start-vibing 4.4.5 → 4.4.6

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "start-vibing",
-	"version": "4.4.5",
+	"version": "4.4.6",
 	"description": "Setup Claude Code with 9 plugins, 6 community skills, and 8 MCP servers. Parallel install, auto-accept, superpowers + ralph-loop. e2e-audit 0.2.0 refactor (skill-only, no agents): SessionStart hook + slash command make the skill keyword-invokable (\"e2e audit\", \"roda o e2e\", \"integration test\", \"test coverage gaps\"). Source-first discovery via detect-stack, discover-routes (Next app/pages/Remix/SvelteKit/Nuxt/Astro), discover-api-surface (HTTP handlers, tRPC procedures, GraphQL, server actions, middleware auth), inventory-existing-tests (preserve prior corpus + sha256 drift hash), and detect-uncovered (branch-diff vs origin/main finds changes not covered by existing specs). Report-then-ask between mapping and Playwright run; post-run-feedback report before writing findings. SHOT+TRACE+ASSERT+SOURCE evidence quad per non-meta finding; meta rules (coverage-gap-*, uncovered-*, test-drift, stack-detect, post-run-feedback) exempt. verify-audit.sh enforces schema + quad. Generic (no project leakage). super-design 0.7.0 carries over.",
 	"type": "module",
 	"bin": {

package/template/.claude/hooks/block-plugin-commits.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Block auto-commits from super-design (sd-fix) and superpowers plugins.
+#
+# Rationale: these plugins commit on behalf of the user without explicit
+# confirmation per commit (sd-fix commits per finding ID; superpowers
+# commits per TDD step). In shared repos this pollutes history.
+#
+# This hook reads the PreToolUse JSON payload from stdin and exits 2
+# (= block + show message to model) when it detects plugin signatures.
+#
+# User-driven commits via /commit or a literal "git commit" run by the
+# user are NOT blocked — only commits whose message matches the known
+# plugin patterns.
+
+set -uo pipefail
+
+input="$(cat)"
+
+# Extract command field; tolerate missing jq
+if command -v jq >/dev/null 2>&1; then
+	cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || true)"
+else
+	cmd="$(printf '%s' "$input" | grep -oE '"command"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed -E 's/.*"command"[[:space:]]*:[[:space:]]*"(.*)"/\1/')"
+fi
+
+# Not a git commit? allow
+if ! printf '%s' "$cmd" | grep -qE 'git[[:space:]]+commit'; then
+	exit 0
+fi
+
+# Plugin commit signatures (super-design fix IDs + superpowers markers)
+patterns=(
+	'\[A[0-9]+-'      # super-design accessibility findings (A1-A15)
+	'\[V[0-9]+-'      # super-design design findings (V1-V8)
+	'\[U[0-9]+-'      # super-design ux findings (U1-U10)
+	'\[P[0-9]+-'      # super-design perf findings (P1-P10)
+	'\[M[0-9]+-'      # super-design mobile findings (M1-M15)
+	'\[DSC-[0-9]+'    # super-design skill findings
+	'finding[_-]?id'  # any explicit finding-id reference
+	'sd-fix'          # sd-fix subagent marker
+	'superpowers:'    # superpowers commit marker
+	'red.*green.*refactor' # TDD step commit
+)
+
+for p in "${patterns[@]}"; do
+	if printf '%s' "$cmd" | grep -qiE "$p"; then
+		printf 'BLOCKED: plugin auto-commit detected (pattern: %s).\n' "$p" >&2
+		printf 'super-design and superpowers must NOT commit automatically.\n' >&2
+		printf 'If the user asked for a commit, run /commit or ask the user to confirm the message first.\n' >&2
+		exit 2
+	fi
+done
+
+exit 0

package/template/.claude/settings.json

@@ -59,6 +59,17 @@
 				]
 			}
 		],
+		"PreToolUse": [
+			{
+				"matcher": "Bash",
+				"hooks": [
+					{
+						"type": "command",
+						"command": "bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/block-plugin-commits.sh\""
+					}
+				]
+			}
+		],
 		"PostToolUse": [
 			{
 				"matcher": "Write|Edit",