specpipe 1.0.0

package/templates/.claude/hooks/file-guard.js

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+// file-guard.js — PostToolUse hook for Claude Code
+//
+// Warns when a Write/Edit operation produces a source code file exceeding a line threshold.
+// Only checks source code files — docs (.md), configs (.json/.yaml/.toml), and templates
+// are intentionally excluded since they are naturally long.
+// Non-blocking: always exits 0 and injects advisory context.
+//
+// Environment:
+//   FILE_GUARD_THRESHOLD  — max lines before warning (default: 350)
+//   FILE_GUARD_EXCLUDE    — comma-separated globs to skip (e.g. "*.generated.swift,*.pb.go")
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+const THRESHOLD = parseInt(process.env.FILE_GUARD_THRESHOLD, 10) || 350;
+
+// Only warn for source code files — docs, configs, and templates are naturally long
+const SOURCE_EXTENSIONS = new Set([
+  // JavaScript / TypeScript
+  ".js", ".mjs", ".cjs", ".jsx",
+  ".ts", ".tsx", ".mts", ".cts",
+  // Frontend frameworks
+  ".vue", ".svelte", ".astro",
+  // Python
+  ".py", ".pyw", ".pyi", ".pyx", ".pxd",
+  // PHP
+  ".php", ".php3", ".php4", ".php5", ".php7", ".php8", ".phtml",
+  // Ruby
+  ".rb", ".rbw",
+  // Rust
+  ".rs",
+  // Go
+  ".go",
+  // Swift
+  ".swift",
+  // Kotlin
+  ".kt", ".kts",
+  // Java
+  ".java",
+  // C#
+  ".cs", ".csx",
+  // C / C++
+  ".c", ".h", ".cc", ".cpp", ".cxx", ".c++", ".hpp", ".hh", ".hxx", ".h++",
+  // Objective-C
+  ".m", ".mm",
+  // Dart
+  ".dart",
+  // Elixir
+  ".ex", ".exs",
+  // Scala
+  ".scala", ".sc",
+  // Groovy
+  ".groovy",
+  // Clojure
+  ".clj", ".cljs", ".cljc",
+  // Haskell
+  ".hs", ".lhs",
+  // F#
+  ".fs", ".fsx", ".fsi",
+  // OCaml
+  ".ml", ".mli", ".mll", ".mly",
+  // Erlang
+  ".erl", ".hrl",
+  // Lua
+  ".lua",
+  // R
+  ".r",
+  // Julia
+  ".jl",
+  // Nim
+  ".nim", ".nims",
+  // Zig
+  ".zig",
+  // Crystal
+  ".cr",
+  // Perl
+  ".pl", ".pm",
+  // Solidity
+  ".sol",
+  // PowerShell
+  ".ps1", ".psm1", ".psd1",
+  // PureScript
+  ".purs",
+  // Elm
+  ".elm",
+  // ReScript / ReasonML
+  ".res", ".resi",
+  // Lisp / Scheme / Racket
+  ".lisp", ".lsp", ".cl", ".el", ".scm", ".ss", ".rkt",
+  // Prolog
+  ".pro",
+  // Fortran
+  ".f", ".f90", ".f95", ".f03", ".f08",
+  // Pascal / Delphi
+  ".pas", ".pp",
+  // VB.NET
+  ".vb",
+  // Arduino
+  ".ino",
+]);
+
+const EXCLUDE = (process.env.FILE_GUARD_EXCLUDE || "")
+  .split(",")
+  .map((g) => g.trim())
+  .filter(Boolean);
+
+function matchesExclude(filePath) {
+  const name = path.basename(filePath);
+  return EXCLUDE.some((pattern) => {
+    // Simple glob: *.ext or exact match
+    if (pattern.startsWith("*")) {
+      return name.endsWith(pattern.slice(1));
+    }
+    return name === pattern;
+  });
+}
+
+function isBinary(buf) {
+  // Check first 512 bytes for null bytes (common binary indicator)
+  const check = buf.slice(0, 512);
+  for (let i = 0; i < check.length; i++) {
+    if (check[i] === 0) return true;
+  }
+  return false;
+}
+
+function main() {
+  let input;
+  try {
+    input = fs.readFileSync(0, "utf-8").trim();
+  } catch {
+    process.exit(0);
+  }
+
+  if (!input) process.exit(0);
+
+  let payload;
+  try {
+    payload = JSON.parse(input);
+  } catch {
+    process.exit(0);
+  }
+
+  const filePath = payload.tool_input?.file_path;
+  if (!filePath) process.exit(0);
+
+  // Skip files outside the project directory (e.g. ~/.claude/plans/)
+  const projectDir = process.cwd() + path.sep;
+  const resolvedFile = path.resolve(filePath);
+  if (!resolvedFile.startsWith(projectDir) && resolvedFile !== process.cwd()) process.exit(0);
+
+  // Skip non-source-code files (docs, configs, templates are naturally long)
+  const ext = path.extname(filePath).toLowerCase();
+  if (!SOURCE_EXTENSIONS.has(ext)) process.exit(0);
+
+  // Skip excluded patterns
+  if (matchesExclude(filePath)) process.exit(0);
+
+  // Skip if file doesn't exist (deleted?) or is a symlink to outside project
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (stat.isSymbolicLink() || !stat.isFile()) process.exit(0);
+  } catch {
+    process.exit(0);
+  }
+
+  // Cap read at 1MB to avoid OOM on huge files
+  const MAX_BYTES = 1024 * 1024;
+  let content;
+  try {
+    const stat = fs.statSync(filePath);
+    if (stat.size > MAX_BYTES) {
+      const rel = path.relative(process.cwd(), filePath);
+      process.stdout.write(JSON.stringify({
+        continue: true,
+        hookSpecificOutput: {
+          hookEventName: "PostToolUse",
+          additionalContext: `Warning: ${rel} is ${Math.round(stat.size / 1024)}KB. Consider splitting into smaller modules.`,
+        },
+      }) + "\n");
+      process.exit(0);
+    }
+    const buf = fs.readFileSync(filePath);
+    if (isBinary(buf)) process.exit(0);
+    content = buf.toString("utf-8");
+  } catch {
+    process.exit(0);
+  }
+
+  const lineCount = content.split("\n").length;
+  if (lineCount <= THRESHOLD) process.exit(0);
+
+  // Inject non-blocking warning
+  const rel = path.relative(process.cwd(), filePath);
+  const warning = `Warning: ${rel} has ${lineCount} lines (threshold: ${THRESHOLD}). Consider splitting into smaller, focused modules.`;
+
+  process.stdout.write(
+    JSON.stringify({
+      continue: true,
+      hookSpecificOutput: {
+        hookEventName: "PostToolUse",
+        additionalContext: warning,
+      },
+    }) + "\n"
+  );
+}
+
+try {
+  main();
+} catch {
+  // Never block on error
+}
+process.exit(0);

package/templates/.claude/hooks/glob-guard.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+// glob-guard.js — PreToolUse hook for Claude Code
+//
+// Blocks overly broad glob patterns (e.g. **/*.ts at project root) that would
+// return thousands of files and fill the context window. Suggests scoped
+// alternatives instead.
+//
+// Blocking: Yes — exits 2 when a broad pattern at a high-level path is detected.
+// Event: PreToolUse on Glob
+
+"use strict";
+
+const fs = require("fs");
+
+// Patterns that match too many files when run at project root
+const BROAD_PATTERNS = [
+  /^\*\*$/,                   // **
+  /^\*$/,                     // *
+  /^\*\*\/\*$/,               // **/*
+  /^\*\.\w+$/,                // *.ts, *.js
+  /^\*\.\{[^}]+\}$/,          // *.{ts,js}
+  /^\*\*\/\*\.\w+$/,          // **/*.ts
+  /^\*\*\/\*\.\{[^}]+\}$/,    // **/*.{ts,tsx}
+  /^\*\*\/\.\*$/,             // **/.* (all dotfiles)
+];
+
+// Directories that indicate an intentional, scoped search
+const SCOPED_DIRS = [
+  "src", "lib", "app", "apps", "packages", "components", "pages",
+  "api", "server", "client", "web", "mobile", "shared", "common",
+  "utils", "helpers", "services", "hooks", "store", "routes",
+  "models", "controllers", "views", "tests", "__tests__", "spec",
+  "Sources", "Tests", "cmd", "pkg", "internal",
+];
+
+// Allow project-specific scoped dirs via env var
+// e.g. GLOB_GUARD_SCOPED_DIRS=Feature,Domain,Presentation
+const extraDirs = (process.env.GLOB_GUARD_SCOPED_DIRS || "")
+  .split(",")
+  .map((d) => d.trim())
+  .filter(Boolean);
+if (extraDirs.length > 0) SCOPED_DIRS.push(...extraDirs);
+
+function isBroadPattern(pattern) {
+  if (!pattern) return false;
+  return BROAD_PATTERNS.some((re) => re.test(pattern.trim()));
+}
+
+function startsWithScopedDir(pattern) {
+  if (!pattern) return false;
+  // Only allow dirs explicitly in SCOPED_DIRS — not arbitrary dirs like node_modules/
+  return SCOPED_DIRS.some(
+    (d) => pattern.startsWith(d + "/") || pattern.startsWith("./" + d + "/")
+  );
+}
+
+function isRootLevel(basePath) {
+  if (!basePath) return true;
+  const norm = basePath.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!norm || norm === ".") return true;
+  const segments = norm.split("/").filter((s) => s && s !== ".");
+  if (segments.length === 0) return true;
+  if (segments.length === 1 && !SCOPED_DIRS.includes(segments[0])) return true;
+  return false;
+}
+
+function suggest(pattern) {
+  let ext = "";
+  const m = pattern.match(/\*\.(\{[^}]+\}|\w+)$/);
+  if (m) ext = m[1];
+  const dirs = ["src", "lib", "app", "tests"];
+  return ext
+    ? dirs.map((d) => `${d}/**/*.${ext}`).slice(0, 3)
+    : dirs.map((d) => `${d}/**/*`).slice(0, 3);
+}
+
+function main() {
+  let input;
+  try { input = fs.readFileSync(0, "utf-8").trim(); } catch { process.exit(0); }
+  if (!input) process.exit(0);
+
+  let payload;
+  try { payload = JSON.parse(input); } catch { process.exit(0); }
+
+  const pattern = payload.tool_input?.pattern;
+  const basePath = payload.tool_input?.path;
+
+  if (!pattern) process.exit(0);
+  if (startsWithScopedDir(pattern)) process.exit(0);
+  if (!isBroadPattern(pattern)) process.exit(0);
+  if (!isRootLevel(basePath)) process.exit(0);
+
+  const alt = suggest(pattern);
+  process.stderr.write(
+    [
+      `Blocked: '${pattern}' is too broad for ${basePath || "project root"} — would fill the context window.`,
+      "Use a scoped pattern instead:",
+      ...alt.map((s) => `  - ${s}`),
+    ].join("\n") + "\n"
+  );
+  process.exit(2);
+}
+
+try { main(); } catch { process.exit(0); }

package/templates/.claude/hooks/path-guard.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# path-guard.sh — PreToolUse hook for Claude Code
+#
+# Blocks Bash commands that target directories known to be large and wasteful
+# to explore (node_modules, build artifacts, .git internals, etc.).
+#
+# Exit codes:
+#   0 — command allowed
+#   2 — command blocked (policy)
+#
+# Environment:
+#   PATH_GUARD_EXTRA — additional pipe-separated patterns to block
+#                      e.g. "\.terraform|\.vagrant"
+
+set -euo pipefail
+
+# Windows note: this hook requires bash (WSL or Git Bash).
+# On Windows without bash, Claude Code will fail to run this hook and skip it silently.
+# Install WSL or Git Bash and ensure `bash` is in PATH to activate protection.
+
+# ─── Read hook payload from stdin ───────────────────────────────────
+
+INPUT=$(cat)
+[[ -z "$INPUT" ]] && exit 0
+
+# Extract command from JSON — try node first, fall back to grep/sed
+extract_command() {
+    if command -v node &>/dev/null; then
+        printf '%s' "$1" | node -e "
+          try {
+            const d = JSON.parse(require('fs').readFileSync(0, 'utf-8'));
+            const cmd = d.tool_input?.command;
+            if (typeof cmd === 'string') process.stdout.write(cmd);
+          } catch {}
+        " 2>/dev/null
+    else
+        # Lightweight fallback: extract "command":"..." from JSON
+        printf '%s' "$1" | grep -o '"command":"[^"]*"' | head -1 | sed 's/^"command":"//;s/"$//' 2>/dev/null
+    fi
+}
+
+COMMAND=$(extract_command "$INPUT") || exit 0
+
+[[ -z "$COMMAND" ]] && exit 0
+
+# ─── Blocked directory patterns ─────────────────────────────────────
+
+# Use explicit path separators to avoid substring false positives.
+# [/\\] matches both forward slash (Unix/macOS) and backslash (Windows Git Bash).
+# e.g. "build/" should not match "rebuild/src" or "my-build-tool"
+SEP="[/\\\\]"
+BLOCKED="(^|[ /\\\\])node_modules(${SEP}|$| )"
+BLOCKED+="|(__pycache__)"
+BLOCKED+="|\.git${SEP}(objects|refs)"
+BLOCKED+="|(^|[ /\\\\])dist${SEP}"
+BLOCKED+="|(^|[ /\\\\])build${SEP}"
+BLOCKED+="|\.next${SEP}"
+BLOCKED+="|(^|[ /\\\\])vendor(${SEP}|$| )"
+BLOCKED+="|(^|[ /\\\\])Pods(${SEP}|$| )"
+BLOCKED+="|\.build${SEP}"
+BLOCKED+="|DerivedData"
+BLOCKED+="|\.gradle${SEP}"
+BLOCKED+="|(^|[ /\\\\])target${SEP}"
+BLOCKED+="|\.nuget"
+BLOCKED+="|\.cache(${SEP}|$| )"
+# Python
+BLOCKED+="|(^|[ /\\\\])\.venv${SEP}"
+BLOCKED+="|(^|[ /\\\\])venv${SEP}"
+BLOCKED+="|\.mypy_cache${SEP}"
+BLOCKED+="|\.pytest_cache${SEP}"
+BLOCKED+="|\.ruff_cache${SEP}"
+BLOCKED+="|\.egg-info(${SEP}|$| )"
+# C# .NET (match .NET-specific subdirs to avoid false positives on generic bin/)
+BLOCKED+="|(^|[ /\\\\])bin${SEP}(Debug|Release|net|x64|x86)"
+BLOCKED+="|(^|[ /\\\\])obj${SEP}(Debug|Release|net)"
+# Node.js frameworks
+BLOCKED+="|\.nuxt${SEP}"
+BLOCKED+="|\.svelte-kit${SEP}"
+BLOCKED+="|\.parcel-cache${SEP}"
+BLOCKED+="|\.turbo${SEP}"
+BLOCKED+="|(^|[ /\\\\])out${SEP}(server|static|_next)"
+# Ruby
+BLOCKED+="|\.bundle${SEP}"
+
+# Append project-specific patterns from env
+if [[ -n "${PATH_GUARD_EXTRA:-}" ]]; then
+    BLOCKED+="|$PATH_GUARD_EXTRA"
+fi
+
+# ─── Exploration-verb pre-check ─────────────────────────────────────
+# Only apply blocked-path rules when the command contains a file-reading
+# or directory-listing verb. This avoids false positives for commands that
+# merely REFERENCE a path through a blocked directory without exploring it
+# (e.g. variable assignments, [ -x "$B" ] binary existence checks, or
+# running a compiled binary whose path happens to include /dist/).
+#
+# Verbs that indicate directory/file exploration:
+EXPLORE_VERB_RE="(^|[[:space:]|;&\`(])(ls|ll|la|find|cat|head|tail|less|more|wc|stat|du|tree|bat|od|xxd|hexdump|nl)([[:space:]]|$)"
+
+if ! printf '%s\n' "$COMMAND" | grep -qE "$EXPLORE_VERB_RE"; then
+    exit 0
+fi
+
+# ─── Match and block ────────────────────────────────────────────────
+
+# Strip node_modules/.bin/<binary> references before checking blocked paths.
+# Executing an installed binary (e.g. node_modules/.bin/playwright) is not
+# directory exploration — only the binary itself is referenced, not the tree.
+COMMAND_FOR_CHECK=$(printf '%s\n' "$COMMAND" | sed -E "s|node_modules[/\\]\.bin[/\\][^[:space:]]*||g")
+
+if printf '%s\n' "$COMMAND_FOR_CHECK" | grep -qE "$BLOCKED"; then
+    # Extract which pattern matched for a useful error message
+    MATCHED=$(printf '%s\n' "$COMMAND" | grep -oE "$BLOCKED" | head -1)
+    echo "Blocked: command references '$MATCHED' — this directory is typically large and exploring it wastes tokens. Use Glob or Grep tools instead." >&2
+    exit 2
+fi
+
+exit 0

package/templates/.claude/hooks/self-review.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# self-review.sh — Stop hook for Claude Code
+#
+# Injects a self-review checklist when Claude is about to finish.
+# Non-blocking: always exits 0, just adds context for Claude to consider.
+#
+# Environment:
+#   SELF_REVIEW_ENABLED — set to "false" to disable (default: true)
+
+# No set -euo pipefail — this hook must NEVER fail
+# Windows note: requires bash (WSL or Git Bash). Silently skipped on Windows native.
+
+# Check if disabled
+if [[ "${SELF_REVIEW_ENABLED:-true}" == "false" ]]; then
+    exit 0
+fi
+
+# Read stdin (Stop event payload — may be empty or minimal)
+cat > /dev/null 2>&1 || true
+
+# Inject self-review checklist as context
+cat <<'REVIEW_JSON'
+{
+  "continue": true,
+  "systemMessage": "Self-review before finishing:\n1. Did you leave any TODO/FIXME comments that should be resolved now?\n2. Did you create mock or fake implementations just to pass tests?\n3. Did you replace real code with placeholder comments like '// ... existing code'?\n4. Do all changed files compile and typecheck cleanly?\n5. Did you run the full test suite, not just the new tests?\n6. Are there any files you modified but forgot to include in the summary?"
+}
+REVIEW_JSON

package/templates/.claude/hooks/sensitive-guard.sh

@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+# sensitive-guard.sh — PreToolUse hook for Claude Code
+#
+# Blocks access to sensitive files: .env, private keys, credentials, tokens.
+# Supports .agentignore for project-specific patterns.
+#
+# Exit codes:
+#   0 — access allowed
+#   2 — access blocked (sensitive file)
+#
+# Environment:
+#   SENSITIVE_GUARD_EXTRA — additional pipe-separated filename patterns to block
+
+set -euo pipefail
+
+# Windows note: this hook requires bash (WSL or Git Bash).
+# On Windows without bash, Claude Code will fail to run this hook and skip it silently.
+# Install WSL or Git Bash and ensure `bash` is in PATH to activate protection.
+
+# ─── Read hook payload from stdin ───────────────────────────────────
+
+INPUT=$(cat)
+[[ -z "$INPUT" ]] && exit 0
+
+# Check Node.js availability — security hook should warn loudly if disabled
+if ! command -v node &>/dev/null; then
+    echo "WARNING: sensitive-guard disabled — Node.js not found. Sensitive files are NOT protected." >&2
+    exit 0
+fi
+
+# Extract file path and/or command using inline Node.js
+PARSED=$(printf '%s' "$INPUT" | node -e "
+  try {
+    const d = JSON.parse(require('fs').readFileSync(0, 'utf-8'));
+    const fp = d.tool_input?.file_path || d.tool_input?.path || '';
+    const cmd = d.tool_input?.command || '';
+    const pat = d.tool_input?.pattern || '';
+    process.stdout.write(fp + '\n' + cmd + '\n' + pat);
+  } catch { process.exit(0); }
+" 2>/dev/null) || exit 0
+
+FILE_PATH=$(printf '%s' "$PARSED" | sed -n '1p')
+COMMAND=$(printf '%s' "$PARSED" | sed -n '2p')
+PATTERN=$(printf '%s' "$PARSED" | sed -n '3p')
+
+# ─── Sensitive filename patterns ────────────────────────────────────
+
+# Returns 0 (true) if the path matches a sensitive pattern
+is_sensitive() {
+    local filepath="$1"
+    local basename
+    basename=$(basename "$filepath" 2>/dev/null) || return 1
+
+    # Exact filenames (basename match)
+    case "$basename" in
+        .env|.env.local|.env.development|.env.production|.env.staging|.env.test)
+            return 0 ;;
+        .npmrc|.pypirc|.netrc)
+            return 0 ;;
+        id_rsa|id_ecdsa|id_ed25519|id_dsa)
+            return 0 ;;
+        serviceAccountKey.json|service-account*.json)
+            return 0 ;;
+        config.json)
+            # config.json only sensitive inside .docker/
+            [[ "$filepath" == *".docker/config.json"* ]] && return 0
+            ;;
+    esac
+
+    # Extension patterns
+    case "$basename" in
+        *.pem|*.key|*.p12|*.pfx|*.jks|*.keystore|*.truststore)
+            return 0 ;;
+        *_rsa|*_ecdsa|*_ed25519|*_dsa)
+            return 0 ;;
+    esac
+
+    # Substring patterns (case-insensitive via bash)
+    local lower
+    lower=$(echo "$basename" | tr '[:upper:]' '[:lower:]')
+    case "$lower" in
+        *credential*|*secret*|*private_key*|*privatekey*)
+            return 0 ;;
+        firebase-adminsdk*)
+            return 0 ;;
+    esac
+
+    # .env.* but NOT .env.example or .env.sample or .env.template
+    if [[ "$basename" =~ ^\.env\. ]]; then
+        case "$basename" in
+            .env.example|.env.sample|.env.template) return 1 ;;
+            *) return 0 ;;
+        esac
+    fi
+
+    # Extra patterns from env var
+    if [[ -n "${SENSITIVE_GUARD_EXTRA:-}" ]]; then
+        if printf '%s\n' "$filepath" | grep -qE "$SENSITIVE_GUARD_EXTRA"; then
+            return 0
+        fi
+    fi
+
+    return 1
+}
+
+# ─── Check .agentignore ────────────────────────────────────────────
+
+check_agentignore() {
+    local filepath="$1"
+    local ignorefile=""
+
+    # Look for ignore files in project root
+    for candidate in .agentignore .aiignore .cursorignore; do
+        if [[ -f "$candidate" ]]; then
+            ignorefile="$candidate"
+            break
+        fi
+    done
+
+    [[ -z "$ignorefile" ]] && return 1
+
+    # Simple line-by-line match (not full gitignore glob, but covers common cases)
+    local relpath
+    # Normalize separators to forward slash before stripping prefix (handles Git Bash on Windows)
+    local normalized_fp normalized_pwd
+    normalized_fp=$(printf '%s' "$filepath" | tr '\\' '/')
+    normalized_pwd=$(pwd | tr '\\' '/')
+    relpath=$(printf '%s' "$normalized_fp" | sed "s|^${normalized_pwd}/||") 2>/dev/null || relpath="$filepath"
+
+    while IFS= read -r pattern || [[ -n "$pattern" ]]; do
+        # Skip comments and empty lines
+        [[ -z "$pattern" || "$pattern" == \#* ]] && continue
+        # Simple glob match
+        if [[ "$relpath" == $pattern ]] || [[ "$(basename "$relpath")" == $pattern ]]; then
+            return 0
+        fi
+    done < "$ignorefile"
+
+    return 1
+}
+
+# ─── Check file path access ────────────────────────────────────────
+
+block_with_message() {
+    local filepath="$1"
+    echo "Blocked: '$filepath' is a sensitive file (secrets, keys, or credentials). Access denied to protect sensitive data. Use .env.example for templates instead." >&2
+    exit 2
+}
+
+warn_with_message() {
+    local filepath="$1"
+    echo "Warning: '$filepath' is a sensitive file. If the user approved this access, proceed. Otherwise, ask the user for permission first via AskUserQuestion before reading sensitive files." >&2
+    # Warn only — exit 0 allows the command to proceed
+    # This enables the flow: Block Read → Claude asks user → User approves → Claude uses bash cat
+    exit 0
+}
+
+# ─── Fast-path: skip obviously safe files ──────────────────────────
+
+fast_path_safe() {
+    local ext="${1##*.}"
+    case "$ext" in
+        md|ts|tsx|js|jsx|css|scss|html|svg|json|yaml|yml|toml|xml|txt|sh|py|rb|rs|go|java|kt|swift|c|cpp|h|hpp|cs|vue|svelte|astro)
+            # But json could be sensitive — check name
+            if [[ "$ext" == "json" ]]; then
+                return 1  # not fast-path safe, need full check
+            fi
+            return 0 ;;
+    esac
+    return 1
+}
+
+# ─── Check direct file access (Read/Write/Edit) → BLOCK ────────────
+
+if [[ -n "$FILE_PATH" ]]; then
+    if ! fast_path_safe "$FILE_PATH"; then
+        if is_sensitive "$FILE_PATH" || check_agentignore "$FILE_PATH"; then
+            block_with_message "$FILE_PATH"
+        fi
+    fi
+fi
+
+# ─── Check bash commands → WARN only (allows approved access) ──────
+
+if [[ -n "$COMMAND" ]]; then
+    # Extract .env file references from commands
+    SENSITIVE_IN_CMD=$(printf '%s\n' "$COMMAND" | grep -oE '[\./[:alnum:]_-]*\.env[\.[:alnum:]_-]*' | head -5) || true
+
+    if [[ -n "$SENSITIVE_IN_CMD" ]]; then
+        while IFS= read -r match; do
+            case "$match" in
+                *.example|*.sample|*.template) continue ;;
+            esac
+            if is_sensitive "$match"; then
+                warn_with_message "$match"
+            fi
+        done <<< "$SENSITIVE_IN_CMD"
+    fi
+
+    # Check for key/cert file references in commands → also warn only
+    KEY_IN_CMD=$(printf '%s\n' "$COMMAND" | grep -oE '[[:alnum:]_./-]*\.(pem|key|p12|pfx|jks|keystore)' | head -3) || true
+    if [[ -n "$KEY_IN_CMD" ]]; then
+        while IFS= read -r match; do
+            warn_with_message "$match"
+        done <<< "$KEY_IN_CMD"
+    fi
+
+    # Check for SSH keys, credentials, service accounts in commands
+    SENSITIVE_NAMES=$(printf '%s\n' "$COMMAND" | grep -oiE '(id_rsa|id_ecdsa|id_ed25519|id_dsa|serviceAccountKey\.json|service-account[[:alnum:]_-]*\.json|\.npmrc|\.pypirc|\.netrc)' | head -3) || true
+    if [[ -n "$SENSITIVE_NAMES" ]]; then
+        while IFS= read -r match; do
+            warn_with_message "$match"
+        done <<< "$SENSITIVE_NAMES"
+    fi
+
+    # Check for credential/secret keywords in file arguments
+    CRED_FILES=$(printf '%s\n' "$COMMAND" | grep -oiE '[[:alnum:]_./-]*(credential|secret|private_key|privatekey)[[:alnum:]_./-]*' | head -3) || true
+    if [[ -n "$CRED_FILES" ]]; then
+        while IFS= read -r match; do
+            warn_with_message "$match"
+        done <<< "$CRED_FILES"
+    fi
+fi
+
+# ─── All checks passed ─────────────────────────────────────────────
+
+exit 0