claude-skill-lord 1.5.0

package/hooks/scripts/check-console-log.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+/**
+ * Stop Hook: Check for console.log statements in modified files
+ *
+ * Cross-platform (Windows, macOS, Linux)
+ *
+ * Runs after each response and checks if any modified JavaScript/TypeScript
+ * files contain console.log statements. Provides warnings to help developers
+ * remember to remove debug statements before committing.
+ *
+ * Exclusions: test files, config files, and scripts/ directory (where
+ * console.log is often intentional).
+ */
+
+const fs = require('fs');
+const { isGitRepo, getGitModifiedFiles, readFile, log } = require('../lib/utils');
+
+// Files where console.log is expected and should not trigger warnings
+const EXCLUDED_PATTERNS = [
+  /\.test\.[jt]sx?$/,
+  /\.spec\.[jt]sx?$/,
+  /\.config\.[jt]s$/,
+  /scripts\//,
+  /__tests__\//,
+  /__mocks__\//,
+];
+
+const MAX_STDIN = 1024 * 1024; // 1MB limit
+let data = '';
+process.stdin.setEncoding('utf8');
+
+process.stdin.on('data', chunk => {
+  if (data.length < MAX_STDIN) {
+    const remaining = MAX_STDIN - data.length;
+    data += chunk.substring(0, remaining);
+  }
+});
+
+process.stdin.on('end', () => {
+  try {
+    if (!isGitRepo()) {
+      process.stdout.write(data);
+      process.exit(0);
+    }
+
+    const files = getGitModifiedFiles(['\\.tsx?$', '\\.jsx?$'])
+      .filter(f => fs.existsSync(f))
+      .filter(f => !EXCLUDED_PATTERNS.some(pattern => pattern.test(f)));
+
+    let hasConsole = false;
+
+    for (const file of files) {
+      const content = readFile(file);
+      if (content && content.includes('console.log')) {
+        log(`[Hook] WARNING: console.log found in ${file}`);
+        hasConsole = true;
+      }
+    }
+
+    if (hasConsole) {
+      log('[Hook] Remove console.log statements before committing');
+    }
+  } catch (err) {
+    log(`[Hook] check-console-log error: ${err.message}`);
+  }
+
+  // Always output the original data
+  process.stdout.write(data);
+  process.exit(0);
+});

package/hooks/scripts/check-hook-enabled.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+'use strict';
+
+const { isHookEnabled } = require('../lib/hook-flags');
+
+const [, , hookId, profilesCsv] = process.argv;
+if (!hookId) {
+  process.stdout.write('yes');
+  process.exit(0);
+}
+
+process.stdout.write(isHookEnabled(hookId, { profiles: profilesCsv }) ? 'yes' : 'no');

package/hooks/scripts/config-protection.js

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+/**
+ * Config Protection Hook
+ *
+ * Blocks modifications to linter/formatter config files.
+ * Agents frequently modify these to make checks pass instead of fixing
+ * the actual code. This hook steers the agent back to fixing the source.
+ *
+ * Exit codes:
+ *   0 = allow (not a config file)
+ *   2 = block (config file modification attempted)
+ */
+
+'use strict';
+
+const path = require('path');
+
+const MAX_STDIN = 1024 * 1024;
+let raw = '';
+
+const PROTECTED_FILES = new Set([
+  // ESLint (legacy + v9 flat config, JS/TS/MJS/CJS)
+  '.eslintrc',
+  '.eslintrc.js',
+  '.eslintrc.cjs',
+  '.eslintrc.json',
+  '.eslintrc.yml',
+  '.eslintrc.yaml',
+  'eslint.config.js',
+  'eslint.config.mjs',
+  'eslint.config.cjs',
+  'eslint.config.ts',
+  'eslint.config.mts',
+  'eslint.config.cts',
+  // Prettier (all config variants including ESM)
+  '.prettierrc',
+  '.prettierrc.js',
+  '.prettierrc.cjs',
+  '.prettierrc.json',
+  '.prettierrc.yml',
+  '.prettierrc.yaml',
+  'prettier.config.js',
+  'prettier.config.cjs',
+  'prettier.config.mjs',
+  // Biome
+  'biome.json',
+  'biome.jsonc',
+  // Ruff (Python)
+  '.ruff.toml',
+  'ruff.toml',
+  // Note: pyproject.toml is intentionally NOT included here because it
+  // contains project metadata alongside linter config. Blocking all edits
+  // to pyproject.toml would prevent legitimate dependency changes.
+  // Shell / Style / Markdown
+  '.shellcheckrc',
+  '.stylelintrc',
+  '.stylelintrc.json',
+  '.stylelintrc.yml',
+  '.markdownlint.json',
+  '.markdownlint.yaml',
+  '.markdownlintrc',
+]);
+
+/**
+ * Exportable run() for in-process execution via run-with-flags.js.
+ * Avoids the ~50-100ms spawnSync overhead when available.
+ */
+function run(input) {
+  const filePath = input?.tool_input?.file_path || input?.tool_input?.file || '';
+  if (!filePath) return { exitCode: 0 };
+
+  const basename = path.basename(filePath);
+  if (PROTECTED_FILES.has(basename)) {
+    return {
+      exitCode: 2,
+      stderr:
+        `BLOCKED: Modifying ${basename} is not allowed. ` +
+        `Fix the source code to satisfy linter/formatter rules instead of ` +
+        `weakening the config. If this is a legitimate config change, ` +
+        `disable the config-protection hook temporarily.`,
+    };
+  }
+
+  return { exitCode: 0 };
+}
+
+module.exports = { run };
+
+// Stdin fallback for spawnSync execution
+let truncated = false;
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {
+  if (raw.length < MAX_STDIN) {
+    const remaining = MAX_STDIN - raw.length;
+    raw += chunk.substring(0, remaining);
+    if (chunk.length > remaining) truncated = true;
+  } else {
+    truncated = true;
+  }
+});
+
+process.stdin.on('end', () => {
+  // If stdin was truncated, the JSON is likely malformed. Fail open but
+  // log a warning so the issue is visible. The run() path (used by
+  // run-with-flags.js in-process) is not affected by this.
+  if (truncated) {
+    process.stderr.write('[config-protection] Warning: stdin exceeded 1MB, skipping check\n');
+    process.stdout.write(raw);
+    return;
+  }
+
+  try {
+    const input = raw.trim() ? JSON.parse(raw) : {};
+    const result = run(input);
+
+    if (result.exitCode === 2) {
+      process.stderr.write(result.stderr + '\n');
+      process.exit(2);
+    }
+  } catch {
+    // Keep hook non-blocking on parse errors.
+  }
+
+  process.stdout.write(raw);
+});

package/hooks/scripts/post-edit-console-warn.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+/**
+ * PostToolUse Hook: Warn about console.log statements after edits
+ *
+ * Cross-platform (Windows, macOS, Linux)
+ *
+ * Runs after Edit tool use. If the edited JS/TS file contains console.log
+ * statements, warns with line numbers to help remove debug statements
+ * before committing.
+ */
+
+const { readFile } = require('../lib/utils');
+
+const MAX_STDIN = 1024 * 1024; // 1MB limit
+let data = '';
+process.stdin.setEncoding('utf8');
+
+process.stdin.on('data', chunk => {
+  if (data.length < MAX_STDIN) {
+    const remaining = MAX_STDIN - data.length;
+    data += chunk.substring(0, remaining);
+  }
+});
+
+process.stdin.on('end', () => {
+  try {
+    const input = JSON.parse(data);
+    const filePath = input.tool_input?.file_path;
+
+    if (filePath && /\.(ts|tsx|js|jsx)$/.test(filePath)) {
+      const content = readFile(filePath);
+      if (!content) { process.stdout.write(data); process.exit(0); }
+      const lines = content.split('\n');
+      const matches = [];
+
+      lines.forEach((line, idx) => {
+        if (/console\.log/.test(line)) {
+          matches.push((idx + 1) + ': ' + line.trim());
+        }
+      });
+
+      if (matches.length > 0) {
+        console.error('[Hook] WARNING: console.log found in ' + filePath);
+        matches.slice(0, 5).forEach(m => console.error(m));
+        console.error('[Hook] Remove console.log before committing');
+      }
+    }
+  } catch {
+    // Invalid input — pass through
+  }
+
+  process.stdout.write(data);
+  process.exit(0);
+});

package/hooks/scripts/post-edit-format.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+/**
+ * PostToolUse Hook: Auto-format JS/TS files after edits
+ *
+ * Cross-platform (Windows, macOS, Linux)
+ *
+ * Runs after Edit tool use. If the edited file is a JS/TS file,
+ * auto-detects the project formatter (Biome or Prettier) by looking
+ * for config files, then formats accordingly.
+ *
+ * For Biome, uses `check --write` (format + lint in one pass) to
+ * avoid a redundant second invocation from quality-gate.js.
+ *
+ * Prefers the local node_modules/.bin binary over npx to skip
+ * package-resolution overhead (~200-500ms savings per invocation).
+ *
+ * Fails silently if no formatter is found or installed.
+ */
+
+const { execFileSync, spawnSync } = require('child_process');
+const path = require('path');
+
+// Shell metacharacters that cmd.exe interprets as command separators/operators
+const UNSAFE_PATH_CHARS = /[&|<>^%!]/;
+
+const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../lib/resolve-formatter');
+
+const MAX_STDIN = 1024 * 1024; // 1MB limit
+
+/**
+ * Core logic — exported so run-with-flags.js can call directly
+ * without spawning a child process.
+ *
+ * @param {string} rawInput - Raw JSON string from stdin
+ * @returns {string} The original input (pass-through)
+ */
+function run(rawInput) {
+  try {
+    const input = JSON.parse(rawInput);
+    const filePath = input.tool_input?.file_path;
+
+    if (filePath && /\.(ts|tsx|js|jsx)$/.test(filePath)) {
+      try {
+        const resolvedFilePath = path.resolve(filePath);
+        const projectRoot = findProjectRoot(path.dirname(resolvedFilePath));
+        const formatter = detectFormatter(projectRoot);
+        if (!formatter) return rawInput;
+
+        const resolved = resolveFormatterBin(projectRoot, formatter);
+        if (!resolved) return rawInput;
+
+        // Biome: `check --write` = format + lint in one pass
+        // Prettier: `--write` = format only
+        const args = formatter === 'biome' ? [...resolved.prefix, 'check', '--write', resolvedFilePath] : [...resolved.prefix, '--write', resolvedFilePath];
+
+        if (process.platform === 'win32' && resolved.bin.endsWith('.cmd')) {
+          // Windows: .cmd files require shell to execute. Guard against
+          // command injection by rejecting paths with shell metacharacters.
+          if (UNSAFE_PATH_CHARS.test(resolvedFilePath)) {
+            throw new Error('File path contains unsafe shell characters');
+          }
+          const result = spawnSync(resolved.bin, args, {
+            cwd: projectRoot,
+            shell: true,
+            stdio: 'pipe',
+            timeout: 15000
+          });
+          if (result.error) throw result.error;
+          if (typeof result.status === 'number' && result.status !== 0) {
+            throw new Error(result.stderr?.toString() || `Formatter exited with status ${result.status}`);
+          }
+        } else {
+          execFileSync(resolved.bin, args, {
+            cwd: projectRoot,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: 15000
+          });
+        }
+      } catch {
+        // Formatter not installed, file missing, or failed — non-blocking
+      }
+    }
+  } catch {
+    // Invalid input — pass through
+  }
+
+  return rawInput;
+}
+
+// ── stdin entry point (backwards-compatible) ────────────────────
+if (require.main === module) {
+  let data = '';
+  process.stdin.setEncoding('utf8');
+
+  process.stdin.on('data', chunk => {
+    if (data.length < MAX_STDIN) {
+      const remaining = MAX_STDIN - data.length;
+      data += chunk.substring(0, remaining);
+    }
+  });
+
+  process.stdin.on('end', () => {
+    data = run(data);
+    process.stdout.write(data);
+    process.exit(0);
+  });
+}
+
+module.exports = { run };

package/hooks/scripts/post-edit-typecheck.js

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/**
+ * PostToolUse Hook: TypeScript check after editing .ts/.tsx files
+ *
+ * Cross-platform (Windows, macOS, Linux)
+ *
+ * Runs after Edit tool use on TypeScript files. Walks up from the file's
+ * directory to find the nearest tsconfig.json, then runs tsc --noEmit
+ * and reports only errors related to the edited file.
+ */
+
+const { execFileSync } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const MAX_STDIN = 1024 * 1024; // 1MB limit
+let data = "";
+process.stdin.setEncoding("utf8");
+
+process.stdin.on("data", (chunk) => {
+  if (data.length < MAX_STDIN) {
+    const remaining = MAX_STDIN - data.length;
+    data += chunk.substring(0, remaining);
+  }
+});
+
+process.stdin.on("end", () => {
+  try {
+    const input = JSON.parse(data);
+    const filePath = input.tool_input?.file_path;
+
+    if (filePath && /\.(ts|tsx)$/.test(filePath)) {
+      const resolvedPath = path.resolve(filePath);
+      if (!fs.existsSync(resolvedPath)) {
+        process.stdout.write(data);
+        process.exit(0);
+      }
+      // Find nearest tsconfig.json by walking up (max 20 levels to prevent infinite loop)
+      let dir = path.dirname(resolvedPath);
+      const root = path.parse(dir).root;
+      let depth = 0;
+
+      while (dir !== root && depth < 20) {
+        if (fs.existsSync(path.join(dir, "tsconfig.json"))) {
+          break;
+        }
+        dir = path.dirname(dir);
+        depth++;
+      }
+
+      if (fs.existsSync(path.join(dir, "tsconfig.json"))) {
+        try {
+          // Use npx.cmd on Windows to avoid shell: true which enables command injection
+          const npxBin = process.platform === "win32" ? "npx.cmd" : "npx";
+          execFileSync(npxBin, ["tsc", "--noEmit", "--pretty", "false"], {
+            cwd: dir,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"],
+            timeout: 30000,
+          });
+        } catch (err) {
+          // tsc exits non-zero when there are errors — filter to edited file
+          const output = (err.stdout || "") + (err.stderr || "");
+          // Compute paths that uniquely identify the edited file.
+          // tsc output uses paths relative to its cwd (the tsconfig dir),
+          // so check for the relative path, absolute path, and original path.
+          // Avoid bare basename matching — it causes false positives when
+          // multiple files share the same name (e.g., src/utils.ts vs tests/utils.ts).
+          const relPath = path.relative(dir, resolvedPath);
+          const candidates = new Set([filePath, resolvedPath, relPath]);
+          const relevantLines = output
+            .split("\n")
+            .filter((line) => {
+              for (const candidate of candidates) {
+                if (line.includes(candidate)) return true;
+              }
+              return false;
+            })
+            .slice(0, 10);
+
+          if (relevantLines.length > 0) {
+            console.error(
+              "[Hook] TypeScript errors in " + path.basename(filePath) + ":",
+            );
+            relevantLines.forEach((line) => console.error(line));
+          }
+        }
+      }
+    }
+  } catch {
+    // Invalid input — pass through
+  }
+
+  process.stdout.write(data);
+  process.exit(0);
+});

package/hooks/scripts/quality-gate.js

@@ -0,0 +1,168 @@
+#!/usr/bin/env node
+/**
+ * Quality Gate Hook
+ *
+ * Runs lightweight quality checks after file edits.
+ * - Targets one file when file_path is provided
+ * - Falls back to no-op when language/tooling is unavailable
+ *
+ * For JS/TS files with Biome, this hook is skipped because
+ * post-edit-format.js already runs `biome check --write`.
+ * This hook still handles .json/.md files for Biome, and all
+ * Prettier / Go / Python checks.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../lib/resolve-formatter');
+
+const MAX_STDIN = 1024 * 1024;
+
+/**
+ * Execute a command synchronously, returning the spawnSync result.
+ *
+ * @param {string} command - Executable path or name
+ * @param {string[]} args - Arguments to pass
+ * @param {string} [cwd] - Working directory (defaults to process.cwd())
+ * @returns {import('child_process').SpawnSyncReturns<string>}
+ */
+function exec(command, args, cwd = process.cwd()) {
+  return spawnSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    env: process.env,
+    timeout: 15000
+  });
+}
+
+/**
+ * Write a message to stderr for logging.
+ *
+ * @param {string} msg - Message to log
+ */
+function log(msg) {
+  process.stderr.write(`${msg}\n`);
+}
+
+/**
+ * Run quality-gate checks for a single file based on its extension.
+ * Skips JS/TS files when Biome is configured (handled by post-edit-format).
+ *
+ * @param {string} filePath - Path to the edited file
+ */
+function maybeRunQualityGate(filePath) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    return;
+  }
+
+  // Resolve to absolute path so projectRoot-relative comparisons work
+  filePath = path.resolve(filePath);
+
+  const ext = path.extname(filePath).toLowerCase();
+  const fix = String(process.env.ECC_QUALITY_GATE_FIX || '').toLowerCase() === 'true';
+  const strict = String(process.env.ECC_QUALITY_GATE_STRICT || '').toLowerCase() === 'true';
+
+  if (['.ts', '.tsx', '.js', '.jsx', '.json', '.md'].includes(ext)) {
+    const projectRoot = findProjectRoot(path.dirname(filePath));
+    const formatter = detectFormatter(projectRoot);
+
+    if (formatter === 'biome') {
+      // JS/TS already handled by post-edit-format via `biome check --write`
+      if (['.ts', '.tsx', '.js', '.jsx'].includes(ext)) {
+        return;
+      }
+
+      // .json / .md — still need quality gate
+      const resolved = resolveFormatterBin(projectRoot, 'biome');
+      if (!resolved) return;
+      const args = [...resolved.prefix, 'check', filePath];
+      if (fix) args.push('--write');
+      const result = exec(resolved.bin, args, projectRoot);
+      if (result.status !== 0 && strict) {
+        log(`[QualityGate] Biome check failed for ${filePath}`);
+      }
+      return;
+    }
+
+    if (formatter === 'prettier') {
+      const resolved = resolveFormatterBin(projectRoot, 'prettier');
+      if (!resolved) return;
+      const args = [...resolved.prefix, fix ? '--write' : '--check', filePath];
+      const result = exec(resolved.bin, args, projectRoot);
+      if (result.status !== 0 && strict) {
+        log(`[QualityGate] Prettier check failed for ${filePath}`);
+      }
+      return;
+    }
+
+    // No formatter configured — skip
+    return;
+  }
+
+  if (ext === '.go') {
+    if (fix) {
+      const r = exec('gofmt', ['-w', filePath]);
+      if (r.status !== 0 && strict) {
+        log(`[QualityGate] gofmt failed for ${filePath}`);
+      }
+    } else if (strict) {
+      const r = exec('gofmt', ['-l', filePath]);
+      if (r.status !== 0) {
+        log(`[QualityGate] gofmt failed for ${filePath}`);
+      } else if (r.stdout && r.stdout.trim()) {
+        log(`[QualityGate] gofmt check failed for ${filePath}`);
+      }
+    }
+    return;
+  }
+
+  if (ext === '.py') {
+    const args = ['format'];
+    if (!fix) args.push('--check');
+    args.push(filePath);
+    const r = exec('ruff', args);
+    if (r.status !== 0 && strict) {
+      log(`[QualityGate] Ruff check failed for ${filePath}`);
+    }
+  }
+}
+
+/**
+ * Core logic — exported so run-with-flags.js can call directly.
+ *
+ * @param {string} rawInput - Raw JSON string from stdin
+ * @returns {string} The original input (pass-through)
+ */
+function run(rawInput) {
+  try {
+    const input = JSON.parse(rawInput);
+    const filePath = String(input.tool_input?.file_path || '');
+    maybeRunQualityGate(filePath);
+  } catch {
+    // Ignore parse errors.
+  }
+  return rawInput;
+}
+
+// ── stdin entry point (backwards-compatible) ────────────────────
+if (require.main === module) {
+  let raw = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => {
+    if (raw.length < MAX_STDIN) {
+      const remaining = MAX_STDIN - raw.length;
+      raw += chunk.substring(0, remaining);
+    }
+  });
+
+  process.stdin.on('end', () => {
+    const result = run(raw);
+    process.stdout.write(result);
+  });
+}
+
+module.exports = { run };

package/hooks/scripts/run-with-flags-shell.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HOOK_ID="${1:-}"
+REL_SCRIPT_PATH="${2:-}"
+PROFILES_CSV="${3:-standard,strict}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "${SCRIPT_DIR}/../.." && pwd)}"
+
+# Preserve stdin for passthrough or script execution
+INPUT="$(cat)"
+
+if [[ -z "$HOOK_ID" || -z "$REL_SCRIPT_PATH" ]]; then
+  printf '%s' "$INPUT"
+  exit 0
+fi
+
+# Ask Node helper if this hook is enabled
+ENABLED="$(node "${PLUGIN_ROOT}/scripts/hooks/check-hook-enabled.js" "$HOOK_ID" "$PROFILES_CSV" 2>/dev/null || echo yes)"
+if [[ "$ENABLED" != "yes" ]]; then
+  printf '%s' "$INPUT"
+  exit 0
+fi
+
+SCRIPT_PATH="${PLUGIN_ROOT}/${REL_SCRIPT_PATH}"
+if [[ ! -f "$SCRIPT_PATH" ]]; then
+  echo "[Hook] Script not found for ${HOOK_ID}: ${SCRIPT_PATH}" >&2
+  printf '%s' "$INPUT"
+  exit 0
+fi
+
+printf '%s' "$INPUT" | "$SCRIPT_PATH"