ralph-cli-sandboxed 0.6.6 → 0.7.1

package/LICENSE

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2024 Lars Gregori
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -518,9 +518,10 @@ ralph docker run
 
 Features:
 - Based on [Claude Code devcontainer](https://github.com/anthropics/claude-code/tree/main/.devcontainer)
-- Network sandboxing (firewall allows only GitHub, npm, Anthropic API)
+- Network sandboxing (firewall allows only GitHub, npm, Anthropic API, plus language-specific domains — e.g., `deno.land`, `jsr.io`, `esm.sh` for Deno projects)
 - Your `~/.claude` credentials mounted automatically (Pro/Max OAuth)
 - Language-specific tooling pre-installed
+- Language-specific Claude Code hooks (e.g., Deno projects auto-install a `PreToolUse` hook that blocks `npm`/`npx`/`yarn`/`pnpm` commands)
 
 See [docs/DOCKER.md](docs/DOCKER.md) for detailed Docker configuration, customization, and troubleshooting.
 
@@ -554,6 +555,25 @@ Responders handle messages and can answer questions about your codebase:
 
 See [docs/CHAT-CLIENTS.md](docs/CHAT-CLIENTS.md) for chat platform setup and [docs/CHAT-RESPONDERS.md](docs/CHAT-RESPONDERS.md) for responder configuration.
 
+## MCP Server
+
+Ralph provides an [MCP (Model Context Protocol)](https://modelcontextprotocol.io/) server that exposes PRD management as tools for AI assistants. This lets MCP-compatible clients like Claude Code list, add, toggle, and check the status of PRD entries directly through tool calls.
+
+Add to your `.mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "ralph": {
+      "command": "ralph-mcp",
+      "args": []
+    }
+  }
+}
+```
+
+See [docs/MCP.md](docs/MCP.md) for available tools, parameters, return values, and example conversations.
+
 ## How It Works
 
 1. **Read PRD**: Claude reads your requirements from `prd.json`
@@ -594,4 +614,4 @@ See [docs/DEVELOPMENT.md](docs/DEVELOPMENT.md) for detailed development setup, p
 
 ## License
 
-MIT
+Apache-2.0 — see [LICENSE](LICENSE) for details.

package/dist/commands/ask.d.ts

@@ -0,0 +1,6 @@
+/**
+ * ralph ask <preset> <message...>
+ *
+ * Run a responder preset from the CLI and print the result to stdout.
+ */
+export declare function ask(args: string[]): Promise<void>;

package/dist/commands/ask.js

@@ -0,0 +1,140 @@
+import { loadConfig } from "../utils/config.js";
+import { loadResponderPresets, presetToResponderConfig } from "../utils/responder-presets.js";
+import { executeLLMResponder } from "../responders/llm-responder.js";
+import { executeClaudeCodeResponder } from "../responders/claude-code-responder.js";
+import { executeCLIResponder } from "../responders/cli-responder.js";
+/**
+ * Large maxLength override for CLI usage — users want the full response.
+ */
+const CLI_MAX_LENGTH = 100_000;
+/**
+ * ralph ask <preset> <message...>
+ *
+ * Run a responder preset from the CLI and print the result to stdout.
+ */
+export async function ask(args) {
+    // Handle flags before positional args
+    if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+        showHelp();
+        return;
+    }
+    if (args[0] === "--list" || args[0] === "-l") {
+        listPresets();
+        return;
+    }
+    const name = args[0];
+    const message = args.slice(1).join(" ");
+    if (!message) {
+        console.error(`Error: No message provided.`);
+        console.error(`Usage: ralph ask <preset> <message...>`);
+        process.exit(1);
+    }
+    // Resolve responder config: config responders first, then built-in presets
+    const { responderConfig } = resolveResponder(name);
+    if (!responderConfig) {
+        console.error(`Error: Unknown responder "${name}".`);
+        console.error(`Run 'ralph ask --list' to see available presets.`);
+        process.exit(1);
+    }
+    // Override maxLength for CLI (no truncation)
+    const config = { ...responderConfig, maxLength: CLI_MAX_LENGTH };
+    // Execute based on type
+    const result = await executeResponder(config, message);
+    if (!result.success) {
+        console.error(`Error: ${result.error}`);
+        process.exit(1);
+    }
+    console.log(result.response);
+}
+function resolveResponder(name) {
+    // 1. Check config responders first (user overrides)
+    try {
+        const ralphConfig = loadConfig();
+        const responders = ralphConfig.chat?.responders;
+        if (responders && responders[name]) {
+            return { responderConfig: responders[name], source: "config" };
+        }
+    }
+    catch {
+        // Config not loaded — fall through to presets
+    }
+    // 2. Check built-in presets
+    const presetsConfig = loadResponderPresets();
+    const preset = presetsConfig.presets[name];
+    if (preset) {
+        return { responderConfig: presetToResponderConfig(preset), source: "preset" };
+    }
+    return { responderConfig: null, source: "preset" };
+}
+async function executeResponder(config, message) {
+    switch (config.type) {
+        case "llm":
+            return executeLLMResponder(message, config, undefined, {
+                responderName: "ask",
+            });
+        case "claude-code":
+            return executeClaudeCodeResponder(message, config, {
+                maxLength: config.maxLength,
+            });
+        case "cli":
+            return executeCLIResponder(message, config, {
+                maxLength: config.maxLength,
+            });
+        default:
+            return {
+                success: false,
+                response: "",
+                error: `Unsupported responder type: ${config.type}`,
+            };
+    }
+}
+function listPresets() {
+    const presetsConfig = loadResponderPresets();
+    console.log("Built-in presets:");
+    for (const [id, preset] of Object.entries(presetsConfig.presets)) {
+        console.log(`  ${id.padEnd(12)} ${preset.type.padEnd(14)} ${preset.description}`);
+    }
+    // Show config responders if available
+    try {
+        const ralphConfig = loadConfig();
+        const responders = ralphConfig.chat?.responders;
+        if (responders && Object.keys(responders).length > 0) {
+            console.log("\nConfigured responders:");
+            for (const [name, cfg] of Object.entries(responders)) {
+                console.log(`  ${name.padEnd(12)} ${cfg.type.padEnd(14)} (from config.json)`);
+            }
+        }
+    }
+    catch {
+        // No config — skip
+    }
+}
+function showHelp() {
+    console.log(`
+ralph ask - Run a responder preset from the CLI
+
+USAGE:
+  ralph ask <preset> <message...>
+  ralph ask --list
+  ralph ask --help
+
+OPTIONS:
+  -l, --list    List available presets and configured responders
+  -h, --help    Show this help message
+
+DESCRIPTION:
+  Runs a responder preset (or custom responder from config) and prints
+  the result to stdout. This lets you use responder presets without
+  needing a chat provider set up.
+
+  Lookup priority: config responders first, then built-in presets.
+
+EXAMPLES:
+  ralph ask qa "What does the config loader do?"
+  ralph ask reviewer diff
+  ralph ask architect "Should we split this into microservices?"
+  ralph ask explain src/utils/config.ts
+  ralph ask code "Add a --verbose flag to the run command"
+  ralph ask --list
+`.trimEnd());
+}

package/dist/commands/branch.js

@@ -163,7 +163,13 @@ async function branchMerge(args) {
             const status = execSync("git status --porcelain", { encoding: "utf-8" });
             conflictingFiles = status
                 .split("\n")
-                .filter((line) => line.startsWith("UU") || line.startsWith("AA") || line.startsWith("DD") || line.startsWith("AU") || line.startsWith("UA") || line.startsWith("DU") || line.startsWith("UD"))
+                .filter((line) => line.startsWith("UU") ||
+                line.startsWith("AA") ||
+                line.startsWith("DD") ||
+                line.startsWith("AU") ||
+                line.startsWith("UA") ||
+                line.startsWith("DU") ||
+                line.startsWith("UD"))
                 .map((line) => line.substring(3).trim());
         }
         catch {
@@ -358,9 +364,7 @@ async function branchDelete(args) {
     const hasWorktree = existsSync(worktreePath);
     // Load PRD to check for tagged items
     const result = loadPrdEntries();
-    const taggedCount = result
-        ? result.entries.filter((e) => e.branch === branchName).length
-        : 0;
+    const taggedCount = result ? result.entries.filter((e) => e.branch === branchName).length : 0;
     console.log(`Branch: ${branchName}`);
     if (hasWorktree) {
         console.log(`Worktree: ${worktreePath}`);

package/dist/commands/chat.js

@@ -7,7 +7,7 @@ import { join, basename, extname } from "path";
 import { execSync, spawn } from "child_process";
 import YAML from "yaml";
 import { robustYamlParse } from "../utils/prd-validator.js";
-import { loadConfig, getRalphDir, isRunningInContainer, getPrdFiles, loadBranchState, getProjectName as getConfigProjectName } from "../utils/config.js";
+import { loadConfig, getRalphDir, isRunningInContainer, getPrdFiles, loadBranchState, getProjectName as getConfigProjectName, } from "../utils/config.js";
 import { createTelegramClient } from "../providers/telegram.js";
 import { createSlackClient } from "../providers/slack.js";
 import { createDiscordClient } from "../providers/discord.js";
@@ -259,9 +259,7 @@ async function handleBranchList(chatId, client, state) {
 async function handleBranchPr(args, chatId, client, state) {
     const branchName = args[0];
     if (!branchName) {
-        const usage = client.provider === "slack"
-            ? "/ralph branch pr <branch-name>"
-            : "/branch pr <branch-name>";
+        const usage = client.provider === "slack" ? "/ralph branch pr <branch-name>" : "/branch pr <branch-name>";
         await client.sendMessage(chatId, `${state.projectName}: Usage: ${usage}`);
         return;
     }
@@ -288,7 +286,9 @@ async function handleBranchPr(args, chatId, client, state) {
     // Verify a git remote exists
     let remote;
     try {
-        remote = execSync("git remote", { encoding: "utf-8", cwd: process.cwd() }).trim().split("\n")[0];
+        remote = execSync("git remote", { encoding: "utf-8", cwd: process.cwd() })
+            .trim()
+            .split("\n")[0];
         if (!remote)
             throw new Error("no remote");
     }
@@ -391,8 +391,12 @@ async function handleBranchMerge(args, chatId, client, state) {
             const status = execSync("git status --porcelain", { encoding: "utf-8", cwd });
             conflictingFiles = status
                 .split("\n")
-                .filter((line) => line.startsWith("UU") || line.startsWith("AA") || line.startsWith("DD") ||
-                line.startsWith("AU") || line.startsWith("UA") || line.startsWith("DU") ||
+                .filter((line) => line.startsWith("UU") ||
+                line.startsWith("AA") ||
+                line.startsWith("DD") ||
+                line.startsWith("AU") ||
+                line.startsWith("UA") ||
+                line.startsWith("DU") ||
                 line.startsWith("UD"))
                 .map((line) => line.substring(3).trim());
         }
@@ -742,7 +746,6 @@ async function handleCommand(command, client, config, state, debug) {
                 await client.sendMessage(chatId, `${state.projectName}: Usage: ${usage}`);
                 return;
             }
-            const prompt = args.join(" ");
             await client.sendMessage(chatId, `⏳ ${state.projectName}: Running Claude Code...\n(this may take a few minutes)`);
             // Send claude command to sandbox with longer timeout (5 minutes)
             const response = await sendToSandbox("claude", args, debug, 300000);

package/dist/commands/docker.js

@@ -1,5 +1,5 @@
 import { existsSync, writeFileSync, readFileSync, mkdirSync, chmodSync, openSync } from "fs";
-import { join, basename } from "path";
+import { join, basename, normalize } from "path";
 import { spawn } from "child_process";
 import { createHash } from "crypto";
 import { loadConfig, getRalphDir, } from "../utils/config.js";
@@ -373,6 +373,21 @@ function generateDockerCompose(imageName, dockerConfig) {
         baseVolumes.push("      # Mount host worktrees directory for git worktree storage");
         baseVolumes.push(`      - ${dockerConfig.worktreesPath}:/worktrees`);
     }
+    // Mount env file if configured (read-only)
+    // Validate envFile to prevent path traversal outside the project root
+    let sanitizedEnvFile;
+    if (dockerConfig?.envFile) {
+        const normalized = normalize(dockerConfig.envFile);
+        if (normalized.startsWith("/") ||
+            normalized.startsWith("..") ||
+            normalized.includes("/../") ||
+            normalized.includes("\\")) {
+            throw new Error(`Invalid envFile path "${dockerConfig.envFile}": must be a relative path within the project root (no "..", absolute paths, or backslashes).`);
+        }
+        sanitizedEnvFile = normalized;
+        baseVolumes.push("      # Mount env file into container");
+        baseVolumes.push(`      - ../../${sanitizedEnvFile}:/workspace/${sanitizedEnvFile}:ro`);
+    }
     if (dockerConfig?.volumes && dockerConfig.volumes.length > 0) {
         const customVolumeLines = dockerConfig.volumes.map((vol) => `      - ${vol}`);
         baseVolumes.push(...customVolumeLines);
@@ -444,7 +459,7 @@ services:
       dockerfile: Dockerfile
 ${portsSection}    volumes:
 ${volumesSection}
-${environmentSection}    working_dir: /workspace
+${environmentSection}${sanitizedEnvFile ? `    env_file:\n      - ../../${sanitizedEnvFile}\n` : ""}    working_dir: /workspace
     stdin_open: true
     tty: true
     cap_add:
@@ -530,7 +545,7 @@ claude \\
   --output-format stream-json \\
   --verbose \\
   --print \\
-  "\$@" 2>&1 \\
+  "$@" 2>&1 \\
 | grep --line-buffered '^{' \\
 | eval $TEE_CMD \\
 | jq --unbuffered -rj "$JQ_FILTER"
@@ -642,22 +657,70 @@ else
 fi
 `;
 }
+// Generate block-npm-commands.sh hook script for Deno projects
+function generateBlockNpmCommandsHook() {
+    return `#!/bin/bash
+# Claude Code PreToolUse hook: blocks npm/npx/yarn/pnpm commands in Deno projects
+# Generated by ralph-cli
+#
+# This project uses Deno. npm/npx/yarn/pnpm should not be used for
+# package management or script execution. Use deno commands instead.
+
+set -e
+
+# Read the command from hook JSON input on stdin
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+if [ -z "$COMMAND" ]; then
+  exit 0
+fi
+
+# Match package-manager invocations at shell-command boundaries.
+# Examples matched: npm test, cd app && pnpm install
+# Examples ignored: grep "npm test" README.md
+if echo "$COMMAND" | grep -qE '(^|[;&|][&|]?[[:space:]]*)(npm|npx|yarn|pnpm)([[:space:]]|$)'; then
+  jq -n --arg reason "Blocked: This is a Deno project. Use 'deno' commands instead of npm/npx/yarn/pnpm. Examples: 'deno task' instead of 'npm run', 'deno test' instead of 'npm test', 'deno add' or import maps instead of 'npm install'." '{
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: $reason
+    }
+  }'
+else
+  exit 0
+fi
+`;
+}
 // Generate .claude/settings.json with hooks configuration
-function generateClaudeSettings() {
-    const settings = {
-        hooks: {
-            PreToolUse: [
+function generateClaudeSettings(language) {
+    const hooks = [
+        {
+            matcher: "Bash",
+            hooks: [
                 {
-                    matcher: "Bash",
-                    hooks: [
-                        {
-                            type: "command",
-                            command: "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-commands.sh",
-                        },
-                    ],
+                    type: "command",
+                    command: '"$CLAUDE_PROJECT_DIR"/.claude/hooks/block-dangerous-commands.sh',
                 },
             ],
         },
+    ];
+    // Add Deno-specific hook to block npm commands
+    if (language === "deno") {
+        hooks.push({
+            matcher: "Bash",
+            hooks: [
+                {
+                    type: "command",
+                    command: '"$CLAUDE_PROJECT_DIR"/.claude/hooks/block-npm-commands.sh',
+                },
+            ],
+        });
+    }
+    const settings = {
+        hooks: {
+            PreToolUse: hooks,
+        },
     };
     return JSON.stringify(settings, null, 2) + "\n";
 }
@@ -668,13 +731,17 @@ async function generateFiles(ralphDir, language, imageName, force = false, javaV
         mkdirSync(dockerDir, { recursive: true });
         console.log(`Created ${DOCKER_DIR}/`);
     }
+    // Merge custom firewall domains with language-specific domains
     const customDomains = dockerConfig?.firewall?.allowedDomains || [];
+    const languagesJson = getLanguagesJson();
+    const langFirewallDomains = languagesJson.languages[language]?.docker?.firewallDomains || [];
+    const allFirewallDomains = [...new Set([...customDomains, ...langFirewallDomains])];
     const files = [
         {
             name: "Dockerfile",
             content: generateDockerfile(language, javaVersion, cliProvider, dockerConfig, cliModel),
         },
-        { name: "init-firewall.sh", content: generateFirewallScript(customDomains) },
+        { name: "init-firewall.sh", content: generateFirewallScript(allFirewallDomains) },
         { name: "docker-compose.yml", content: generateDockerCompose(imageName, dockerConfig) },
         { name: ".dockerignore", content: DOCKERIGNORE },
     ];
@@ -779,12 +846,32 @@ async function generateFiles(ralphDir, language, imageName, force = false, javaV
         chmodSync(hookScriptPath, 0o755);
         console.log("Created .claude/hooks/block-dangerous-commands.sh");
     }
+    // Generate Deno-specific hook to block npm commands
+    if (language === "deno") {
+        const npmHookPath = join(hooksDir, "block-npm-commands.sh");
+        if (existsSync(npmHookPath) && !force) {
+            const overwrite = await promptConfirm(".claude/hooks/block-npm-commands.sh already exists. Overwrite?");
+            if (overwrite) {
+                writeFileSync(npmHookPath, generateBlockNpmCommandsHook());
+                chmodSync(npmHookPath, 0o755);
+                console.log("Created .claude/hooks/block-npm-commands.sh");
+            }
+            else {
+                console.log("Skipped .claude/hooks/block-npm-commands.sh");
+            }
+        }
+        else {
+            writeFileSync(npmHookPath, generateBlockNpmCommandsHook());
+            chmodSync(npmHookPath, 0o755);
+            console.log("Created .claude/hooks/block-npm-commands.sh");
+        }
+    }
     // Generate .claude/settings.json with hooks configuration
     const settingsPath = join(projectRoot, ".claude", "settings.json");
     if (existsSync(settingsPath) && !force) {
         const overwrite = await promptConfirm(".claude/settings.json already exists. Overwrite?");
         if (overwrite) {
-            writeFileSync(settingsPath, generateClaudeSettings());
+            writeFileSync(settingsPath, generateClaudeSettings(language));
             console.log("Created .claude/settings.json");
         }
         else {
@@ -792,7 +879,7 @@ async function generateFiles(ralphDir, language, imageName, force = false, javaV
         }
     }
     else {
-        writeFileSync(settingsPath, generateClaudeSettings());
+        writeFileSync(settingsPath, generateClaudeSettings(language));
         console.log("Created .claude/settings.json");
     }
     // Save config hash for change detection