@ionivetech/mugiwara 0.9.0 → 0.9.1

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "mugiwara",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
   "contextFileName": "GEMINI.md"
 }

package/hooks/engagement-marker.js

@@ -30,6 +30,8 @@ async function main() {
     let firstSeen = new Date().toISOString();
     let dispatchedAt = "";
     let plannedAt = "";
+    let bannerFlow = null;
+    let bannerFlowAt = "";
     if (existsSync(file)) {
       try {
         const prev = JSON.parse(readFileSync(file, "utf8"));
@@ -40,6 +42,10 @@ async function main() {
           dispatchedAt = prev.executor_dispatched_at;
         if (sameSession && typeof prev.planner_dispatched_at === "string")
           plannedAt = prev.planner_dispatched_at;
+        if (sameSession && typeof prev.last_banner_flow === "number")
+          bannerFlow = prev.last_banner_flow;
+        if (sameSession && typeof prev.last_banner_flow_at === "string")
+          bannerFlowAt = prev.last_banner_flow_at;
       } catch {}
     }
     if (dispatched)
@@ -51,7 +57,9 @@ async function main() {
       first_seen: firstSeen,
       touched_at: new Date().toISOString(),
       executor_dispatched_at: dispatchedAt,
-      planner_dispatched_at: plannedAt
+      planner_dispatched_at: plannedAt,
+      last_banner_flow: bannerFlow,
+      last_banner_flow_at: bannerFlowAt
     }, null, 2) + `
 `);
   } catch {}

package/hooks/engagement-marker.ts

@@ -68,9 +68,11 @@ async function main(): Promise<void> {
     let firstSeen = new Date().toISOString();
     let dispatchedAt = '';
     let plannedAt = '';
+    let bannerFlow: number | null = null;
+    let bannerFlowAt = '';
     if (existsSync(file)) {
       try {
-        const prev = JSON.parse(readFileSync(file, 'utf8')) as { session_id?: string; first_seen?: string; executor_dispatched_at?: string; planner_dispatched_at?: string };
+        const prev = JSON.parse(readFileSync(file, 'utf8')) as { session_id?: string; first_seen?: string; executor_dispatched_at?: string; planner_dispatched_at?: string; last_banner_flow?: number; last_banner_flow_at?: string };
         const sameSession = !sessionId || !prev.session_id || prev.session_id === sessionId;
         if (sameSession && typeof prev.first_seen === 'string') firstSeen = prev.first_seen;
         // A dispatch belongs to the session that made it. Carrying it into the
@@ -78,6 +80,10 @@ async function main(): Promise<void> {
         // because Zoro ran yesterday.
         if (sameSession && typeof prev.executor_dispatched_at === 'string') dispatchedAt = prev.executor_dispatched_at;
         if (sameSession && typeof prev.planner_dispatched_at === 'string') plannedAt = prev.planner_dispatched_at;
+        // A banner belongs to its session too — yesterday's banner must not
+        // silence today's missing one.
+        if (sameSession && typeof prev.last_banner_flow === 'number') bannerFlow = prev.last_banner_flow;
+        if (sameSession && typeof prev.last_banner_flow_at === 'string') bannerFlowAt = prev.last_banner_flow_at;
       } catch { /* corrupt marker — rewrite it */ }
     }
     if (dispatched) dispatchedAt = new Date().toISOString();
@@ -88,6 +94,8 @@ async function main(): Promise<void> {
       touched_at: new Date().toISOString(),
       executor_dispatched_at: dispatchedAt,
       planner_dispatched_at: plannedAt,
+      last_banner_flow: bannerFlow,
+      last_banner_flow_at: bannerFlowAt,
     }, null, 2) + '\n');
   } catch {
     // cannot write (read-only fs, permissions) — stay silent, guard stays off

package/hooks/hooks.json

@@ -60,6 +60,18 @@
           }
         ]
       }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}\"/hooks/pretool-guard.js",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   }
 }

package/hooks/pipeline-guard.js

@@ -2,7 +2,7 @@
 // @bun
 
 // hooks/pipeline-guard.ts
-import { existsSync, readFileSync, readdirSync, statSync, lstatSync } from "fs";
+import { existsSync, readFileSync, readdirSync, statSync, lstatSync, writeFileSync } from "fs";
 import { execFileSync } from "child_process";
 import { homedir } from "os";
 import { join } from "path";
@@ -50,6 +50,44 @@ function sourceChanged() {
     return false;
   }
 }
+function sessionStartFrom(markerFile) {
+  try {
+    const m = JSON.parse(readFileSync(markerFile, "utf8"));
+    return Date.parse(m.first_seen ?? "") || Date.parse(m.touched_at ?? "") || 0;
+  } catch {
+    return 0;
+  }
+}
+function artifactWorkNow() {
+  const markerFile = join(cwd, ".mugiwara", ".engaged");
+  if (!existsSync(markerFile))
+    return false;
+  const sessionStart = sessionStartFrom(markerFile);
+  if (!sessionStart)
+    return false;
+  try {
+    const stack = ["missions", "spec", "plans"].map((s) => join(cwd, ".mugiwara", s)).filter((p) => existsSync(p));
+    while (stack.length) {
+      const cur = stack.pop();
+      for (const e of readdirSync(cur, { withFileTypes: true })) {
+        const full = join(cur, e.name);
+        try {
+          if (e.isSymbolicLink())
+            continue;
+          if (e.isDirectory()) {
+            stack.push(full);
+            continue;
+          }
+          if (statSync(full).mtimeMs + 1000 >= sessionStart)
+            return true;
+        } catch {}
+      }
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
 function newestMissionState() {
   const base = join(cwd, ".mugiwara", "missions");
   if (!existsSync(base))
@@ -141,6 +179,96 @@ function planTouched() {
   } catch {}
   return false;
 }
+var TRANSCRIPT_BANNER_RE = /## .*Flow (\d+)\s*\u2014/g;
+function extractBannerFlow(text) {
+  let best = 0;
+  for (const m of text.matchAll(TRANSCRIPT_BANNER_RE)) {
+    const n = Number(m[1]);
+    if (Number.isFinite(n) && n > best)
+      best = n;
+  }
+  return best;
+}
+function recordBannerFlow(flow, sessionId) {
+  const file = join(cwd, ".mugiwara", ".engaged");
+  try {
+    const prev = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+    const sameSession = !sessionId || typeof prev.session_id !== "string" || prev.session_id === sessionId;
+    if (!sameSession)
+      return;
+    writeFileSync(file, JSON.stringify({
+      ...prev,
+      touched_at: new Date().toISOString(),
+      last_banner_flow: flow,
+      last_banner_flow_at: new Date().toISOString()
+    }, null, 2) + `
+`);
+  } catch {}
+}
+function bannerRecorded(sessionId) {
+  const file = join(cwd, ".mugiwara", ".engaged");
+  if (!existsSync(file))
+    return false;
+  try {
+    const m = JSON.parse(readFileSync(file, "utf8"));
+    if (typeof m.last_banner_flow !== "number" || !m.last_banner_flow_at)
+      return false;
+    if (sessionId && m.session_id && m.session_id !== sessionId)
+      return false;
+    return Date.now() - (Date.parse(m.last_banner_flow_at) || 0) < MARKER_TTL_MS;
+  } catch {
+    return false;
+  }
+}
+function bannerFromTranscript(payload) {
+  const p = payload.transcript_path;
+  if (typeof p !== "string" || !p)
+    return 0;
+  try {
+    if (!existsSync(p))
+      return 0;
+    return extractBannerFlow(readFileSync(p, "utf8"));
+  } catch {
+    return 0;
+  }
+}
+function bannerThisSession() {
+  const markerFile = join(cwd, ".mugiwara", ".engaged");
+  if (!existsSync(markerFile))
+    return true;
+  const sessionStart = sessionStartFrom(markerFile);
+  if (!sessionStart)
+    return true;
+  const re = /^## .*Flow (\d+)\s*\u2014/m;
+  try {
+    const missionsDir = join(cwd, ".mugiwara", "missions");
+    for (const e of readdirSync(missionsDir, { withFileTypes: true })) {
+      if (!e.isDirectory())
+        continue;
+      const files = [`${join(missionsDir, e.name)}/decisions.md`];
+      const flowsDir = join(missionsDir, e.name, "flows");
+      if (existsSync(flowsDir)) {
+        for (const f of readdirSync(flowsDir)) {
+          if (f.endsWith(".md"))
+            files.push(join(flowsDir, f));
+        }
+      }
+      for (const f of files) {
+        try {
+          if (!existsSync(f))
+            continue;
+          if (statSync(f).mtimeMs + 1000 < sessionStart)
+            continue;
+          if (re.test(readFileSync(f, "utf8")))
+            return true;
+        } catch {}
+      }
+    }
+  } catch {
+    return true;
+  }
+  return false;
+}
 async function main() {
   let input = "";
   for await (const chunk of process.stdin)
@@ -169,12 +297,18 @@ async function main() {
       process.stderr.write("\u26A0 Mugiwara: a plan doc (missions/<mission>/plan.md) was written this session, " + "but no planner (nami-planner / mugiwara-planning) was dispatched or embodied. " + "Only Nami writes the plan \u2014 dispatch nami-planner, or record the plan as a " + `deliberate exception in the decision log. Set enforce=off in .mugiwara/config to disable.
 `);
     }
+    const transcriptFlow = bannerFromTranscript(payload);
+    if (transcriptFlow > 0)
+      recordBannerFlow(transcriptFlow, sessionId);
+    if ((sourceChangedNow || planTouched()) && !bannerRecorded(sessionId) && !bannerThisSession()) {
+      process.stderr.write("\u26A0 Mugiwara: work recorded with no flow banner this session. The banner is the " + "only signal the user has that the pipeline ran. Open each stage with " + "`## <emoji> Flow N \u2014 Crew (Role)`.\n");
+    }
     return;
   }
   if (!state) {
-    if (!sourceChangedNow)
+    if (!sourceChangedNow && !artifactWorkNow())
       return;
-    const reason = "Mugiwara: source changed in this session but no Flow 0 triage is on disk. " + "Run Flow 0 (classify, size the lane, write the decision log) and record it with " + '`mugiwara savepoint <mission> "" 0 <mode>` \u2014 or, if this is Lane 0 trivial work, ' + "record a Lane 0 savepoint to say so. Set enforce=off in .mugiwara/config to disable this check.";
+    const reason = "Mugiwara: this session did work (source and/or .mugiwara artifacts) but no " + "Flow 0 triage is on disk. " + "Run Flow 0 (classify, size the lane, write the decision log) and record it with " + '`mugiwara savepoint <mission> "" 0 <mode>` \u2014 or, if this is Lane 0 trivial work, ' + "record a Lane 0 savepoint to say so. Set enforce=off in .mugiwara/config to disable this check.";
     if (enforce === "warn") {
       process.stderr.write(`\u26A0 ${reason}
 `);

package/hooks/pipeline-guard.ts

@@ -19,7 +19,7 @@
 //
 // Fails OPEN on any internal error. A fence that can wedge a session gets
 // disabled by its users, and then it fences nothing.
-import { existsSync, readFileSync, readdirSync, statSync, lstatSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, lstatSync, writeFileSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -83,6 +83,53 @@ function sourceChanged(): boolean {
   }
 }
 
+/**
+ * Session anchor for the session-scoped scans: first_seen, else touched_at,
+ * else 0 (unknown). Shared by artifactWorkNow and bannerThisSession — one
+ * definition, not two copies. Fail open.
+ */
+function sessionStartFrom(markerFile: string): number {
+  try {
+    const m = JSON.parse(readFileSync(markerFile, 'utf8')) as { first_seen?: string; touched_at?: string };
+    return Date.parse(m.first_seen ?? '') || Date.parse(m.touched_at ?? '') || 0;
+  } catch { return 0; }
+}
+
+/**
+ * Artifact work in this session: files written under .mugiwara/missions,
+ * .mugiwara/spec, or .mugiwara/plans since the session's first-seen marker.
+ * Work is not only source edits — a brainstorm that produced a spec, a plan,
+ * or a recommendation is work, and it escaped the source-only predicate. (E3)
+ * Session-scoped like planTouched: an absent/unreadable marker means untouched,
+ * never "everything counts". Fail open throughout.
+ */
+function artifactWorkNow(): boolean {
+  const markerFile = join(cwd, '.mugiwara', '.engaged');
+  if (!existsSync(markerFile)) return false;
+  const sessionStart = sessionStartFrom(markerFile);
+  if (!sessionStart) return false;
+  try {
+    const stack = ['missions', 'spec', 'plans']
+      .map((s) => join(cwd, '.mugiwara', s))
+      .filter((p) => existsSync(p));
+    while (stack.length) {
+      const cur = stack.pop() as string;
+      for (const e of readdirSync(cur, { withFileTypes: true })) {
+        const full = join(cur, e.name);
+        try {
+          // Symlink check first: a symlink dirent reports isDirectory()
+          // false, so nesting this inside the directory branch never fires.
+          if (e.isSymbolicLink()) continue;
+          if (e.isDirectory()) { stack.push(full); continue; }
+          // 1s tolerance, same as planTouched (FS granularity / clock skew)
+          if (statSync(full).mtimeMs + 1000 >= sessionStart) return true;
+        } catch { /* unreadable entry — skip */ }
+      }
+    }
+  } catch { return false; }
+  return false;
+}
+
 /**
  * The newest readable savepoint for any mission, or null when there is none.
  * Its existence IS the triage fact (check 1); its `lane` field is the input to
@@ -187,6 +234,99 @@ function planTouched(): boolean {
   return false;
 }
 
+/**
+ * Flow-banner detection. The heading form is `## <emoji> Flow N — Crew (Role)`,
+ * so the match tolerates anything between `## ` and `Flow`. Warning only,
+ * never a block: banner detection matches response text, and a false block on
+ * a formatting variance is the outcome that gets the whole fence disabled.
+ */
+// Transcripts are JSONL: the banner sits mid-line inside an escaped string,
+// so the transcript scan is not line-anchored. Warning-only, so a discussion
+// *about* a banner counting as one is benign.
+const TRANSCRIPT_BANNER_RE = /## .*Flow (\d+)\s*—/g;
+
+/** Highest flow stage announced in text, or 0 when no banner is present. */
+function extractBannerFlow(text: string): number {
+  let best = 0;
+  for (const m of text.matchAll(TRANSCRIPT_BANNER_RE)) {
+    const n = Number(m[1]);
+    if (Number.isFinite(n) && n > best) best = n;
+  }
+  return best;
+}
+
+/**
+ * Record last_banner_flow in the engagement marker (schema owned by
+ * engagement-marker.ts — this only writes its two fields, same-session
+ * scoped like the dispatch facts). The marker itself never sees response
+ * text (its payload is tool input), so the Stop hook — whose payload may
+ * carry transcript_path — owns detection. Never throws.
+ */
+function recordBannerFlow(flow: number, sessionId: string): void {
+  const file = join(cwd, '.mugiwara', '.engaged');
+  try {
+    const prev = existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) as Record<string, unknown> : {};
+    const sameSession = !sessionId || typeof prev.session_id !== 'string' || prev.session_id === sessionId;
+    if (!sameSession) return;
+    writeFileSync(file, JSON.stringify({
+      ...prev,
+      touched_at: new Date().toISOString(),
+      last_banner_flow: flow,
+      last_banner_flow_at: new Date().toISOString(),
+    }, null, 2) + '\n');
+  } catch { /* fail open */ }
+}
+
+/** A banner recorded for this session (fresh scan already stored, or stored earlier). */
+function bannerRecorded(sessionId: string): boolean {
+  const file = join(cwd, '.mugiwara', '.engaged');
+  if (!existsSync(file)) return false;
+  try {
+    const m = JSON.parse(readFileSync(file, 'utf8')) as { session_id?: string; last_banner_flow?: unknown; last_banner_flow_at?: string };
+    if (typeof m.last_banner_flow !== 'number' || !m.last_banner_flow_at) return false;
+    if (sessionId && m.session_id && m.session_id !== sessionId) return false;
+    return Date.now() - (Date.parse(m.last_banner_flow_at) || 0) < MARKER_TTL_MS;
+  } catch { return false; }
+}
+
+/** Highest banner in the Stop-hook transcript, or 0 when absent/unreadable. */
+function bannerFromTranscript(payload: Record<string, unknown>): number {
+  const p = payload.transcript_path;
+  if (typeof p !== 'string' || !p) return 0;
+  try {
+    if (!existsSync(p)) return 0;
+    return extractBannerFlow(readFileSync(p, 'utf8'));
+  } catch { return 0; }
+}
+function bannerThisSession(): boolean {
+  const markerFile = join(cwd, '.mugiwara', '.engaged');
+  if (!existsSync(markerFile)) return true; // no session anchor — no opinion
+  const sessionStart = sessionStartFrom(markerFile);
+  if (!sessionStart) return true;
+  const re = /^## .*Flow (\d+)\s*—/m;
+  try {
+    const missionsDir = join(cwd, '.mugiwara', 'missions');
+    for (const e of readdirSync(missionsDir, { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      const files = [`${join(missionsDir, e.name)}/decisions.md`];
+      const flowsDir = join(missionsDir, e.name, 'flows');
+      if (existsSync(flowsDir)) {
+        for (const f of readdirSync(flowsDir)) {
+          if (f.endsWith('.md')) files.push(join(flowsDir, f));
+        }
+      }
+      for (const f of files) {
+        try {
+          if (!existsSync(f)) continue;
+          if (statSync(f).mtimeMs + 1000 < sessionStart) continue;
+          if (re.test(readFileSync(f, 'utf8'))) return true;
+        } catch { /* unreadable entry — skip */ }
+      }
+    }
+  } catch { return true; }
+  return false;
+}
+
 async function main(): Promise<void> {
   let input = '';
   for await (const chunk of process.stdin) input += chunk;
@@ -242,6 +382,21 @@ async function main(): Promise<void> {
         'deliberate exception in the decision log. Set enforce=off in .mugiwara/config to disable.\n',
       );
     }
+    // --- check 4: the banner signal (warning only) -----------------------
+    // Work recorded with state on disk but no flow banner this session. The
+    // banner is the only visible signal the pipeline ran — its absence is how
+    // an off-pipeline session goes unnoticed. Warning, never a block.
+    // Signal order: fresh transcript scan (recorded to the marker) →
+    // marker's same-session record → mission-file fallback.
+    const transcriptFlow = bannerFromTranscript(payload);
+    if (transcriptFlow > 0) recordBannerFlow(transcriptFlow, sessionId);
+    if ((sourceChangedNow || planTouched()) && !bannerRecorded(sessionId) && !bannerThisSession()) {
+      process.stderr.write(
+        '⚠ Mugiwara: work recorded with no flow banner this session. The banner is the ' +
+        'only signal the user has that the pipeline ran. Open each stage with ' +
+        '`## <emoji> Flow N — Crew (Role)`.\n',
+      );
+    }
     return;
   }
 
@@ -250,9 +405,12 @@ async function main(): Promise<void> {
   // the original invariant and it BLOCKS (the triage fact is a crisp on-disk
   // check, no absence-inference). Only fires when source actually changed.
   if (!state) {
-    if (!sourceChangedNow) return;
+    // Any work at all — source edits OR artifacts written — with no triage on
+    // disk is the escape this guard exists to close. (E3)
+    if (!sourceChangedNow && !artifactWorkNow()) return;
     const reason =
-      'Mugiwara: source changed in this session but no Flow 0 triage is on disk. ' +
+      'Mugiwara: this session did work (source and/or .mugiwara artifacts) but no ' +
+      'Flow 0 triage is on disk. ' +
       'Run Flow 0 (classify, size the lane, write the decision log) and record it with ' +
       '`mugiwara savepoint <mission> "" 0 <mode>` — or, if this is Lane 0 trivial work, ' +
       'record a Lane 0 savepoint to say so. Set enforce=off in .mugiwara/config to disable this check.';

package/hooks/pretool-guard.js

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+// @bun
+
+// hooks/pretool-guard.ts
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+// src/guards.ts
+var FORBIDDEN = [
+  [/\bgh\s+pr\s+(create|merge|ready)\b/, "opening or merging a PR"],
+  [/\bgh\s+release\s+create\b/, "creating a release"],
+  [/\bgit\s+merge\b/, "merging a branch"],
+  [/\bgit\s+push\b[^|;&]*\b(main|master|production|release)\b/, "pushing to a protected branch"],
+  [/\bgit\s+push\b[^|;&]*--force/, "force-pushing"],
+  [/\bnpm\s+publish\b|\byarn\s+publish\b|\bpnpm\s+publish\b/, "publishing a package"],
+  [/\bkubectl\s+(apply|delete|rollout)\b/, "changing a cluster"],
+  [/\bterraform\s+(apply|destroy)\b/, "changing infrastructure"],
+  [/\bdocker\s+push\b/, "pushing an image"],
+  [/\baws\s+\w+\s+(create|delete|update|put)\b/, "changing cloud resources"]
+];
+function checkCommand(command) {
+  for (const [re, action] of FORBIDDEN) {
+    if (re.test(command))
+      return action;
+  }
+  return null;
+}
+function refusalMessage(action) {
+  return `Mugiwara: refusing to ${action}. The crew never creates a PR, merges, or ` + `deploys — the human does, from the branch and the verdict the crew hands over. ` + `Run it yourself, or set enforce=off in .mugiwara/config.`;
+}
+
+// hooks/pretool-guard.ts
+var cwd = process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
+function readEnforce() {
+  for (const base of [cwd, homedir()]) {
+    if (!base)
+      continue;
+    const file = join(base, ".mugiwara", "config");
+    if (!existsSync(file))
+      continue;
+    for (const line of readFileSync(file, "utf8").split(/\r?\n/)) {
+      const [k, v] = line.split("=").map((s) => s.trim());
+      if (k !== "enforce")
+        continue;
+      if (v === "off" || v === "warn" || v === "block")
+        return v;
+      process.stderr.write(`mugiwara: unknown enforce="${v}" in ${file}, using "block"
+`);
+      return "block";
+    }
+  }
+  return "block";
+}
+async function main() {
+  let input = "";
+  for await (const chunk of process.stdin)
+    input += chunk;
+  let payload = {};
+  try {
+    payload = JSON.parse(input);
+  } catch {}
+  try {
+    const enforce = readEnforce();
+    if (enforce === "off")
+      return;
+    const toolInput = payload.tool_input ?? {};
+    const command = typeof toolInput.command === "string" ? toolInput.command : "";
+    if (!command)
+      return;
+    const action = checkCommand(command);
+    if (action) {
+      const reason = refusalMessage(action);
+      if (enforce === "warn") {
+        process.stderr.write(`\u26A0 ${reason}
+`);
+        return;
+      }
+      process.stdout.write(JSON.stringify({ decision: "block", reason }));
+      return;
+    }
+  } catch {}
+}
+main().catch(() => {});

package/hooks/pretool-guard.ts

@@ -0,0 +1,60 @@
+#!/usr/bin/env bun
+// hooks/pretool-guard.ts — PreToolUse on Bash: refuse irreversible commands.
+//
+// Luffy's rule 13 says the crew never creates a PR, merges, or deploys. That
+// rule had zero mechanisms behind it; every other invariant in the repo has at
+// least one. Prose enforcement measured 0-for-21 in this codebase. (E4)
+//
+// Fails OPEN on any internal error, like pipeline-guard: a fence that wedges a
+// session gets disabled, and then it fences nothing.
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { checkCommand, refusalMessage } from '../src/guards.ts';
+
+const cwd = process.env.CLAUDE_PROJECT_DIR ?? process.cwd();
+
+type Enforce = 'off' | 'warn' | 'block';
+
+function readEnforce(): Enforce {
+  // Same key as pipeline-guard (off | warn | block, default block).
+  for (const base of [cwd, homedir()]) {
+    if (!base) continue;
+    const file = join(base, '.mugiwara', 'config');
+    if (!existsSync(file)) continue;
+    for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
+      const [k, v] = line.split('=').map((s) => s.trim());
+      if (k !== 'enforce') continue;
+      if (v === 'off' || v === 'warn' || v === 'block') return v;
+      process.stderr.write(`mugiwara: unknown enforce="${v}" in ${file}, using "block"\n`);
+      return 'block';
+    }
+  }
+  return 'block';
+}
+
+async function main(): Promise<void> {
+  let input = '';
+  for await (const chunk of process.stdin) input += chunk;
+  let payload: Record<string, unknown> = {};
+  try { payload = JSON.parse(input) as Record<string, unknown>; } catch { /* no payload — allow */ }
+  try {
+    const enforce = readEnforce();
+    if (enforce === 'off') return;
+    const toolInput = (payload.tool_input ?? {}) as Record<string, unknown>;
+    const command = typeof toolInput.command === 'string' ? toolInput.command : '';
+    if (!command) return;
+    const action = checkCommand(command);
+    if (action) {
+      const reason = refusalMessage(action);
+      if (enforce === 'warn') {
+        process.stderr.write(`⚠ ${reason}\n`);
+        return;
+      }
+      process.stdout.write(JSON.stringify({ decision: 'block', reason }));
+      return;
+    }
+  } catch { /* fail open — never wedge a session */ }
+}
+
+main().catch(() => { /* a hook must never fail the turn */ });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionivetech/mugiwara",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, self-healing. Installs into Claude Code, opencode, Copilot, Gemini, Codex, Cursor, Kimi, pi, Windsurf, Cline, Kilo, Antigravity.",
   "homepage": "https://github.com/ionivetech/mugiwara#readme",
   "repository": {

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mugiwara",
   "description": "The Straw Hat crew of AI agents and skills: brainstorm, plan, execute, checkpoint, quality, gates, review, security, healing.",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "author": {
     "name": "ionivetech"
   },