clikit-plugin 0.2.5 → 0.2.7

package/dist/hooks/auto-format.d.ts

@@ -23,8 +23,8 @@ type FormatterEntry = {
     command: (file: string) => string;
 };
 export declare function detectFormatter(projectDir: string): FormatterEntry | undefined;
-export declare function shouldFormat(filePath: string, extensions?: string[]): boolean;
-export declare function runFormatter(filePath: string, projectDir: unknown, formatterOverride?: string): FormatResult;
+export declare function shouldFormat(filePath: unknown, extensions?: string[]): boolean;
+export declare function runFormatter(filePath: unknown, projectDir: unknown, formatterOverride?: string): FormatResult;
 export declare function formatAutoFormatLog(result: FormatResult): string;
 export {};
 //# sourceMappingURL=auto-format.d.ts.map

package/dist/hooks/auto-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auto-format.d.ts","sourceRoot":"","sources":["../../src/hooks/auto-format.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACnC,CAAC;AAsBF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CA2B9E;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAI7E;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,YAAY,CAoCd;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAKhE"}
+{"version":3,"file":"auto-format.d.ts","sourceRoot":"","sources":["../../src/hooks/auto-format.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACnC,CAAC;AAsBF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CA2B9E;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAK9E;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,OAAO,EACjB,UAAU,EAAE,OAAO,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,YAAY,CAqCd;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAKhE"}

package/dist/hooks/git-guard.d.ts

@@ -9,6 +9,6 @@ export interface GitGuardResult {
     command: string;
     reason?: string;
 }
-export declare function checkDangerousCommand(command: string, allowForceWithLease?: boolean): GitGuardResult;
+export declare function checkDangerousCommand(command: unknown, allowForceWithLease?: boolean): GitGuardResult;
 export declare function formatBlockedWarning(result: GitGuardResult): string;
 //# sourceMappingURL=git-guard.d.ts.map

package/dist/hooks/git-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/git-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,UAAO,GAAG,cAAc,CAUjG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"git-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/git-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,mBAAmB,UAAO,GAAG,cAAc,CAalG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE"}

package/dist/hooks/subagent-question-blocker.d.ts

@@ -5,7 +5,7 @@
  * Subagents should execute their task autonomously without clarification.
  * Runs on tool.execute.before for Task tool.
  */
-export declare function containsQuestion(text: string): boolean;
-export declare function isSubagentTool(toolName: string): boolean;
+export declare function containsQuestion(text: unknown): boolean;
+export declare function isSubagentTool(toolName: unknown): boolean;
 export declare function formatBlockerWarning(): string;
 //# sourceMappingURL=subagent-question-blocker.d.ts.map

package/dist/hooks/subagent-question-blocker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-question-blocker.d.ts","sourceRoot":"","sources":["../../src/hooks/subagent-question-blocker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}
+{"version":3,"file":"subagent-question-blocker.d.ts","sourceRoot":"","sources":["../../src/hooks/subagent-question-blocker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAiBH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAMvD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/hooks/swarm-enforcer.d.ts

@@ -24,8 +24,8 @@ export interface EnforcementResult {
     reason?: string;
     suggestion?: string;
 }
-export declare function isFileInScope(filePath: string, scope: TaskScope): boolean;
-export declare function checkEditPermission(filePath: string, scope: TaskScope | undefined, config?: SwarmEnforcerConfig): EnforcementResult;
-export declare function extractFileFromToolInput(toolName: string, input: Record<string, unknown>): string | undefined;
+export declare function isFileInScope(filePath: unknown, scope: TaskScope): boolean;
+export declare function checkEditPermission(filePath: unknown, scope: TaskScope | undefined, config?: SwarmEnforcerConfig): EnforcementResult;
+export declare function extractFileFromToolInput(toolName: unknown, input: Record<string, unknown>): string | undefined;
 export declare function formatEnforcementWarning(result: EnforcementResult): string;
 //# sourceMappingURL=swarm-enforcer.d.ts.map

package/dist/hooks/swarm-enforcer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"swarm-enforcer.d.ts","sourceRoot":"","sources":["../../src/hooks/swarm-enforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GACf,OAAO,CAqBT;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,mBAAmB,GAC3B,iBAAiB,CAqBnB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,GAAG,SAAS,CA4BpB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAM1E"}
+{"version":3,"file":"swarm-enforcer.d.ts","sourceRoot":"","sources":["../../src/hooks/swarm-enforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,SAAS,GACf,OAAO,CAsBT;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,mBAAmB,GAC3B,iBAAiB,CAyBnB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,GAAG,SAAS,CA6BpB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAM1E"}

package/dist/hooks/typecheck-gate.d.ts

@@ -23,9 +23,9 @@ export interface TypeCheckResult {
     errors: TypeDiagnostic[];
     checkedFile: string;
 }
-export declare function isTypeScriptFile(filePath: string): boolean;
-export declare function findTsConfig(projectDir: string, override?: string): string | undefined;
-export declare function hasTscInstalled(projectDir: string): boolean;
-export declare function runTypeCheck(filePath: string, projectDir: unknown, config?: TypeCheckConfig): TypeCheckResult;
+export declare function isTypeScriptFile(filePath: unknown): boolean;
+export declare function findTsConfig(projectDir: unknown, override?: string): string | undefined;
+export declare function hasTscInstalled(projectDir: unknown): boolean;
+export declare function runTypeCheck(filePath: unknown, projectDir: unknown, config?: TypeCheckConfig): TypeCheckResult;
 export declare function formatTypeCheckWarning(result: TypeCheckResult): string;
 //# sourceMappingURL=typecheck-gate.d.ts.map

package/dist/hooks/typecheck-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typecheck-gate.d.ts","sourceRoot":"","sources":["../../src/hooks/typecheck-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAetF;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAW3D;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,EACnB,MAAM,CAAC,EAAE,eAAe,GACvB,eAAe,CAgCjB;AAqCD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAetE"}
+{"version":3,"file":"typecheck-gate.d.ts","sourceRoot":"","sources":["../../src/hooks/typecheck-gate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAG3D;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgBvF;AAED,wBAAgB,eAAe,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAY5D;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,OAAO,EACjB,UAAU,EAAE,OAAO,EACnB,MAAM,CAAC,EAAE,eAAe,GACvB,eAAe,CAiCjB;AAsCD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAetE"}

package/dist/index.js

@@ -3884,6 +3884,9 @@ var DANGEROUS_PATTERNS = [
   { pattern: /git\s+branch\s+-D/, reason: "Force-deleting branch may lose unmerged work" }
 ];
 function checkDangerousCommand(command, allowForceWithLease = true) {
+  if (typeof command !== "string") {
+    return { blocked: false, command: "" };
+  }
   for (const { pattern, reason } of DANGEROUS_PATTERNS) {
     if (pattern.test(command)) {
       if (allowForceWithLease && /--force-with-lease/.test(command)) {
@@ -3971,11 +3974,14 @@ var QUESTION_INDICATORS = [
   "could you provide"
 ];
 function containsQuestion(text) {
+  if (typeof text !== "string" || !text) {
+    return false;
+  }
   const lower = text.toLowerCase();
   return QUESTION_INDICATORS.some((indicator) => lower.includes(indicator));
 }
 function isSubagentTool(toolName) {
-  return toolName === "task" || toolName === "Task";
+  return typeof toolName === "string" && (toolName === "task" || toolName === "Task");
 }
 function formatBlockerWarning() {
   return `[CliKit:subagent-blocker] Subagent attempted to ask clarifying questions. Subagents should execute autonomously.`;
@@ -4263,23 +4269,26 @@ function detectFormatter(projectDir) {
   return;
 }
 function shouldFormat(filePath, extensions) {
+  if (typeof filePath !== "string")
+    return false;
   const ext = path5.extname(filePath).toLowerCase();
   const allowedExts = extensions || DEFAULT_EXTENSIONS;
   return allowedExts.includes(ext);
 }
 function runFormatter(filePath, projectDir, formatterOverride) {
+  const safePath = typeof filePath === "string" && filePath ? filePath : "";
   const safeDir = typeof projectDir === "string" && projectDir ? projectDir : process.cwd();
   const formatter = formatterOverride ? FORMATTERS.find((f) => f.name === formatterOverride) : detectFormatter(safeDir);
-  if (!formatter) {
+  if (!formatter || !safePath) {
     return {
       formatted: false,
-      file: filePath,
+      file: safePath,
       formatter: "none",
-      error: "No formatter detected"
+      error: formatter ? "No file path provided" : "No formatter detected"
     };
   }
   try {
-    const cmd = formatter.command(filePath);
+    const cmd = formatter.command(safePath);
     execSync2(cmd, {
       cwd: safeDir,
       timeout: 1e4,
@@ -4287,13 +4296,13 @@ function runFormatter(filePath, projectDir, formatterOverride) {
     });
     return {
       formatted: true,
-      file: filePath,
+      file: safePath,
       formatter: formatter.name
     };
   } catch (err) {
     return {
       formatted: false,
-      file: filePath,
+      file: safePath,
       formatter: formatter.name,
       error: err instanceof Error ? err.message : String(err)
     };
@@ -4311,16 +4320,19 @@ import * as path6 from "path";
 import { execSync as execSync3 } from "child_process";
 var TS_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts"];
 function isTypeScriptFile(filePath) {
+  if (typeof filePath !== "string")
+    return false;
   return TS_EXTENSIONS.includes(path6.extname(filePath).toLowerCase());
 }
 function findTsConfig(projectDir, override) {
+  const safeDir = typeof projectDir === "string" && projectDir ? projectDir : process.cwd();
   if (override) {
-    const overridePath = path6.resolve(projectDir, override);
+    const overridePath = path6.resolve(safeDir, override);
     return fs6.existsSync(overridePath) ? overridePath : undefined;
   }
   const candidates = ["tsconfig.json", "tsconfig.build.json"];
   for (const candidate of candidates) {
-    const fullPath = path6.join(projectDir, candidate);
+    const fullPath = path6.join(safeDir, candidate);
     if (fs6.existsSync(fullPath)) {
       return fullPath;
     }
@@ -4328,10 +4340,11 @@ function findTsConfig(projectDir, override) {
   return;
 }
 function runTypeCheck(filePath, projectDir, config) {
+  const safePath = typeof filePath === "string" && filePath ? filePath : "";
   const safeDir = typeof projectDir === "string" && projectDir ? projectDir : process.cwd();
   const tsConfig = findTsConfig(safeDir, config?.tsconfig);
   if (!tsConfig) {
-    return { clean: true, errors: [], checkedFile: filePath };
+    return { clean: true, errors: [], checkedFile: safePath };
   }
   try {
     const tscCmd = `npx tsc --noEmit --pretty false -p "${tsConfig}"`;
@@ -4341,18 +4354,20 @@ function runTypeCheck(filePath, projectDir, config) {
       stdio: ["pipe", "pipe", "pipe"],
       encoding: "utf-8"
     });
-    return { clean: true, errors: [], checkedFile: filePath };
+    return { clean: true, errors: [], checkedFile: safePath };
   } catch (err) {
     const output = err instanceof Error && "stdout" in err ? String(err.stdout) : "";
-    const errors = parseTscOutput(output, filePath);
+    const errors = parseTscOutput(output, safePath);
     return {
       clean: errors.length === 0,
       errors,
-      checkedFile: filePath
+      checkedFile: safePath
     };
   }
 }
 function parseTscOutput(output, filterFile) {
+  if (typeof output !== "string")
+    return [];
   const diagnostics = [];
   const lines = output.split(`
 `);

package/memory/handoffs/2026-02-15-complete-audit.md

@@ -0,0 +1,136 @@
+---
+date: 2026-02-15
+phase: implementing
+branch: main
+---
+
+# Handoff: CliKit Complete Type Guard Audit
+
+---
+
+## Status Summary
+
+CliKit plugin v0.2.6 published with many type guards. Typecheck passes. However, there are still potential runtime issues where OpenCode passes non-string values that could cause `.toLowerCase()`, `.test()`, `.split()` etc. to fail.
+
+---
+
+## Version History
+
+| Version | Fix |
+|---------|-----|
+| 0.2.1 | Type guards in hooks (truncator, security-check, compaction) |
+| 0.2.2 | Abort on JSON parse error |
+| 0.2.3 | Fix JSONC comment stripping breaking URLs |
+| 0.2.4 | Remove backup logic, fix `todos.filter` error |
+| 0.2.5 | Fix `path.join` error - guards for projectDir/cwd params |
+| 0.2.6 | Fix `text.toLowerCase` error in subagent-question-blocker |
+
+---
+
+## Remaining Issues (Need Type Guards)
+
+### 1. git-guard.ts: `checkDangerousCommand`
+**Line 25:** `command: string` - no type guard
+**Used:** `index.ts:221` - `toolInput.command as string | undefined`
+**Risk:** `pattern.test(command)` fails if command is object
+
+```typescript
+// Fix needed:
+export function checkDangerousCommand(command: unknown, allowForceWithLease = true): GitGuardResult {
+  if (typeof command !== "string") {
+    return { blocked: false, command: "" };
+  }
+  // ... rest
+}
+```
+
+### 2. swarm-enforcer.ts: `isFileInScope`
+**Line 33-36:** `filePath: string` - no type guard
+**Risk:** `path.resolve(filePath)` fails if filePath is not string
+
+```typescript
+// Fix needed:
+export function isFileInScope(filePath: unknown, scope: TaskScope): boolean {
+  if (typeof filePath !== "string") return false;
+  // ...
+}
+```
+
+### 3. swarm-enforcer.ts: `checkEditPermission`
+**Line 59-62:** `filePath: string` - no type guard
+
+### 4. index.ts: Tool input casting
+Multiple places where `toolInput.X as string | undefined` is used but the value could be an object:
+- Line 218: `toolInput.command` 
+- Line 269: `toolInput.prompt`
+- Line 335: `toolInput.filePath`
+- Line 351: `toolInput.filePath`
+
+---
+
+## Files Modified (Uncommitted)
+
+| File | Status |
+|------|--------|
+| `.opencode/package.json` | v0.2.6 |
+| `.opencode/src/cli.ts` | Removed backup, fixed JSONC |
+| `.opencode/src/config.ts` | Type guard for loadCliKitConfig |
+| `.opencode/src/index.ts` | Array.isArray for todos |
+| `.opencode/src/hooks/auto-format.ts` | Type guards |
+| `.opencode/src/hooks/comment-checker.ts` | Type guards |
+| `.opencode/src/hooks/compaction.ts` | Type guards |
+| `.opencode/src/hooks/env-context.ts` | Type guards |
+| `.opencode/src/hooks/security-check.ts` | Type guards |
+| `.opencode/src/hooks/session-notification.ts` | Type guards |
+| `.opencode/src/hooks/subagent-question-blocker.ts` | Type guards |
+| `.opencode/src/hooks/swarm-enforcer.ts` | Partial (extractFileFromToolInput only) |
+| `.opencode/src/hooks/todo-enforcer.ts` | Type guards |
+| `.opencode/src/hooks/truncator.ts` | Type guards |
+| `.opencode/src/hooks/typecheck-gate.ts` | Type guards |
+
+---
+
+## Git State
+
+- **Branch:** `main`
+- **Last commit:** `31b200c` - Update README with simplified installation
+- **Uncommitted changes:** 15 files
+
+---
+
+## Next Steps
+
+1. [ ] Add type guard to `git-guard.ts:checkDangerousCommand(command: unknown)`
+2. [ ] Add type guard to `swarm-enforcer.ts:isFileInScope(filePath: unknown)`
+3. [ ] Add type guard to `swarm-enforcer.ts:checkEditPermission(filePath: unknown)`
+4. [ ] Run typecheck
+5. [ ] Publish v0.2.7
+6. [ ] Test: `opencode` starts without errors
+
+---
+
+## Pattern for Type Guards
+
+```typescript
+// Before (breaks on non-string):
+export function myFunc(content: string): Result {
+  return content.split("\n");  // CRASH if content is object
+}
+
+// After (safe):
+export function myFunc(content: unknown): Result {
+  if (typeof content !== "string") {
+    return defaultResult;  // Safe fallback
+  }
+  return content.split("\n");
+}
+```
+
+---
+
+## Resume Command
+
+To resume, use `/resume` and it will:
+1. Load this handoff
+2. Propose fixing remaining type guards in git-guard.ts and swarm-enforcer.ts
+3. Publish v0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clikit-plugin",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "OpenCode plugin with 10 agents, 19 commands, 48 skills, 14 hooks",
   "type": "module",
   "main": "./dist/index.js",