feat(rules): add 4 migration-discipline PreToolUse rules

[lapc506]

Summary

Adds a new rule family — Database / migration discipline — that prevents the class of drift exposed when a teammate's PR shipped supabase/migrations/ files that did not auto-run on staging. The manual SQL Editor workaround introduced silent skew between the migrations directory and other devs' local databases. Future devs had no record that the migrations had ever been applied outside of timestamped files.

Pain pattern

1. PR merges with N new files in supabase/migrations/.
2. CI does not re-run migrations in target env (config gap, but real and recurrent).
3. Author resolves manually via SQL Editor / psql against *.supabase.co.
4. Other devs' local DBs are now out of sync with the migrations directory.
5. The next dev to run supabase db reset --local may hit conflicts, or worse, ship a follow-up migration that re-applies the same DDL.

The 4 new rules

Rule	Action	Tool surface	Intent
schema-sql-outside-migrations	block	Edit, Write, MultiEdit	Refuses ALTER/CREATE/DROP/GRANT/REVOKE/CREATE POLICY in any .sql file outside supabase/migrations/, supabase/tests/, or supabase/seed.
warn-psql-against-supabase-remote	warn	Bash	Nudges away from psql / SQL-Editor-style direct execution against any *.supabase.co host.
pr-create-with-migrations-needs-deploy-note	warn	Bash	Reminds the author to describe migration deployment in the gh pr create --body. Heuristic only — does not inspect the diff. Bypass marker for migration-free PRs.
block-supabase-db-push-prod	block	Bash	Hard stop on supabase db push aimed at the PRODUCTION project ref (ukwovawzehnebuoowcec). Only the create-release SOP may apply migrations to prod.

Each rule ships with a kebab-case bypass_marker for documented exceptions and a populated tests array (full coverage of positive matches, negative matches, and bypass behavior).

Test count

Before: 59 / 59 passed
After:  80 / 80 passed   (+21 new tests)

Version bump

1.6.0 → 1.7.0

Per semver, adding new enforcement rules is a feature add → minor bump. Bumped in:

• package.json
• .claude-plugin/plugin.json
• .claude-plugin/marketplace.json (top-level + nested plugin entry)

Test plan

• npm run build-rules — regenerates rules.json (14 → 18 rules)
• npm run test-hooks — 80 / 80 pass
• CI on feat/migration-discipline-hooks (Blacksmith runner) — npm run test-hooks + git diff hooks/rules/rules.json clean
• Greptile review — target 5/5

Notes for reviewers

• The rules use POSIX ERE ([[:space:]]+ not \s) consistent with the existing manifest.
• block-supabase-db-push-prod is layered on top of the existing destructive-db-ops rule. Both fire for a prod db push; the new rule has a narrower bypass marker (prod-db-push-approved) to make the prod-specific approval explicit.
• pr-create-with-migrations-needs-deploy-note is intentionally a heuristic — it cannot read the PR diff. Bypass marker is the escape hatch for migration-free PRs.

🤖 Generated with Claude Code

[lapc506]

@greptile review

[greptile-apps]

Greptile Summary

This PR introduces a "Database / migration discipline" rule family (4 new PreToolUse rules) to prevent the silent drift that occurs when Supabase migrations fail to auto-run in CI and a developer resorts to direct SQL execution against the live host. It also adds a per-install token-substitution layer to build-rules.mjs so the production project ref can be injected from a gitignored .private/substitutions.json without being committed to the public source tree.

• schema-sql-outside-migrations blocks DDL in any .sql file outside supabase/migrations/, supabase/tests/, or supabase/seed; CREATE INDEX/DROP INDEX are not yet in the pattern and the seed not_pattern is not delimited.
• warn-psql-against-supabase-remote and block-supabase-db-push-prod cover the direct-execution surface including pg_dump/pg_restore and --linked resolution with token-substituted project refs.
• pr-create-with-migrations-needs-deploy-note is an intentional heuristic that only inspects the inline --body string and explicitly documents its --body-file blind spot.

Confidence Score: 5/5

Safe to merge — the new rules are additive enforcement hooks with documented bypass markers; no runtime code path is altered and the substitution mechanism degrades gracefully to an inert rule when unconfigured.

All four rules carry full positive/negative/bypass test coverage and the only findings are minor pattern-coverage gaps (CREATE INDEX omission, loosely-anchored seed not_pattern) and a documentation clarification on regex safety for substitution values — none affect correctness of the existing test suite or runtime behavior.

hooks/rules/rules.yaml — the schema-sql-outside-migrations content pattern and the seed not_pattern anchor are worth tightening before the next rule iteration.

Important Files Changed

Filename	Overview
hooks/rules/rules.yaml	Adds 4 new migration-discipline rules with good test coverage; minor gaps in the schema-sql-outside-migrations pattern (missing CREATE/DROP INDEX, loosely-anchored seed not_pattern).
hooks/rules/rules.json	Generated artifact matching rules.yaml; placeholder tokens remain verbatim, which is the correct documented inert-state behavior for marketplace consumers.
scripts/build-rules.mjs	Adds a well-structured opt-in substitution layer; token validation is solid, but the 'literal string' comment slightly overstates safety since values are later consumed as ERE regex patterns.
hooks/rules/README.md	Documentation for the substitution mechanism and new rule family is clear and accurate.
.claude-plugin/marketplace.json	Version bumped from 1.6.0 to 1.7.0 consistently in both top-level and nested plugin entry.
.claude-plugin/plugin.json	Version bump only, no functional changes.
package.json	Version bump only, no functional changes.

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
hooks/rules/rules.yaml:714
The `not_pattern` for the seed directory is not path-anchored. Because `supabase/seed` is a prefix match with no trailing delimiter, it would also exempt any file whose path contains that substring — for example, `supabase/seedlings/setup.sql` or `supabase/seed_historical/fix.sql`. A more precise pattern would use a trailing `/` or `\.sql` to pin the match to the actual seed file or directory.

```suggestion
      not_pattern: '(supabase/migrations/|supabase/tests/|supabase/seed[./])'
```

### Issue 2 of 3
hooks/rules/rules.yaml:716
`CREATE INDEX` and `DROP INDEX` are DDL statements that modify the database schema and should live in versioned migration files, just like `ALTER TABLE` or `CREATE TABLE`. They are not currently in the content pattern, so a developer who writes `CREATE INDEX` in a script outside `supabase/migrations/` would bypass this rule entirely.

```suggestion
      pattern: '\b(ALTER TABLE|CREATE TABLE|DROP TABLE|CREATE INDEX|DROP INDEX|CREATE POLICY|DROP POLICY|GRANT |REVOKE |CREATE FUNCTION|DROP FUNCTION|CREATE TYPE|ALTER TYPE)\b'
```

### Issue 3 of 3
scripts/build-rules.mjs:848-851
**Substitution values land verbatim inside regex patterns**

The comment "no risk of $-backref interpolation in the replacement" is accurate for the JS string substitution step, but the substituted value is then interpreted as a POSIX ERE regex by the hook engine at runtime. If a consumer sets `PROD_SUPABASE_REF` to a value containing regex metacharacters (`.`, `+`, `(`, `|`, etc.), those characters will be treated as operators in the compiled pattern, not as literals. Supabase project refs are typically alphanumeric so this is unlikely in practice, but the comment and the README could note that token values must be regex-safe (alphanumeric and hyphens only for project refs).

_{Reviews (2): Last reviewed commit: "fix(rules): address Greptile review on m..." | Re-trigger Greptile}

[lapc506]

Round 2: addressed all 4 Greptile findings. See commit e930eba.

1. Marketplace-safe prod ref — Hardcoded ukwovawzehnebuoowcec / xepaexmpawtpqtilhcpw replaced with __PROD_SUPABASE_REF__ / __STAGING_SUPABASE_REF__ placeholders. New build-time substitution layer in scripts/build-rules.mjs reads .private/substitutions.json (gitignored, UPPER_SNAKE token map) and swaps placeholders before YAML parse. Without the config, placeholders remain inert. Documented in hooks/rules/README.md.

2. --linked coverage — Pattern extended to match __PROD_SUPABASE_REF__ OR --linked\b. Two new tests for the --linked path.

3. --body-file false-positive — Tightened positive pattern to require --body followed by space / = / EOL; added not_pattern: '--body-file' as defense in depth. New test exercises gh pr create --body-file.

4. pg_dump / pg_restore coverage — Extended pattern to \b(psql|pg_dump|pg_restore|pg_dumpall)\b.*\.supabase\.co. Two new tests.

Test count: 80 -> 86 (all pass locally).

@greptile review