@hivehub/rulebook 5.5.2 → 5.8.0

package/templates/hooks/check-context-and-handoff.sh

@@ -3,8 +3,10 @@
 #
 # Runs after every model turn. Estimates the current context usage
 # from the JSONL transcript and, when it exceeds the configured
-# threshold, emits additionalContext instructing the model to invoke
-# the /handoff skill and tell the user to type /clear.
+# threshold, instructs the model to invoke the /handoff skill and tell
+# the user to type /clear. The Stop event has no `additionalContext`
+# field, so force mode uses `decision:"block"`+`reason` (fed to the
+# model) and warn mode uses `systemMessage` (surfaced to the user).
 #
 # Thresholds are read from .rulebook/rulebook.json `handoff` section.
 # Defaults: warn=75, force=90 (percentage of estimated max context).
@@ -36,18 +38,16 @@ if [[ -f "$CONFIG_FILE" ]] && command -v jq &>/dev/null; then
   FORCE_PCT=$(jq -r '.handoff.forceThresholdPct // 90' "$CONFIG_FILE" 2>/dev/null || echo 90)
 fi
 
-# Try to find the transcript path from the session
-# Claude Code stores transcripts as JSONL in ~/.claude/projects/<hash>/
-# The hook input may or may not contain session info; we fall back to
-# estimating from the input itself.
+# Resolve transcript size from the payload's transcript_path. Claude Code
+# always passes this in Stop hook stdin (Anthropic hook spec), so we avoid
+# scanning $HOME/.claude/projects — which grows linearly with session count
+# and also returns the wrong file in concurrent sessions.
 transcript_size=0
 
-# Strategy 1: check the most recent JSONL in the project-specific Claude dir
-CLAUDE_PROJECTS_DIR="${HOME}/.claude/projects"
-if [[ -d "$CLAUDE_PROJECTS_DIR" ]]; then
-  latest_jsonl=$(find "$CLAUDE_PROJECTS_DIR" -name "*.jsonl" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $2}' || true)
-  if [[ -n "$latest_jsonl" && -f "$latest_jsonl" ]]; then
-    transcript_size=$(stat -c%s "$latest_jsonl" 2>/dev/null || stat -f%z "$latest_jsonl" 2>/dev/null || echo 0)
+if [[ -n "$input" ]] && command -v jq &>/dev/null; then
+  transcript_path="$(printf '%s' "$input" | jq -r '.transcript_path // empty' 2>/dev/null || true)"
+  if [[ -n "$transcript_path" && -f "$transcript_path" ]]; then
+    transcript_size=$(stat -c%s "$transcript_path" 2>/dev/null || stat -f%z "$transcript_path" 2>/dev/null || echo 0)
   fi
 fi
 
@@ -64,11 +64,19 @@ if [[ "$pct" -ge "$FORCE_PCT" ]]; then
   # Force mode: write urgent sentinel + emit strong instruction
   mkdir -p "$HANDOFF_DIR"
   touch "${HANDOFF_DIR}/.urgent"
-  msg="⚠️ CONTEXT AT ${pct}% (FORCE THRESHOLD). You MUST invoke /handoff NOW to save session state to .rulebook/handoff/_pending.md. After it succeeds, tell the user: '>>> TYPE /clear NOW — your context will be auto-restored in the next session <<<'. Do NOT continue working until the user has typed /clear."
-  jq -nc --arg msg "$msg" '{ hookSpecificOutput: { hookEventName: "Stop", additionalContext: $msg } }'
+  # Block exactly once: drive the model to invoke /handoff. After the handoff
+  # file exists, switch to a non-blocking systemMessage so we don't trap the
+  # model in a stop-loop that burns context at the worst possible moment.
+  if [[ -f "${HANDOFF_DIR}/_pending.md" ]]; then
+    msg="⚠️ CONTEXT AT ${pct}% — handoff already saved to .rulebook/handoff/_pending.md. >>> TYPE /clear NOW — your context will be auto-restored in the next session <<<"
+    jq -nc --arg msg "$msg" '{ systemMessage: $msg }'
+  else
+    msg="⚠️ CONTEXT AT ${pct}% (FORCE THRESHOLD). You MUST invoke /handoff NOW to save session state to .rulebook/handoff/_pending.md. After it succeeds, tell the user: '>>> TYPE /clear NOW — your context will be auto-restored in the next session <<<'. Do NOT continue working until the user has typed /clear."
+    jq -nc --arg msg "$msg" '{ decision: "block", reason: $msg }'
+  fi
 elif [[ "$pct" -ge "$WARN_PCT" ]]; then
-  msg="⚠️ Context at ${pct}%. Recommended: invoke /handoff to save session state. After it succeeds, tell the user to type /clear for a fresh session."
-  jq -nc --arg msg "$msg" '{ hookSpecificOutput: { hookEventName: "Stop", additionalContext: $msg } }'
+  msg="⚠️ Context at ${pct}%. Recommended: invoke /handoff to save session state, then type /clear for a fresh session."
+  jq -nc --arg msg "$msg" '{ systemMessage: $msg }'
 else
   # Below threshold — no-op
   printf '%s' '{}'

package/templates/hooks/enforce-pre-tool.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# PreToolUse hook (v5.6.0): consolidated deny rules.
+#
+# Replaces three legacy hooks (enforce-no-deferred / enforce-no-shortcuts /
+# enforce-mcp-for-tasks) with a single bash + node invocation. Each rule's
+# permissionDecisionReason is preserved verbatim so existing user guidance
+# is unchanged.
+set -euo pipefail
+input="$(cat)"
+
+result="$(node -e "
+const input = JSON.parse(process.argv[1]);
+const tool = input.tool_name || '';
+const ti = input.tool_input || {};
+const file = (ti.file_path || ti.filePath || '').replace(/\\\\/g, '/');
+const content = ti.new_string || ti.content || '';
+const cmd = ti.command || '';
+
+// Rule: mcp-for-tasks — manual creation of task scaffolding is forbidden.
+if (tool === 'Write' || tool === 'Edit') {
+  const m = file.match(/\.rulebook\/tasks\/[^/]+\/(proposal\.md|\.metadata\.json)\$/);
+  if (m) {
+    try { require('fs').accessSync(file); /* existing file: allow edit */ }
+    catch { console.log('DENY_MCP'); process.exit(0); }
+  }
+}
+if (tool === 'Bash' && /mkdir.*\\.rulebook\\/tasks\\//.test(cmd)) {
+  console.log('DENY_MCP'); process.exit(0);
+}
+
+// Rule: no-deferred — tasks.md must not contain deferred / skip / later / TODO.
+if ((tool === 'Edit' || tool === 'Write') && file.endsWith('tasks.md')) {
+  if (/\\b(deferred|skip(ped)?|later|todo)\\b/i.test(content)) {
+    console.log('DENY_DEFERRED'); process.exit(0);
+  }
+}
+
+// Rule: no-shortcuts — source files must not contain TODO/FIXME/HACK or stub/placeholder.
+if (tool === 'Edit' || tool === 'Write') {
+  if (/\\.(ts|tsx|js|jsx|py|rs|go|java|cs|cpp|c|hpp|h)\$/.test(file)
+      && !/\\.test\\.|\\.spec\\.|__tests__|\\/tests\\//.test(file)) {
+    if (/\\/\\/\\s*(TODO|FIXME|HACK)\\b|\\/\\*\\s*(TODO|FIXME|HACK)\\b|#\\s*(TODO|FIXME|HACK)\\b/.test(content)) {
+      console.log('DENY_TODO'); process.exit(0);
+    }
+    if (/\\bplaceholder\\b|\\bstub\\b/i.test(content)) {
+      console.log('DENY_STUB'); process.exit(0);
+    }
+  }
+}
+
+console.log('ALLOW');
+" "$input" 2>/dev/null || echo "ALLOW")"
+
+case "$result" in
+  DENY_MCP)
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DENIED: task files must be created via rulebook_task_create MCP tool, not manually. Use: rulebook_task_create({ taskId: phase1_your-task-name })"}}'
+    ;;
+  DENY_DEFERRED)
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DENIED: tasks.md cannot contain deferred, skip, later, or TODO. Implement the item now or explain why impossible. See .claude/rules/no-deferred.md"}}'
+    ;;
+  DENY_TODO)
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DENIED: source code cannot contain // TODO, // FIXME, or // HACK. Implement the logic now. See .claude/rules/no-shortcuts.md"}}'
+    ;;
+  DENY_STUB)
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DENIED: source code cannot contain placeholders or stubs. Implement real logic. See .claude/rules/no-shortcuts.md"}}'
+    ;;
+  *)
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
+    ;;
+esac

package/templates/hooks/terse-mode-tracker.sh

@@ -1,81 +1,75 @@
 #!/usr/bin/env bash
-# Claude Code UserPromptSubmit hook for rulebook-terse (v5.4.0).
+# Claude Code UserPromptSubmit hook for rulebook-terse (v5.6.0).
 #
 # Parses slash commands + natural-language activation/deactivation
 # phrases in the user prompt, updates the project-local flag file,
 # and emits a short (~45 token) attention anchor as hookSpecificOutput
-# when a persistent mode is active — keeps the compression register in
-# the model's attention on every user message.
+# when a persistent mode is active.
 #
-# Independent sub-skill modes (commit / review) do NOT get the anchor:
-# their own SKILL.md files drive behavior for the single turn they're
-# invoked.
+# Performance: fast-path bash trigger scan avoids spawning node when the
+# prompt cannot change state. When state can change, a single node call
+# parses stdin + configs and returns a pre-resolved decision
+# (`set:<mode>` / `unset` / `noop`) plus the resolved cwd. Bash only
+# applies filesystem changes after that.
 #
 # Silent-fails on every filesystem error.
 
 set -u
 
 input="$(cat || true)"
-prompt=""
-cwd=""
-if [ -n "$input" ]; then
-  # Parse JSON via node (always available in Claude Code hook env).
-  # Emits two lines: prompt on line 1, cwd on line 2.
-  parsed="$(printf '%s' "$input" | node -e "
-    try {
-      const data = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-      process.stdout.write((data.prompt || '') + '\\n' + (data.cwd || ''));
-    } catch { process.stdout.write('\\n'); }
-  " 2>/dev/null || printf '\n')"
-  prompt="$(printf '%s' "$parsed" | head -n 1)"
-  cwd="$(printf '%s' "$parsed" | tail -n +2)"
-fi
 
-PROJECT_ROOT="${cwd:-${CLAUDE_PROJECT_DIR:-$(pwd)}}"
-FLAG_PATH="${PROJECT_ROOT}/.rulebook/.terse-mode"
-CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/rulebook"
-USER_CONFIG="${CONFIG_DIR}/config.json"
-PROJECT_CONFIG="${PROJECT_ROOT}/.rulebook/rulebook.json"
+# Fast-path trigger scan over raw stdin payload. JSON-escaped string
+# values still match these literal substrings (the trigger words contain
+# no JSON-special characters), so this is a safe coarse filter. If none
+# match, we skip node entirely.
+TRIGGER_RE='(/rulebook-terse|terse mode|be terse|stop terse|disable terse|deactivate terse|turn off terse|enable terse|activate terse|turn on terse|normal mode|less tokens?)'
+prompt_has_trigger=0
+if [ -n "$input" ] && printf '%s' "$input" | grep -qiE "$TRIGGER_RE"; then
+  prompt_has_trigger=1
+fi
 
 VALID_MODES_RE='^(off|brief|terse|ultra|commit|review)$'
 MAX_FLAG_BYTES=32
 
-resolve_default_mode() {
-  if [ -n "${RULEBOOK_TERSE_MODE:-}" ]; then
-    local m="$(printf '%s' "$RULEBOOK_TERSE_MODE" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
-    if [[ "$m" =~ $VALID_MODES_RE ]]; then printf '%s' "$m"; return; fi
-  fi
-  if [ -f "$PROJECT_CONFIG" ]; then
-    local m
-    m="$(node -e "
-      try {
-        const cfg = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'));
-        if (cfg.terse && cfg.terse.defaultMode) process.stdout.write(String(cfg.terse.defaultMode));
-      } catch { }
-    " "$PROJECT_CONFIG" 2>/dev/null | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]' || true)"
-    if [ -n "$m" ] && [[ "$m" =~ $VALID_MODES_RE ]]; then printf '%s' "$m"; return; fi
+read_flag() {
+  # Symlink-safe, size-capped, whitelist-validated read.
+  local flag_path="$1"
+  [ ! -f "$flag_path" ] && return 1
+  [ -L "$flag_path" ] && return 1
+  local size
+  size="$(wc -c < "$flag_path" 2>/dev/null || echo "$MAX_FLAG_BYTES")"
+  [ "$size" -gt "$MAX_FLAG_BYTES" ] && return 1
+  local raw
+  raw="$(head -c "$MAX_FLAG_BYTES" "$flag_path" 2>/dev/null | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
+  if [[ "$raw" =~ $VALID_MODES_RE ]]; then
+    printf '%s' "$raw"
+    return 0
   fi
-  if [ -f "$USER_CONFIG" ]; then
-    local m
-    m="$(node -e "
-      try {
-        const cfg = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'));
-        if (cfg.terse && cfg.terse.defaultMode) process.stdout.write(String(cfg.terse.defaultMode));
-      } catch { }
-    " "$USER_CONFIG" 2>/dev/null | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]' || true)"
-    if [ -n "$m" ] && [[ "$m" =~ $VALID_MODES_RE ]]; then printf '%s' "$m"; return; fi
+  return 1
+}
+
+emit_anchor() {
+  # Hand-construct the JSON. The text below contains no quotes,
+  # backslashes, or control chars, so this is safe.
+  local mode="$1"
+  local keep_clause
+  if [ "$mode" = "brief" ]; then
+    keep_clause="Keep articles and full sentences."
+  else
+    keep_clause="Fragments OK."
   fi
-  printf 'terse'
+  local text="RULEBOOK-TERSE ACTIVE (${mode}). Drop filler/hedging/pleasantries. ${keep_clause} Code/tests/commits/security: write full. Quality-gate failures + destructive ops: write full."
+  printf '{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"%s"}}' "$text"
 }
 
 safe_write_flag() {
-  local content="$1"
+  local flag_path="$1"
+  local content="$2"
   local dir
-  dir="$(dirname "$FLAG_PATH")"
+  dir="$(dirname "$flag_path")"
   mkdir -p "$dir" 2>/dev/null || return 0
   [ -L "$dir" ] && return 0
-  [ -L "$FLAG_PATH" ] && return 0
-
+  [ -L "$flag_path" ] && return 0
   local tmp
   tmp="$(mktemp "$dir/.terse-mode.XXXXXX" 2>/dev/null)" || return 0
   {
@@ -83,105 +77,114 @@ safe_write_flag() {
     printf '%s' "$content" > "$tmp" 2>/dev/null || { rm -f "$tmp"; return 0; }
   }
   chmod 600 "$tmp" 2>/dev/null || true
-  mv -f "$tmp" "$FLAG_PATH" 2>/dev/null || rm -f "$tmp"
+  mv -f "$tmp" "$flag_path" 2>/dev/null || rm -f "$tmp"
 }
 
-read_flag() {
-  # Symlink-safe, size-capped, whitelist-validated read.
-  [ ! -f "$FLAG_PATH" ] && return 1
-  [ -L "$FLAG_PATH" ] && return 1
-  local size
-  size="$(wc -c < "$FLAG_PATH" 2>/dev/null || echo "$MAX_FLAG_BYTES")"
-  [ "$size" -gt "$MAX_FLAG_BYTES" ] && return 1
-
-  local raw
-  raw="$(head -c "$MAX_FLAG_BYTES" "$FLAG_PATH" 2>/dev/null | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')"
-  if [[ "$raw" =~ $VALID_MODES_RE ]]; then
-    printf '%s' "$raw"
-    return 0
-  fi
-  return 1
-}
-
-default_mode="$(resolve_default_mode)"
-lower_prompt="$(printf '%s' "$prompt" | tr '[:upper:]' '[:lower:]')"
-
-# Parse intent. Order matters: deactivation wins over accidental
-# activation, slash commands win over natural-language patterns.
-new_mode=""
-deactivate=0
-
-# Slash commands
-if [[ "$lower_prompt" == /rulebook-terse-commit* ]]; then
-  new_mode="commit"
-elif [[ "$lower_prompt" == /rulebook-terse-review* ]]; then
-  new_mode="review"
-elif [[ "$lower_prompt" == /rulebook-terse ]]; then
-  new_mode="$default_mode"
-elif [[ "$lower_prompt" == /rulebook-terse\ * ]]; then
-  arg="$(printf '%s' "$lower_prompt" | awk '{print $2}')"
-  case "$arg" in
-    off) deactivate=1 ;;
-    brief|terse|ultra|commit|review) new_mode="$arg" ;;
-    *) : ;;  # unknown subcommand → leave state unchanged
+# Fast exit: no trigger in prompt → state cannot change. Just emit the
+# anchor for the active persistent mode (if any) and return.
+if [ "$prompt_has_trigger" -eq 0 ]; then
+  PROJECT_ROOT="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+  active_mode="$(read_flag "${PROJECT_ROOT}/.rulebook/.terse-mode" || true)"
+  case "$active_mode" in
+    brief|terse|ultra) emit_anchor "$active_mode" ;;
   esac
+  exit 0
 fi
 
-# Natural-language deactivation — checked first so "stop terse" wins.
-if [ -z "$new_mode" ] && [ "$deactivate" -eq 0 ]; then
-  if echo "$prompt" | grep -qiE '\b(stop|disable|turn off|deactivate)\b.*\brulebook[- ]?terse\b' \
-     || echo "$prompt" | grep -qiE '\brulebook[- ]?terse\b.*\b(stop|disable|turn off|deactivate)\b' \
-     || echo "$prompt" | grep -qiE '\b(stop|disable) terse\b' \
-     || echo "$prompt" | grep -qiE '\bnormal mode\b'; then
-    deactivate=1
-  fi
-fi
+# Slow path: ONE node call does the entire parse + decision logic, then
+# emits two lines: `cwd` and `decision` (one of `set:<mode>`, `unset`,
+# `noop`). Bash only handles filesystem ops after that.
+result="$(printf '%s' "$input" | RULEBOOK_TERSE_MODE="${RULEBOOK_TERSE_MODE:-}" node -e '
+  const fs = require("fs");
+  function readJson(p) { try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch { return null; } }
+  const VALID = /^(off|brief|terse|ultra|commit|review)$/;
+
+  let data = {};
+  try { data = JSON.parse(fs.readFileSync(0, "utf8")); } catch { }
+  const prompt = String(data.prompt || "");
+  const cwd = String(data.cwd || "");
+  const lower = prompt.toLowerCase();
+
+  // Resolve default mode: env > project config > user config > "terse".
+  function norm(s) { return String(s || "").toLowerCase().replace(/\s+/g, ""); }
+  let def = norm(process.env.RULEBOOK_TERSE_MODE);
+  if (!VALID.test(def)) def = "";
+  if (!def && cwd) {
+    const pc = readJson(cwd + "/.rulebook/rulebook.json");
+    const m = norm(pc && pc.terse && pc.terse.defaultMode);
+    if (VALID.test(m)) def = m;
+  }
+  if (!def) {
+    const home = process.env.HOME || process.env.USERPROFILE || "";
+    const xdg = process.env.XDG_CONFIG_HOME || (home ? home + "/.config" : "");
+    if (xdg) {
+      const uc = readJson(xdg + "/rulebook/config.json");
+      const m = norm(uc && uc.terse && uc.terse.defaultMode);
+      if (VALID.test(m)) def = m;
+    }
+  }
+  if (!def) def = "terse";
+
+  // Slash commands.
+  let newMode = "";
+  let deact = false;
+  if (lower.startsWith("/rulebook-terse-commit")) newMode = "commit";
+  else if (lower.startsWith("/rulebook-terse-review")) newMode = "review";
+  else if (lower === "/rulebook-terse") newMode = def;
+  else if (lower.startsWith("/rulebook-terse ")) {
+    const arg = lower.split(/\s+/)[1] || "";
+    if (arg === "off") deact = true;
+    else if (/^(brief|terse|ultra|commit|review)$/.test(arg)) newMode = arg;
+  }
 
-# Natural-language activation
-if [ -z "$new_mode" ] && [ "$deactivate" -eq 0 ]; then
-  if echo "$prompt" | grep -qiE '\b(activate|enable|turn on|start)\b.*\brulebook[- ]?terse\b' \
-     || echo "$prompt" | grep -qiE '\brulebook[- ]?terse\b.*\b(mode|activate|enable|turn on|start)\b' \
-     || echo "$prompt" | grep -qiE '\bbe terse\b' \
-     || echo "$prompt" | grep -qiE '\bterse mode\b' \
-     || echo "$prompt" | grep -qiE '\bless tokens?\b'; then
-    new_mode="$default_mode"
-  fi
-fi
+  // Natural-language deactivation (checked first so "stop terse" wins).
+  if (!newMode && !deact) {
+    if (
+      /\b(stop|disable|turn off|deactivate)\b.*\brulebook[- ]?terse\b/i.test(prompt) ||
+      /\brulebook[- ]?terse\b.*\b(stop|disable|turn off|deactivate)\b/i.test(prompt) ||
+      /\b(stop|disable) terse\b/i.test(prompt) ||
+      /\bnormal mode\b/i.test(prompt)
+    ) deact = true;
+  }
+  // Natural-language activation.
+  if (!newMode && !deact) {
+    if (
+      /\b(activate|enable|turn on|start)\b.*\brulebook[- ]?terse\b/i.test(prompt) ||
+      /\brulebook[- ]?terse\b.*\b(mode|activate|enable|turn on|start)\b/i.test(prompt) ||
+      /\bbe terse\b/i.test(prompt) ||
+      /\bterse mode\b/i.test(prompt) ||
+      /\bless tokens?\b/i.test(prompt)
+    ) newMode = def;
+  }
+
+  let decision = "noop";
+  if (deact || newMode === "off") decision = "unset";
+  else if (newMode) decision = "set:" + newMode;
+
+  process.stdout.write(cwd + "\n" + decision);
+' 2>/dev/null || printf '\nnoop')"
 
-# Apply intent
-if [ "$deactivate" -eq 1 ]; then
-  rm -f "$FLAG_PATH" 2>/dev/null || true
-elif [ -n "$new_mode" ]; then
-  if [ "$new_mode" = "off" ]; then
+# First line = cwd, rest = decision.
+cwd="$(printf '%s' "$result" | sed -n '1p')"
+decision="$(printf '%s' "$result" | sed -n '2p')"
+
+PROJECT_ROOT="${cwd:-${CLAUDE_PROJECT_DIR:-$(pwd)}}"
+FLAG_PATH="${PROJECT_ROOT}/.rulebook/.terse-mode"
+
+case "$decision" in
+  unset)
     rm -f "$FLAG_PATH" 2>/dev/null || true
-  else
-    safe_write_flag "$new_mode"
-  fi
-fi
+    ;;
+  set:*)
+    new_mode="${decision#set:}"
+    safe_write_flag "$FLAG_PATH" "$new_mode"
+    ;;
+  *)  # noop
+    ;;
+esac
 
 # Emit attention anchor for persistent modes only.
-active_mode="$(read_flag || true)"
+active_mode="$(read_flag "$FLAG_PATH" || true)"
 case "$active_mode" in
-  brief|terse|ultra)
-    if [ "$active_mode" = "brief" ]; then
-      keep_clause="Keep articles and full sentences."
-    else
-      keep_clause="Fragments OK."
-    fi
-    text="RULEBOOK-TERSE ACTIVE (${active_mode}). Drop filler/hedging/pleasantries. ${keep_clause} Code/tests/commits/security: write full. Quality-gate failures + destructive ops: write full."
-    # Emit hookSpecificOutput JSON via node — universal across platforms.
-    node -e "
-      const text = process.argv[1];
-      process.stdout.write(JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'UserPromptSubmit',
-          additionalContext: text
-        }
-      }));
-    " "$text" 2>/dev/null || true
-    ;;
-  *)
-    # No active persistent mode, or commit/review sub-skill — no anchor.
-    :
-    ;;
+  brief|terse|ultra) emit_anchor "$active_mode" ;;
 esac

package/templates/hooks/update-check.ps1

@@ -0,0 +1,84 @@
+# Claude Code SessionStart hook — rulebook update check (Windows).
+#
+# Mirrors templates/hooks/update-check.sh: compares the project's installed
+# rulebook version (.rulebook/rulebook.json -> version) against the latest
+# @hivehub/rulebook on npm, cached 24h in .rulebook/.update-check. Emits an
+# additionalContext advisory when a newer version exists, else `{}`.
+
+$ErrorActionPreference = 'SilentlyContinue'
+
+function Emit-None { Write-Output '{}'; exit 0 }
+
+# Resolve project root from stdin JSON cwd, else env, else pwd.
+$inputRaw = $null
+if ([Console]::IsInputRedirected) { try { $inputRaw = [Console]::In.ReadToEnd() } catch { } }
+$projectRoot = $null
+if ($inputRaw) { try { $projectRoot = (ConvertFrom-Json $inputRaw).cwd } catch { } }
+if (-not $projectRoot) {
+  if ($env:CLAUDE_PROJECT_DIR) { $projectRoot = $env:CLAUDE_PROJECT_DIR }
+  else { $projectRoot = (Get-Location).Path }
+}
+
+$configFile = Join-Path $projectRoot '.rulebook/rulebook.json'
+$cacheFile  = Join-Path $projectRoot '.rulebook/.update-check'
+$pkg = '@hivehub/rulebook'
+$cacheTtl = 86400
+
+if (-not (Test-Path $configFile)) { Emit-None }
+
+$config = $null
+try { $config = Get-Content -Raw $configFile | ConvertFrom-Json } catch { Emit-None }
+$installed = $config.version
+if (-not $installed) { Emit-None }
+if ($config.updateCheck -and $config.updateCheck.enabled -eq $false) { Emit-None }
+
+$now = [int][double]::Parse((Get-Date -UFormat %s))
+$latest = $null
+$cacheTs = 0
+if (Test-Path $cacheFile) {
+  try {
+    $cache = Get-Content -Raw $cacheFile | ConvertFrom-Json
+    $cacheTs = [int]$cache.checkedAt
+    $latest = $cache.latest
+  } catch { }
+}
+
+$age = $now - $cacheTs
+if (-not $latest -or $age -ge $cacheTtl) {
+  $fetched = $null
+  try {
+    $job = Start-Job { param($p) npm view $p version 2>$null } -ArgumentList $pkg
+    if (Wait-Job $job -Timeout 5) { $fetched = (Receive-Job $job) }
+    Remove-Job $job -Force
+  } catch { }
+  if ($fetched) {
+    $latest = ("$fetched").Trim()
+    try {
+      [IO.File]::WriteAllText($cacheFile, (@{ latest = $latest; checkedAt = $now } | ConvertTo-Json -Compress))
+    } catch { }
+  }
+}
+
+if (-not $latest) { Emit-None }
+
+function Ver-Gt([string]$a, [string]$b) {
+  $aa = ($a -split '-')[0]; $bb = ($b -split '-')[0]
+  $A = $aa -split '\.'; $B = $bb -split '\.'
+  for ($i = 0; $i -lt 3; $i++) {
+    $ai = 0; $bi = 0
+    if ($A[$i]) { [int]::TryParse(($A[$i] -replace '[^0-9]', ''), [ref]$ai) | Out-Null }
+    if ($B[$i]) { [int]::TryParse(($B[$i] -replace '[^0-9]', ''), [ref]$bi) | Out-Null }
+    if ($ai -gt $bi) { return $true }
+    if ($ai -lt $bi) { return $false }
+  }
+  return $false
+}
+
+if (Ver-Gt $latest $installed) {
+  $ctx = "## Rulebook update available`n`nThis project is on rulebook **$installed**, but **$latest** is published on npm.`n`nAsk the user whether they want to update. If they agree, run ``rulebook update`` (or ``npx $pkg@latest update``) to regenerate the rules to the latest version, then review the diff before committing. Do not update without the user's confirmation."
+  $out = @{ hookSpecificOutput = @{ hookEventName = 'SessionStart'; additionalContext = $ctx } }
+  Write-Output ($out | ConvertTo-Json -Compress -Depth 4)
+  exit 0
+}
+
+Emit-None