chore(deps): bump markdown-it from 14.1.0 to 14.1.1

.claude/hooks/format-prettier.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit early if no file path
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Run Prettier on the specific file
+OUTPUT=$(cd "$CLAUDE_PROJECT_DIR" && pnpm exec prettier --write --ignore-unknown --no-error-on-unmatched-pattern "$FILE_PATH" 2>&1) || EXIT_CODE=$?
+
+if [[ ${EXIT_CODE:-0} -ne 0 && -n "$OUTPUT" ]]; then
+  echo "$OUTPUT" >&2
+  exit 2
+fi
+
+exit 0

.claude/hooks/guard-critical-files.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit early if no file path
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Resolve to a path relative to the project directory for consistent matching
+REL_PATH="${FILE_PATH#"$CLAUDE_PROJECT_DIR"/}"
+
+# Protected slow-layer infrastructure files
+PROTECTED_FILES=(
+  "pnpm-workspace.yaml"
+  "commitlint.config.js"
+  "release.config.cjs"
+  "package.json"
+  "pnpm-lock.yaml"
+  ".nvmrc"
+  ".husky"
+  "config"
+)
+
+# Check if the file is a root-level protected file
+BASENAME=$(basename "$REL_PATH")
+DIRNAME=$(dirname "$REL_PATH")
+
+for PROTECTED in "${PROTECTED_FILES[@]}"; do
+  # Only protect root-level files (dirname is . or matches project dir)
+  if [[ "$BASENAME" == "$PROTECTED" && ("$DIRNAME" == "." || "$FILE_PATH" == "$CLAUDE_PROJECT_DIR/$PROTECTED") ]]; then
+    echo "BLOCKED: '$PROTECTED' is a critical infrastructure file (slow-layer)." >&2
+    echo "These files affect the entire monorepo and should only be modified when the user explicitly requests it." >&2
+    echo "If the user has asked for this change, re-run the command to confirm." >&2
+    exit 2
+  fi
+done
+
+exit 0

.claude/hooks/guard-destructive.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+# Exit early if not a git command
+if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE '^\s*git\s'; then
+  exit 0
+fi
+
+block() {
+  echo "BLOCKED: Destructive git operation detected." >&2
+  echo "  Command: $COMMAND" >&2
+  echo "  Reason: $1." >&2
+  echo "" >&2
+  echo "Per AGENTS.md policy, destructive git operations require explicit user confirmation." >&2
+  echo "If the user has explicitly requested this operation, ask them to run it manually." >&2
+  exit 2
+}
+
+echo "$COMMAND" | grep -qF "reset --hard"   && block "git reset --hard discards all uncommitted changes irreversibly"
+echo "$COMMAND" | grep -qF "push --force"    && block "git push --force can overwrite remote history and destroy teammates' work"
+echo "$COMMAND" | grep -qF "push -f"         && block "git push -f can overwrite remote history and destroy teammates' work"
+echo "$COMMAND" | grep -qF "clean -f"        && block "git clean -f permanently deletes untracked files"
+echo "$COMMAND" | grep -qF "checkout -- ."   && block "git checkout -- . discards all unstaged changes irreversibly"
+echo "$COMMAND" | grep -qF "branch -D"       && block "git branch -D force-deletes a branch without merge checks"
+
+exit 0

.claude/hooks/guard-package-manager.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+# Exit early if empty or not an npm/yarn command
+if [[ -z "$COMMAND" ]]; then
+  exit 0
+fi
+
+block() {
+  echo "BLOCKED: Wrong package manager detected." >&2
+  echo "  Command: $COMMAND" >&2
+  echo "  Reason: $1." >&2
+  echo "" >&2
+  echo "This project uses pnpm exclusively. Replace '$2' with '$3' and try again." >&2
+  exit 2
+}
+
+# Block npm and npx
+if echo "$COMMAND" | grep -qE '(^|\s|&&|\|\||;)npm(\s|$)'; then
+  block "npm is not the package manager for this monorepo" "npm" "pnpm"
+fi
+
+if echo "$COMMAND" | grep -qE '(^|\s|&&|\|\||;)npx(\s|$)'; then
+  block "Use 'pnpm dlx' instead of 'npx' in this monorepo" "npx" "pnpm dlx"
+fi
+
+# Block yarn
+if echo "$COMMAND" | grep -qE '(^|\s|&&|\|\||;)yarn(\s|$)'; then
+  block "yarn is not the package manager for this monorepo" "yarn" "pnpm"
+fi
+
+exit 0

.claude/hooks/lint-commitlint.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+# Exit early if not a git commit command
+if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE '^\s*git\s+commit\b'; then
+  exit 0
+fi
+
+# Extract commit message header (first line) from -m flag
+# Supports: -m "msg", -m 'msg', -m "$(cat <<'EOF'\n...\nEOF\n)"
+MSG=""
+if echo "$COMMAND" | grep -qE '\$\(cat\s+<<'; then
+  # HEREDOC pattern: jq decodes JSON \n to real newlines, so the command is multi-line.
+  # Extract the first non-blank content line after the <<...EOF marker line.
+  MSG=$(echo "$COMMAND" | awk '
+    /<<.*EOF/ { found=1; next }
+    found && /^[[:space:]]*$/ { next }
+    found && /^[[:space:]]*EOF[[:space:]]*$/ { exit }
+    found { sub(/^[[:space:]]+/, ""); print; exit }
+  ')
+elif echo "$COMMAND" | grep -qE "\-m\s+'"; then
+  # Single-quoted message
+  MSG=$(echo "$COMMAND" | sed -n "s/.*-m[[:space:]]*'\\([^']*\\)'.*/\\1/p" | head -1)
+elif echo "$COMMAND" | grep -qE '\-m\s+"'; then
+  # Double-quoted message
+  MSG=$(echo "$COMMAND" | sed -n 's/.*-m[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
+fi
+
+# If we couldn't extract a message, let git handle validation
+if [[ -z "$MSG" ]]; then
+  exit 0
+fi
+
+# Run commitlint on the extracted message
+echo "$MSG" | pnpm exec commitlint 2>&1

.claude/hooks/lint-eslint.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit early if no file path
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Only lint .ts, .js, and .css files
+case "$FILE_PATH" in
+  *.ts|*.js|*.css) ;;
+  *) exit 0 ;;
+esac
+
+# Skip directories that should not be linted
+case "$FILE_PATH" in
+  */dist/*|*/node_modules/*|*/__screenshots__/*|*/generated/*) exit 0 ;;
+esac
+
+# Resolve the project directory by walking up from the file looking for eslint.config.js
+DIR=$(dirname "$FILE_PATH")
+PROJECT_DIR=""
+while [[ "$DIR" != "/" && "$DIR" != "." ]]; do
+  if [[ -f "$DIR/eslint.config.js" ]]; then
+    PROJECT_DIR="$DIR"
+    break
+  fi
+  DIR=$(dirname "$DIR")
+done
+
+# Exit if no eslint config found (e.g., root-level files)
+if [[ -z "$PROJECT_DIR" ]]; then
+  exit 0
+fi
+
+# Compute the file path relative to the project directory
+REL_PATH=$(realpath --relative-to="$PROJECT_DIR" "$FILE_PATH" 2>/dev/null) || REL_PATH="${FILE_PATH#"$PROJECT_DIR"/}"
+
+# Rules that should warn but not block (transient during refactoring)
+SOFT_RULES="no-unused-vars|@typescript-eslint/no-unused-vars"
+
+# Run ESLint with JSON output to classify errors
+JSON_OUTPUT=$(cd "$PROJECT_DIR" && pnpm exec eslint -c ./eslint.config.js --no-warn-ignored --cache --cache-location .eslintcache/ --format json "$REL_PATH" 2>/dev/null) || true
+
+# Check if there are any hard errors (not in the soft rules list)
+HARD_ERRORS=$(echo "$JSON_OUTPUT" | jq -r --arg soft "$SOFT_RULES" '
+  [.[].messages[] | select(.severity == 2) | select(.ruleId | test($soft) | not)] | length
+') 2>/dev/null || HARD_ERRORS="0"
+
+TOTAL_ERRORS=$(echo "$JSON_OUTPUT" | jq -r '
+  [.[].messages[] | select(.severity == 2)] | length
+') 2>/dev/null || TOTAL_ERRORS="0"
+
+# No errors at all — pass silently
+if [[ "$TOTAL_ERRORS" == "0" ]]; then
+  exit 0
+fi
+
+# Get human-readable output for display
+READABLE=$(cd "$PROJECT_DIR" && pnpm exec eslint -c ./eslint.config.js --no-warn-ignored --color --cache --cache-location .eslintcache/ "$REL_PATH" 2>&1) || true
+
+if [[ "$HARD_ERRORS" != "0" ]]; then
+  # Hard errors present — block
+  echo "$READABLE" >&2
+  exit 2
+else
+  # Only soft errors (unused vars/imports) — warn but don't block
+  echo "$READABLE" >&2
+  exit 0
+fi

.claude/hooks/lint-stylelint.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit early if no file path
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Only lint .css files
+case "$FILE_PATH" in
+  *.css) ;;
+  *) exit 0 ;;
+esac
+
+# Skip directories that should not be linted
+case "$FILE_PATH" in
+  */dist/*|*/node_modules/*|*/vendor/*) exit 0 ;;
+esac
+
+# Resolve the repo root (location of stylelint.config.mjs)
+REPO_ROOT="$CLAUDE_PROJECT_DIR"
+
+# Walk up from the file to find the nearest package.json with a lint:style wireit task
+DIR=$(dirname "$FILE_PATH")
+PROJECT_DIR=""
+while [[ "$DIR" != "/" && "$DIR" != "." ]]; do
+  if [[ -f "$DIR/package.json" ]] && jq -e '.wireit["lint:style"]' "$DIR/package.json" >/dev/null 2>&1; then
+    PROJECT_DIR="$DIR"
+    break
+  fi
+  DIR=$(dirname "$DIR")
+done
+
+# Exit if no matching project found (file is in a project without stylelint)
+if [[ -z "$PROJECT_DIR" ]]; then
+  exit 0
+fi
+
+# Compute the file path relative to the project directory
+REL_PATH=$(realpath --relative-to="$PROJECT_DIR" "$FILE_PATH" 2>/dev/null) || REL_PATH="${FILE_PATH#"$PROJECT_DIR"/}"
+
+# Run Stylelint from the project directory
+OUTPUT=$(cd "$PROJECT_DIR" && pnpm exec stylelint --config="$REPO_ROOT/stylelint.config.mjs" --color "$REL_PATH" 2>&1) || EXIT_CODE=$?
+
+if [[ ${EXIT_CODE:-0} -ne 0 && -n "$OUTPUT" ]]; then
+  echo "$OUTPUT" >&2
+  exit 2
+fi
+
+exit 0

.claude/hooks/lint-vale.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit early if no file path
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+# Only lint .md and .ts files
+case "$FILE_PATH" in
+  *.md|*.ts) ;;
+  *) exit 0 ;;
+esac
+
+# Skip test files and excluded paths (matches vale --glob exclusions)
+case "$FILE_PATH" in
+  *.test.*|*/starters/*|*/404/*|*/vendor/*|*/changelog/*|*/icons/*|*/generated/*|*/dist/*|*/LICENSE*|*/CHANGELOG*) exit 0 ;;
+esac
+
+# Skip Claude plan and memory files
+case "$FILE_PATH" in
+  */.claude/plans/*|*/.claude/projects/*) exit 0 ;;
+esac
+
+# Run Vale on the specific file
+OUTPUT=$(cd "$CLAUDE_PROJECT_DIR" && config/vale/bin/vale --config .vale.ini "$FILE_PATH" 2>&1) || EXIT_CODE=$?
+
+if [[ ${EXIT_CODE:-0} -ne 0 && -n "$OUTPUT" ]]; then
+  echo "$OUTPUT" >&2
+  exit 2
+fi
+
+exit 0

.claude/hooks/session-start.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INPUT=$(cat)
+
+NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
+if [[ ! -s "$NVM_DIR/nvm.sh" ]]; then
+  echo "nvm not found at $NVM_DIR/nvm.sh" >&2
+  exit 0
+fi
+
+source "$NVM_DIR/nvm.sh"
+
+cd "$CLAUDE_PROJECT_DIR"
+
+nvm install 2>&1 >/dev/null
+corepack enable 2>&1 >/dev/null
+corepack prepare --activate 2>&1 >/dev/null
+
+INSTALL_OUTPUT=$(pnpm i --frozen-lockfile --prefer-offline 2>&1) || {
+  echo "pnpm install failed:" >&2
+  echo "$INSTALL_OUTPUT" >&2
+  exit 0
+}
+
+NODE_V=$(node --version)
+PNPM_V=$(pnpm --version)
+echo "Environment ready: node $NODE_V, pnpm $PNPM_V. Dependencies installed."

.claude/hooks/stop.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -e
+cd "$CLAUDE_PROJECT_DIR" 2>/dev/null || cd "$(git rev-parse --show-toplevel)" 2>/dev/null || exit 0
+pnpm run agent:stop