3f8eb7406f
Skills are opt-in (I have to remember to invoke them). Hooks are
ambient — they fire on every matching event automatically. This PR
moves the careful-mode and learnings discipline from "doc I should
read" to "harness-enforced behavior I cannot bypass".
## 6 new hooks (.claude/hooks/)
- pre-bash-careful — REFUSES git push --force to main, rm -rf at root,
DROP TABLE against prod schema. WARNs on force-with-lease, gh pr/
issue close. Tested: blocks the destructive case, allows safe ones.
- pre-edit-freeze — implements /freeze. When .claude/freeze contains
a path glob, edits outside it are denied. Tested: edits to PLAN.md
blocked when scope locked to platform/internal/handlers/.
- session-start-context — auto-loads last 20 cron-learnings, freeze
status, open-PR/issue counts as additionalContext at session start.
Tested: emits valid SessionStart JSON.
- post-edit-audit — appends every Edit/Write to .claude/audit.jsonl
(gitignored). One-line records {ts, tool, file, ok}. Tested writes.
- user-prompt-tag — injects context warnings when prompt mentions
force-push, drop-table, "delete all", "push to main", etc. Tested:
emits warning for "force push the fix to main".
- subagent-stop-judge — off by default; touch .claude/judge-subagents
to enable. When on, prompts orchestrator to verify subagent's last
message addresses the original task. Cost-free MVP (no LLM call yet).
All hooks are Python (jq isn't on the hook PATH on macOS — Python is).
Shared helpers in _lib.py: read_input, deny_pretooluse, add_context,
warn_to_stderr.
## settings.json — wires all 6 hooks
Adds SessionStart, UserPromptSubmit, SubagentStop event handlers.
Existing PreToolUse:Bash + PostToolUse:Edit chains gain the new hooks
alongside the existing ones (check-inbox.sh, echo reminder).
Adds @modelcontextprotocol/server-sequential-thinking MCP server for
structured chain-of-thought scratchpad — useful when triaging multiple
PRs in parallel without losing context.
## .claude/commands/triage.md — slash command shortcut
Manual /triage runs the same flow as the c5074cd5 hourly cron, on
demand. Saves ~4KB of prompt every invocation by pulling the cron
prompt out of working memory.
## CLAUDE.md additions
New "Agent operating rules (auto-loaded — read first)" section right
after Ecosystem Context. Documents:
- Cron / triage discipline (read learnings, treat docs PRs touching
CLAUDE.md/PLAN.md as noteworthy, write per-tick reflections)
- Table of all 6 hooks active in this repo
- List of skills and how to invoke them
- Standing rules (inviolable) consolidated for the agent
This block auto-loads into every conversation context — free behavior
change without me remembering to opt in.
## .gitignore
audit.jsonl, freeze, judge-subagents, per-tick-reflections.md are all
local operational state, never committed.
## Verification
- echo '{"tool_input":{"command":"git push --force origin main"}}' |
bash pre-bash-careful.sh → emits deny JSON ✓
- Same for git status (safe command) → empty output, exit 0 ✓
- pre-edit-freeze with .claude/freeze=platform/handlers/ blocks
edits to PLAN.md, allows edits inside the locked path ✓
- post-edit-audit appends valid JSONL ✓
- session-start-context emits additionalContext with PR/issue counts ✓
- user-prompt-tag emits warning for "force push to main" prompt ✓
- python3 -c "json.load(open('.claude/settings.json'))" → valid ✓
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
116 lines
1.7 KiB
Plaintext
116 lines
1.7 KiB
Plaintext
# Binaries
|
|
platform/server
|
|
platform/molecli
|
|
*.exe
|
|
*.out
|
|
*.bin
|
|
|
|
# Go
|
|
*.test
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
|
|
# Build output
|
|
dist/
|
|
**/.next/
|
|
canvas/tsconfig.tsbuildinfo
|
|
canvas/next-env.d.ts
|
|
mcp-server/dist/
|
|
|
|
# Environment & secrets
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
.env.production
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# IDE
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
.venv/
|
|
venv/
|
|
*.egg-info/
|
|
.pytest_cache/
|
|
|
|
# Docker
|
|
*.log
|
|
|
|
# Local docker-compose overrides (per-developer port remaps, etc.)
|
|
docker-compose.override.yml
|
|
docker-compose.override.yaml
|
|
|
|
# Test / coverage
|
|
coverage/
|
|
.coverage
|
|
.coverage.*
|
|
.nyc_output/
|
|
test-results/
|
|
playwright-report/
|
|
|
|
# Databases (local dev)
|
|
*.db
|
|
*.sqlite
|
|
*.sqlite3
|
|
|
|
# Langfuse / ClickHouse / Docker volumes
|
|
langfuse_data/
|
|
clickhouse_data/
|
|
postgres_data/
|
|
redis_data/
|
|
|
|
# Auth tokens
|
|
.auth-token
|
|
|
|
# Awareness memory (local agent memory, not project code)
|
|
.awareness/
|
|
|
|
# Claude Code worktrees and runtime artifacts
|
|
.claude/worktrees/
|
|
.claude/scheduled_tasks.lock
|
|
.claude/audit.jsonl
|
|
.claude/freeze
|
|
.claude/judge-subagents
|
|
.claude/per-tick-reflections.md
|
|
|
|
# Workspace instance configs (auto-generated by provisioner, not templates)
|
|
workspace-configs-templates/ws-*
|
|
|
|
# Local dev cruft — provisioner writes here at runtime; templates live at repo root
|
|
platform/workspace-configs-templates/
|
|
|
|
# Codex/Gemini agent skill cache (local only, not authoritative)
|
|
.agents/
|
|
|
|
# Workspace runtime markers (written by agent containers, not committed)
|
|
.initial_prompt_done
|
|
|
|
# Exported bundles (may contain env vars / secrets)
|
|
*.bundle.json
|
|
|
|
# Logs
|
|
logs/
|
|
|
|
# Backups
|
|
backups/
|
|
docs/.vitepress/dist/
|
|
.claude-bridge/
|
|
org-templates/**/.env
|
|
org-templates/**/.auth-token
|
|
|
|
# Migration additions (2026-04-13)
|
|
.initial_prompt_done
|
|
.claude-bridge/
|
|
.claude/scheduled_tasks.json
|