moai-adk 0.32.8__py3-none-any.whl → 0.41.0__py3-none-any.whl

moai_adk/templates/.claude/hooks/moai/post_tool__linter.py

@@ -0,0 +1,307 @@
+#!/usr/bin/env python3
+"""PostToolUse Hook: Automatic Linting
+
+Claude Code Event: PostToolUse
+Matcher: Write|Edit
+Purpose: Automatically run linters after Claude writes or edits files
+
+Provides feedback to Claude about code quality issues:
+- Python: ruff check, mypy
+- JavaScript/TypeScript: eslint, biome lint
+- Go: golangci-lint
+- Rust: clippy
+- And many more...
+
+Exit Codes:
+- 0: Success (linting completed, issues reported as context)
+- 2: Critical lint errors (Claude should address immediately)
+
+Output:
+- JSON with additionalContext containing lint issues
+- Exit code 2 triggers Claude to review and fix issues
+"""
+
+import json
+import sys
+from pathlib import Path
+from typing import Any, Dict, List
+
+# Setup import path for shared modules
+HOOKS_DIR = Path(__file__).parent
+LIB_DIR = HOOKS_DIR / "lib"
+if str(LIB_DIR) not in sys.path:
+    sys.path.insert(0, str(LIB_DIR))
+
+try:
+    from lib.tool_registry import ToolResult, ToolType, get_tool_registry
+except ImportError:
+    # Fallback if module not available
+    def get_tool_registry():
+        return None
+
+    class ToolType:
+        LINTER = "linter"
+
+    class ToolResult:
+        def __init__(self, **kwargs):
+            for k, v in kwargs.items():
+                setattr(self, k, v)
+
+
+# Maximum number of issues to report to Claude
+MAX_ISSUES_TO_REPORT = 5
+
+# File extensions that should skip linting
+SKIP_EXTENSIONS = {
+    ".json",
+    ".lock",
+    ".min.js",
+    ".min.css",
+    ".map",
+    ".svg",
+    ".png",
+    ".jpg",
+    ".gif",
+    ".ico",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".eot",
+    ".md",  # Markdown usually doesn't need linting for code generation
+}
+
+# Directories to skip
+SKIP_DIRECTORIES = {
+    "node_modules",
+    ".git",
+    ".venv",
+    "venv",
+    "__pycache__",
+    ".cache",
+    "dist",
+    "build",
+    ".next",
+    ".nuxt",
+    "target",
+    "vendor",
+}
+
+
+def should_skip_file(file_path: str) -> tuple[bool, str]:
+    """Check if file should be skipped for linting.
+
+    Args:
+        file_path: Path to the file
+
+    Returns:
+        Tuple of (should_skip, reason)
+    """
+    path = Path(file_path)
+
+    # Check extension
+    if path.suffix.lower() in SKIP_EXTENSIONS:
+        return True, f"Skipped: {path.suffix} files are not linted"
+
+    # Check for minified files
+    if ".min." in path.name:
+        return True, "Skipped: minified file"
+
+    # Check if in skip directory
+    for parent in path.parents:
+        if parent.name in SKIP_DIRECTORIES:
+            return True, f"Skipped: file in {parent.name}/ directory"
+
+    # Check if file exists
+    if not path.exists():
+        return True, "Skipped: file does not exist"
+
+    return False, ""
+
+
+def parse_lint_output(output: str, error: str) -> List[Dict[str, Any]]:
+    """Parse linter output to extract issues.
+
+    Args:
+        output: stdout from linter
+        error: stderr from linter
+
+    Returns:
+        List of parsed issues
+    """
+    issues = []
+    combined = (output + "\n" + error).strip()
+
+    if not combined:
+        return issues
+
+    # Parse line by line
+    for line in combined.split("\n"):
+        line = line.strip()
+        if not line:
+            continue
+
+        # Skip non-issue lines
+        if any(
+            skip in line.lower()
+            for skip in [
+                "warning:",
+                "info:",
+                "running",
+                "checking",
+                "finished",
+                "success",
+                "✓",
+                "✔",
+            ]
+        ):
+            continue
+
+        # Look for error patterns
+        if "error" in line.lower() or ":" in line:
+            issues.append({"message": line[:200]})  # Truncate long messages
+
+        if len(issues) >= MAX_ISSUES_TO_REPORT:
+            break
+
+    return issues
+
+
+def lint_file(file_path: str) -> Dict[str, Any]:
+    """Lint a single file using the appropriate linter.
+
+    Args:
+        file_path: Path to the file to lint
+
+    Returns:
+        Dictionary with linting results
+    """
+    results: Dict[str, Any] = {
+        "file": file_path,
+        "linted": False,
+        "issues": [],
+        "issues_fixed": 0,
+        "tools_run": [],
+        "errors": [],
+    }
+
+    # Check if we should skip
+    should_skip, skip_reason = should_skip_file(file_path)
+    if should_skip:
+        results["skipped"] = True
+        results["skip_reason"] = skip_reason
+        return results
+
+    # Get tool registry
+    registry = get_tool_registry()
+    if not registry:
+        results["errors"].append("Tool registry not available")
+        return results
+
+    # Get linters for this file
+    linters = registry.get_tools_for_file(file_path, ToolType.LINTER)
+    if not linters:
+        language = registry.get_language_for_file(file_path)
+        if language:
+            results["skipped"] = True
+            results["skip_reason"] = f"No linter available for {language}"
+        else:
+            results["skipped"] = True
+            results["skip_reason"] = "Unknown file type"
+        return results
+
+    # Run linters (use first available)
+    for linter in linters[:1]:  # Only run the highest priority linter
+        result = registry.run_tool(linter, file_path)
+        results["tools_run"].append(
+            {
+                "name": result.tool_name,
+                "success": result.success,
+                "fixed": result.file_modified,
+            }
+        )
+
+        results["linted"] = True
+
+        if result.file_modified:
+            results["issues_fixed"] += 1
+
+        # Parse issues from output
+        if result.output or result.error:
+            parsed_issues = parse_lint_output(result.output, result.error)
+            results["issues"].extend(parsed_issues)
+
+        break  # Only use first linter
+
+    return results
+
+
+def main() -> None:
+    """Main entry point for PostToolUse linter hook.
+
+    Reads JSON input from stdin, lints the file if applicable,
+    and outputs JSON result for Claude.
+    """
+    try:
+        # Read JSON input from stdin
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Invalid JSON input - exit silently
+        sys.exit(0)
+
+    # Extract tool information
+    tool_name = input_data.get("tool_name", "")
+    tool_input = input_data.get("tool_input", {})
+
+    # Only process Write and Edit tools
+    if tool_name not in ("Write", "Edit"):
+        sys.exit(0)
+
+    # Get file path from tool input
+    file_path = tool_input.get("file_path", "")
+    if not file_path:
+        sys.exit(0)
+
+    # Lint the file
+    result = lint_file(file_path)
+
+    # Build output
+    output: Dict[str, Any] = {}
+
+    if result.get("issues"):
+        # Issues found - provide context to Claude
+        issue_count = len(result["issues"])
+        issue_summary = "; ".join([i["message"] for i in result["issues"][:3]])
+
+        if issue_count > 3:
+            issue_summary += f" (+{issue_count - 3} more)"
+
+        # If issues were auto-fixed, just inform
+        if result.get("issues_fixed", 0) > 0:
+            output = {
+                "hookSpecificOutput": {
+                    "hookEventName": "PostToolUse",
+                    "additionalContext": f"Lint: {result['issues_fixed']} issues auto-fixed",
+                }
+            }
+            print(json.dumps(output))
+            sys.exit(0)
+        else:
+            # Issues need attention - use exit code 2 to alert Claude
+            print(f"Lint issues found: {issue_summary}", file=sys.stderr)
+            sys.exit(2)
+
+    elif result.get("linted"):
+        # Linting passed with no issues
+        output = {"suppressOutput": True}
+        print(json.dumps(output))
+        sys.exit(0)
+
+    else:
+        # Skipped or no linter available
+        output = {"suppressOutput": True}
+        print(json.dumps(output))
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

moai_adk/templates/.claude/hooks/moai/pre_tool__security_guard.py

@@ -0,0 +1,231 @@
+#!/usr/bin/env python3
+"""PreToolUse Hook: Security Guard
+
+Claude Code Event: PreToolUse
+Matcher: Write|Edit
+Purpose: Protect sensitive files and prevent dangerous modifications
+
+Security Features:
+- Block modifications to .env and secret files
+- Protect lock files (package-lock.json, yarn.lock)
+- Guard .git directory
+- Prevent accidental overwrites of critical configs
+
+Exit Codes:
+- 0: Success (with JSON output for permission decision)
+- 2: Error (blocking the operation)
+
+Permission Decisions:
+- "allow": Auto-approve safe operations
+- "deny": Block dangerous operations (reason shown to Claude)
+- "ask": Request user confirmation
+"""
+
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any, Dict, List, Tuple
+
+# Patterns for files that should NEVER be modified
+DENY_PATTERNS = [
+    # Environment and secrets
+    r"\.env$",
+    r"\.env\.[^/]+$",  # .env.local, .env.production, etc.
+    r"\.envrc$",
+    r"secrets?\.(json|ya?ml|toml)$",
+    r"credentials?\.(json|ya?ml|toml)$",
+    r"\.secrets/.*",
+    r"secrets/.*",
+    # SSH and certificates
+    r"\.ssh/.*",
+    r"id_rsa.*",
+    r"id_ed25519.*",
+    r"\.pem$",
+    r"\.key$",
+    r"\.crt$",
+    # Git internals
+    r"\.git/.*",
+    # Cloud credentials
+    r"\.aws/.*",
+    r"\.gcloud/.*",
+    r"\.azure/.*",
+    r"\.kube/.*",
+    # Token files
+    r"\.token$",
+    r"\.tokens/.*",
+    r"auth\.json$",
+]
+
+# Patterns for files that require user confirmation
+ASK_PATTERNS = [
+    # Lock files
+    r"package-lock\.json$",
+    r"yarn\.lock$",
+    r"pnpm-lock\.ya?ml$",
+    r"Gemfile\.lock$",
+    r"Cargo\.lock$",
+    r"poetry\.lock$",
+    r"composer\.lock$",
+    r"Pipfile\.lock$",
+    r"uv\.lock$",
+    # Critical configs
+    r"tsconfig\.json$",
+    r"pyproject\.toml$",
+    r"Cargo\.toml$",
+    r"package\.json$",
+    r"docker-compose\.ya?ml$",
+    r"Dockerfile$",
+    r"\.dockerignore$",
+    # CI/CD configs
+    r"\.github/workflows/.*\.ya?ml$",
+    r"\.gitlab-ci\.ya?ml$",
+    r"\.circleci/.*",
+    r"Jenkinsfile$",
+    # Infrastructure
+    r"terraform/.*\.tf$",
+    r"\.terraform/.*",
+    r"kubernetes/.*\.ya?ml$",
+    r"k8s/.*\.ya?ml$",
+]
+
+# Content patterns that indicate sensitive data
+SENSITIVE_CONTENT_PATTERNS = [
+    r"-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----",
+    r"-----BEGIN\s+CERTIFICATE-----",
+    r"sk-[a-zA-Z0-9]{32,}",  # OpenAI API keys
+    r"ghp_[a-zA-Z0-9]{36}",  # GitHub tokens
+    r"gho_[a-zA-Z0-9]{36}",  # GitHub OAuth tokens
+    r"glpat-[a-zA-Z0-9\-]{20}",  # GitLab tokens
+    r"xox[baprs]-[a-zA-Z0-9\-]+",  # Slack tokens
+    r"AKIA[0-9A-Z]{16}",  # AWS access keys
+    r"ya29\.[a-zA-Z0-9_\-]+",  # Google OAuth tokens
+]
+
+
+def compile_patterns(patterns: List[str]) -> List[re.Pattern]:
+    """Compile regex patterns for efficient matching."""
+    return [re.compile(p, re.IGNORECASE) for p in patterns]
+
+
+DENY_COMPILED = compile_patterns(DENY_PATTERNS)
+ASK_COMPILED = compile_patterns(ASK_PATTERNS)
+SENSITIVE_COMPILED = compile_patterns(SENSITIVE_CONTENT_PATTERNS)
+
+
+def check_file_path(file_path: str) -> Tuple[str, str]:
+    """Check if file path matches any security patterns.
+
+    Args:
+        file_path: Path to check
+
+    Returns:
+        Tuple of (decision, reason)
+        decision: "allow", "deny", or "ask"
+    """
+    # Normalize path for matching
+    normalized = file_path.replace("\\", "/")
+
+    # Check deny patterns first
+    for pattern in DENY_COMPILED:
+        if pattern.search(normalized):
+            return "deny", "Protected file: access denied for security reasons"
+
+    # Check ask patterns
+    for pattern in ASK_COMPILED:
+        if pattern.search(normalized):
+            return "ask", f"Critical config file: {Path(file_path).name}"
+
+    return "allow", ""
+
+
+def check_content_for_secrets(content: str) -> Tuple[bool, str]:
+    """Check if content contains sensitive data patterns.
+
+    Args:
+        content: Content to check
+
+    Returns:
+        Tuple of (has_secrets, description)
+    """
+    for pattern in SENSITIVE_COMPILED:
+        match = pattern.search(content)
+        if match:
+            # Don't reveal the actual secret or pattern
+            return True, "Detected sensitive data (credentials, API keys, or certificates)"
+
+    return False, ""
+
+
+def main() -> None:
+    """Main entry point for PreToolUse security guard hook.
+
+    Reads JSON input from stdin, checks for security concerns,
+    and outputs permission decision.
+    """
+    try:
+        # Read JSON input from stdin
+        input_data = json.load(sys.stdin)
+    except json.JSONDecodeError:
+        # Invalid JSON input - allow by default
+        sys.exit(0)
+
+    # Extract tool information
+    tool_name = input_data.get("tool_name", "")
+    tool_input = input_data.get("tool_input", {})
+
+    # Only process Write and Edit tools
+    if tool_name not in ("Write", "Edit"):
+        sys.exit(0)
+
+    # Get file path from tool input
+    file_path = tool_input.get("file_path", "")
+    if not file_path:
+        sys.exit(0)
+
+    # Check file path against patterns
+    decision, reason = check_file_path(file_path)
+
+    # For Write operations, also check content for secrets
+    if tool_name == "Write" and decision == "allow":
+        content = tool_input.get("content", "")
+        if content:
+            has_secrets, secret_reason = check_content_for_secrets(content)
+            if has_secrets:
+                decision = "deny"
+                reason = f"Content contains secrets: {secret_reason}"
+
+    # Build output based on decision
+    output: Dict[str, Any] = {}
+
+    if decision == "deny":
+        output = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": reason,
+            }
+        }
+        print(json.dumps(output))
+        sys.exit(0)
+
+    elif decision == "ask":
+        output = {
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "ask",
+                "permissionDecisionReason": reason,
+            }
+        }
+        print(json.dumps(output))
+        sys.exit(0)
+
+    else:
+        # Allow - no output needed (or suppress)
+        output = {"suppressOutput": True}
+        print(json.dumps(output))
+        sys.exit(0)
+
+
+if __name__ == "__main__":
+    main()

moai_adk/templates/.claude/hooks/moai/session_end__auto_cleanup.py

@@ -31,7 +31,11 @@ from typing import Any, Dict, List, Optional
 # Add module path
 sys.path.insert(0, str(Path(__file__).parent.parent.parent.parent / "src"))
 
-from lib.path_utils import find_project_root  # noqa: E402
+from lib.path_utils import (  # noqa: E402
+    ensure_moai_dir,
+    find_project_root,
+    get_safe_moai_path,
+)
 
 # Import unified timeout manager and Git operations manager
 try:
@@ -120,16 +124,18 @@ logger = logging.getLogger(__name__)
 
 
 def load_hook_timeout() -> int:
-    """Load hook timeout from config.json (default: 5000ms)
+    """Load hook timeout from config.yaml (default: 5000ms)
 
     Returns:
         Timeout in milliseconds
     """
     try:
-        config_file = Path(".moai/config/config.json")
+        import yaml
+
+        config_file = get_safe_moai_path("config/config.yaml")
         if config_file.exists():
             with open(config_file, "r", encoding="utf-8") as f:
-                config: Dict[str, Any] = json.load(f)
+                config: Dict[str, Any] = yaml.safe_load(f) or {}
                 return config.get("hooks", {}).get("timeout_ms", 5000)
     except Exception:
         pass
@@ -137,16 +143,18 @@ def load_hook_timeout() -> int:
 
 
 def get_graceful_degradation() -> bool:
-    """Load graceful_degradation setting from config.json (default: true)
+    """Load graceful_degradation setting from config.yaml (default: true)
 
     Returns:
         Whether graceful degradation is enabled
     """
     try:
-        config_file = Path(".moai/config/config.json")
+        import yaml
+
+        config_file = get_safe_moai_path("config/config.yaml")
         if config_file.exists():
             with open(config_file, "r", encoding="utf-8") as f:
-                config: Dict[str, Any] = json.load(f)
+                config: Dict[str, Any] = yaml.safe_load(f) or {}
                 return config.get("hooks", {}).get("graceful_degradation", True)
     except Exception:
         pass
@@ -172,13 +180,13 @@ def cleanup_old_files(config: Dict[str, Any]) -> Dict[str, int]:
         cleanup_days = cleanup_config.get("cleanup_days", 7)
         cutoff_date = datetime.now() - timedelta(days=cleanup_days)
 
-        # Clean up temporary files
-        temp_dir = Path(".moai/temp")
+        # Clean up temporary files (use safe path to prevent creation in wrong directory)
+        temp_dir = get_safe_moai_path("temp")
         if temp_dir.exists():
             stats["temp_cleaned"] = cleanup_directory(temp_dir, cutoff_date, None, patterns=["*"])
 
-        # Clean up cache files
-        cache_dir = Path(".moai/cache")
+        # Clean up cache files (use safe path to prevent creation in wrong directory)
+        cache_dir = get_safe_moai_path("cache")
         if cache_dir.exists():
             stats["cache_cleaned"] = cleanup_directory(cache_dir, cutoff_date, None, patterns=["*"])
 
@@ -256,9 +264,8 @@ def save_session_metrics(payload: Dict[str, Any]) -> bool:
         Success status
     """
     try:
-        # Create logs directory
-        logs_dir = Path(".moai/logs/sessions")
-        logs_dir.mkdir(parents=True, exist_ok=True)
+        # Create logs directory (use ensure_moai_dir for safe creation in project root)
+        logs_dir = ensure_moai_dir("logs/sessions")
 
         # Collect session information
         session_metrics = {
@@ -293,9 +300,8 @@ def save_work_state(payload: Dict[str, Any]) -> bool:
         Success status
     """
     try:
-        # Create memory directory
-        memory_dir = Path(".moai/memory")
-        memory_dir.mkdir(parents=True, exist_ok=True)
+        # Create memory directory (use ensure_moai_dir for safe creation in project root)
+        ensure_moai_dir("memory")
 
         # Collect work state
         work_state = {
@@ -307,7 +313,7 @@ def save_work_state(payload: Dict[str, Any]) -> bool:
         }
 
         # Save state
-        state_file = memory_dir / "last-session-state.json"
+        state_file = get_safe_moai_path("memory/last-session-state.json")
         with open(state_file, "w", encoding="utf-8") as f:
             json.dump(work_state, f, indent=2, ensure_ascii=False)
 
@@ -492,8 +498,8 @@ def extract_specs_from_memory() -> List[str]:
     specs = []
 
     try:
-        # Query recent SPECs from command_execution_state.json
-        state_file = Path(".moai/memory/command-execution-state.json")
+        # Query recent SPECs from command_execution_state.json (use safe path)
+        state_file = get_safe_moai_path("memory/command-execution-state.json")
         if state_file.exists():
             with open(state_file, "r", encoding="utf-8") as f:
                 state_data = json.load(f)
@@ -524,10 +530,8 @@ def scan_root_violations(config: Dict[str, Any]) -> List[Dict[str, str]]:
     violations = []
 
     try:
-        # Get project root
-        project_root = Path(".moai/config/config.json").parent.parent
-        if not project_root.exists():
-            project_root = find_project_root()
+        # Get project root (always use find_project_root for consistent behavior)
+        project_root = find_project_root()
 
         # Scan root directory
         for item in project_root.iterdir():