clikit-plugin 0.2.6 → 0.2.7

package/dist/hooks/git-guard.d.ts

@@ -9,6 +9,6 @@ export interface GitGuardResult {
     command: string;
     reason?: string;
 }
-export declare function checkDangerousCommand(command: string, allowForceWithLease?: boolean): GitGuardResult;
+export declare function checkDangerousCommand(command: unknown, allowForceWithLease?: boolean): GitGuardResult;
 export declare function formatBlockedWarning(result: GitGuardResult): string;
 //# sourceMappingURL=git-guard.d.ts.map

package/dist/hooks/git-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/git-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB,UAAO,GAAG,cAAc,CAUjG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"git-guard.d.ts","sourceRoot":"","sources":["../../src/hooks/git-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,mBAAmB,UAAO,GAAG,cAAc,CAalG;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAEnE"}

package/dist/hooks/swarm-enforcer.d.ts

@@ -24,8 +24,8 @@ export interface EnforcementResult {
     reason?: string;
     suggestion?: string;
 }
-export declare function isFileInScope(filePath: string, scope: TaskScope): boolean;
-export declare function checkEditPermission(filePath: string, scope: TaskScope | undefined, config?: SwarmEnforcerConfig): EnforcementResult;
+export declare function isFileInScope(filePath: unknown, scope: TaskScope): boolean;
+export declare function checkEditPermission(filePath: unknown, scope: TaskScope | undefined, config?: SwarmEnforcerConfig): EnforcementResult;
 export declare function extractFileFromToolInput(toolName: unknown, input: Record<string, unknown>): string | undefined;
 export declare function formatEnforcementWarning(result: EnforcementResult): string;
 //# sourceMappingURL=swarm-enforcer.d.ts.map

package/dist/hooks/swarm-enforcer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"swarm-enforcer.d.ts","sourceRoot":"","sources":["../../src/hooks/swarm-enforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GACf,OAAO,CAqBT;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,mBAAmB,GAC3B,iBAAiB,CAqBnB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,GAAG,SAAS,CA6BpB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAM1E"}
+{"version":3,"file":"swarm-enforcer.d.ts","sourceRoot":"","sources":["../../src/hooks/swarm-enforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,SAAS,GACf,OAAO,CAsBT;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,mBAAmB,GAC3B,iBAAiB,CAyBnB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,GAAG,SAAS,CA6BpB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAM1E"}

package/dist/index.js

@@ -3884,6 +3884,9 @@ var DANGEROUS_PATTERNS = [
   { pattern: /git\s+branch\s+-D/, reason: "Force-deleting branch may lose unmerged work" }
 ];
 function checkDangerousCommand(command, allowForceWithLease = true) {
+  if (typeof command !== "string") {
+    return { blocked: false, command: "" };
+  }
   for (const { pattern, reason } of DANGEROUS_PATTERNS) {
     if (pattern.test(command)) {
       if (allowForceWithLease && /--force-with-lease/.test(command)) {

package/memory/handoffs/2026-02-15-complete-audit.md

@@ -0,0 +1,136 @@
+---
+date: 2026-02-15
+phase: implementing
+branch: main
+---
+
+# Handoff: CliKit Complete Type Guard Audit
+
+---
+
+## Status Summary
+
+CliKit plugin v0.2.6 published with many type guards. Typecheck passes. However, there are still potential runtime issues where OpenCode passes non-string values that could cause `.toLowerCase()`, `.test()`, `.split()` etc. to fail.
+
+---
+
+## Version History
+
+| Version | Fix |
+|---------|-----|
+| 0.2.1 | Type guards in hooks (truncator, security-check, compaction) |
+| 0.2.2 | Abort on JSON parse error |
+| 0.2.3 | Fix JSONC comment stripping breaking URLs |
+| 0.2.4 | Remove backup logic, fix `todos.filter` error |
+| 0.2.5 | Fix `path.join` error - guards for projectDir/cwd params |
+| 0.2.6 | Fix `text.toLowerCase` error in subagent-question-blocker |
+
+---
+
+## Remaining Issues (Need Type Guards)
+
+### 1. git-guard.ts: `checkDangerousCommand`
+**Line 25:** `command: string` - no type guard
+**Used:** `index.ts:221` - `toolInput.command as string | undefined`
+**Risk:** `pattern.test(command)` fails if command is object
+
+```typescript
+// Fix needed:
+export function checkDangerousCommand(command: unknown, allowForceWithLease = true): GitGuardResult {
+  if (typeof command !== "string") {
+    return { blocked: false, command: "" };
+  }
+  // ... rest
+}
+```
+
+### 2. swarm-enforcer.ts: `isFileInScope`
+**Line 33-36:** `filePath: string` - no type guard
+**Risk:** `path.resolve(filePath)` fails if filePath is not string
+
+```typescript
+// Fix needed:
+export function isFileInScope(filePath: unknown, scope: TaskScope): boolean {
+  if (typeof filePath !== "string") return false;
+  // ...
+}
+```
+
+### 3. swarm-enforcer.ts: `checkEditPermission`
+**Line 59-62:** `filePath: string` - no type guard
+
+### 4. index.ts: Tool input casting
+Multiple places where `toolInput.X as string | undefined` is used but the value could be an object:
+- Line 218: `toolInput.command` 
+- Line 269: `toolInput.prompt`
+- Line 335: `toolInput.filePath`
+- Line 351: `toolInput.filePath`
+
+---
+
+## Files Modified (Uncommitted)
+
+| File | Status |
+|------|--------|
+| `.opencode/package.json` | v0.2.6 |
+| `.opencode/src/cli.ts` | Removed backup, fixed JSONC |
+| `.opencode/src/config.ts` | Type guard for loadCliKitConfig |
+| `.opencode/src/index.ts` | Array.isArray for todos |
+| `.opencode/src/hooks/auto-format.ts` | Type guards |
+| `.opencode/src/hooks/comment-checker.ts` | Type guards |
+| `.opencode/src/hooks/compaction.ts` | Type guards |
+| `.opencode/src/hooks/env-context.ts` | Type guards |
+| `.opencode/src/hooks/security-check.ts` | Type guards |
+| `.opencode/src/hooks/session-notification.ts` | Type guards |
+| `.opencode/src/hooks/subagent-question-blocker.ts` | Type guards |
+| `.opencode/src/hooks/swarm-enforcer.ts` | Partial (extractFileFromToolInput only) |
+| `.opencode/src/hooks/todo-enforcer.ts` | Type guards |
+| `.opencode/src/hooks/truncator.ts` | Type guards |
+| `.opencode/src/hooks/typecheck-gate.ts` | Type guards |
+
+---
+
+## Git State
+
+- **Branch:** `main`
+- **Last commit:** `31b200c` - Update README with simplified installation
+- **Uncommitted changes:** 15 files
+
+---
+
+## Next Steps
+
+1. [ ] Add type guard to `git-guard.ts:checkDangerousCommand(command: unknown)`
+2. [ ] Add type guard to `swarm-enforcer.ts:isFileInScope(filePath: unknown)`
+3. [ ] Add type guard to `swarm-enforcer.ts:checkEditPermission(filePath: unknown)`
+4. [ ] Run typecheck
+5. [ ] Publish v0.2.7
+6. [ ] Test: `opencode` starts without errors
+
+---
+
+## Pattern for Type Guards
+
+```typescript
+// Before (breaks on non-string):
+export function myFunc(content: string): Result {
+  return content.split("\n");  // CRASH if content is object
+}
+
+// After (safe):
+export function myFunc(content: unknown): Result {
+  if (typeof content !== "string") {
+    return defaultResult;  // Safe fallback
+  }
+  return content.split("\n");
+}
+```
+
+---
+
+## Resume Command
+
+To resume, use `/resume` and it will:
+1. Load this handoff
+2. Propose fixing remaining type guards in git-guard.ts and swarm-enforcer.ts
+3. Publish v0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clikit-plugin",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "OpenCode plugin with 10 agents, 19 commands, 48 skills, 14 hooks",
   "type": "module",
   "main": "./dist/index.js",