fix: address 11 CodeRabbit findings from PR #11

.github/ISSUE_TEMPLATE/security_vulnerability.md

@@ -10,23 +10,29 @@ labels: security
 Only use this template for low-severity or already-patched security concerns.
 
 ## Vulnerability Type
+
 <!-- e.g., command injection, path traversal, unsafe deserialization -->
 
 ## Affected Component
+
 <!-- e.g., core engine, CLI, feed producer, Python TUI -->
 
 ## Description
+
 A clear description of the vulnerability and its potential impact.
 
 ## Reproduction Steps
+
 1. Configuration or setup required
 2. Command or action to trigger
 3. Observable result
 
 ## Suggested Fix
+
 If you have a recommendation for how to fix this.
 
 ## Environment
+
 - hookwise version: (run `hookwise --version`)
 - Node.js version:
 - OS:

CONTRIBUTING.md

@@ -8,7 +8,7 @@ Thanks for your interest in contributing to hookwise! Here's how to get started.
 git clone https://github.com/vishnujayvel/hookwise.git
 cd hookwise
 npm install
-npm test          # 1440 tests via vitest
+npm test          # 1400+ tests via vitest
 npm run build     # tsup build
 npm run typecheck # tsc --noEmit
 ```
@@ -25,7 +25,7 @@ src/
   cli/            # CLI commands (init, doctor, status, stats, test, migrate)
   testing/        # HookRunner, HookResult, GuardTester
 
-tests/            # 1440+ tests
+tests/            # 1400+ tests
 recipes/          # 12 built-in recipes
 examples/         # Example configs
 ```

README.md

@@ -219,6 +219,4 @@ Key design choices: parameterized SQL everywhere, safe YAML parsing only, no `ev
 
 `git clone`, `npm install`, `npm test` (1,440 tests), `npm run build`. See [CONTRIBUTING.md](CONTRIBUTING.md).
 
-[MIT](LICENSE) -- Built by [Vishnu](https://github.com/vishnujayvel). *Born from the gap between how fast AI makes you feel — and how fast you actually are.*
-</content>
-</invoke>
+[MIT](LICENSE) -- Built by [Vishnu](https://github.com/vishnujayvel). *Born from the gap between how fast AI makes you feel — and how fast you actually are.*

SECURITY.md

@@ -11,8 +11,8 @@
 
 If you discover a security vulnerability, please report it responsibly:
 
-1. **Do not** open a public issue
-2. Email **vishnu@hookwise.dev** with a description, reproduction steps, and impact assessment
+1. **For sensitive vulnerabilities**, email **vishnu@hookwise.dev** with a description, reproduction steps, and impact assessment. Do not open a public issue for exploitable or unpatched vulnerabilities.
+2. **For low-severity or already-patched issues**, you may use the [Security Vulnerability issue template](https://github.com/vishnujayvel/hookwise/issues/new?template=security_vulnerability.md).
 3. You will receive an acknowledgment within 48 hours
 4. We aim to release a fix within 7 days for confirmed vulnerabilities
 
@@ -51,6 +51,7 @@ The codebase enforces the following security practices by design:
 - **No `eval()` or `Function()`** -- Explicitly avoided throughout the codebase and documented in source comments.
 - **`execFileSync` for untrusted paths** -- Used where arguments could contain special characters (e.g., calendar credentials path).
 - **`spawnSync` without shell** -- The dispatcher passes handler arguments as array elements, preventing shell injection.
+- **Scoped `shell: true` usage** -- The status line renderer and test helper (`HookRunner`) use `shell: true` for trusted, locally-authored commands. The feed registry uses `exec()` for producer scripts defined in the user's own `hookwise.yaml` config (same trust level as a Makefile). These are intentional — external/untrusted input never reaches shell execution.
 
 ### File System
 - **Restrictive permissions** -- Database files use `0o600`; directories use `0o700` (owner-only).

docs/architecture.md

@@ -32,7 +32,8 @@ Any unhandled exception anywhere in the dispatch pipeline results in `exit 0`. h
 
 ## Feed Platform Architecture
 
-> **Diagram source:** feed-platform.excalidraw (in docs/assets/) -- open in [Excalidraw](https://excalidraw.com) for an editable hand-drawn version.
+> **Diagram:** Feed platform showing 8 producers polling data sources on staggered intervals, writing to an atomic cache bus, consumed by 21 status line segments.
+> **Source:** feed-platform.excalidraw (in docs/assets/) -- open in [Excalidraw](https://excalidraw.com) for an editable hand-drawn version.
 
 ```mermaid
 graph LR
@@ -95,9 +96,9 @@ src/
 tui/              # Interactive TUI (Python Textual)
   hookwise_tui/   # App, tabs, widgets, data readers
 
-tests/            # 1440+ tests across 61 test files
+tests/            # 1400+ tests across 61 test files
   core/           # Unit tests for each module
-  integration/    # End-to-end dispatch flow tests
+  integration/    # Mock-based integration tests (dispatch flow, pipeline wiring)
   performance/    # Benchmarks and import boundary tests
   cli/            # CLI command tests
 

docs/cli.md

@@ -46,7 +46,7 @@ hookwise migrate          Migrate from Python hookwise (v0.1.0) to TypeScript
 | Preset | What you get |
 |--------|-------------|
 | `minimal` | Guards only -- just the safety rails |
-| `coaching` | Guards + metacognition + builder's trap + status line |
+| `coaching` | Guards + metacognition + builder's trap + communication |
 | `analytics` | Guards + SQLite session tracking |
 | `full` | Everything enabled |
 
@@ -57,14 +57,14 @@ hookwise includes testing utilities so you can validate guards in CI:
 ```typescript
 import { GuardTester } from "hookwise/testing";
 
-const tester = new GuardTester("hookwise.yaml");
+const tester = new GuardTester({ configPath: "hookwise.yaml" });
 
 // Test blocking
-const blocked = tester.evaluate("Bash", { command: "rm -rf /" });
+const blocked = tester.testToolCall("Bash", { command: "rm -rf /" });
 expect(blocked.action).toBe("block");
 
 // Test allowing
-const allowed = tester.evaluate("Bash", { command: "ls -la" });
+const allowed = tester.testToolCall("Bash", { command: "ls -la" });
 expect(allowed.action).toBe("allow");
 ```
 

scripts/calendar-feed.py

@@ -84,6 +84,11 @@ def main():
         # full calendar scope (e.g., shared with Google Calendar MCP).
         # Both calendar and calendar.readonly work for read-only queries.
         creds = Credentials.from_authorized_user_file(TOKEN_PATH)
+        # Verify loaded scopes are compatible (must include calendar or calendar.readonly)
+        if creds and creds.scopes and not any(
+            s.endswith("calendar") or s.endswith("calendar.readonly") for s in creds.scopes
+        ):
+            creds = None  # Incompatible scopes — re-trigger OAuth
 
     if not creds or not creds.valid:
         if creds and creds.expired and creds.refresh_token:

src/cli/commands/init.tsx

@@ -103,7 +103,7 @@ function runInit(preset: string, dir: string): Step[] {
     try {
       let yamlContent: string;
       if (effectivePreset === "minimal") {
-        yamlContent = `# hookwise configuration\n# Preset: minimal\n# Docs: https://github.com/vishnujayvel/hookwise\n\nversion: 1\nguards: []\n`;
+        yamlContent = `# hookwise configuration\n# Preset: minimal\n# Docs: https://github.com/vishnujayvel/hookwise\n\nversion: 1\nguards: []\ntui:\n  auto_launch: true\n`;
       } else {
         const config = applyPreset(getDefaultConfig(), effectivePreset);
         const snakeCased = deepCamelToSnake(config);

src/core/tui-launcher.ts

@@ -212,9 +212,10 @@ export function launchTui(config: TuiConfig, pidPath?: string): boolean {
       // Note: osascript is transient — its PID is not the python3 PID, so we
       // skip PID-based duplicate prevention for newWindow mode.
       const pythonCmd = resolveTuiPython();
+      const escapedCmd = pythonCmd.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
       const child = spawn(
         "osascript",
-        ["-e", `tell application "Terminal" to do script "${pythonCmd} -m hookwise_tui"`],
+        ["-e", `tell application "Terminal" to do script "${escapedCmd} -m hookwise_tui"`],
         {
           detached: true,
           stdio: "ignore",

tests/core/tui-launcher.test.ts

@@ -178,7 +178,7 @@ describe("launchTui", () => {
 
     expect(mockedSpawn).toHaveBeenCalledWith(
       "osascript",
-      ["-e", 'tell application "Terminal" to do script "python3 -m hookwise_tui"'],
+      ["-e", expect.stringContaining("-m hookwise_tui")],
       expect.objectContaining({ detached: true, stdio: "ignore" }),
     );
   });
@@ -213,7 +213,7 @@ describe("launchTui", () => {
     launchTui(config, pidPath);
 
     expect(mockedSpawn).toHaveBeenCalledWith(
-      "python3",
+      expect.stringContaining("python3"),
       ["-m", "hookwise_tui"],
       expect.objectContaining({ detached: true, stdio: "ignore" }),
     );