moai-adk 0.25.4__py3-none-any.whl → 0.41.0__py3-none-any.whl

moai_adk/templates/.claude/hooks/moai/post_tool__linter.py

@@ -0,0 +1,307 @@
+#!/usr/bin/env python3
+"""PostToolUse Hook: Automatic Linting
+
+Claude Code Event: PostToolUse
+Matcher: Write|Edit
+Purpose: Automatically run linters after Claude writes or edits files
+
+Provides feedback to Claude about code quality issues:
+- Python: ruff check, mypy
+- JavaScript/TypeScript: eslint, biome lint
+- Go: golangci-lint
+- Rust: clippy
+- And many more...
+
+Exit Codes:
+- 0: Success (linting completed, issues reported as context)
+- 2: Critical lint errors (Claude should address immediately)
+
+Output:
+- JSON with additionalContext containing lint issues
+- Exit code 2 triggers Claude to review and fix issues
+"""
+
+import json
+import sys
+from pathlib import Path
+from typing import Any, Dict, List
+
+# Setup import path for shared modules
+HOOKS_DIR = Path(__file__).parent
+LIB_DIR = HOOKS_DIR / "lib"
+if str(LIB_DIR) not in sys.path:
+    sys.path.insert(0, str(LIB_DIR))
+
+try:
+    from lib.tool_registry import ToolResult, ToolType, get_tool_registry
+except ImportError:
+    # Fallback if module not available
+    def get_tool_registry():
+        return None
+
+    class ToolType:
+        LINTER = "linter"
+
+    class ToolResult:
+        def __init__(self, **kwargs):
+            for k, v in kwargs.items():
+                setattr(self, k, v)
+
+
+# Maximum number of issues to report to Claude
+MAX_ISSUES_TO_REPORT = 5
+
+# File extensions that should skip linting
+SKIP_EXTENSIONS = {
+    ".json",
+    ".lock",
+    ".min.js",
+    ".min.css",
+    ".map",
+    ".svg",
+    ".png",
+    ".jpg",
+    ".gif",
+    ".ico",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".eot",
+    ".md",  # Markdown usually doesn't need linting for code generation
+}
+
+# Directories to skip
+SKIP_DIRECTORIES = {
+    "node_modules",
+    ".git",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".cache",
+    "dist",
+    "build",
+    ".next",
+    ".nuxt",
+    "target",
+    "vendor",
+}
+
+
+def should_skip_file(file_path: str) -> tuple[bool, str]:
+    """Check if file should be skipped for linting.
+
+    Args:
+        file_path: Path to the file
+
+    Returns:
+        Tuple of (should_skip, reason)
+    """
+    path = Path(file_path)
+
+    # Check extension
+    if path.suffix.lower() in SKIP_EXTENSIONS:
+        return True, f"Skipped: {path.suffix} files are not linted"
+
+    # Check for minified files
+    if ".min." in path.name:
+        return True, "Skipped: minified file"
+
+    # Check if in skip directory
+    for parent in path.parents:
+        if parent.name in SKIP_DIRECTORIES:
+            return True, f"Skipped: file in {parent.name}/ directory"
+
+    # Check if file exists
+    if not path.exists():
+        return True, "Skipped: file does not exist"
+
+    return False, ""
+
+
+def parse_lint_output(output: str, error: str) -> List[Dict[str, Any]]:
+    """Parse linter output to extract issues.
+
+    Args:
+        output: stdout from linter
+        error: stderr from linter
+
+    Returns:
+        List of parsed issues
+    """
+    issues = []
+    combined = (output + "\n" + error).strip()
+
+    if not combined:
+        return issues
+
+    # Parse line by line
+    for line in combined.split("\n"):
+        line = line.strip()
+        if not line:
+            continue
+
+        # Skip non-issue lines
+        if any(
+            skip in line.lower()
+            for skip in [
+                "warning:",
+                "info:",
+                "running",
+                "checking",
+                "finished",
+                "success",
+                "✓",
+                "✔",
+            ]
+        ):
+            continue
+
+        # Look for error patterns
+        if "error" in line.lower() or ":" in line:
+            issues.append({"message": line[:200]})  # Truncate long messages
+
+        if len(issues) >= MAX_ISSUES_TO_REPORT:
+            break
+
+    return issues
+
+
+def lint_file(file_path: str) -> Dict[str, Any]:
+    """Lint a single file using the appropriate linter.
+
+    Args:
+        file_path: Path to the file to lint
+
+    Returns:
+        Dictionary with linting results
+    """
+    results: Dict[str, Any] = {
+        "file": file_path,
+        "linted": False,
+        "issues": [],
+        "issues_fixed": 0,
+        "tools_run": [],
+        "errors": [],
+    }
+
+    # Check if we should skip
+    should_skip, skip_reason = should_skip_file(file_path)
+    if should_skip:
+        results["skipped"] = True
+        results["skip_reason"] = skip_reason
+        return results
+
+    # Get tool registry
+    registry = get_tool_registry()
+    if not registry:
+        results["errors"].append("Tool registry not available")
+        return results
+
+    # Get linters for this file
+    linters = registry.get_tools_for_file(file_path, ToolType.LINTER)
+    if not linters:
+        language = registry.get_language_for_file(file_path)
+        if language:
+            results["skipped"] = True
+            results["skip_reason"] = f"No linter available for {language}"
+        else:
+            results["skipped"] = True
+            results["skip_reason"] = "Unknown file type"
+        return results
+
+    # Run linters (use first available)
+    for linter in linters[:1]:  # Only run the highest priority linter
+        result = registry.run_tool(linter, file_path)
+        results["tools_run"].append(
+            {
+                "name": result.tool_name,
+                "success": result.success,
+                "fixed": result.file_modified,
+            }
+        )
+
+        results["linted"] = True
+
+        if result.file_modified:
+            results["issues_fixed"] += 1
+
+        # Parse issues from output
+        if result.output or result.error:
+            parsed_issues = parse_lint_output(result.output, result.error)
+            results["issues"].extend(parsed_issues)
+
+        break  # Only use first linter
+
+    return results
+
+
+def main() -> None:
+    """Main entry point for PostToolUse linter hook.
+
+    Reads JSON input from stdin, lints the file if applicable,
+    and outputs JSON result for Claude.
+    """
+    try:
+        # Read JSON input from stdin
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Invalid JSON input - exit silently
+        sys.exit(0)
+
+    # Extract tool information
+    tool_name = input_data.get("tool_name", "")
+    tool_input = input_data.get("tool_input", {})
+
+    # Only process Write and Edit tools
+    if tool_name not in ("Write", "Edit"):
+        sys.exit(0)
+
+    # Get file path from tool input
+    file_path = tool_input.get("file_path", "")
+    if not file_path:
+        sys.exit(0)
+
+    # Lint the file
+    result = lint_file(file_path)
+
+    # Build output
+    output: Dict[str, Any] = {}
+
+    if result.get("issues"):
+        # Issues found - provide context to Claude
+        issue_count = len(result["issues"])
+        issue_summary = "; ".join([i["message"] for i in result["issues"][:3]])
+
+        if issue_count > 3:
+            issue_summary += f" (+{issue_count - 3} more)"
+
+        # If issues were auto-fixed, just inform
+        if result.get("issues_fixed", 0) > 0:
+            output = {
+                "hookSpecificOutput": {
+                    "hookEventName": "PostToolUse",
+                    "additionalContext": f"Lint: {result['issues_fixed']} issues auto-fixed",
+                }
+            }
+            print(json.dumps(output))
+            sys.exit(0)
+        else:
+            # Issues need attention - use exit code 2 to alert Claude
+            print(f"Lint issues found: {issue_summary}", file=sys.stderr)
+            sys.exit(2)
+
+    elif result.get("linted"):
+        # Linting passed with no issues
+        output = {"suppressOutput": True}
+        print(json.dumps(output))
+        sys.exit(0)
+
+    else:
+        # Skipped or no linter available
+        output = {"suppressOutput": True}
+        print(json.dumps(output))
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

moai_adk/templates/.claude/hooks/moai/pre_tool__security_guard.py

@@ -0,0 +1,231 @@
+#!/usr/bin/env python3
+"""PreToolUse Hook: Security Guard
+
+Claude Code Event: PreToolUse
+Matcher: Write|Edit
+Purpose: Protect sensitive files and prevent dangerous modifications
+
+Security Features:
+- Block modifications to .env and secret files
+- Protect lock files (package-lock.json, yarn.lock)
+- Guard .git directory
+- Prevent accidental overwrites of critical configs
+
+Exit Codes:
+- 0: Success (with JSON output for permission decision)
+- 2: Error (blocking the operation)
+
+Permission Decisions:
+- "allow": Auto-approve safe operations
+- "deny": Block dangerous operations (reason shown to Claude)
+- "ask": Request user confirmation
+"""
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Tuple
+
+# Patterns for files that should NEVER be modified
+DENY_PATTERNS = [
+    # Environment and secrets
+    r"\.env$",
+    r"\.env\.[^/]+$",  # .env.local, .env.production, etc.
+    r"\.envrc$",
+    r"secrets?\.(json|ya?ml|toml)$",
+    r"credentials?\.(json|ya?ml|toml)$",
+    r"\.secrets/.*",
+    r"secrets/.*",
+    # SSH and certificates
+    r"\.ssh/.*",
+    r"id_rsa.*",
+    r"id_ed25519.*",
+    r"\.pem$",
+    r"\.key$",
+    r"\.crt$",
+    # Git internals
+    r"\.git/.*",
+    # Cloud credentials
+    r"\.aws/.*",
+    r"\.gcloud/.*",
+    r"\.azure/.*",
+    r"\.kube/.*",
+    # Token files
+    r"\.token$",
+    r"\.tokens/.*",
+    r"auth\.json$",
+]
+
+# Patterns for files that require user confirmation
+ASK_PATTERNS = [
+    # Lock files
+    r"package-lock\.json$",
+    r"yarn\.lock$",
+    r"pnpm-lock\.ya?ml$",
+    r"Gemfile\.lock$",
+    r"Cargo\.lock$",
+    r"poetry\.lock$",
+    r"composer\.lock$",
+    r"Pipfile\.lock$",
+    r"uv\.lock$",
+    # Critical configs
+    r"tsconfig\.json$",
+    r"pyproject\.toml$",
+    r"Cargo\.toml$",
+    r"package\.json$",
+    r"docker-compose\.ya?ml$",
+    r"Dockerfile$",
+    r"\.dockerignore$",
+    # CI/CD configs
+    r"\.github/workflows/.*\.ya?ml$",
+    r"\.gitlab-ci\.ya?ml$",
+    r"\.circleci/.*",
+    r"Jenkinsfile$",
+    # Infrastructure
+    r"terraform/.*\.tf$",
+    r"\.terraform/.*",
+    r"kubernetes/.*\.ya?ml$",
+    r"k8s/.*\.ya?ml$",
+]
+
+# Content patterns that indicate sensitive data
+SENSITIVE_CONTENT_PATTERNS = [
+    r"-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----",
+    r"-----BEGIN\s+CERTIFICATE-----",
+    r"sk-[a-zA-Z0-9]{32,}",  # OpenAI API keys
+    r"ghp_[a-zA-Z0-9]{36}",  # GitHub tokens
+    r"gho_[a-zA-Z0-9]{36}",  # GitHub OAuth tokens
+    r"glpat-[a-zA-Z0-9\-]{20}",  # GitLab tokens
+    r"xox[baprs]-[a-zA-Z0-9\-]+",  # Slack tokens
+    r"AKIA[0-9A-Z]{16}",  # AWS access keys
+    r"ya29\.[a-zA-Z0-9_\-]+",  # Google OAuth tokens
+]
+
+
+def compile_patterns(patterns: List[str]) -> List[re.Pattern]:
+    """Compile regex patterns for efficient matching."""
+    return [re.compile(p, re.IGNORECASE) for p in patterns]
+
+
+DENY_COMPILED = compile_patterns(DENY_PATTERNS)
+ASK_COMPILED = compile_patterns(ASK_PATTERNS)
+SENSITIVE_COMPILED = compile_patterns(SENSITIVE_CONTENT_PATTERNS)
+
+
+def check_file_path(file_path: str) -> Tuple[str, str]:
+    """Check if file path matches any security patterns.
+
+    Args:
+        file_path: Path to check
+
+    Returns:
+        Tuple of (decision, reason)
+        decision: "allow", "deny", or "ask"
+    """
+    # Normalize path for matching
+    normalized = file_path.replace("\\", "/")
+
+    # Check deny patterns first
+    for pattern in DENY_COMPILED:
+        if pattern.search(normalized):
+            return "deny", "Protected file: access denied for security reasons"
+
+    # Check ask patterns
+    for pattern in ASK_COMPILED:
+        if pattern.search(normalized):
+            return "ask", f"Critical config file: {Path(file_path).name}"
+
+    return "allow", ""
+
+
+def check_content_for_secrets(content: str) -> Tuple[bool, str]:
+    """Check if content contains sensitive data patterns.
+
+    Args:
+        content: Content to check
+
+    Returns:
+        Tuple of (has_secrets, description)
+    """
+    for pattern in SENSITIVE_COMPILED:
+        match = pattern.search(content)
+        if match:
+            # Don't reveal the actual secret or pattern
+            return True, "Detected sensitive data (credentials, API keys, or certificates)"
+
+    return False, ""
+
+
+def main() -> None:
+    """Main entry point for PreToolUse security guard hook.
+
+    Reads JSON input from stdin, checks for security concerns,
+    and outputs permission decision.
+    """
+    try:
+        # Read JSON input from stdin
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Invalid JSON input - allow by default
+        sys.exit(0)
+
+    # Extract tool information
+    tool_name = input_data.get("tool_name", "")
+    tool_input = input_data.get("tool_input", {})
+
+    # Only process Write and Edit tools
+    if tool_name not in ("Write", "Edit"):
+        sys.exit(0)
+
+    # Get file path from tool input
+    file_path = tool_input.get("file_path", "")
+    if not file_path:
+        sys.exit(0)
+
+    # Check file path against patterns
+    decision, reason = check_file_path(file_path)
+
+    # For Write operations, also check content for secrets
+    if tool_name == "Write" and decision == "allow":
+        content = tool_input.get("content", "")
+        if content:
+            has_secrets, secret_reason = check_content_for_secrets(content)
+            if has_secrets:
+                decision = "deny"
+                reason = f"Content contains secrets: {secret_reason}"
+
+    # Build output based on decision
+    output: Dict[str, Any] = {}
+
+    if decision == "deny":
+        output = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }
+        }
+        print(json.dumps(output))
+        sys.exit(0)
+
+    elif decision == "ask":
+        output = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "ask",
+                "permissionDecisionReason": reason,
+            }
+        }
+        print(json.dumps(output))
+        sys.exit(0)
+
+    else:
+        # Allow - no output needed (or suppress)
+        output = {"suppressOutput": True}
+        print(json.dumps(output))
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()