {
+      "description": "Chrome DevTools integration for rendered verification",
+      "tools": ["evaluate_script", "take_screenshot", "navigate_page", "resize_page", "emulate", "lighthouse_audit"],
+      "degradation": "If unavailable, degrade to static analysis only"
+    }
+  },
+
+  "session_dirs": {
+    "base": ".workflow/.team/VA-{slug}-{YYYY-MM-DD}/",
+    "color_audit": "audits/color/",
+    "typo_audit": "audits/typography/",
+    "focus_audit": "audits/focus/",
+    "remediation": "remediation/",
+    "fixes": "fixes/",
+    "re_audit": "re-audit/",
+    "evidence": "evidence/",
+    "messages": ".workflow/.team-msg/{team-name}/"
+  }
+}

package/.codex/skills/team-visual-a11y/specs/typography-scale.md

@@ -0,0 +1,165 @@
+# Typography Accessibility Standards
+
+Reference guide for typography readability analysis. Used by typo-auditor and fix-implementer roles.
+
+## Font Stack Hierarchy
+
+| Purpose | Category | Example | Usage |
+|---------|----------|---------|-------|
+| Display | Serif | Cormorant Garamond, Georgia, serif | Headings, hero text |
+| Body | Sans-serif | Instrument Sans, Inter, system-ui, sans-serif | Paragraphs, UI text |
+| Mono | Monospace | Space Grotesk, Fira Code, monospace | Code blocks, labels |
+
+### System Font Stack (Fallback)
+
+```css
+--font-body: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+--font-mono: ui-monospace, "Cascadia Code", "Fira Code", Menlo, monospace;
+```
+
+## Responsive Size Scale
+
+### clamp() Formula Pattern
+
+```css
+/* clamp(minimum, preferred, maximum) */
+/* preferred = slope * 100vw + intercept */
+/* slope = (max - min) / (max-viewport - min-viewport) */
+```
+
+### Recommended Scale
+
+| Element | clamp() Value | Min (320px) | Max (1400px) | WCAG |
+|---------|--------------|-------------|-------------|------|
+| Hero | `clamp(2.5rem, 7vw, 4.5rem)` | 40px | 72px | -- |
+| Section title | `clamp(1.75rem, 4vw, 2.5rem)` | 28px | 40px | -- |
+| H1 | `clamp(2rem, 5vw, 3rem)` | 32px | 48px | -- |
+| H2 | `clamp(1.5rem, 3vw, 2.25rem)` | 24px | 36px | -- |
+| H3 | `clamp(1.25rem, 2vw, 1.75rem)` | 20px | 28px | -- |
+| Body | `clamp(1rem, 1vw + 0.875rem, 1.25rem)` | 16px | 20px | 1.4.4 |
+| Small/caption | 14px (fixed floor) | 14px | 14px | 1.4.4 |
+
+### Absolute Minimums
+
+| Element | Minimum | Rationale |
+|---------|---------|-----------|
+| Body text | 16px | WCAG 1.4.4 baseline readability |
+| Small text / caption | 14px | Absolute floor for legibility |
+| Interactive labels | 14px | Touch/click target readability |
+
+**Never**: Set body text below 14px at any viewport width.
+
+## Line Height Scale
+
+| Element Type | Range | Optimal | Rationale |
+|-------------|-------|---------|-----------|
+| Body text | 1.5 - 1.75 | 1.625 | WCAG 1.4.12, optimal readability |
+| Headings | 1.1 - 1.3 | 1.2 | Tight for visual impact, still readable |
+| Code blocks | 1.5 - 1.7 | 1.6 | Generous for scanning |
+| Buttons/labels | 1.2 - 1.5 | 1.3 | Compact UI element |
+| Lists | 1.4 - 1.6 | 1.5 | Slightly tighter than body |
+
+### Line Height Rules
+
+- Use unitless values (not px or em) for proper inheritance
+- `line-height: 1.5` (unitless) is preferred over `line-height: 24px` (fixed)
+- WCAG 1.4.12 requires text to remain readable at 1.5x font-size line-height
+
+## Letter Spacing Scale
+
+| Element Type | Range | Optimal | Notes |
+|-------------|-------|---------|-------|
+| Display headings | -0.02em to 0 | -0.015em | Tight for visual weight |
+| Body text | 0 (default) | 0 | Browser default is optimal |
+| Uppercase labels | 0.05em - 0.1em | 0.08em | Open for legibility |
+| Monospace code | 0.08em - 0.15em | 0.1em | Wide for character distinction |
+| Small caps | 0.05em - 0.08em | 0.06em | Slight opening |
+
+### WCAG 1.4.12 Override Requirements
+
+Content must remain readable when user applies:
+- Letter spacing: 0.12em
+- Word spacing: 0.16em
+- These overrides should not cause content overflow or overlap
+
+## Reading Width
+
+| Metric | Optimal | Acceptable | Flag |
+|--------|---------|-----------|------|
+| Characters per line | 66ch | 45-75ch | < 45 (too narrow) or > 75 (too wide) |
+| Container max-width | 65ch | 60ch-75ch | > 80ch |
+| Content column width | Up to 900px | Up to 1000px | > 1000px without columns |
+
+### Implementation
+
+```css
+/* Preferred: ch-based */
+.content { max-width: 70ch; }
+
+/* Alternative: px-based */
+.content { max-width: 700px; }
+
+/* With centering */
+.content {
+  max-width: 70ch;
+  margin-inline: auto;
+  padding-inline: 1rem;
+}
+```
+
+## Font Loading Strategy
+
+### font-display Values
+
+| Value | Behavior | Recommended For |
+|-------|----------|----------------|
+| `swap` | Show fallback immediately, swap when loaded | Body text |
+| `optional` | Show fallback, swap only if already cached | Display/decorative fonts |
+| `fallback` | Brief invisible period (~100ms), then fallback | Important fonts |
+| `block` | Invisible text up to 3s | Avoid for body text |
+| `auto` | Browser decides | Avoid (unpredictable) |
+
+### Best Practices
+
+```css
+/* Body font: swap for immediate readability */
+@font-face {
+  font-family: "Body Font";
+  src: url("body.woff2") format("woff2");
+  font-display: swap;
+}
+
+/* Display font: optional to prevent layout shift */
+@font-face {
+  font-family: "Display Font";
+  src: url("display.woff2") format("woff2");
+  font-display: optional;
+}
+```
+
+### Preloading Critical Fonts
+
+```html
+<link rel="preload" href="/fonts/body.woff2" as="font" type="font/woff2" crossorigin>
+```
+
+### Fallback Stack Requirements
+
+- Every custom font must have a system fallback
+- Fallback should have similar metrics (x-height, width) to minimize layout shift
+- Use `size-adjust`, `ascent-override`, `descent-override` for metric matching
+
+## Responsive Typography Checklist
+
+| # | Check | Standard | Method |
+|---|-------|----------|--------|
+| 1 | Body text >= 16px at 320px | WCAG 1.4.4 | Computed style at mobile viewport |
+| 2 | No text below 14px at any viewport | Best practice | Search for font-size values |
+| 3 | clamp() min >= 14px | Best practice | Parse clamp() functions |
+| 4 | Line-height unitless | Best practice | Search for px/em line-height |
+| 5 | Body line-height 1.5-1.75 | WCAG 1.4.12 | Computed style check |
+| 6 | Reading width 45-75ch | Best practice | Measure container + font size |
+| 7 | font-display: swap on body | Best practice | Parse @font-face rules |
+| 8 | System fallback defined | Best practice | Parse font-family stacks |
+| 9 | 200% zoom no overflow | WCAG 1.4.4 | Zoom test |
+| 10 | Text spacing override safe | WCAG 1.4.12 | Apply overrides, check layout |

package/.codex/skills/team-visual-a11y/specs/wcag-matrix.md

@@ -0,0 +1,133 @@
+# WCAG 2.1 Criteria Matrix
+
+Reference matrix for visual accessibility audit. Maps WCAG success criteria to audit methods and responsible roles.
+
+## Criteria Covered by This Team
+
+| Criterion | Level | Automated | Manual | Check Method | Primary Role |
+|-----------|-------|-----------|--------|-------------|-------------|
+| 1.4.3 Contrast (Minimum) | AA | Yes | - | Color ratio calculation (4.5:1 normal, 3:1 large) | color-auditor |
+| 1.4.6 Contrast (Enhanced) | AAA | Yes | - | Color ratio calculation (7:1 normal, 4.5:1 large) | color-auditor |
+| 1.4.11 Non-text Contrast | AA | Partial | Yes | UI component border/fill contrast >= 3:1 | color-auditor |
+| 1.4.4 Resize Text | AA | Yes | - | 200% zoom, no content loss | typo-auditor |
+| 1.4.12 Text Spacing | AA | Partial | Yes | Override line-height 1.5x, letter-spacing 0.12em, word-spacing 0.16em | typo-auditor |
+| 2.1.1 Keyboard | A | Partial | Yes | Tab through all interactive elements | focus-auditor |
+| 2.1.2 No Keyboard Trap | A | - | Yes | Tab can escape all contexts (except intentional traps with Escape) | focus-auditor |
+| 2.4.1 Bypass Blocks | A | Yes | - | Skip link present and functional | focus-auditor |
+| 2.4.3 Focus Order | A | - | Yes | Logical tab sequence | focus-auditor |
+| 2.4.7 Focus Visible | AA | Partial | Yes | Visible focus indicator on all interactive elements | focus-auditor |
+| 2.4.11 Focus Not Obscured (Min) | AA | - | Yes | Focus indicator not hidden by overlays, sticky headers | focus-auditor |
+| 2.5.8 Target Size (Minimum) | AA | Yes | - | Minimum 24x24px CSS pixel touch targets | focus-auditor |
+| 4.1.2 Name, Role, Value | A | Yes | - | ARIA roles, labels, and states on interactive elements | focus-auditor |
+| 4.1.3 Status Messages | AA | Partial | Yes | aria-live regions for dynamic status updates | focus-auditor |
+
+## Audit Method Legend
+
+| Method | Description |
+|--------|-------------|
+| Automated | Can be verified programmatically (CSS parsing, contrast calculation) |
+| Manual | Requires human judgment or runtime interaction |
+| Partial | Automated detection of presence, manual verification of correctness |
+
+## Criterion Details
+
+### 1.4.3 Contrast (Minimum) - AA
+
+**Requirement**: Text and images of text have a contrast ratio of at least 4.5:1 (3:1 for large text).
+
+**Large text definition**: >= 18pt (24px) or >= 14pt bold (18.66px bold).
+
+**Exceptions**: Decorative text, logos, inactive UI components.
+
+**Check**: Extract foreground/background colors -> calculate contrast ratio -> compare against threshold.
+
+### 1.4.6 Contrast (Enhanced) - AAA
+
+**Requirement**: Text has contrast ratio of at least 7:1 (4.5:1 for large text).
+
+**Check**: Same as 1.4.3 but with higher thresholds.
+
+### 1.4.11 Non-text Contrast - AA
+
+**Requirement**: UI components and graphical objects have at least 3:1 contrast against adjacent colors.
+
+**Applies to**: Buttons, inputs, icons, focus indicators, charts, custom controls.
+
+**Check**: Extract border/fill colors of UI components -> calculate contrast against background.
+
+### 1.4.4 Resize Text - AA
+
+**Requirement**: Text can be resized up to 200% without loss of content or functionality.
+
+**Check**: Zoom to 200% -> verify no horizontal scrolling, no content clipping, no overlap.
+
+### 1.4.12 Text Spacing - AA
+
+**Requirement**: Content must remain readable when user overrides:
+- Line height to 1.5x font size
+- Paragraph spacing to 2x font size
+- Letter spacing to 0.12x font size
+- Word spacing to 0.16x font size
+
+**Check**: Apply overrides via JavaScript/CSS -> verify no content loss or overlap.
+
+### 2.1.1 Keyboard - A
+
+**Requirement**: All functionality available via keyboard (Enter, Space, Tab, Arrow keys, Escape).
+
+**Check**: Tab to every interactive element -> activate with Enter/Space -> navigate composites with Arrows.
+
+### 2.1.2 No Keyboard Trap - A
+
+**Requirement**: Keyboard focus can be moved away from any component using standard keys.
+
+**Exception**: Modal dialogs that trap focus intentionally (must have Escape to exit).
+
+**Check**: Tab forward and backward through all elements -> verify escape from all containers.
+
+### 2.4.1 Bypass Blocks - A
+
+**Requirement**: Mechanism to bypass repeated content blocks (skip links, landmarks, headings).
+
+**Check**: Verify skip link as first focusable element, target exists, focus moves correctly.
+
+### 2.4.3 Focus Order - A
+
+**Requirement**: Focus order preserves meaning and operability (logical sequence).
+
+**Check**: Tab through page -> verify order matches visual/reading order.
+
+### 2.4.7 Focus Visible - AA
+
+**Requirement**: Keyboard focus indicator is visible on all interactive elements.
+
+**Check**: Tab to each element -> verify visible outline/border/shadow change.
+
+### 2.4.11 Focus Not Obscured (Minimum) - AA
+
+**Requirement**: Focused element is not entirely hidden by other content (sticky headers, overlays, banners).
+
+**Check**: Tab through elements near sticky/fixed positioned elements -> verify focus indicator partially visible.
+
+### 2.5.8 Target Size (Minimum) - AA
+
+**Requirement**: Interactive targets are at least 24x24 CSS pixels, or have adequate spacing.
+
+**Exceptions**: Inline links within text, user agent default controls, essential presentation.
+
+**Check**: Measure interactive element dimensions -> verify >= 24x24px or adequate spacing.
+
+### 4.1.2 Name, Role, Value - A
+
+**Requirement**: All UI components have accessible name, role, and state programmatically determined.
+
+**Check**: Verify interactive elements have:
+- Accessible name (text content, aria-label, aria-labelledby)
+- Appropriate role (native HTML or ARIA role)
+- Current state (aria-expanded, aria-pressed, aria-selected, aria-checked)
+
+### 4.1.3 Status Messages - AA
+
+**Requirement**: Status messages can be programmatically determined through role or properties without receiving focus.
+
+**Check**: Verify dynamic content updates use `aria-live` or appropriate roles (`status`, `alert`, `log`).

package/README.md

@@ -412,6 +412,14 @@ Visual workflow template editor with drag-drop.
 
 ---
 
+## 🙏 Acknowledgments
+
+- **[Impeccable](https://github.com/pbakaus/impeccable)** — Design audit methodology, OKLCH color system, anti-AI-slop detection patterns, editorial typography standards, motion/animation token architecture, and vanilla JS interaction patterns. The UI team skills (`team-ui-polish`, `team-interactive-craft`, `team-motion-design`, `team-visual-a11y`, `team-uidesign`, `team-ux-improve`) draw heavily from Impeccable's design knowledge.
+
+- **[gstack](https://github.com/garrytan/gstack)** — Systematic debugging methodology, security audit frameworks, and release pipeline patterns. The skills `investigate` (Iron Law debugging), `security-audit` (OWASP Top 10 + STRIDE), and `ship` (gated release pipeline) are inspired by gstack's workflow designs.
+
+---
+
 ## 🤝 Contributing
 
 <div align="center">

package/ccw/dist/core/hooks/hook-templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook-templates.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/hook-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,cAAc,GACd,MAAM,GACN,YAAY,CAAC;AAEjB,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,YAAY,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AA0KD,eAAO,MAAM,cAAc,EAAE,YAAY,EAoZxC,CAAC;AASF;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEhE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,YAAY,EAAE,CAEhD;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAS1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAelF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,SAAS,GAAG,QAAoB,GACtC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAiDvC"}
+{"version":3,"file":"hook-templates.d.ts","sourceRoot":"","sources":["../../../src/core/hooks/hook-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,MAAM,MAAM,eAAe,GACvB,cAAc,GACd,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,cAAc,GACd,MAAM,GACN,YAAY,CAAC;AAEjB,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,YAAY,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,OAAO,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAwND,eAAO,MAAM,cAAc,EAAE,YAAY,EA2dxC,CAAC;AASF;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAEhE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAYlF;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,YAAY,EAAE,CAEhD;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAS1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAelF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,SAAS,GAAG,QAAoB,GACtC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAiDvC"}

package/ccw/dist/core/hooks/hook-templates.js

@@ -11,7 +11,7 @@
  */
 import { spawnSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
+import { join, resolve } from 'path';
 import { homedir } from 'os';
 // ============================================================================
 // Helper Functions
@@ -61,9 +61,51 @@ function isDangerousCommand(cmd) {
         />\s*\/dev\//i,
         /wget.*\|.*sh/i,
         /curl.*\|.*bash/i,
+        /DROP\s+TABLE/i,
+        /TRUNCATE\s+TABLE/i,
+        /kubectl\s+delete/i,
+        /docker\s+(rm|rmi|system\s+prune)/i,
     ];
     return patterns.some(p => p.test(cmd));
 }
+/**
+ * Safe deletion targets - directories commonly cleaned in dev workflows
+ */
+const SAFE_DELETE_TARGETS = [
+    'node_modules',
+    '.next',
+    'dist',
+    '__pycache__',
+    '.cache',
+    'coverage',
+    '.turbo',
+    'build',
+];
+/**
+ * Check if a destructive command targets only safe directories.
+ * Returns true if the command IS dangerous (not a safe exception).
+ * Returns false if the command targets a safe directory (allow it through).
+ */
+function isDestructiveWithSafeException(cmd) {
+    if (!isDangerousCommand(cmd)) {
+        return false;
+    }
+    // Only apply safe exceptions for rm -rf patterns
+    const rmRfMatch = cmd.match(/rm\s+-rf\s+(.+)/i);
+    if (rmRfMatch) {
+        const args = rmRfMatch[1].trim().split(/\s+/);
+        // Every target must match a safe pattern for the exception to apply
+        const allSafe = args.length > 0 && args.every(arg => {
+            const target = arg.replace(/^["']|["']$/g, '').replace(/[/\\]+$/, '');
+            const targetBase = target.split(/[/\\]/).pop() || '';
+            return SAFE_DELETE_TARGETS.some(safe => targetBase === safe || target === safe);
+        });
+        if (allSafe) {
+            return false; // Safe exception - not dangerous
+        }
+    }
+    return true; // Dangerous, no safe exception applies
+}
 /**
  * Check if command is a dangerous git operation
  */
@@ -469,6 +511,77 @@ export const HOOK_TEMPLATES = [
             return { exitCode: 0 };
         }
     },
+    {
+        id: 'careful-destructive-guard',
+        name: 'Careful Destructive Guard',
+        description: 'Block destructive commands but allow safe targets (node_modules, dist, .next, etc.)',
+        category: 'protection',
+        trigger: 'PreToolUse',
+        matcher: 'Bash',
+        execute: (data) => {
+            const cmd = data.tool_input?.command || '';
+            if (isDestructiveWithSafeException(cmd)) {
+                return {
+                    exitCode: 0,
+                    jsonOutput: {
+                        hookSpecificOutput: {
+                            hookEventName: 'PreToolUse',
+                            permissionDecision: 'ask',
+                            permissionDecisionReason: `Destructive command detected: requires user confirmation`
+                        }
+                    }
+                };
+            }
+            return { exitCode: 0 };
+        }
+    },
+    {
+        id: 'freeze-edit-boundary',
+        name: 'Freeze Edit Boundary',
+        description: 'Block Write/Edit to files outside locked directories defined in .claude/freeze.json',
+        category: 'protection',
+        trigger: 'PreToolUse',
+        matcher: 'Write|Edit',
+        execute: (data) => {
+            const file = getStringInput(data.tool_input?.file_path);
+            if (!file) {
+                return { exitCode: 0 };
+            }
+            const projectDir = data.cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd();
+            const freezePath = join(projectDir, '.claude', 'freeze.json');
+            if (!existsSync(freezePath)) {
+                return { exitCode: 0 };
+            }
+            try {
+                const freezeData = JSON.parse(readFileSync(freezePath, 'utf8'));
+                const lockedDirs = freezeData.locked_dirs;
+                if (!Array.isArray(lockedDirs) || lockedDirs.length === 0) {
+                    return { exitCode: 0 };
+                }
+                const resolvedFile = resolve(projectDir, file);
+                const isInLockedDir = lockedDirs.some(dir => {
+                    const resolvedDir = resolve(projectDir, dir);
+                    return resolvedFile.startsWith(resolvedDir + '/') || resolvedFile.startsWith(resolvedDir + '\\');
+                });
+                if (!isInLockedDir) {
+                    return {
+                        exitCode: 2,
+                        jsonOutput: {
+                            hookSpecificOutput: {
+                                hookEventName: 'PreToolUse',
+                                permissionDecision: 'deny',
+                                permissionDecisionReason: `File ${file} is outside locked directories: ${lockedDirs.join(', ')}`
+                            }
+                        }
+                    };
+                }
+            }
+            catch {
+                // Ignore parse errors - if freeze.json is invalid, allow edits
+            }
+            return { exitCode: 0 };
+        }
+    },
     // ============ Indexing Templates ============
     {
         id: 'post-edit-index',