claude-devkit-cli 1.2.4 → 1.2.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-devkit-cli",
-  "version": "1.2.4",
+  "version": "1.2.5",
   "description": "CLI toolkit for spec-first development with Claude Code — hooks, commands, guards, and test runners",
   "bin": {
     "claude-devkit": "./bin/devkit.js",

package/templates/.claude/hooks/comment-guard.js

@@ -66,7 +66,11 @@ function main() {
 
   // Skip files outside the project directory (e.g. ~/.claude/plans/)
   const filePath = payload.tool_input?.file_path;
-  if (filePath && !path.resolve(filePath).startsWith(process.cwd())) process.exit(0);
+  if (filePath) {
+    const projectDir = process.cwd() + path.sep;
+    const resolved = path.resolve(filePath);
+    if (!resolved.startsWith(projectDir) && resolved !== process.cwd()) process.exit(0);
+  }
 
   const oldStr = payload.tool_input?.old_string;
   const newStr = payload.tool_input?.new_string;

package/templates/.claude/hooks/file-guard.js

@@ -60,8 +60,9 @@ function main() {
   if (!filePath) process.exit(0);
 
   // Skip files outside the project directory (e.g. ~/.claude/plans/)
-  const projectDir = process.cwd();
-  if (!path.resolve(filePath).startsWith(projectDir)) process.exit(0);
+  const projectDir = process.cwd() + path.sep;
+  const resolvedFile = path.resolve(filePath);
+  if (!resolvedFile.startsWith(projectDir) && resolvedFile !== process.cwd()) process.exit(0);
 
   // Skip excluded patterns
   if (matchesExclude(filePath)) process.exit(0);
@@ -80,7 +81,6 @@ function main() {
   try {
     const stat = fs.statSync(filePath);
     if (stat.size > MAX_BYTES) {
-      // >1MB = definitely over threshold, warn without exact count
       const rel = path.relative(process.cwd(), filePath);
       process.stdout.write(JSON.stringify({
         continue: true,
@@ -88,7 +88,7 @@ function main() {
           hookEventName: "PostToolUse",
           additionalContext: `Warning: ${rel} is ${Math.round(stat.size / 1024)}KB. Consider splitting into smaller modules.`,
         },
-      }));
+      }) + "\n");
       process.exit(0);
     }
     const buf = fs.readFileSync(filePath);
@@ -112,7 +112,7 @@ function main() {
         hookEventName: "PostToolUse",
         additionalContext: warning,
       },
-    })
+    }) + "\n"
   );
 }
 

package/templates/.claude/hooks/path-guard.sh

@@ -19,42 +19,44 @@ set -euo pipefail
 INPUT=$(cat)
 [[ -z "$INPUT" ]] && exit 0
 
-# Check Node.js availability
-if ! command -v node &>/dev/null; then
-    echo "WARNING: path-guard disabled — Node.js not found." >&2
-    exit 0
-fi
+# Extract command from JSON — try node first, fall back to grep/sed
+extract_command() {
+    if command -v node &>/dev/null; then
+        printf '%s' "$1" | node -e "
+          try {
+            const d = JSON.parse(require('fs').readFileSync(0, 'utf-8'));
+            const cmd = d.tool_input?.command;
+            if (typeof cmd === 'string') process.stdout.write(cmd);
+          } catch {}
+        " 2>/dev/null
+    else
+        # Lightweight fallback: extract "command":"..." from JSON
+        printf '%s' "$1" | grep -o '"command":"[^"]*"' | head -1 | sed 's/^"command":"//;s/"$//' 2>/dev/null
+    fi
+}
 
-# Parse JSON with inline Node.js (avoids jq dependency)
-COMMAND=$(printf '%s' "$INPUT" | node -e "
-  try {
-    const d = JSON.parse(require('fs').readFileSync(0, 'utf-8'));
-    const cmd = d.tool_input?.command;
-    if (typeof cmd === 'string') process.stdout.write(cmd);
-    else process.exit(0);
-  } catch { process.exit(0); }
-" 2>/dev/null) || exit 0
+COMMAND=$(extract_command "$INPUT") || exit 0
 
 [[ -z "$COMMAND" ]] && exit 0
 
 # ─── Blocked directory patterns ─────────────────────────────────────
 
-BLOCKED="node_modules"
-BLOCKED+="|__pycache__"
-BLOCKED+="|\.git/objects"
-BLOCKED+="|\.git/refs"
-BLOCKED+="|dist/"
-BLOCKED+="|build/"
+# Use word boundaries (\b) and explicit path separators to avoid substring false positives
+# e.g. "build/" should not match "rebuild/src" or "my-build-tool"
+BLOCKED="(^|[ /])node_modules(/|$| )"
+BLOCKED+="|(__pycache__)"
+BLOCKED+="|\.git/(objects|refs)"
+BLOCKED+="|(^|[ /])dist(/|$| )"
+BLOCKED+="|(^|[ /])build(/|$| )"
 BLOCKED+="|\.next/"
-BLOCKED+="|vendor/"
-BLOCKED+="|Pods/"
+BLOCKED+="|(^|[ /])vendor(/|$| )"
+BLOCKED+="|(^|[ /])Pods(/|$| )"
 BLOCKED+="|\.build/"
 BLOCKED+="|DerivedData"
 BLOCKED+="|\.gradle/"
-BLOCKED+="|target/debug"
-BLOCKED+="|target/release"
+BLOCKED+="|target/(debug|release)(/|$| )"
 BLOCKED+="|\.nuget"
-BLOCKED+="|\.cache"
+BLOCKED+="|\.cache(/|$| )"
 
 # Append project-specific patterns from env
 if [[ -n "${PATH_GUARD_EXTRA:-}" ]]; then

package/templates/.claude/hooks/self-review.sh

@@ -7,7 +7,7 @@
 # Environment:
 #   SELF_REVIEW_ENABLED — set to "false" to disable (default: true)
 
-set -euo pipefail
+# No set -euo pipefail — this hook must NEVER fail
 
 # Check if disabled
 if [[ "${SELF_REVIEW_ENABLED:-true}" == "false" ]]; then

package/templates/.claude/hooks/sensitive-guard.sh

@@ -57,13 +57,9 @@ is_sensitive() {
             return 0 ;;
         serviceAccountKey.json|service-account*.json)
             return 0 ;;
-        .mcp.json|config.json)
-            # config.json only sensitive inside .docker/ — check full path
-            if [[ "$basename" == "config.json" ]]; then
-                [[ "$filepath" == *".docker/config.json"* ]] && return 0
-            else
-                return 0
-            fi
+        config.json)
+            # config.json only sensitive inside .docker/
+            [[ "$filepath" == *".docker/config.json"* ]] && return 0
             ;;
     esac
 
@@ -151,11 +147,28 @@ warn_with_message() {
     exit 0
 }
 
+# ─── Fast-path: skip obviously safe files ──────────────────────────
+
+fast_path_safe() {
+    local ext="${1##*.}"
+    case "$ext" in
+        md|ts|tsx|js|jsx|css|scss|html|svg|json|yaml|yml|toml|xml|txt|sh|py|rb|rs|go|java|kt|swift|c|cpp|h|hpp|cs|vue|svelte|astro)
+            # But json could be sensitive — check name
+            if [[ "$ext" == "json" ]]; then
+                return 1  # not fast-path safe, need full check
+            fi
+            return 0 ;;
+    esac
+    return 1
+}
+
 # ─── Check direct file access (Read/Write/Edit) → BLOCK ────────────
 
 if [[ -n "$FILE_PATH" ]]; then
-    if is_sensitive "$FILE_PATH" || check_agentignore "$FILE_PATH"; then
-        block_with_message "$FILE_PATH"
+    if ! fast_path_safe "$FILE_PATH"; then
+        if is_sensitive "$FILE_PATH" || check_agentignore "$FILE_PATH"; then
+            block_with_message "$FILE_PATH"
+        fi
     fi
 fi