qualitative-research-pro 1.0.0

package/bin/cli.mjs

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+
+// Qualitative Research Pro npm CLI
+// npx qualitative-research-pro [command] [options]
+
+import { existsSync, mkdirSync, cpSync, readdirSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const REPO_DIR = join(__dirname, '..');
+const CLAUDE_DIR = join(homedir(), '.claude');
+const VERSION = '1.0.0';
+
+const COLORS = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  dim: '\x1b[2m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  blue: '\x1b[34m',
+  cyan: '\x1b[36m',
+  red: '\x1b[31m',
+};
+
+function c(color, text) { return `${COLORS[color]}${text}${COLORS.reset}`; }
+
+function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise(resolve => rl.question(question, answer => { rl.close(); resolve(answer); }));
+}
+
+function countFiles(dir, pattern) {
+  try {
+    if (pattern === 'dirs') return readdirSync(dir).filter(f => statSync(join(dir, f)).isDirectory()).length;
+    return readdirSync(dir).filter(f => f.endsWith(pattern)).length;
+  } catch { return 0; }
+}
+
+function smartCopy(src, dest, force = false) {
+  let added = 0, skipped = 0;
+  if (!existsSync(src)) return { added, skipped };
+
+  if (statSync(src).isDirectory()) {
+    if (force || !existsSync(dest)) {
+      mkdirSync(dirname(dest), { recursive: true });
+      cpSync(src, dest, { recursive: true });
+      added++;
+    } else { skipped++; }
+  } else {
+    if (force || !existsSync(dest)) {
+      mkdirSync(dirname(dest), { recursive: true });
+      cpSync(src, dest);
+      added++;
+    } else { skipped++; }
+  }
+  return { added, skipped };
+}
+
+function install(options = {}) {
+  const { force = false, profile = 'all' } = options;
+  let totalAdded = 0, totalSkipped = 0;
+
+  const track = (result) => { totalAdded += result.added; totalSkipped += result.skipped; };
+
+  const count = (dir, opts = {}) => {
+    const p = join(REPO_DIR, dir);
+    if (!existsSync(p)) return 0;
+    const entries = readdirSync(p);
+    if (opts.dirs) return entries.filter(e => statSync(join(p, e)).isDirectory()).length;
+    return entries.filter(e => e.endsWith(opts.ext || '.md')).length;
+  };
+  const agents = count('agents');
+  const skills = count('skills', { dirs: true });
+  const hooks = count('hooks/src', { ext: '.ts' });
+  const rules = count('rules');
+
+  console.log(c('bold', '\nQualitative Research Pro installer'));
+  console.log('========================\n');
+  console.log(`Installing into ${c('cyan', '~/.claude/')}:`);
+  console.log(`  - ${agents} agents   -> ~/.claude/agents/`);
+  console.log(`  - ${skills} skills   -> ~/.claude/skills/`);
+  console.log(`  - ${hooks} hooks    -> ~/.claude/hooks/`);
+  console.log(`  - ${rules} rules    -> ~/.claude/rules/`);
+  console.log(`\nMode: ${force ? c('yellow', 'OVERWRITE') : c('green', 'MERGE')} | Profile: ${c('blue', profile)}\n`);
+
+  process.stdout.write('Installing agents...');
+  mkdirSync(join(CLAUDE_DIR, 'agents'), { recursive: true });
+  const agentDir = join(REPO_DIR, 'agents');
+  if (existsSync(agentDir)) {
+    for (const f of readdirSync(agentDir).filter(f => f.endsWith('.md'))) {
+      track(smartCopy(join(agentDir, f), join(CLAUDE_DIR, 'agents', f), force));
+    }
+  }
+  console.log(c('green', ' done'));
+
+  process.stdout.write('Installing skills...');
+  mkdirSync(join(CLAUDE_DIR, 'skills'), { recursive: true });
+  const skillDir = join(REPO_DIR, 'skills');
+  if (existsSync(skillDir)) {
+    for (const d of readdirSync(skillDir)) {
+      const fullPath = join(skillDir, d);
+      if (statSync(fullPath).isDirectory()) {
+        track(smartCopy(fullPath, join(CLAUDE_DIR, 'skills', d), force));
+      }
+    }
+  }
+  console.log(c('green', ' done'));
+
+  process.stdout.write('Installing hooks...');
+  mkdirSync(join(CLAUDE_DIR, 'hooks', 'dist'), { recursive: true });
+  const distDir = join(REPO_DIR, 'hooks', 'dist');
+  if (existsSync(distDir)) {
+    for (const f of readdirSync(distDir).filter(f => f.endsWith('.mjs'))) {
+      track(smartCopy(join(distDir, f), join(CLAUDE_DIR, 'hooks', 'dist', f), force));
+    }
+  }
+  const hooksJson = join(REPO_DIR, 'hooks', 'hooks.json');
+  if (existsSync(hooksJson)) {
+    track(smartCopy(hooksJson, join(CLAUDE_DIR, 'hooks', 'hooks.json'), force));
+  }
+  console.log(c('green', ' done'));
+
+  process.stdout.write('Installing rules...');
+  mkdirSync(join(CLAUDE_DIR, 'rules'), { recursive: true });
+  const rulesDir = join(REPO_DIR, 'rules');
+  if (existsSync(rulesDir)) {
+    for (const f of readdirSync(rulesDir).filter(f => f.endsWith('.md'))) {
+      track(smartCopy(join(rulesDir, f), join(CLAUDE_DIR, 'rules', f), force));
+    }
+  }
+  console.log(c('green', ' done'));
+
+  console.log(`\n${c('bold', 'Installation complete!')}`);
+  console.log(`  ${c('green', 'Added:')}   ${totalAdded} files`);
+  console.log(`  ${c('dim', 'Skipped:')} ${totalSkipped} files (already existed)`);
+  console.log(`\n  Agents: ${countFiles(join(CLAUDE_DIR, 'agents'), '.md')}`);
+  console.log(`  Skills: ${countFiles(join(CLAUDE_DIR, 'skills'), 'dirs')}`);
+  console.log(`  Hooks:  ${countFiles(join(CLAUDE_DIR, 'hooks', 'dist'), '.mjs')}`);
+  console.log(`  Rules:  ${countFiles(join(CLAUDE_DIR, 'rules'), '.md')}`);
+
+  if (totalSkipped > 0) {
+    console.log(`\n  Tip: Use ${c('yellow', 'npx qualitative-research-pro init --force')} to overwrite existing files.`);
+  }
+
+  console.log(`\n  Run ${c('cyan', 'npx qualitative-research-pro doctor')} to verify your setup.\n`);
+}
+
+function showHelp() {
+  const cnt = (dir, opts = {}) => {
+    const p = join(REPO_DIR, dir);
+    if (!existsSync(p)) return '?';
+    const entries = readdirSync(p);
+    if (opts.dirs) return entries.filter(e => statSync(join(p, e)).isDirectory()).length;
+    return entries.filter(e => e.endsWith(opts.ext || '.md')).length;
+  };
+  console.log(`
+${c('bold', 'Qualitative Research Pro')} v${VERSION} - Academic qualitative research squad
+
+${c('bold', 'USAGE')}
+  npx qualitative-research-pro [command] [options]
+
+${c('bold', 'COMMANDS')}
+  init              Install Qualitative Research Pro into ~/.claude/
+  init --force      Overwrite existing files
+  doctor            Run health check on installation
+  version           Show version
+  help              Show this help
+
+${c('bold', 'EXAMPLES')}
+  npx qualitative-research-pro init          # Install all components
+  npx qualitative-research-pro init --force  # Overwrite existing setup
+  npx qualitative-research-pro doctor        # Verify installation
+
+${c('bold', 'COMPONENTS')}
+  ${cnt('agents')} agents   Grounded theory, qualitative analysis, writing, review
+  ${cnt('skills', { dirs: true })} skills   Deep methodology knowledge across qualitative traditions
+  ${cnt('hooks/src', { ext: '.ts' })} hooks    Research quality checks (citations, methodology)
+  ${cnt('rules')} rules    Academic research methodology guidelines
+
+${c('dim', 'https://github.com/ccashwell/qualitative-research-pro')}
+`);
+}
+
+function doctor() {
+  console.log(`\n${c('bold', 'Qualitative Research Pro doctor')} - Health Check\n`);
+  const checks = [
+    { name: 'Agents directory', path: join(CLAUDE_DIR, 'agents'), type: 'dir' },
+    { name: 'Skills directory', path: join(CLAUDE_DIR, 'skills'), type: 'dir' },
+    { name: 'Hooks dist', path: join(CLAUDE_DIR, 'hooks', 'dist'), type: 'dir' },
+    { name: 'Rules directory', path: join(CLAUDE_DIR, 'rules'), type: 'dir' },
+  ];
+
+  let pass = 0, fail = 0;
+  for (const check of checks) {
+    const exists = existsSync(check.path);
+    const status = exists ? c('green', 'PASS') : c('red', 'FAIL');
+    console.log(`  ${status}  ${check.name}`);
+    if (exists) pass++; else fail++;
+  }
+
+  console.log(`\n  ${pass} passed, ${fail} failed\n`);
+  if (fail > 0) {
+    console.log(`  Run ${c('cyan', 'npx qualitative-research-pro init')} to fix.\n`);
+  }
+}
+
+const args = process.argv.slice(2);
+const command = args[0] || 'help';
+
+switch (command) {
+  case 'init': {
+    const force = args.includes('--force');
+    const profileIdx = args.indexOf('--profile');
+    const profile = profileIdx !== -1 ? args[profileIdx + 1] : 'all';
+    install({ force, profile });
+    break;
+  }
+  case 'doctor':
+    doctor();
+    break;
+  case 'version':
+  case '--version':
+  case '-v':
+    console.log(`Qualitative Research Pro v${VERSION}`);
+    break;
+  case 'help':
+  case '--help':
+  case '-h':
+  default:
+    showHelp();
+    break;
+}

package/hooks/dist/agent-memory-loader.mjs

@@ -0,0 +1,94 @@
+// src/agent-memory-loader.ts
+import { readFileSync, existsSync, readdirSync, statSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CLAUDE_HOME = join(homedir(), ".claude");
+var MAX_MEMORY_SIZE = 8e3;
+var MAX_FILES = 10;
+function sanitizeAgentType(agentType) {
+  return agentType.replace(/[:/\\]/g, "-").replace(/\s+/g, "-").toLowerCase();
+}
+function getAgentMemoryDir(agentType, scope) {
+  const dirName = sanitizeAgentType(agentType);
+  switch (scope) {
+    case "user":
+      return join(CLAUDE_HOME, "agent-memory", dirName);
+    case "project":
+      return join(process.cwd(), ".claude", "agent-memory", dirName);
+    case "local":
+      return join(process.cwd(), ".claude", "agent-memory-local", dirName);
+  }
+}
+function scanMemoryDir(dir) {
+  if (!existsSync(dir)) return [];
+  const results = [];
+  try {
+    const files = readdirSync(dir).filter((f) => f.endsWith(".md")).slice(0, MAX_FILES);
+    for (const file of files) {
+      const filePath = join(dir, file);
+      try {
+        const stat = statSync(filePath);
+        if (stat.isFile() && stat.size > 0 && stat.size < 5e4) {
+          const content = readFileSync(filePath, "utf-8").trim();
+          if (content) {
+            results.push(`### ${file}
+${content}`);
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return results;
+}
+function getAgentMemoryScope(agentType) {
+  const agentDir = join(CLAUDE_HOME, "agents");
+  const agentFile = join(agentDir, `${agentType}.md`);
+  if (!existsSync(agentFile)) return void 0;
+  try {
+    const content = readFileSync(agentFile, "utf-8");
+    const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---/);
+    if (!frontmatterMatch) return void 0;
+    const memoryMatch = frontmatterMatch[1].match(/^memory:\s*(.+)$/m);
+    if (!memoryMatch) return void 0;
+    const scope = memoryMatch[1].trim().toLowerCase();
+    if (scope === "user" || scope === "project" || scope === "local") {
+      return scope;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function main() {
+  try {
+    const input = JSON.parse(process.argv[2] || "{}");
+    if (input.tool_name !== "Agent") return;
+    const agentType = input.tool_input?.subagent_type;
+    if (!agentType) return;
+    const scope = getAgentMemoryScope(agentType);
+    const effectiveScope = scope || "user";
+    const memoryDir = getAgentMemoryDir(agentType, effectiveScope);
+    const memories = scanMemoryDir(memoryDir);
+    if (memories.length === 0) return;
+    let combined = memories.join("\n\n");
+    if (combined.length > MAX_MEMORY_SIZE) {
+      combined = combined.substring(0, MAX_MEMORY_SIZE) + "\n\n[... truncated]";
+    }
+    const context = `## Agent Persistent Memory (${agentType}, scope: ${effectiveScope})
+
+Bu agent'in onceki session'lardan biriktirdigi kalici bellek:
+
+${combined}
+
+---
+Bu memory'yi guncelle: Yeni ogrenimler varsa ~/.claude/agent-memory/${sanitizeAgentType(agentType)}/ dizinine yaz.
+Memory guncelleme zorunlu DEGiL - sadece gercekten yeni ve degerli bilgi varsa kaydet.`;
+    const result = {
+      additionalContext: context
+    };
+    process.stdout.write(JSON.stringify(result));
+  } catch {
+  }
+}
+main();

package/hooks/dist/agent-memory-saver.mjs

@@ -0,0 +1,113 @@
+// src/agent-memory-saver.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync, appendFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+var CLAUDE_HOME = join(homedir(), ".claude");
+var LEARNING_SIGNALS = [
+  /\bfound\b.*\bbug\b/i,
+  /\broot cause\b/i,
+  /\bfixed\b.*\bissue\b/i,
+  /\bpattern\b.*\bdetected\b/i,
+  /\bsecurity\b.*\b(vuln|issue|risk)\b/i,
+  /\bperformance\b.*\b(issue|bottleneck|slow)\b/i,
+  /\barchitectur(e|al)\b.*\b(decision|change|pattern)\b/i,
+  /\bVERDICT:\s*(FAIL|WARN)\b/i,
+  /\bCRITICAL\b/i,
+  /\bbreaking change\b/i,
+  /\bdeprecated\b/i,
+  /\bmigrat(e|ion)\b/i,
+  /\berror.*handl/i,
+  /\brace condition\b/i,
+  /\bmemory leak\b/i
+];
+var SUCCESS_SIGNALS = [
+  /\bVERDICT:\s*PASS\b/i,
+  /\ball tests pass/i,
+  /\bbuild succeed/i,
+  /\bimplemented\b/i,
+  /\brefactored\b/i
+];
+function sanitizeAgentType(agentType) {
+  return agentType.replace(/[:/\\]/g, "-").replace(/\s+/g, "-").toLowerCase();
+}
+function ensureDir(dir) {
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
+function getTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
+}
+function hasLearningSignal(output) {
+  return LEARNING_SIGNALS.some((pattern) => pattern.test(output));
+}
+function hasSuccessSignal(output) {
+  return SUCCESS_SIGNALS.some((pattern) => pattern.test(output));
+}
+function extractKeyInfo(output, maxLen = 500) {
+  const lines = output.split("\n");
+  const keyLines = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (/VERDICT|CRITICAL|WARN|FAIL|ERROR|FOUND|PATTERN|DECISION|BUG|FIX|ROOT CAUSE/i.test(trimmed) || trimmed.startsWith("- ") || trimmed.startsWith("* ") || trimmed.startsWith("##")) {
+      keyLines.push(trimmed);
+    }
+  }
+  let result = keyLines.join("\n");
+  if (result.length > maxLen) {
+    result = result.substring(0, maxLen) + "...";
+  }
+  return result || output.substring(0, maxLen);
+}
+function main() {
+  try {
+    const input = JSON.parse(process.argv[2] || "{}");
+    if (input.tool_name !== "Agent") return;
+    const agentType = input.tool_input?.subagent_type;
+    const output = input.tool_output || "";
+    const description = input.tool_input?.description || "";
+    if (!agentType || !output || output.length < 50) return;
+    const hasLearning = hasLearningSignal(output);
+    const hasSuccess = hasSuccessSignal(output);
+    if (!hasLearning && !hasSuccess) return;
+    const dirName = sanitizeAgentType(agentType);
+    const memoryDir = join(CLAUDE_HOME, "agent-memory", dirName);
+    ensureDir(memoryDir);
+    const timestamp = getTimestamp();
+    const keyInfo = extractKeyInfo(output);
+    if (hasLearning) {
+      const journalPath = join(memoryDir, "learnings.md");
+      const entry = `
+## ${timestamp} - ${description || "Agent task"}
+
+${keyInfo}
+
+---
+`;
+      appendFileSync(journalPath, entry, "utf-8");
+      try {
+        const content = readFileSync(journalPath, "utf-8");
+        if (content.length > 5e4) {
+          const truncated = content.substring(content.length - 4e4);
+          const firstNewline = truncated.indexOf("\n## ");
+          writeFileSync(journalPath, firstNewline > 0 ? truncated.substring(firstNewline) : truncated, "utf-8");
+        }
+      } catch {
+      }
+    }
+    const memoryMdPath = join(memoryDir, "MEMORY.md");
+    if (!existsSync(memoryMdPath)) {
+      const initialContent = `# ${agentType} Agent Memory
+
+Bu dosya ${agentType} agent'inin kalici bellegidir. Otomatik guncellenir.
+
+## Ogrenimler
+- [learnings.md](learnings.md) - Tespit edilen sorunlar, patternler, kararlar
+`;
+      writeFileSync(memoryMdPath, initialContent, "utf-8");
+    }
+  } catch {
+  }
+}
+main();

package/hooks/dist/bash-audit-log.mjs

@@ -0,0 +1,71 @@
+// src/bash-audit-log.ts
+import { readFileSync as readFileSync2, mkdirSync, existsSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+
+// src/shared/log-rotation.ts
+import { statSync, readFileSync, writeFileSync, appendFileSync, renameSync, unlinkSync } from "fs";
+function appendWithRotation(filePath, line, maxBytes = 2 * 1024 * 1024, keepLines = 5e3) {
+  appendFileSync(filePath, line);
+  try {
+    const stats = statSync(filePath);
+    if (stats.size > maxBytes) {
+      const tmpPath = filePath + ".rotating";
+      try {
+        renameSync(filePath, tmpPath);
+        const content = readFileSync(tmpPath, "utf-8");
+        const lines = content.split("\n").filter((l) => l.length > 0);
+        writeFileSync(filePath, lines.slice(-keepLines).join("\n") + "\n");
+        unlinkSync(tmpPath);
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
+
+// src/bash-audit-log.ts
+var WRITE_PATTERNS = [
+  /^(rm|mv|cp|mkdir|rmdir|touch|chmod|chown)\b/,
+  /^git\s+(push|commit|reset|checkout|merge|rebase|stash|clean|branch\s+-[dD])/,
+  /\b(npm|pnpm|yarn)\s+(install|uninstall|publish|run\s+build)/,
+  />(>)?/,
+  // redirect
+  /\bsudo\b/,
+  /\bdocker\s+(rm|stop|kill|exec|run)/
+];
+function isWriteCommand(cmd) {
+  return WRITE_PATTERNS.some((p) => p.test(cmd.trim()));
+}
+function main() {
+  let raw = "";
+  try {
+    raw = readFileSync2(0, "utf-8");
+  } catch {
+    return;
+  }
+  if (!raw) return;
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    console.log("{}");
+    return;
+  }
+  if (input.tool_name !== "Bash" || !input.tool_input?.command) {
+    console.log("{}");
+    return;
+  }
+  const cmd = input.tool_input.command;
+  const tag = isWriteCommand(cmd) ? "[WRITE]" : "[READ]";
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const desc = input.tool_input.description || "";
+  const sessionId = input.session_id?.slice(0, 8) || "unknown";
+  const logDir = join(homedir(), ".claude");
+  if (!existsSync(logDir)) mkdirSync(logDir, { recursive: true });
+  const logLine = `${timestamp} ${tag} [${sessionId}] ${cmd}${desc ? ` # ${desc}` : ""}
+`;
+  appendWithRotation(join(logDir, "bash-audit.log"), logLine);
+  console.log("{}");
+}
+main();

package/hooks/dist/credential-deny.mjs

@@ -0,0 +1,165 @@
+// src/credential-deny.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+var HOME = homedir().replace(/\\/g, "/");
+var DENIED_PATHS = [
+  { pattern: /[/\\]\.ssh[/\\]/, reason: "SSH keys" },
+  { pattern: /[/\\]\.aws[/\\]/, reason: "AWS credentials" },
+  { pattern: /[/\\]\.kube[/\\]/, reason: "Kubernetes config" },
+  { pattern: /[/\\]\.gnupg[/\\]/, reason: "GPG keys" },
+  { pattern: /[/\\]\.npmrc$/, reason: "NPM tokens" },
+  { pattern: /[/\\]\.pypirc$/, reason: "PyPI tokens" },
+  { pattern: /[/\\]\.docker[/\\]config\.json$/, reason: "Docker credentials" },
+  { pattern: /[/\\]\.netrc$/, reason: "Network credentials" },
+  { pattern: /[/\\]credentials\.json$/, reason: "Credential file" },
+  { pattern: /[/\\]service[-_]?account.*\.json$/i, reason: "Service account key" },
+  { pattern: /[/\\]\.env$/, reason: "Environment secrets" },
+  { pattern: /[/\\]\.env\.[\w.]+$/, reason: "Environment secrets" },
+  { pattern: /[/\\]id_rsa$/, reason: "Private SSH key" },
+  { pattern: /[/\\]id_ed25519$/, reason: "Private SSH key" },
+  { pattern: /[/\\]id_ecdsa$/, reason: "Private SSH key" },
+  { pattern: /terraform\.tfstate$/i, reason: "Terraform state (may contain secrets)" },
+  { pattern: /[/\\]\.git[/\\]config$/, reason: "Git config (may contain credential helpers)" },
+  { pattern: /[/\\]\.password-store[/\\]/, reason: "Password store" }
+];
+var SENSITIVE_ENV_VARS = [
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_TOKEN",
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "DATABASE_URL",
+  "DB_PASSWORD",
+  "SECRET_KEY",
+  "PRIVATE_KEY",
+  "NPM_TOKEN",
+  "PYPI_TOKEN"
+];
+var SENSITIVE_KEYWORDS = [
+  { pattern: /\.ssh\b/, reason: "SSH directory reference" },
+  { pattern: /\.aws\b/, reason: "AWS directory reference" },
+  { pattern: /\.kube\b/, reason: "Kubernetes directory reference" },
+  { pattern: /\.gnupg\b/, reason: "GPG directory reference" },
+  { pattern: /\bid_rsa\b/, reason: "SSH private key reference" },
+  { pattern: /\bid_ed25519\b/, reason: "SSH private key reference" },
+  { pattern: /\bid_ecdsa\b/, reason: "SSH private key reference" }
+];
+function checkFilePath(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  for (const deny of DENIED_PATHS) {
+    if (deny.pattern.test(normalized)) {
+      return deny.reason;
+    }
+  }
+  return null;
+}
+function extractPaths(cmd) {
+  const paths = [];
+  let m;
+  const absRegex = /(?:^|\s|[<>=|"'])(~?\/[^\s;|&><"']+)/g;
+  while ((m = absRegex.exec(cmd)) !== null) {
+    let p = m[1].trim();
+    if (p.startsWith("~")) p = HOME + p.slice(1);
+    paths.push(p);
+  }
+  const relRegex = /(?:^|\s)(\.{1,2}\/[^\s;|&><"']+)/g;
+  while ((m = relRegex.exec(cmd)) !== null) {
+    paths.push(m[1]);
+  }
+  const bareRegex = /(?:^|\s)(\.(?:ssh|aws|kube|gnupg|env|npmrc|pypirc|netrc)\b[^\s;|&><"']*)/g;
+  while ((m = bareRegex.exec(cmd)) !== null) {
+    paths.push(m[1]);
+  }
+  const homeVarRegex = /\$(?:HOME|\{HOME\})(\/[^\s;|&><"']+)/g;
+  while ((m = homeVarRegex.exec(cmd)) !== null) {
+    paths.push(HOME + m[1]);
+  }
+  const quotedRegex = /['"](\/?[^'"]*(?:\.ssh|\.aws|\.kube|\.gnupg|\.env|credentials|id_rsa|id_ed25519|\.npmrc|\.pypirc|\.netrc)[^'"]*)['"]/gi;
+  while ((m = quotedRegex.exec(cmd)) !== null) {
+    paths.push(m[1]);
+  }
+  return paths;
+}
+function checkBashCommand(cmd) {
+  if (/^\s*(env|printenv|set)\s*$/.test(cmd) || /^\s*(env|printenv|set)\s*\|/.test(cmd) || /\bexport\s+-p\b/.test(cmd)) {
+    return "Env dump tum secret'lari ifsa eder";
+  }
+  for (const v of SENSITIVE_ENV_VARS) {
+    const escaped = v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (new RegExp(`\\$\\{?${escaped}\\}?`).test(cmd)) {
+      return `Hassas env var erisimi: ${v}`;
+    }
+  }
+  for (const kw of SENSITIVE_KEYWORDS) {
+    if (kw.pattern.test(cmd)) {
+      return `${kw.reason} (bash komutu ile)`;
+    }
+  }
+  const paths = extractPaths(cmd);
+  for (const p of paths) {
+    const reason = checkFilePath(p);
+    if (reason) return `${reason} (bash komutu ile)`;
+  }
+  return null;
+}
+function block(reason) {
+  console.log(JSON.stringify({
+    decision: "block",
+    reason: `ENGELLENDI: ${reason}. Guvenlik kurali.`
+  }));
+}
+function main() {
+  let raw = "";
+  try {
+    raw = readFileSync(0, "utf-8");
+  } catch {
+    return;
+  }
+  if (!raw) {
+    console.log("{}");
+    return;
+  }
+  let input;
+  try {
+    input = JSON.parse(raw);
+  } catch {
+    block("Malformed hook input - fail closed");
+    return;
+  }
+  if (["Read", "Edit", "Write"].includes(input.tool_name) && input.tool_input?.file_path) {
+    const reason = checkFilePath(input.tool_input.file_path);
+    if (reason) {
+      block(`${reason} dosyasina erisim yasak`);
+      return;
+    }
+  }
+  if (input.tool_name === "Bash" && input.tool_input?.command) {
+    const reason = checkBashCommand(input.tool_input.command);
+    if (reason) {
+      block(reason);
+      return;
+    }
+  }
+  if (input.tool_name === "Grep" && input.tool_input?.path) {
+    const searchPath = input.tool_input.path;
+    const reason = checkFilePath(searchPath + "/") || checkFilePath(searchPath);
+    if (reason) {
+      block(`${reason} - Grep ile erisim yasak`);
+      return;
+    }
+  }
+  if (input.tool_name === "Glob") {
+    const globPath = input.tool_input?.path || "";
+    const globPattern = input.tool_input?.pattern || "";
+    const fullPath = globPath ? `${globPath}/${globPattern}` : globPattern;
+    const reason = checkFilePath(fullPath + "/") || checkFilePath(fullPath);
+    if (reason) {
+      block(`${reason} - Glob ile erisim yasak`);
+      return;
+    }
+  }
+  console.log("{}");
+}
+main();