coding-friend-cli 1.28.0 → 1.29.0

package/dist/{chunk-JVYZ72EP.js → chunk-ADCFJSCP.js}

@@ -203,9 +203,23 @@ var STATIC_RULES = [
     category: "Testing & Build",
     recommended: true
   },
+  // Narrow npx rules only — the broad "Bash(npx *)" used to live here but
+  // grants execution of any package from any registry, which conflicts with
+  // the auto-approve hook's threat model (see plugin/hooks/auto-approve.cjs).
+  // tsc and prettier are safe because they typecheck/format and do not
+  // execute arbitrary code from input files. Tools that execute arbitrary
+  // code (eslint plugins, jest test files, vitest, tsx) are intentionally
+  // NOT in the static recommended list — users who want them must add them
+  // explicitly with awareness of the risk.
+  {
+    rule: "Bash(npx tsc *)",
+    description: "[execute] Run TypeScript compiler \xB7 Used by: cf-verification",
+    category: "Testing & Build",
+    recommended: true
+  },
   {
-    rule: "Bash(npx *)",
-    description: "[execute] Run npx commands (eslint, tsc) \xB7 Used by: cf-verification",
+    rule: "Bash(npx prettier *)",
+    description: "[execute] Run Prettier formatter \xB7 Used by: cf-verification",
     category: "Testing & Build",
     recommended: true
   },
@@ -305,7 +319,8 @@ var DANGEROUS_RULE_PATTERNS = [
     reason: "Grants execution of any npm script"
   },
   {
-    pattern: /^Bash\(npx\*?\)$/,
+    // Matches Bash(npx), Bash(npx*), and Bash(npx *) — any bare npx wildcard
+    pattern: /^Bash\(npx\s*\*?\)$/,
     reason: "Grants execution of any npx package"
   },
   {

package/dist/{config-U2WEZXF6.js → config-GRJ5WKFR.js}

@@ -47,7 +47,7 @@ import {
 import {
   getAllRules,
   getExistingRules
-} from "./chunk-JVYZ72EP.js";
+} from "./chunk-ADCFJSCP.js";
 import {
   mergeJson,
   readJson
@@ -393,7 +393,7 @@ async function editAutoApprove(globalCfg, localCfg) {
   if (scope === "back") return;
   writeToScope(scope, { autoApprove: value });
   if (value) {
-    const { runDangerousRulesAudit } = await import("./permissions-O24R7WUU.js");
+    const { runDangerousRulesAudit } = await import("./permissions-DDLSTTPS.js");
     await runDangerousRulesAudit(
       [
         claudeProjectSettingsPath(),
@@ -570,7 +570,7 @@ async function editPermissions() {
     )
   });
   if (choice === BACK) return;
-  const { permissionCommand } = await import("./permission-K54DWLHN.js");
+  const { permissionCommand } = await import("./permission-HU36DY4C.js");
   switch (choice) {
     case "interactive":
       await permissionCommand({});

package/dist/{guide-F2FLCDYO.js → guide-LQ2BHU5Y.js}

@@ -10,6 +10,7 @@ import {
 } from "./chunk-5UVDWG5L.js";
 
 // src/commands/guide.ts
+import chalk from "chalk";
 import { existsSync, mkdirSync, readdirSync, writeFileSync } from "fs";
 import { join, resolve } from "path";
 var GUIDE_TEMPLATE = `# Custom Guide for {{SKILL_NAME}}
@@ -100,11 +101,14 @@ function guideListCommand() {
     return;
   }
   const skillsDir = findPluginSkillsDir();
-  log.info(`Custom guides (${entries.length}):`);
+  log.info(`Custom guides (${chalk.bold(entries.length)}):`);
   for (const name of entries) {
     const path = join(customDir, `${name}-custom`, "SKILL.md");
-    const exists = skillsDir != null && skillExists(skillsDir, name) ? "\u2714" : "\u26A0 skill not found";
-    log.info(`  ${name}  \u2192  ${path}  (${exists})`);
+    const found = skillsDir != null && skillExists(skillsDir, name);
+    const status = found ? chalk.green("\u2714") : chalk.yellow("\u26A0 skill not found");
+    log.info(
+      `  ${status}  ${chalk.cyan(name)}  ${chalk.dim("\u2192")}  ${chalk.dim(path)}`
+    );
   }
 }
 export {

package/dist/index.js

@@ -30,11 +30,11 @@ program.command("enable").description("Re-enable the Coding Friend plugin").opti
   await enableCommand(opts);
 });
 program.command("init").description("Initialize coding-friend in current project").action(async () => {
-  const { initCommand } = await import("./init-R5L2GAFV.js");
+  const { initCommand } = await import("./init-4GHLRTOK.js");
   await initCommand();
 });
 program.command("config").description("Manage Coding Friend configuration").action(async () => {
-  const { configCommand } = await import("./config-U2WEZXF6.js");
+  const { configCommand } = await import("./config-GRJ5WKFR.js");
   await configCommand();
 });
 program.command("host").description("Build and serve learning docs as a static website").argument("[path]", "path to docs folder").option("-p, --port <port>", "port number", "3333").action(async (path, opts) => {
@@ -49,7 +49,7 @@ program.command("permission").description("Manage Claude Code permission rules f
   "--project",
   "Save to project-level settings (.claude/settings.local.json)"
 ).action(async (opts) => {
-  const { permissionCommand } = await import("./permission-K54DWLHN.js");
+  const { permissionCommand } = await import("./permission-HU36DY4C.js");
   await permissionCommand(opts);
 });
 program.command("statusline").description("Setup coding-friend statusline in Claude Code").action(async () => {
@@ -61,7 +61,7 @@ program.command("update").description("Update coding-friend plugin, CLI, and sta
   await updateCommand(opts);
 });
 program.command("status").description("Show comprehensive Coding Friend status").action(async () => {
-  const { statusCommand } = await import("./status-JXUXVHRH.js");
+  const { statusCommand } = await import("./status-7WFW4JI2.js");
   await statusCommand();
 });
 var session = program.command("session").description("Save and load Claude Code sessions across machines");
@@ -150,11 +150,11 @@ memory.command("rm").description("Remove a project database").option("--project-
 );
 var guide = program.command("guide").description("Manage custom skill guides");
 guide.command("create").description("Create a custom guide for a skill").argument("<skill-name>", "skill to create guide for (e.g. cf-commit)").action(async (skillName) => {
-  const { guideCreateCommand } = await import("./guide-F2FLCDYO.js");
+  const { guideCreateCommand } = await import("./guide-LQ2BHU5Y.js");
   guideCreateCommand(skillName);
 });
 guide.command("list").description("List existing custom guides").action(async () => {
-  const { guideListCommand } = await import("./guide-F2FLCDYO.js");
+  const { guideListCommand } = await import("./guide-LQ2BHU5Y.js");
   guideListCommand();
 });
 var dev = program.command("dev").description("Development mode commands");

package/dist/{init-R5L2GAFV.js → init-4GHLRTOK.js}

@@ -59,7 +59,7 @@ import {
   getExistingRules,
   getMissingRules,
   logPluginScriptWarning
-} from "./chunk-JVYZ72EP.js";
+} from "./chunk-ADCFJSCP.js";
 import {
   mergeJson,
   readJson,
@@ -827,7 +827,7 @@ async function initMenu(gitAvailable) {
           log.success(`Saved to ${targetPath}`);
         }
         if (autoApproveChoice) {
-          const { runDangerousRulesAudit } = await import("./permissions-O24R7WUU.js");
+          const { runDangerousRulesAudit } = await import("./permissions-DDLSTTPS.js");
           await runDangerousRulesAudit(
             [
               claudeProjectSettingsPath(),

package/dist/{permission-K54DWLHN.js → permission-HU36DY4C.js}

@@ -26,7 +26,7 @@ import {
   groupByCategory,
   logPluginScriptWarning,
   runDangerousRulesAudit
-} from "./chunk-JVYZ72EP.js";
+} from "./chunk-ADCFJSCP.js";
 import {
   mergeJson,
   readJson

package/dist/{permissions-O24R7WUU.js → permissions-DDLSTTPS.js}

@@ -15,7 +15,7 @@ import {
   logPluginScriptWarning,
   runDangerousRulesAudit,
   stripDangerousRules
-} from "./chunk-JVYZ72EP.js";
+} from "./chunk-ADCFJSCP.js";
 import "./chunk-5UVDWG5L.js";
 export {
   DANGEROUS_RULE_PATTERNS,

package/dist/{status-JXUXVHRH.js → status-7WFW4JI2.js}

@@ -30,7 +30,7 @@ import {
 import "./chunk-NREZK463.js";
 import {
   getExistingRules
-} from "./chunk-JVYZ72EP.js";
+} from "./chunk-ADCFJSCP.js";
 import {
   readJson
 } from "./chunk-5UVDWG5L.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-friend-cli",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "CLI for coding-friend — host learning docs, setup MCP server, initialize projects",
   "type": "module",
   "bin": {