pre-bash-dep-guard.sh

来自 cli/templates/level-2/

#!/usr/bin/env bash
set -euo pipefail
input=$(cat)
cmd=$(echo "$input" | jq -r '.tool_input.command // ""')

# Only intercept package install commands
if ! echo "$cmd" | grep -qE '(npm install|npm add|yarn add|pnpm add)'; then
  exit 0
fi

# Extract all package names (strip flags and versions)
pkgs=$(echo "$cmd" | sed -E 's/^(npm install|npm add|yarn add|pnpm add)[[:space:]]+//' | tr ' ' '\n' | grep -v '^-')

if [ -z "$pkgs" ]; then
  exit 0
fi

# Pass 1: Check all packages against banned list (blocking)
banned=("moment" "jquery" "lodash")
for pkg in $pkgs; do
  pkg=$(echo "$pkg" | sed 's/@.*//')
  [ -z "$pkg" ] && continue
  for b in "${banned[@]}"; do
    if [ "$pkg" = "$b" ]; then
      echo "BLOCKED: $pkg is in the banned dependency list. See docs/references/approved-deps.md for alternatives." >&2
      exit 2
    fi
  done
done

# Pass 2: Check allowlist (non-blocking warning)
if [ -f "docs/references/approved-deps.md" ]; then
  for pkg in $pkgs; do
    pkg=$(echo "$pkg" | sed 's/@.*//')
    [ -z "$pkg" ] && continue
    if ! grep -q "$pkg" docs/references/approved-deps.md; then
      echo "WARNING: $pkg is not in the approved dependency list. Evaluate before adding to docs/references/approved-deps.md." >&2
      exit 1
    fi
  done
fi

exit 0