thanh-kit 2.5.0 → 2.5.2

package/templates/hooks/tests/{test-privacy-block.js → test-privacy-block.cjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * test-privacy-block.js - Unit tests for privacy-block hook
+ * test-privacy-block.cjs - Unit tests for privacy-block hook
  */
 
 const { spawn } = require('child_process');

package/templates/hooks/tests/test-scout-block.cjs

@@ -0,0 +1,315 @@
+#!/usr/bin/env node
+
+/**
+ * Test script for scout-block.cjs hook
+ * Tests various tool inputs to verify blocking logic
+ *
+ * Updated to use Node.js dispatcher directly (not bash wrapper)
+ */
+
+const { execSync } = require('child_process');
+const path = require('path');
+
+const testCases = [
+  // Directory access - should be BLOCKED
+  {
+    name: 'Bash: ls node_modules',
+    input: { tool_name: 'Bash', tool_input: { command: 'ls node_modules' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: 'Bash: cd build',
+    input: { tool_name: 'Bash', tool_input: { command: 'cd build' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: 'Bash: cat dist/bundle.js',
+    input: { tool_name: 'Bash', tool_input: { command: 'cat dist/bundle.js' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: 'Grep with node_modules path',
+    input: { tool_name: 'Grep', tool_input: { pattern: 'test', path: 'node_modules' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: 'Glob with node_modules pattern',
+    input: { tool_name: 'Glob', tool_input: { pattern: '**/node_modules/**' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: 'Read with node_modules file_path',
+    input: { tool_name: 'Read', tool_input: { file_path: 'node_modules/package.json' } },
+    expected: 'BLOCKED'
+  },
+
+  // Subfolder blocking (THE BUG FIX)
+  {
+    name: '[BUG FIX] Bash: ls packages/web/node_modules',
+    input: { tool_name: 'Bash', tool_input: { command: 'ls packages/web/node_modules' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[BUG FIX] Read: subfolder node_modules',
+    input: { tool_name: 'Read', tool_input: { file_path: 'apps/api/node_modules/pkg/index.js' } },
+    expected: 'BLOCKED'
+  },
+
+  // Build commands - should be ALLOWED
+  {
+    name: 'Bash: npm build',
+    input: { tool_name: 'Bash', tool_input: { command: 'npm build' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Bash: pnpm build',
+    input: { tool_name: 'Bash', tool_input: { command: 'pnpm build' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Bash: yarn build',
+    input: { tool_name: 'Bash', tool_input: { command: 'yarn build' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Bash: npm run build',
+    input: { tool_name: 'Bash', tool_input: { command: 'npm run build' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Bash: pnpm --filter web run build',
+    input: { tool_name: 'Bash', tool_input: { command: 'pnpm --filter web run build 2>&1 | tail -100' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Bash: npm install',
+    input: { tool_name: 'Bash', tool_input: { command: 'npm install' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Bash: npx tsc',
+    input: { tool_name: 'Bash', tool_input: { command: 'npx tsc' } },
+    expected: 'ALLOWED'
+  },
+
+  // Safe operations - should be ALLOWED
+  {
+    name: 'Grep with safe path',
+    input: { tool_name: 'Grep', tool_input: { pattern: 'test', path: 'src' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Read with safe file_path',
+    input: { tool_name: 'Read', tool_input: { file_path: 'src/index.js' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: 'Glob with scoped pattern',
+    input: { tool_name: 'Glob', tool_input: { pattern: 'src/**/*.ts' } },
+    expected: 'ALLOWED'
+  },
+  // Broad pattern detection (NEW)
+  {
+    name: '[NEW] Glob with broad pattern (should block)',
+    input: { tool_name: 'Glob', tool_input: { pattern: '**/*.ts' } },
+    expected: 'BLOCKED'
+  },
+
+  // Venv executable paths - should be ALLOWED (Issue #265)
+  // .venv (with dot)
+  {
+    name: '[#265] Bash: Unix .venv python executable',
+    input: { tool_name: 'Bash', tool_input: { command: '~/.claude/skills/.venv/bin/python3 script.py' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#265] Bash: Windows .venv python executable',
+    input: { tool_name: 'Bash', tool_input: { command: '.venv/Scripts/python.exe script.py' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#265] Bash: project .venv pip',
+    input: { tool_name: 'Bash', tool_input: { command: './project/.venv/bin/pip install requests' } },
+    expected: 'ALLOWED'
+  },
+  // venv (without dot)
+  {
+    name: '[#265] Bash: Unix venv python executable',
+    input: { tool_name: 'Bash', tool_input: { command: 'venv/bin/python3 script.py' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#265] Bash: Windows venv python executable',
+    input: { tool_name: 'Bash', tool_input: { command: 'venv/Scripts/python.exe script.py' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#265] Bash: project venv pip',
+    input: { tool_name: 'Bash', tool_input: { command: './myproject/venv/bin/pip install flask' } },
+    expected: 'ALLOWED'
+  },
+
+  // Venv exploration - should be BLOCKED
+  {
+    name: '[#265] Bash: cat .venv lib (blocked)',
+    input: { tool_name: 'Bash', tool_input: { command: 'cat .venv/lib/python3.11/site.py' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[#265] Bash: ls .venv (blocked)',
+    input: { tool_name: 'Bash', tool_input: { command: 'ls -la .venv/' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[#265] Read: .venv file (blocked)',
+    input: { tool_name: 'Read', tool_input: { file_path: '.venv/pyvenv.cfg' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[#265] Bash: cat venv lib (blocked)',
+    input: { tool_name: 'Bash', tool_input: { command: 'cat venv/lib/python3.11/site.py' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[#265] Bash: ls venv (blocked)',
+    input: { tool_name: 'Bash', tool_input: { command: 'ls -la venv/' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[#265] Read: venv file (blocked)',
+    input: { tool_name: 'Read', tool_input: { file_path: 'venv/pyvenv.cfg' } },
+    expected: 'BLOCKED'
+  },
+
+  // Venv creation commands - should be ALLOWED (Issue #386)
+  {
+    name: '[#386] Bash: python -m venv .venv',
+    input: { tool_name: 'Bash', tool_input: { command: 'python -m venv .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: python3 -m venv .venv',
+    input: { tool_name: 'Bash', tool_input: { command: 'python3 -m venv .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: python3 -m venv --system-site-packages .venv',
+    input: { tool_name: 'Bash', tool_input: { command: 'python3 -m venv --system-site-packages .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: py -m venv .venv (Windows)',
+    input: { tool_name: 'Bash', tool_input: { command: 'py -m venv .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: py -3.11 -m venv .venv (Windows version)',
+    input: { tool_name: 'Bash', tool_input: { command: 'py -3.11 -m venv .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: uv venv',
+    input: { tool_name: 'Bash', tool_input: { command: 'uv venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: uv venv .venv',
+    input: { tool_name: 'Bash', tool_input: { command: 'uv venv .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: virtualenv .venv',
+    input: { tool_name: 'Bash', tool_input: { command: 'virtualenv .venv' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[#386] Bash: virtualenv --python=python3.11 my_env',
+    input: { tool_name: 'Bash', tool_input: { command: 'virtualenv --python=python3.11 my_env' } },
+    expected: 'ALLOWED'
+  },
+
+  // Compound/multi-line commands with build - should be ALLOWED (Issue: scout-block false positive)
+  {
+    name: '[COMPOUND] echo + npm run build (newline)',
+    input: { tool_name: 'Bash', tool_input: { command: 'echo "Checking build output..."\nnpm run build 2>&1 | tail -15' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[COMPOUND] echo + npm run build (&&)',
+    input: { tool_name: 'Bash', tool_input: { command: 'echo "Building..." && npm run build' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[COMPOUND] npm install + npm run build (&&)',
+    input: { tool_name: 'Bash', tool_input: { command: 'npm install && npm run build' } },
+    expected: 'ALLOWED'
+  },
+  {
+    name: '[COMPOUND] echo + cd node_modules (should block)',
+    input: { tool_name: 'Bash', tool_input: { command: 'echo "test" && cd node_modules' } },
+    expected: 'BLOCKED'
+  },
+  {
+    name: '[COMPOUND] npm run build + cat dist/file.js (should block)',
+    input: { tool_name: 'Bash', tool_input: { command: 'npm run build && cat dist/bundle.js' } },
+    expected: 'BLOCKED'
+  },
+
+  // Non-venv python commands - should NOT be specially allowed (Issue #386 negative tests)
+  {
+    name: '[#386] Bash: python3 --version (not specially allowed)',
+    input: { tool_name: 'Bash', tool_input: { command: 'python3 --version' } },
+    expected: 'ALLOWED'  // Allowed because no blocked path, but NOT via isAllowedCommand
+  },
+  {
+    name: '[#386] Bash: uv pip install (not venv creation)',
+    input: { tool_name: 'Bash', tool_input: { command: 'uv pip install requests' } },
+    expected: 'ALLOWED'  // Allowed because no blocked path, but NOT via isAllowedCommand
+  }
+];
+
+console.log('Testing scout-block.cjs hook...\n');
+
+// Test Node.js dispatcher directly
+const scriptPath = path.join(__dirname, '..', 'scout-block.cjs');
+let passed = 0;
+let failed = 0;
+
+for (const test of testCases) {
+  try {
+    const input = JSON.stringify(test.input);
+    const result = execSync(`node "${scriptPath}"`, {
+      input,
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+
+    const actual = 'ALLOWED';
+    const success = actual === test.expected;
+
+    if (success) {
+      console.log(`\x1b[32m✓\x1b[0m ${test.name}: ${actual}`);
+      passed++;
+    } else {
+      console.log(`\x1b[31m✗\x1b[0m ${test.name}: expected ${test.expected}, got ${actual}`);
+      failed++;
+    }
+  } catch (error) {
+    const actual = error.status === 2 ? 'BLOCKED' : 'ERROR';
+    const success = actual === test.expected;
+
+    if (success) {
+      console.log(`\x1b[32m✓\x1b[0m ${test.name}: ${actual}`);
+      passed++;
+    } else {
+      console.log(`\x1b[31m✗\x1b[0m ${test.name}: expected ${test.expected}, got ${actual}`);
+      if (error.stderr) {
+        console.log(`  Error: ${error.stderr.toString().trim().split('\n')[0]}`);
+      }
+      failed++;
+    }
+  }
+}
+
+console.log(`\nResults: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/templates/hooks/usage-context-awareness.cjs

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+/**
+ * Usage Cache Writer - UserPromptSubmit & PostToolUse Hook
+ *
+ * Fetches Claude Code usage limits from Anthropic OAuth API and writes to cache.
+ * The cache is read by:
+ * - statusline.cjs (for display)
+ * - context-builder.cjs (for injection)
+ *
+ * Features:
+ * - Cross-platform credential retrieval (macOS Keychain, file-based)
+ * - API response caching (60s TTL)
+ * - Throttled API calls (1 min for prompts, 5 mins for tool use)
+ */
+
+// Crash wrapper
+try {
+  const fs = require("fs");
+  const path = require("path");
+  const os = require("os");
+  const { execSync } = require("child_process");
+  const { isHookEnabled } = require('./lib/ck-config-utils.cjs');
+
+  // Early exit if hook disabled in config
+  if (!isHookEnabled('usage-context-awareness')) {
+    process.exit(0);
+  }
+
+// Cache configuration
+const USAGE_CACHE_FILE = path.join(os.tmpdir(), "ck-usage-limits-cache.json");
+const CACHE_TTL_MS = 60000; // 60 seconds
+const FETCH_INTERVAL_MS = 300000; // 5 minutes for PostToolUse
+const FETCH_INTERVAL_PROMPT_MS = 60000; // 1 minute for UserPromptSubmit
+
+/**
+ * Get Claude OAuth credentials (cross-platform)
+ */
+function getClaudeCredentials() {
+	// macOS: Try Keychain first
+	if (os.platform() === "darwin") {
+		try {
+			const result = execSync('security find-generic-password -s "Claude Code-credentials" -w', {
+				timeout: 5000,
+				encoding: "utf-8",
+				stdio: ["pipe", "pipe", "ignore"],
+			}).trim();
+			const parsed = JSON.parse(result);
+			if (parsed.claudeAiOauth?.accessToken) {
+				return parsed.claudeAiOauth.accessToken;
+			}
+		} catch {
+			// Fallback to file-based
+		}
+	}
+
+	// File-based credentials (Linux/Windows, or macOS fallback)
+	const credPath = path.join(os.homedir(), ".claude", ".credentials.json");
+	try {
+		const content = fs.readFileSync(credPath, "utf-8");
+		const parsed = JSON.parse(content);
+		return parsed.claudeAiOauth?.accessToken || null;
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Check if we should fetch (throttled)
+ */
+function shouldFetch(isUserPrompt = false) {
+	const interval = isUserPrompt ? FETCH_INTERVAL_PROMPT_MS : FETCH_INTERVAL_MS;
+
+	try {
+		if (fs.existsSync(USAGE_CACHE_FILE)) {
+			const cache = JSON.parse(fs.readFileSync(USAGE_CACHE_FILE, "utf-8"));
+			if (Date.now() - cache.timestamp < interval) {
+				return false;
+			}
+		}
+	} catch {}
+	return true;
+}
+
+/**
+ * Write cache with status (available or unavailable)
+ */
+function writeCache(status, data = null) {
+	fs.writeFileSync(
+		USAGE_CACHE_FILE,
+		JSON.stringify({
+			timestamp: Date.now(),
+			status,
+			data,
+		})
+	);
+}
+
+/**
+ * Fetch usage limits from Anthropic OAuth API and write to cache
+ * Always writes status to cache (available or unavailable) for statusline fallback
+ */
+async function fetchAndCacheUsageLimits() {
+	const token = getClaudeCredentials();
+	if (!token) {
+		writeCache("unavailable");
+		return false;
+	}
+
+	try {
+		const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
+			method: "GET",
+			headers: {
+				Accept: "application/json",
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`,
+				"anthropic-beta": "oauth-2025-04-20",
+				"User-Agent": "claudekit-engineer/1.0",
+			},
+		});
+
+		if (!response.ok) {
+			writeCache("unavailable");
+			return false;
+		}
+
+		const data = await response.json();
+		writeCache("available", data);
+		return true;
+	} catch {
+		writeCache("unavailable");
+		return false;
+	}
+}
+
+/**
+ * Main hook execution - just fetch and cache, no injection
+ */
+async function main() {
+	// Always allow operation to continue
+	const result = { continue: true };
+
+	try {
+		// Read hook input
+		let inputStr = "";
+		try {
+			inputStr = fs.readFileSync(0, "utf-8");
+		} catch {}
+
+		const input = JSON.parse(inputStr || "{}");
+
+		// Detect hook type
+		const isUserPrompt = typeof input.prompt === "string";
+
+		// Check if we should fetch (throttled)
+		if (shouldFetch(isUserPrompt)) {
+			await fetchAndCacheUsageLimits();
+		}
+	} catch {}
+
+	// Output result (no injection, just continue)
+	console.log(JSON.stringify(result));
+  }
+
+  main().catch(() => {
+    console.log(JSON.stringify({ continue: true }));
+    process.exit(0);
+  });
+} catch (e) {
+  // Minimal crash logging (zero deps — only Node builtins)
+  try {
+    const fs = require('fs');
+    const p = require('path');
+    const logDir = p.join(__dirname, '.logs');
+    if (!fs.existsSync(logDir)) fs.mkdirSync(logDir, { recursive: true });
+    fs.appendFileSync(p.join(logDir, 'hook-log.jsonl'),
+      JSON.stringify({ ts: new Date().toISOString(), hook: p.basename(__filename, '.cjs'), status: 'crash', error: e.message }) + '\n');
+  } catch (_) {}
+  process.exit(0); // fail-open
+}

package/templates/metadata.json

@@ -0,0 +1,104 @@
+{
+  "deletions": [
+    "agents/copywriter.md",
+    "agents/database-admin.md",
+    "agents/scout.md",
+    "agents/scout-external.md",
+    "commands/ask.md",
+    "commands/bootstrap.md",
+    "commands/bootstrap/auto.md",
+    "commands/bootstrap/auto/fast.md",
+    "commands/brainstorm.md",
+    "commands/ck-help.md",
+    "commands/code.md",
+    "commands/coding-level.md",
+    "commands/content/cro.md",
+    "commands/content/enhance.md",
+    "commands/content/fast.md",
+    "commands/content/good.md",
+    "commands/cook.md",
+    "commands/cook/auto.md",
+    "commands/cook/auto/fast.md",
+    "commands/debug.md",
+    "commands/design/3d.md",
+    "commands/design/describe.md",
+    "commands/design/fast.md",
+    "commands/design/good.md",
+    "commands/design/screenshot.md",
+    "commands/design/video.md",
+    "commands/docs/init.md",
+    "commands/docs/summarize.md",
+    "commands/docs/update.md",
+    "commands/fix.md",
+    "commands/fix/ci.md",
+    "commands/fix/fast.md",
+    "commands/fix/hard.md",
+    "commands/fix/logs.md",
+    "commands/fix/test.md",
+    "commands/fix/types.md",
+    "commands/fix/ui.md",
+    "commands/git/cm.md",
+    "commands/git/cp.md",
+    "commands/git/pr.md",
+    "commands/integrate/polar.md",
+    "commands/integrate/sepay.md",
+    "commands/journal.md",
+    "commands/kanban.md",
+    "commands/plan.md",
+    "commands/plan/archive.md",
+    "commands/plan/ci.md",
+    "commands/plan/cro.md",
+    "commands/plan/fast.md",
+    "commands/plan/hard.md",
+    "commands/plan/parallel.md",
+    "commands/plan/red-team.md",
+    "commands/plan/two.md",
+    "commands/plan/validate.md",
+    "commands/preview.md",
+    "commands/review/codebase.md",
+    "commands/review/codebase/parallel.md",
+    "commands/scout.md",
+    "commands/scout/ext.md",
+    "commands/skill/add.md",
+    "commands/skill/create.md",
+    "commands/skill/fix-logs.md",
+    "commands/skill/optimize.md",
+    "commands/skill/optimize/auto.md",
+    "commands/test.md",
+    "commands/test/ui.md",
+    "commands/use-mcp.md",
+    "commands/watzup.md",
+    "commands/worktree.md",
+    "commands/bootstrap/auto/parallel.md",
+    "commands/code/auto.md",
+    "commands/code/no-test.md",
+    "commands/code/parallel.md",
+    "commands/cook/auto/parallel.md",
+    "commands/fix/parallel.md",
+    "commands/skill/update.md",
+    "command-archive/**",
+    "skills/.shadowed/**",
+    "skills/_archive/**",
+    "skills/aesthetic/**",
+    "skills/beads/**",
+    "skills/brainstorming/**",
+    "skills/claude-code/**",
+    "skills/debugging/**",
+    "skills/frontend-design-pro/**",
+    "skills/planning/**",
+    "skills/agent-teams/**"
+  ],
+  "version": "2.13.0",
+  "name": "claudekit-engineer",
+  "description": "A comprehensive boilerplate template for building professional software projects with CLI Coding Agents (Claude Code and Open Code).",
+  "buildDate": "2026-02-25T15:14:15.765Z",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/claudekit/claudekit-engineer.git"
+  },
+  "download": {
+    "lastDownloadedAt": null,
+    "downloadedBy": null,
+    "installCount": 0
+  }
+}