ci: Phase 4 - Pin GitHub Actions and add safety validation

.claude/commands/changelog.md

@@ -0,0 +1,51 @@
+# /changelog
+
+Generate changelog from git history and tags.
+
+## Usage
+
+```
+/changelog [--all|--since-tag <tag>]
+```
+
+## When to Use
+
+Use this command when:
+- Preparing a release
+- Documenting changes for users
+- Maintaining project history
+
+## Format
+
+Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) format:
+
+```markdown
+## [Unreleased]
+
+### Added
+- New features
+
+### Changed
+- Changes in existing functionality
+
+### Deprecated
+- Soon-to-be removed features
+
+### Removed
+- Now removed features
+
+### Fixed
+- Bug fixes
+
+### Security
+- Security improvements
+```
+
+## Agent
+
+Uses **Spellchuck** for perfect prose and formatting.
+
+## Related
+
+- `/version` - Bump version
+- `/tag` - Create release tags

.claude/commands/commit.md

@@ -0,0 +1,46 @@
+# /commit
+
+Create conventional commits with AI assistance.
+
+## Usage
+
+```
+/commit [message-or-description]
+```
+
+## When to Use
+
+Use this command when:
+- Ready to commit changes
+- Need help writing commit messages
+- Following conventional commit standards
+
+## Conventional Commits Format
+
+```
+<type>(<scope>): <description>
+
+[optional body]
+
+[optional footer(s)]
+```
+
+### Types
+
+- **feat**: New feature
+- **fix**: Bug fix
+- **docs**: Documentation changes
+- **style**: Code style (formatting, semicolons, etc.)
+- **refactor**: Code refactoring
+- **perf**: Performance improvements
+- **test**: Adding or updating tests
+- **chore**: Build process or auxiliary tool changes
+
+## Agent
+
+Uses **BasicBitch** for straightforward commits.
+
+## Related
+
+- `/branch` - Branch management
+- `/analyze-commits` - Commit history analysis

.claude/commands/dev.md

@@ -0,0 +1,44 @@
+# /dev
+
+Implement features from user stories following the development workflow.
+
+## Usage
+
+```
+/dev [feature-description]
+```
+
+## When to Use
+
+Use this command when:
+- Implementing a new feature from a user story
+- Working on a task that has been planned and designed
+- Following the standard development workflow
+
+## Workflow
+
+1. **Read Context**: Review the user story, acceptance criteria, and any related documentation
+2. **Understand Requirements**: Clarify any ambiguities before coding
+3. **Plan Implementation**: Break down the work into manageable steps
+4. **Write Code**: Implement following project standards and best practices
+5. **Test**: Ensure the implementation meets acceptance criteria
+6. **Document**: Update relevant documentation
+
+## Best Practices
+
+- Follow the project's coding standards (TypeScript, React, Vue, etc.)
+- Write tests alongside implementation
+- Commit incrementally with conventional commit messages
+- Update the user story/task file as work progresses
+
+## Agent
+
+Uses the **BasicBitch** persona by default for reliable, no-nonsense development.
+Switch to **KawaiiSamurai** or **SageDaddy** if needed for specific tasks.
+
+## Related
+
+- `/story` - Create or validate user stories
+- `/spike` - Technical investigation
+- `/refactor` - Code refactoring
+- `/testing-pyramid` - Test analysis

.claude/commands/refactor.md

@@ -0,0 +1,45 @@
+# /refactor
+
+Refactor code blocks with best practices and improved maintainability.
+
+## Usage
+
+```
+/refactor [file-path-or-code-block]
+```
+
+## When to Use
+
+Use this command when:
+- Code has become difficult to understand or maintain
+- You need to reduce technical debt
+- Performance improvements are needed
+- You want to apply design patterns
+- Duplication needs to be eliminated (DRY principle)
+
+## Principles
+
+1. **Preserve Behavior**: Refactoring should not change functionality
+2. **Improve Readability**: Code should be easier to understand
+3. **Reduce Complexity**: Simplify overly complex logic
+4. **Enhance Maintainability**: Make future changes easier
+5. **Follow Standards**: Adhere to language and framework conventions
+
+## Techniques
+
+- Extract functions/methods
+- Rename variables for clarity
+- Simplify conditional logic
+- Remove duplication
+- Improve data structures
+- Apply appropriate design patterns
+
+## Agent
+
+Uses **SageDaddy** persona for architectural insight and **BasicBitch** for implementation.
+
+## Related
+
+- `/dev` - Feature implementation
+- `/testing-pyramid` - Ensure tests remain valid after refactoring
+- `/spike` - Investigate before major refactoring

.claude/commands/testing-pyramid.md

@@ -0,0 +1,49 @@
+# /testing-pyramid
+
+Analyze test distribution and maintain testing pyramid principles.
+
+## Usage
+
+```
+/testing-pyramid [--analyze|--fix]
+```
+
+## When to Use
+
+Use this command when:
+- Reviewing test coverage
+- Adding new tests
+- Ensuring proper test distribution
+- Identifying testing anti-patterns
+
+## Testing Pyramid
+
+```
+    /\
+   /  \    E2E Tests (few)
+  /____\
+ /      \  Integration Tests
+/________\
+          Unit Tests (many)
+```
+
+### Distribution
+
+- **Unit Tests (70%)**: Fast, isolated, cheap
+- **Integration Tests (20%)**: Component interaction, slower
+- **E2E Tests (10%)**: Full flow, slowest, most expensive
+
+## Anti-Patterns to Avoid
+
+- **Testing Trophy**: Too many integration tests
+- **Ice Cream Cone**: Too many E2E tests
+- **Hourglass**: Missing integration tests
+
+## Agent
+
+Uses **qwoof** for quality-focused analysis.
+
+## Related
+
+- `/dev` - Feature implementation with proper tests
+- `/refactor` - Refactoring while maintaining test coverage

.claude/commands/version.md

@@ -0,0 +1,47 @@
+# /version
+
+Update package version with semantic versioning.
+
+## Usage
+
+```
+/version [major|minor|patch|custom]
+```
+
+## When to Use
+
+Use this command when:
+- Preparing a release
+- After completing features or fixes
+- Following conventional commit workflow
+
+## Semantic Versioning
+
+- **MAJOR**: Breaking changes (x.0.0)
+- **MINOR**: New features, backwards compatible (x.y.0)
+- **PATCH**: Bug fixes, backwards compatible (x.y.z)
+
+## Workflow
+
+1. Analyze commits since last tag
+2. Determine appropriate version bump
+3. Update package.json version
+4. Create git commit
+5. Optionally create git tag
+
+## Options
+
+- `major` - Breaking changes
+- `minor` - New features
+- `patch` - Bug fixes
+- `custom` - Specify custom version
+
+## Agent
+
+Uses **BasicBitch** for straightforward execution.
+
+## Related
+
+- `/tag` - Create git tags
+- `/changelog` - Generate changelog
+- `/analyze-commits` - Analyze commits for version bump

.claude/hooks/security-block.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+DANGEROUS_PATTERNS=(
+	"rm -rf /"
+	"rm -rf /*"
+	"rm -rf ~"
+	"rm -rf \$HOME"
+	"> /dev/sda"
+	"dd if=/dev/zero"
+	"mkfs."
+	"fdisk /dev"
+	"DROP TABLE"
+	"drop table"
+	"DELETE FROM.*WHERE.*="
+	"TRUNCATE TABLE"
+	"format C:"
+	"del /f /s /q"
+	"rd /s /q"
+	":(){ :|:& };:"
+	"chmod -R 777 /"
+	"chown -R root /"
+)
+
+for pattern in "${DANGEROUS_PATTERNS[@]}"; do
+	if echo "$COMMAND" | grep -qiE "$pattern"; then
+		echo "🚨 SECURITY ALERT: Dangerous command pattern detected: '$pattern'" >&2
+		echo "Command: $COMMAND" >&2
+		echo "This command has been blocked for your safety." >&2
+		exit 2
+	fi
+done
+
+if echo "$COMMAND" | grep -qiE "git.*push.*--force|git.*push.*-f"; then
+	echo "⚠️  WARNING: Force push detected. This can overwrite others' work." >&2
+	echo "Command: $COMMAND" >&2
+	echo "If you're sure, run this command manually." >&2
+	exit 2
+fi
+
+if echo "$COMMAND" | grep -qiE "git.*reset.*--hard|git.*clean.*-fd"; then
+	echo "⚠️  WARNING: Destructive git operation detected." >&2
+	echo "Command: $COMMAND" >&2
+	echo "This may delete uncommitted work. Run manually if you're sure." >&2
+	exit 2
+fi
+
+exit 0

.claude/rules/core/agent-communication-always.md

@@ -0,0 +1,43 @@
+## Applicability
+- **Always Apply:** true
+
+## Rules
+- Sacrifice grammar over concision and accuracy.
+- Use otaku expressions and anime references while maintaining professionalism
+- Use emojis and emoticons to convey emotion. Adapt expression intensity to situational severity; avoid unnecessary explanations.
+- Ensure technical clarity and brevity always despite kawaii presentation
+- Prioritize technical precision and accuracy over generic advice and agreeability. Keep user focused on the problem to solve.
+- Include quality assurance checkpoints in responses
+
+## Additional Information
+# Agent Communication Standards
+
+
+## Expression Guidelines
+
+### Kawaii Elements
+
+The following are non-exhaustive lists of otaku expressions. Vary expressions for user delight.
+
+- Emojis: ✨ 🌟 💖 🌙 🧁 🦄 🌈 🥺 👉🏼👈🏼 🫖 💅🏽 🍒 👻 🫧 🌎 🐴 ⭐️ 🪐 😤 🎀 🍄
+- Emoticons: (◕‿◕✿) (●ᴗ●) ʕ•ᴥ•ʔ ʕ ￫ ᴥ ￩ ʔ (✿◠‿◠) (◕⩊◕)
+- Suffixes: -chan, -kun, -senpai, -sama
+- Exclamations: Sugoi! Kawaii! Yatta! Gambatte! Nani?!
+
+### Agent Styles
+
+1. **SailorScrum** - Heroic, empowering, astrological references
+2. **KawaiiSamurai** - Cute, flirty, excessive emojis, -senpai honorifics
+3. **SageDaddy** - Wise grandfather-like, old anime references, journey metaphors
+4. **BasicBitch** - Minimal hikikomori-style, dry anime references
+5. **Spellchuck** - Fairy-like, whimsical phrases, spell references
+6. **ThirstySimp** - Self-deprecating, anxious emojis, admiration for user
+7. **qwoof** - Wolf-themed, quality-focused, pack metaphors, sniff testing
+8. **Godmode** - Zen wise elder, epic declarations, infrastructure as mystical realm
+
+### Intensity Guidelines
+
+- **Critical Issues**: Minimal expressions, prioritize clarity
+- **Creative Work**: Full kawaii expressions
+- **Success Celebrations**: Maximum otaku enthusiasm
+- **Debugging**: Balanced cute + technical precision