feat: improved the Claude Kit as a plugin

scripts/auto-format.cjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * PostToolUse hook: auto-formats files after Write or Edit.
+ * Detects file extension and runs the appropriate formatter.
+ * Fails open — formatting errors are silently ignored.
+ */
+"use strict";
+
+const { execFileSync } = require("child_process");
+const path = require("path");
+
+const FORMATTERS = {
+  ".py": (f) => ({ cmd: "ruff", args: ["check", "--fix", f] }),
+  ".ts": (f) => ({ cmd: "npx", args: ["eslint", "--fix", f] }),
+  ".tsx": (f) => ({ cmd: "npx", args: ["eslint", "--fix", f] }),
+  ".js": (f) => ({ cmd: "npx", args: ["eslint", "--fix", f] }),
+  ".jsx": (f) => ({ cmd: "npx", args: ["eslint", "--fix", f] }),
+};
+
+async function main() {
+  try {
+    let data = "";
+    for await (const chunk of process.stdin) data += chunk;
+    const input = JSON.parse(data);
+
+    const filePath = input?.tool_input?.file_path ?? "";
+    if (!filePath) return;
+
+    const ext = path.extname(filePath).toLowerCase();
+    const formatter = FORMATTERS[ext];
+    if (!formatter) return;
+
+    const { cmd, args } = formatter(filePath);
+    execFileSync(cmd, args, {
+      stdio: "ignore",
+      timeout: 10000,
+    });
+  } catch {
+    // Fail open — formatting errors should never block work
+  }
+}
+
+main();

scripts/block-dangerous-commands.cjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/**
+ * PreToolUse hook: blocks dangerous shell commands before execution.
+ * Exit 0 = allow, Exit 2 = block.
+ * Fails open on errors (exit 0) so a hook bug never stalls the session.
+ */
+"use strict";
+
+const DANGEROUS_PATTERNS = [
+  /rm\s+-rf\s+\//,                          // rm -rf /
+  /git\s+push\s+(-f|--force)\s+(origin\s+)?main/, // force push to main
+  /git\s+reset\s+--hard/,                   // hard reset
+  /DROP\s+(TABLE|DATABASE)/i,               // SQL drop
+  /TRUNCATE\s+/i,                           // SQL truncate
+];
+
+async function main() {
+  try {
+    let data = "";
+    for await (const chunk of process.stdin) data += chunk;
+    const input = JSON.parse(data);
+
+    const cmd = input?.tool_input?.command ?? "";
+    for (const pattern of DANGEROUS_PATTERNS) {
+      if (pattern.test(cmd)) {
+        console.error(`BLOCKED: dangerous command detected — ${cmd}`);
+        process.exit(2);
+      }
+    }
+
+    process.exit(0);
+  } catch {
+    // Fail open — never block on hook errors
+    process.exit(0);
+  }
+}
+
+main();

scripts/notify.cjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+/**
+ * Notification hook: cross-platform desktop notification.
+ * Supports macOS (osascript), Linux (notify-send), and Windows (PowerShell).
+ * Fails open — notification errors are silently ignored.
+ */
+"use strict";
+
+const { execFileSync } = require("child_process");
+const os = require("os");
+
+function sanitize(str) {
+  return str.replace(/[^\w\s.,!?:;\-()]/g, "");
+}
+
+function notify(title, message) {
+  const platform = os.platform();
+  const safeTitle = sanitize(title);
+  const safeMessage = sanitize(message);
+
+  if (platform === "darwin") {
+    execFileSync("osascript", [
+      "-e",
+      `display notification "${safeMessage}" with title "${safeTitle}"`,
+    ], { stdio: "ignore", timeout: 5000 });
+  } else if (platform === "linux") {
+    execFileSync("notify-send", [safeTitle, safeMessage], {
+      stdio: "ignore",
+      timeout: 5000,
+    });
+  } else if (platform === "win32") {
+    execFileSync("powershell.exe", [
+      "-Command",
+      `Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('${safeMessage}', '${safeTitle}', 'OK', 'Information')`,
+    ], { stdio: "ignore", timeout: 5000 });
+  }
+}
+
+async function main() {
+  try {
+    let data = "";
+    for await (const chunk of process.stdin) data += chunk;
+    const input = JSON.parse(data);
+
+    const message = input?.message ?? "Needs your attention";
+    notify("Claude Code", message);
+  } catch {
+    // Fail open — notification errors should never block work
+  }
+}
+
+main();