oh-my-customcode 1.1.52 → 1.1.54

package/dist/cli/index.js

@@ -243,7 +243,7 @@ var init_package = __esm(() => {
     workspaces: [
       "packages/*"
     ],
-    version: "1.1.52",
+    version: "1.1.54",
     description: "Batteries-included agent harness for Claude Code",
     type: "module",
     bin: {
@@ -7634,7 +7634,7 @@ async function _scanDirForLockfiles(dir2, depth, seen, results, home, currentVer
   }
 }
 async function _findProjectsFromLockfiles(options, currentVersion) {
-  const { dirname: dirname3 } = await import("node:path");
+  const { dirname: dirname4 } = await import("node:path");
   const fs3 = await import("node:fs/promises");
   const seen = new Set;
   const results = [];
@@ -7644,7 +7644,7 @@ async function _findProjectsFromLockfiles(options, currentVersion) {
     const cwd = process.cwd();
     if (!searchPaths.includes(cwd))
       searchPaths.push(cwd);
-    const parent = dirname3(cwd);
+    const parent = dirname4(cwd);
     if (parent !== cwd && !searchPaths.includes(parent))
       searchPaths.push(parent);
   }
@@ -27949,6 +27949,489 @@ function getDefaultWorkflow() {
   };
 }
 
+// src/core/hooks-settings.ts
+init_fs();
+import { dirname as dirname3 } from "node:path";
+var IDENT_CHAR = /[A-Za-z0-9_.]/;
+var IDENT_START = /[A-Za-z_]/;
+function consumeSingleCharOp(input, i) {
+  const ch = input[i];
+  if (ch === "(" || ch === ")" || ch === "!") {
+    return { token: { type: "OP", value: ch }, next: i + 1 };
+  }
+  return null;
+}
+function consumeTwoCharOp(input, i) {
+  const two = input.slice(i, i + 2);
+  if (two === "&&" || two === "||" || two === "==") {
+    return { token: { type: "OP", value: two }, next: i + 2 };
+  }
+  return null;
+}
+function consumeStringLiteral(input, i) {
+  const n = input.length;
+  let j = i + 1;
+  let value = "";
+  while (j < n && input[j] !== '"') {
+    if (input[j] === "\\" && j + 1 < n) {
+      value += input[j + 1];
+      j += 2;
+    } else {
+      value += input[j];
+      j++;
+    }
+  }
+  if (j >= n) {
+    throw new Error(`unterminated string literal in matcher expression: ${input}`);
+  }
+  return { token: { type: "STRING", value }, next: j + 1 };
+}
+function consumeIdentifierOrKeyword(input, i) {
+  const n = input.length;
+  let j = i;
+  while (j < n && IDENT_CHAR.test(input[j]))
+    j++;
+  const word = input.slice(i, j);
+  const token = word === "matches" ? { type: "OP", value: "matches" } : { type: "IDENT", value: word };
+  return { token, next: j };
+}
+function tokenizeMatcher(input) {
+  const tokens = [];
+  const n = input.length;
+  let i = 0;
+  while (i < n) {
+    const ch = input[i];
+    if (ch === " " || ch === "\t" || ch === `
+` || ch === "\r") {
+      i++;
+      continue;
+    }
+    const twoCharOp = consumeTwoCharOp(input, i);
+    if (twoCharOp) {
+      tokens.push(twoCharOp.token);
+      i = twoCharOp.next;
+      continue;
+    }
+    const singleCharOp = consumeSingleCharOp(input, i);
+    if (singleCharOp) {
+      tokens.push(singleCharOp.token);
+      i = singleCharOp.next;
+      continue;
+    }
+    if (ch === '"') {
+      const literal = consumeStringLiteral(input, i);
+      tokens.push(literal.token);
+      i = literal.next;
+      continue;
+    }
+    if (IDENT_START.test(ch)) {
+      const ident = consumeIdentifierOrKeyword(input, i);
+      tokens.push(ident.token);
+      i = ident.next;
+      continue;
+    }
+    throw new Error(`unexpected character '${ch}' at offset ${i} in matcher expression: ${input}`);
+  }
+  return tokens;
+}
+
+class MatcherParser {
+  tokens;
+  pos = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  parse() {
+    const node = this.parseOr();
+    if (this.pos !== this.tokens.length) {
+      throw new Error(`trailing tokens after position ${this.pos} in matcher expression`);
+    }
+    return node;
+  }
+  peek() {
+    return this.tokens[this.pos];
+  }
+  next() {
+    const t2 = this.tokens[this.pos];
+    if (!t2)
+      throw new Error("unexpected end of matcher expression");
+    this.pos++;
+    return t2;
+  }
+  expectOp(value) {
+    const t2 = this.next();
+    if (t2.type !== "OP" || t2.value !== value) {
+      throw new Error(`expected '${value}', got ${JSON.stringify(t2)}`);
+    }
+  }
+  parseOr() {
+    let left = this.parseAnd();
+    while (this.peek()?.type === "OP" && this.peek()?.value === "||") {
+      this.next();
+      const right = this.parseAnd();
+      left = { kind: "or", left, right };
+    }
+    return left;
+  }
+  parseAnd() {
+    let left = this.parseUnary();
+    while (this.peek()?.type === "OP" && this.peek()?.value === "&&") {
+      this.next();
+      const right = this.parseUnary();
+      left = { kind: "and", left, right };
+    }
+    return left;
+  }
+  parseUnary() {
+    if (this.peek()?.type === "OP" && this.peek()?.value === "!") {
+      this.next();
+      this.expectOp("(");
+      const inner = this.parseOr();
+      this.expectOp(")");
+      return { kind: "not", child: inner };
+    }
+    return this.parseAtom();
+  }
+  parseAtom() {
+    if (this.peek()?.type === "OP" && this.peek()?.value === "(") {
+      this.next();
+      const inner = this.parseOr();
+      this.expectOp(")");
+      return inner;
+    }
+    const identTok = this.next();
+    if (identTok.type !== "IDENT") {
+      throw new Error(`expected identifier, got ${JSON.stringify(identTok)}`);
+    }
+    const opTok = this.next();
+    if (opTok.type !== "OP" || opTok.value !== "==" && opTok.value !== "matches") {
+      throw new Error(`expected '==' or 'matches' after identifier '${identTok.value}'`);
+    }
+    const strTok = this.next();
+    if (strTok.type !== "STRING") {
+      throw new Error(`expected string literal after '${opTok.value}'`);
+    }
+    if (opTok.value === "==") {
+      if (identTok.value !== "tool") {
+        throw new Error(`unsupported '==' comparison on field '${identTok.value}' (only 'tool' is supported)`);
+      }
+      return { kind: "toolEq", tool: strTok.value };
+    }
+    return { kind: "fieldMatch", field: identTok.value, pattern: strTok.value };
+  }
+}
+function parseMatcherExpr(raw) {
+  const tokens = tokenizeMatcher(raw);
+  if (tokens.length === 0) {
+    throw new Error("empty matcher expression");
+  }
+  return new MatcherParser(tokens).parse();
+}
+function isToolOnly(node) {
+  switch (node.kind) {
+    case "toolEq":
+      return true;
+    case "and":
+    case "or":
+      return isToolOnly(node.left) && isToolOnly(node.right);
+    case "not":
+      return isToolOnly(node.child);
+    case "fieldMatch":
+      return false;
+  }
+}
+function collectToolNames(node) {
+  switch (node.kind) {
+    case "toolEq":
+      return [node.tool];
+    case "and":
+    case "or":
+      return [...collectToolNames(node.left), ...collectToolNames(node.right)];
+    default:
+      return [];
+  }
+}
+function flattenAnd(node) {
+  if (node.kind === "and") {
+    return [...flattenAnd(node.left), ...flattenAnd(node.right)];
+  }
+  return [node];
+}
+function tryPureOrFieldRegex(node, field) {
+  if (node.kind === "fieldMatch") {
+    return node.field === field ? node.pattern : null;
+  }
+  if (node.kind === "or") {
+    const left = tryPureOrFieldRegex(node.left, field);
+    const right = tryPureOrFieldRegex(node.right, field);
+    if (left === null || right === null)
+      return null;
+    return `${left}|${right}`;
+  }
+  return null;
+}
+function fallbackExtractToolNames(raw) {
+  const names = new Set;
+  const re = /tool\s*==\s*"([^"]+)"/g;
+  let m;
+  while ((m = re.exec(raw)) !== null) {
+    names.add(m[1]);
+  }
+  return Array.from(names);
+}
+function analyzeMixedAndExpr(ast, raw) {
+  const parts = flattenAnd(ast);
+  const toolParts = parts.filter(isToolOnly);
+  const fieldParts = parts.filter((p) => !isToolOnly(p));
+  if (toolParts.length === 0) {
+    const names = fallbackExtractToolNames(raw);
+    if (names.length === 0) {
+      throw new Error(`cannot extract a tool matcher from expression (no top-level tool==X clause): ${raw}`);
+    }
+    return { toolRegex: names.join("|"), fieldNode: null };
+  }
+  const tools = Array.from(new Set(toolParts.flatMap(collectToolNames)));
+  const toolRegex = tools.join("|") || "*";
+  if (fieldParts.length === 0) {
+    return { toolRegex, fieldNode: null };
+  }
+  const fieldNode = fieldParts.reduce((acc, part) => acc === null ? part : { kind: "and", left: acc, right: part }, null);
+  return { toolRegex, fieldNode };
+}
+function analyzeMatcher(raw) {
+  if (raw === undefined || raw === "*" || raw.trim() === "") {
+    return { toolRegex: "*", fieldNode: null };
+  }
+  let ast;
+  try {
+    ast = parseMatcherExpr(raw);
+  } catch (err) {
+    const names = fallbackExtractToolNames(raw);
+    if (names.length === 0) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new Error(`unparseable matcher expression and no fallback tool name found: ${raw} (${message})`);
+    }
+    return { toolRegex: names.join("|"), fieldNode: null };
+  }
+  if (isToolOnly(ast)) {
+    const tools = Array.from(new Set(collectToolNames(ast)));
+    return { toolRegex: tools.join("|") || "*", fieldNode: null };
+  }
+  const mcpRegex = tryPureOrFieldRegex(ast, "mcp_tool_name");
+  if (mcpRegex !== null) {
+    return { toolRegex: mcpRegex, fieldNode: null };
+  }
+  return analyzeMixedAndExpr(ast, raw);
+}
+function fieldNodeToJq(node) {
+  switch (node.kind) {
+    case "and":
+      return `(${fieldNodeToJq(node.left)} and ${fieldNodeToJq(node.right)})`;
+    case "or":
+      return `(${fieldNodeToJq(node.left)} or ${fieldNodeToJq(node.right)})`;
+    case "not":
+      return `(${fieldNodeToJq(node.child)} | not)`;
+    case "fieldMatch": {
+      const jqPath = node.field === "mcp_tool_name" ? ".tool_name" : `.${node.field}`;
+      return `((${jqPath} // "") | test(${JSON.stringify(node.pattern)}))`;
+    }
+    case "toolEq":
+      return "true";
+  }
+}
+function shellSingleQuote(value) {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function buildGuardedCommand(jqCond, originalCommand) {
+  const quotedCond = shellSingleQuote(jqCond);
+  return [
+    "input=$(cat)",
+    `if printf '%s' "$input" | jq -e ${quotedCond} >/dev/null 2>&1; then`,
+    `  printf '%s' "$input" | (`,
+    originalCommand,
+    "  )",
+    "else",
+    `  printf '%s' "$input"`,
+    "fi"
+  ].join(`
+`);
+}
+var CLASSIFICATION_TABLE = [
+  {
+    event: "PreToolUse",
+    description: "Block dev servers outside tmux - ensures you can access logs",
+    decision: "wrap-guard",
+    reason: 'inline script unconditionally `exit 1`-blocks on ANY match once invoked; it never re-parses tool_input.command, so widening the matcher to bare "Bash" would block every Bash call'
+  },
+  {
+    event: "PreToolUse",
+    description: "Reminder to use tmux for long-running commands",
+    decision: "wrap-guard",
+    reason: 'inline script only checks `[ -z "$TMUX" ]`; it never re-checks tool_input.command against the npm/pnpm/yarn/bun/cargo/docker/pytest/vitest/playwright pattern, so widening the matcher would nag on every Bash call'
+  },
+  {
+    event: "PreToolUse",
+    description: "Pause before git push to review changes",
+    decision: "wrap-guard",
+    reason: 'inline script unconditionally prints the pause prompt once invoked; it never re-checks tool_input.command for "git push", so widening the matcher would pause on every Bash call'
+  },
+  {
+    event: "PreToolUse",
+    description: "Block creation of random .md files - keeps docs consolidated",
+    decision: "drop-condition",
+    reason: "inline script re-parses tool_input.file_path via jq and re-tests both the `\\.(md|txt)$` and the README/CLAUDE/AGENT/SKILL exclusion with its own [[ =~ ]] checks before blocking — the matcher condition is fully redundant with the script body"
+  },
+  {
+    event: "PreToolUse",
+    description: "Warn before destructive git commands — advisory recovery guidance (R001/R021)",
+    decision: "drop-condition",
+    reason: "destructive-git-guard.sh re-parses tool_input.command via jq/python3 and re-greps for each destructive git subcommand (reset --hard, clean -f*, restore, checkout -- ., branch -D) itself before warning — matcher condition is redundant"
+  },
+  {
+    event: "PreToolUse",
+    description: "Block rule file deletion — requires individual user confirmation per rule (R001 safety)",
+    decision: "drop-condition",
+    reason: 'rule-deletion-guard.sh explicitly re-checks `tool != "Bash"` (passthrough) and re-greps tool_input.command for rm/git rm/mv/unlink AND a .claude/rules path before blocking — matcher condition is redundant'
+  },
+  {
+    event: "PostToolUse",
+    description: "Auto-format JS/TS files with Prettier after edits",
+    decision: "wrap-guard",
+    reason: 'inline script only checks file existence (`[ -f "$file_path" ]`); it never re-checks the .ts/.tsx/.js/.jsx extension, so widening the matcher to bare "Edit" would run prettier on every edited file regardless of type'
+  },
+  {
+    event: "PostToolUse",
+    description: "TypeScript check after editing .ts/.tsx files",
+    decision: "wrap-guard",
+    reason: "inline script never re-checks the .ts/.tsx extension before walking up for tsconfig.json and invoking tsc — widening the matcher would run a TS project check after editing non-TS files"
+  },
+  {
+    event: "PostToolUse",
+    description: "Warn about console.log statements after edits",
+    decision: "wrap-guard",
+    reason: "inline script greps the edited file for `console\\.log` unconditionally on file existence; it never re-checks the .ts/.tsx/.js/.jsx extension, so widening the matcher would run this grep on every edited file type"
+  },
+  {
+    event: "PostToolUse",
+    description: "Auto-format Go files with gofmt after edits",
+    decision: "wrap-guard",
+    reason: "inline script never re-checks the .go extension before invoking gofmt -w; running gofmt on a non-Go file would error/corrupt output"
+  },
+  {
+    event: "PostToolUse",
+    description: "Auto-format and lint Python files with ruff after edits",
+    decision: "wrap-guard",
+    reason: "inline script never re-checks the .py extension before invoking ruff format/check --fix; running ruff on a non-Python file would error"
+  },
+  {
+    event: "PostToolUse",
+    description: "Type check Python files with ty after edits",
+    decision: "wrap-guard",
+    reason: "inline script never re-checks the .py extension before invoking `ty check`; running a Python type checker on a non-Python file would error"
+  }
+];
+function findClassification(event, description) {
+  if (description === undefined)
+    return;
+  return CLASSIFICATION_TABLE.find((c) => c.event === event && c.description === description);
+}
+function looksHardBlock(command) {
+  return /\bexit\s+[12]\b/.test(command);
+}
+function convertHookCommand(cmd, fieldNode, decision, warnCollector, context) {
+  if (fieldNode === null || decision === "drop-condition") {
+    return { ...cmd };
+  }
+  if (cmd.type !== "command" || typeof cmd.command !== "string") {
+    warnCollector.push(`hooks: ${context} — cannot wrap a non-command hook (type="${cmd.type}") with a stdin guard; condition dropped, hook now fires unconditionally on matcher match`);
+    return { ...cmd };
+  }
+  let jqCond;
+  try {
+    jqCond = fieldNodeToJq(fieldNode);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (looksHardBlock(cmd.command)) {
+      warnCollector.push(`hooks: ${context} — could not translate condition to jq (${message}); hook looks hard-block (exit 1/2) so it was conservatively EXCLUDED from the converted settings — manual review required`);
+      return null;
+    }
+    warnCollector.push(`hooks: ${context} — could not translate condition to jq (${message}); relaxed to unconditional firing (advisory hook, over-firing preferred over silent drop)`);
+    return { ...cmd };
+  }
+  return {
+    ...cmd,
+    command: buildGuardedCommand(jqCond, cmd.command)
+  };
+}
+function convertHooksEntry(event, entry, warnCollector) {
+  const context = `${event} / "${entry.description ?? "(no description)"}"`;
+  let analysis;
+  try {
+    analysis = analyzeMatcher(entry.matcher);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    warnCollector.push(`hooks: ${context} — matcher could not be auto-converted, entry EXCLUDED: ${message}`);
+    return null;
+  }
+  let decision = "auto";
+  if (analysis.fieldNode !== null) {
+    const classification = findClassification(event, entry.description);
+    if (classification) {
+      decision = classification.decision;
+    } else {
+      decision = "wrap-guard";
+      warnCollector.push(`hooks: ${context} — has a tool_input condition not present in CLASSIFICATION_TABLE; defaulted to wrap-guard (safer) — add an explicit classification entry after reading the script`);
+    }
+  }
+  const convertedHooks = entry.hooks.map((cmd) => convertHookCommand(cmd, analysis.fieldNode, decision, warnCollector, context)).filter((cmd) => cmd !== null);
+  if (convertedHooks.length === 0) {
+    return null;
+  }
+  const out = { hooks: convertedHooks };
+  if (analysis.toolRegex !== "*") {
+    out.matcher = analysis.toolRegex;
+  } else if (entry.matcher !== undefined) {
+    out.matcher = "*";
+  }
+  if (entry.description !== undefined) {
+    out.description = entry.description;
+  }
+  return out;
+}
+function convertHooksJson(hooksJson) {
+  const warnings = [];
+  const warnCollector = { push: (msg) => warnings.push(msg) };
+  const result = {};
+  for (const [event, entries] of Object.entries(hooksJson.hooks ?? {})) {
+    const convertedEntries = [];
+    for (const entry of entries) {
+      const converted = convertHooksEntry(event, entry, warnCollector);
+      if (converted)
+        convertedEntries.push(converted);
+    }
+    if (convertedEntries.length > 0) {
+      result[event] = convertedEntries;
+    }
+  }
+  return { hooks: result, warnings };
+}
+async function mergeHooksIntoSettings(settingsPath, hooksJsonPath) {
+  const hooksJson = await readJsonFile(hooksJsonPath);
+  const { hooks, warnings } = convertHooksJson(hooksJson);
+  let settings = {};
+  try {
+    const existingRaw = await readTextFile(settingsPath);
+    settings = JSON.parse(existingRaw);
+  } catch {
+    settings = {};
+  }
+  settings.hooks = hooks;
+  await ensureDirectory(dirname3(settingsPath));
+  await writeTextFile(settingsPath, `${JSON.stringify(settings, null, 2)}
+`);
+  return { warnings };
+}
+
 // src/core/scope-filter.ts
 function getSkillScope(content) {
   const cleaned = content.replace(/^\uFEFF/, "");
@@ -28129,6 +28612,26 @@ async function installSettingsLocal(targetDir, result) {
   await writeJsonFile(settingsPath, statusLineConfig);
   debug("install.settings_local_created", {});
 }
+async function installHooksSettings(targetDir, _options, result) {
+  const layout = getProviderLayout();
+  const hooksJsonPath = join8(targetDir, getComponentPath("hooks"), "hooks.json");
+  const settingsPath = join8(targetDir, layout.rootDir, "settings.local.json");
+  if (!await fileExists(hooksJsonPath)) {
+    debug("install.hooks_settings_skipped", { reason: "hooks.json not installed" });
+    return;
+  }
+  try {
+    const mergeResult = await mergeHooksIntoSettings(settingsPath, hooksJsonPath);
+    if (mergeResult && Array.isArray(mergeResult.warnings) && mergeResult.warnings.length > 0) {
+      result.warnings.push(...mergeResult.warnings);
+    }
+    debug("install.hooks_settings_merged", {});
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    result.warnings.push(`Failed to merge hooks into settings.local.json: ${message}`);
+    warn("install.hooks_settings_failed", { error: message });
+  }
+}
 async function installEntryDocWithTracking(targetDir, options, result) {
   const language = options.language ?? DEFAULT_LANGUAGE2;
   const overwrite = !!(options.force || options.backup);
@@ -28187,6 +28690,7 @@ async function install(options) {
     await installStatusline(options.targetDir, options, result);
     await installTestsConfig(options.targetDir, options, result);
     await installSettingsLocal(options.targetDir, result);
+    await installHooksSettings(options.targetDir, options, result);
     await installEntryDocWithTracking(options.targetDir, options, result);
     if (preservation) {
       const layout = getProviderLayout();
@@ -29670,7 +30174,7 @@ async function initCommand(options) {
 }
 
 // src/cli/list.ts
-import { basename as basename5, dirname as dirname3, join as join14, relative as relative3 } from "node:path";
+import { basename as basename5, dirname as dirname4, join as join14, relative as relative3 } from "node:path";
 init_fs();
 var ALLOWED_TOP_LEVEL_KEYS = new Set(["name", "type", "description", "version", "category"]);
 function parseKeyValue(line) {
@@ -29871,7 +30375,7 @@ async function getSkills(targetDir, rootDir = ".claude", config) {
     const customSkillPaths = new Set(customComponents.filter((c) => c.type === "skill").map((c) => c.path));
     const skillMdFiles = await listFiles(skillsDir, { recursive: true, pattern: "SKILL.md" });
     const skills = await Promise.all(skillMdFiles.map(async (skillMdPath) => {
-      const skillDir = dirname3(skillMdPath);
+      const skillDir = dirname4(skillMdPath);
       const indexYamlPath = join14(skillDir, "index.yaml");
       const { description, version } = await tryReadIndexYamlMetadata(indexYamlPath);
       const relativePath = relative3(targetDir, skillDir);