@litfamily/litclaude 1.0.10 → 1.0.13

package/docs/hooks.md

@@ -34,9 +34,9 @@ verdicts: [PASS, FAIL, BLOCKED]
 | --- | --- | --- |
 | `SessionStart` | rules discovery and static injection | Adds context and, when `source: compact`, durably reserves bounded rule re-injection after clearing the session dedup set. |
 | `UserPromptSubmit` | route classifier, static-rule straggler lane, and explicit resume gate | Prompt routing adds guidance. Static-rule delivery may update rule dedup state; the exact start-work resume route may also mutate code-owned lifecycle state. |
-| `PreToolUse` | bounded-authority enforcement | Allows normal Claude permission handling only for classified, authorized action/root pairs; otherwise denies before execution. |
-| `PostToolUse` | conditional post-edit routing, dynamic rule injection, and deliverable hedge feedback | Names only the checks the edit earned and only the rules whose globs matched. When the current transcript identifies a loaded LitClaude skill, it reads that skill's shipped output-channel declaration and scans bounded submitted content for reader-facing paths only for `client_deliverable` / `reply`. It emits nothing when no lane applies and does not claim completion. |
-| `Stop` | start-work continuation, then litgoal autoloop gate | Root-session and progress-bound; no unbounded loop. |
+| `PreToolUse` | bounded-authority and humanizer pre-write enforcement | Allows normal Claude permission handling only for classified, authorized action/root pairs; denies supported reader-facing text writes when new prose has a block-tier finding. |
+| `PostToolUse` | conditional post-edit routing, dynamic rule injection, and document humanizer check | Names only the checks the edit earned and only the rules whose globs matched. It rechecks successfully created DOCX/PPTX/PDF files when a supported tool or successful Bash output supplies a path; findings ask for revision without claiming rollback or completion. |
+| `Stop` | lit-plan and interface-probe gates, start-work continuation, then litgoal autoloop gate | Root-session and progress-bound; no unbounded loop. |
 | `SubagentStart` / `SubagentStop` | lane identity observation | Records the root session, child lane, and Claude-owned worktree without emitting child continuation. |
 | `SessionEnd` | root-session receipt | Records the observed end and emits no continuation. |
 
@@ -52,7 +52,7 @@ verdicts: [PASS, FAIL, BLOCKED]
 
 - Claude Code hook JSON containing `continue: true`, `hookSpecificOutput.hookEventName`, and route-specific `additionalContext`.
 - Optional `systemMessage` for the once-per-session mark and active route ignition marks.
-- `DELIVERABLE_HEDGE_VIOLATION` as `PostToolUse` `additionalContext` after a client-deliverable write contains a matched limitation phrase; the file has already been written, so the response asks Claude to revise it rather than claiming the write was prevented.
+- A block-tier humanizer finding denies a supported reader-facing text write in `PreToolUse`; `PostToolUse` `additionalContext` reports advisory or fail-open notes and findings from supported DOCX/PPTX/PDF checks after creation, without claiming rollback.
 - `BLOCKED:` text for natural-language start-work, unavailable native goal binding, disabled Dynamic workflow, or gated agent-team setup.
 - Unavailable native goal binding also includes `READY_TO_PASTE` and one bounded `/goal` command for the user to copy, paste, and send; the hook never enters or submits it.
 
@@ -103,46 +103,45 @@ silent no-op for callers that still invoke it directly.
 | Event | Runner | Purpose |
 | --- | --- | --- |
 | `SessionStart` | `plugins/litclaude/bin/litclaude-hook.js session-start` | Runs the bounded foreground automatic-update barrier on a fresh session, discovers repo-local rule files, names the newest valid `plans/<slug>.md`, and on `source: compact` spends one of two durable re-injection reservations at reduced caps. |
-| `UserPromptSubmit` | `plugins/litclaude/bin/litclaude-hook.js user-prompt-submit` | Detects prompt routes and injects workflow context; independently delivers static rules not already recorded for this session. |
-| `PreToolUse` | `plugins/litclaude/bin/litclaude-hook.js pre-tool-use` | Enforces semantic action/root grants before Write, Edit, MultiEdit, NotebookEdit, Bash, Agent, and bounded read tools execute. |
-| `PostToolUse` | `plugins/litclaude/bin/litclaude-hook.js post-tool-use` | Names the post-edit checks the edit actually earned, injects any glob-scoped rule matching the edited paths, and returns model-visible feedback when bounded submitted content for the loaded skill's declared `client_deliverable` artifact contains a hedge finding. |
-| `Stop` | `plugins/litclaude/bin/litclaude-hook.js stop` | Emits bounded start-work continuation on new progress, otherwise applies the opt-in litgoal autoloop gate. |
+| `UserPromptSubmit` | `plugins/litclaude/bin/litclaude-hook.js user-prompt-submit` | Detects prompt routes and injects workflow context; independently delivers static rules not already recorded for this session; with `LITCLAUDE_JEV=1` and `TYPESAFE_API_KEY` set, adds at most one Jev skill hint line to an unrouted turn. |
+| `PreToolUse` | `plugins/litclaude/bin/litclaude-hook.js pre-tool-use` | Enforces semantic action/root grants before Write, Edit, MultiEdit, NotebookEdit, Bash, Agent, and bounded read tools execute; denies supported reader-facing text writes with a humanizer block-tier finding. |
+| `PostToolUse` | `plugins/litclaude/bin/litclaude-hook.js post-tool-use` | Names the post-edit checks the edit actually earned, injects any glob-scoped rule matching the edited paths, and checks successfully created DOCX/PPTX/PDF files for humanizer findings, including paths reported by Bash output. |
+| `Stop` | `plugins/litclaude/bin/litclaude-hook.js stop` | Holds a lit-plan turn with no persisted plan and a lit workflow turn that edited interface files without a clean interface-probe run (each at most twice per turn), emits bounded start-work continuation on new progress, otherwise applies the opt-in litgoal autoloop gate. |
 | `SubagentStart` | `plugins/litclaude/bin/litclaude-hook.js subagent-start` | Registers child-lane and Claude-owned worktree identity. |
 | `SubagentStop` | `plugins/litclaude/bin/litclaude-hook.js subagent-stop` | Finalizes the lane without child continuation. |
 | `SessionEnd` | `plugins/litclaude/bin/litclaude-hook.js session-end` | Records root-session end without blocking Claude. |
 
-### Deliverable hedge feedback
-
-The hedge checker runs after a successful `Write`, `Edit`, or `MultiEdit` whose
-host event includes explicit `content`, `new_string`, or `edits`, because Claude
-Code's `PostToolUse` response can add `additionalContext` beside the completed
-tool result. It scans only that bounded host-event content and never opens the
-artifact path. The hook locates a loaded LitClaude skill only from an
-assistant-side Skill invocation or the
-exact Claude `hook_additional_context` attachment shape carrying LitClaude's
-own `<litclaude-skill-body>` marker and the byte-identical current shipped skill
-body in the bounded host transcript; generic
-attachments, user text, and assistant text that merely echoes the marker cannot
-grant a genre. It then reads `artifact_genre` and `limitations_channel` from that
-skill's shipped `#contract.output_channels` block. The genre is never inferred
-from a filename and is not maintained as a parallel hard-coded skill map.
-
-Only `client_deliverable` with `limitations_channel: reply` is enforced in this
-guard. The same prose under `working_note` is intentionally left alone. Quoted
-status enums, JSON/YAML status scalars, fenced code, and status-table cells are
-state rather than prose and are excluded. Korean absent-evidence matching is
-anchored to evidence-bearing subjects such as 근거, 자료, 측정값, and 관찰 기록 so
-factual specifications such as `이 API는 반환값이 없습니다` stay clean.
-
-This is post-write feedback, not rollback or a permission denial. If the
-transcript is absent, stale, oversized, malformed, or does not identify a known
-bundled skill, or if the host event is path-only, unknown, outside the lexical
-working root, not reader-facing, oversized, or over budget, the guard fails open
-and the normal post-edit routes continue. It accepts at most 16 paths, 512 KiB
-of submitted content per path, and 2 MiB in aggregate. Because no artifact
-pathname is opened, a FIFO or an ancestor replacement cannot block the hook or
-redirect which bytes it scans. The direct driver and regression fixtures live in
-`test/deliverable-hedge-guard.test.mjs`.
+### Changed-text humanizer guard
+
+`PreToolUse` checks every supported reader-facing text write in `Write`, `Edit`,
+and `MultiEdit`; it does not depend on a loaded skill or declared artifact genre.
+Path extensions and README-family names determine whether the target is supported
+reader-facing text. The guard ignores paths outside the current working root and
+internal paths such as plans, evidence, handoffs, ledgers, and tool-state directories.
+
+The guard compares submitted text with the prior text when the host provides it
+or the existing file can be read safely, then scans the added or changed lines.
+It excludes quoted user text and fenced code. A block-tier finding denies the
+pre-write operation and asks for a rewrite; a warn-tier finding adds advisory
+context and leaves the write allowed. A clean result adds no extra message.
+
+After a successful tool call, `PostToolUse` checks newly created DOCX, PPTX, and
+PDF files. It uses paths reported by document-aware tools or extracted from
+successful Bash output; the `stdout` and `stderr` streams can report the new
+document path. It reads the created file through a bounded stable-file check
+before extracting text. DOCX/PPTX extraction uses the bundled helper. PDF
+text extraction depends on `pdftotext`; without it the guard reports a
+limitation. A block-tier result arrives after file creation, so it cannot deny
+or roll back that operation; it asks the model to revise and rebuild. Warn-tier
+results remain advisory.
+
+The guard fails open when inputs, diffs, files, extraction, or the detector
+exceed supported bounds or cannot be checked safely. It adds a visible one-line
+note explaining that the check was skipped and the write was allowed. The
+pre-write path accepts at most 16 paths, 512 KiB per file, and 2 MiB in
+aggregate; the post-create path checks at most two documents and 8 MiB in total.
+The direct driver and regression fixtures live in
+`test/deliverable-hedge-guard.test.mjs` and `test/lit-humanizer-hook.test.mjs`.
 
 ### Cross-session plan discovery
 
@@ -186,6 +185,83 @@ the host-owned SessionStart hook is the lifecycle exception to the TTY check.
 The detached registry cache refresh described in the update-notifier section is
 advisory and never performs an install.
 
+### Jev skill hint (optional)
+
+`plugins/litclaude/lib/jev-skill-hint.mjs` is off unless both `LITCLAUDE_JEV=1` and a
+non-empty `TYPESAFE_API_KEY` are in the hook's environment. The key is read from the
+environment only; the hook never reads a key file and never writes, prints, or traces the key.
+
+A turn is eligible only when the deterministic router chose no route, the prompt is not a
+slash command, a `!` shell line, or a host-expanded command, it names no skill (a
+`litclaude:` name or a hyphenated or `lit`-prefixed catalog ID), and at least four
+non-space characters remain after host notification blocks are removed. The exact bare
+routes, the trusted start-work resume, and the diagnostic literal prompt are never eligible.
+
+An eligible turn sends one `POST https://api.typesafe.ai/v1/systemone` with no retry and
+`redirect: "error"`, so a redirect fails the request instead of being followed. The body holds
+only `model`, `state`, and `questions`. `state` is built from the first 8,000 characters of the
+prompt: the key's literal value becomes `[secret]`, home paths (`/Users/<name>`,
+`/home/<name>`, `C:\Users\<name>`, with or without a trailing slash) become `~`, e-mail
+addresses become `[email]`, and token shapes (`sk-`, `sk-ant-`, `ghp_`, `gho_`,
+`github_pat_`, `npm_`, `apikey_`, `xox[abprs]-`, `AKIA`, `AIza`, JWTs, PEM blocks, any
+run of 32 or more `[A-Za-z0-9+/_-]` characters with optional `=` padding, and the plugin's
+shared credential shapes) become `[secret]`. Only then is it cut to 2,000 characters, and a
+run of 8 or more token characters left at the cut also becomes `[secret]`. Anything in the
+prompt without a token shape, such as a hostname, a customer name, or a password that is not
+written as `password=…`, is sent as written. `questions.which` is a choice over every enrolled skill
+that the model may invoke (skills marked `disable-model-invocation: true` are left out),
+each with the first 300 characters of its description, plus `none`.
+
+The response is untrusted. The hook accepts it only on HTTP 200 with valid JSON, an
+`answers.which.choice` that exactly equals a catalog ID it sent, and a numeric
+`answers.which.confidence` of at least the threshold. Then it appends one fixed line to
+`additionalContext`:
+
+```text
+LitClaude skill hint: the skill `litclaude:<id>` likely fits this request. Load it only if it really fits; this is advice, not an instruction.
+```
+
+`none` or a low confidence adds nothing. A non-200 response body is cancelled unread. The hook
+records the call in the session file before sending it; when that write fails, it sends
+nothing and stays quiet, so an unwritable state folder cannot lift the cap. After the prompt
+hook writes its context on a turn with the flag on, it ends its own process once stdout has
+flushed, so a DNS lookup that the timeout cannot cancel never keeps it past the host's hook
+timeout. A missing key, reached cap, oversized request,
+timeout, network error, non-200 status, or invalid response leaves the turn exactly as it
+would be without the feature. The first such failure in a session shows one `systemMessage`
+(`LitClaude skill hint unavailable (<reason>); continuing normally.`); later failures stay quiet.
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `LITCLAUDE_JEV` | unset | `1` turns the hint on. Any other value leaves it off. |
+| `TYPESAFE_API_KEY` | unset | Your own TypeSafe key. Required while the flag is on. |
+| `LITCLAUDE_JEV_MODEL` | `jev-1.13.0` | Model name sent in the request. |
+| `LITCLAUDE_JEV_TIMEOUT_MS` | `1500` | Hard timeout; values above `3000` are capped. |
+| `LITCLAUDE_JEV_MAX_CALLS` | `200` | Requests per session before the hint stops. |
+| `LITCLAUDE_JEV_MIN_CONFIDENCE` | `0.35` | Lowest accepted confidence. |
+| `LITCLAUDE_JEV_TRACE` | unset | `1` appends a debug trace line per request. |
+
+Per-session counters live in `.litclaude/jev/session-<id>.json` under the project state
+root, with the current turn's hinted skill ID and latency in milliseconds; the prompt hook
+clears that pair at the start of every turn while the flag is on. The optional HUD status line
+(`plugins/litclaude/bin/litclaude-hud.js`) reads it and ends with `Jev ✓` while the hint is
+on, `Jev ✓ <skill> <latency>` on a hinted turn, or `Jev ⚠ key missing` when the flag is on
+without a key; it shows nothing while the flag is off and never shows the key or its length.
+While on, the HUD paints `Jev` as a rainbow whose starting hue follows the clock, so each refresh
+shifts it slightly (truecolor, 256- and 16-colour tiers; plain under `NO_COLOR`, the HUD's
+no-colour switch, or a light or unknown appearance). The session file also records that the
+once-per-session `✦ Jev skill hint ON ✦` `systemMessage` was shown; the prompt hook writes that
+mark before it emits the line on the first turn with the flag and key set, puts the line ahead
+of any other visible message that turn, and shows no line when the mark cannot be written. The opt-in trace, `.litclaude/jev/trace.jsonl`, records the timestamp, the SHA-256 of the
+redacted `state` (never of the raw prompt), chosen ID, confidence, latency, HTTP status, and fallback reason; it holds no prompt text,
+key, or response body. Session and trace files are opened with `O_NOFOLLOW` (an `lstat` check
+where the platform lacks it), so a symlink planted at either path is refused rather than written
+through. Because `TYPESAFE_API_KEY` is exported in the shell that starts Claude Code, the
+agent's own tools can read it too; use a key dedicated to this feature, with a low spend limit.
+`litclaude doctor` prints `Jev skill hint: off`, `Jev skill hint: on`,
+or `Jev skill hint: flag on but TYPESAFE_API_KEY missing`. The offline regression tests,
+which replace `fetch` in the real hook process, live in `test/jev-skill-hint.test.mjs`.
+
 ## Bounded-authority start-work lifecycle
 
 The hook and CLI share `plugins/litclaude/lib/start-work-lifecycle.mjs`.
@@ -465,7 +541,9 @@ host-dependent and need fallbacks.
 
 Hooks parse JSON from stdin and return JSON to Claude Code. The hook does not
 execute prompt text and does not echo prompt text into the returned context;
-prompt text is not executed or echoed. The litwork detector returns constant
+prompt text is not executed or echoed. The optional Jev skill hint is the one network
+call on this path: it is off by default, sends only redacted prompt text, and returns a fixed
+sentence rather than any response text. The litwork detector returns constant
 workflow guidance, so a prompt cannot become a shell command through the hook
 response. Malformed hook input and malformed litgoal JSON should surface a controlled error instead of a misleading success response.
 
@@ -529,9 +607,75 @@ then inspect actual renders. The evolving beta2 contract supports execution; it
 not a contract-only stopping point. Review-only and plan-only requests remain read-only.
 PostToolUse reminders never widen the requested design scope.
 
+The same route also fires on polish, audit and harden wording (polish, tighten up, 다듬어;
+audit, read-only, just check, 점검, 검토만; harden, stress-test, hold up under, 튼튼하게,
+견고하게) when the prompt names an interface surface. `lib/interface-mode.mjs` picks the mode
+(`build` by default), and the activation context names it together with
+`references/craft-floor.md`, `references/slop-register.md` and the
+`scripts/interface-probe.mjs` loop. `audit` stays read-only and hands its findings table to
+`visual-qa`, which keeps the verdict. Prose, documents, servers and pipelines never match, and
+video, 영상, 모션 and 발표 wording never widens the route.
+
+UI work inside the other lit workflows reaches the same skill. A lit-loop, litwork,
+litgoal, native-workflow or frontend-ui-ux turn is armed at UserPromptSubmit
+(`lib/interface-probe-gate.mjs`); PostToolUse records every edit to a file a browser renders
+as the interface (`.html`, `.css` and its preprocessors, `.vue`, `.svelte`, `.astro`, `.tsx`,
+`.jsx`) and every `node … interface-probe.mjs` run. The Stop hook then holds the turn until a
+clean run follows the last interface edit, and its reason hands the interface part to
+`frontend-ui-ux`. A clean run shows `Verdict: Approve (0 HIGH)` and no `BLOCKED:` line, or, when
+its output went to a file, leaves an `--out` manifest newer than the edit with exit code 0, all
+seven matrix rows and no HIGH finding. Empty output, a BLOCKED run and anything unreadable are
+not clean. The gate
+blocks at most twice per turn, then warns once and allows; unreadable state allows. Edits to
+scripts, servers, command-line tools or docs, and turns outside a lit workflow, are never held.
+lit-loop's SURFACE step and lit-plan's Verification rows say the same in prose.
+
 Leading `readme-studio` / `$readme-studio` selects the plugin's README skill and embeds
 its body. Incidental, quoted and near-miss tokens do not enroll that route. There is
 no dedicated command file, new hook event or bundled image-generation service.
 Actual Claude Code capability governs generation; absent tools produce
 `IMAGE_GENERATION_UNAVAILABLE`, followed by composition from a supplied inspected
 background if available. Integrity checks include its nested templates and helpers.
+
+Leading `lit-diagram-drawer` / `$lit-diagram-drawer` selects the diagram skill. The
+hook adds its mode contract and the exact installed `SKILL.md` path, whose directory
+anchors the verifier, export, doctor, and importer scripts. `/litclaude:lit-diagram-drawer`
+is Claude Code's own skill route and does not pass through the hook. The words
+"diagram", "chart", or "visualization" alone activate nothing, so interface requests
+keep reaching `frontend-ui-ux` and the exact bare `lit-scientific-visualization` route
+is unchanged. Quoted, fenced, mid-sentence, and near-miss tokens stay inert.
+
+Leading `lit-pptx` / `$lit-pptx` and `lit-docx` / `$lit-docx` select the office skills, and
+so does a bare `lit` whose prompt both asks to make something (만들, 작성, 써줘, 정리해,
+준비, 초안, make, write, draft, prepare, build, …) and names slides (발표자료, 발표, 슬라이드,
+덱, PPT, 피피티, slides, deck, presentation, pptx) or a document (보고서, 리포트, 기획서,
+제안서, 계획서, 문서, 워드, report, doc, docx, document, proposal, memo). A prompt that names
+both activates both skills. This check runs before the research, goal, and plan routes,
+because the prompt asks for a file. Code documentation (README, API docs, docstrings,
+`.md` files) and tool reports (bug, test, coverage, error) never take this route. The hook
+adds each skill's mode contract, the exact installed `SKILL.md` path, and the lit defaults
+(AZURE-PRO with Pretendard; `korean-generic` for Korean text, plain styling otherwise; no
+style questions). An explicit token keeps the one-question style gate instead.
+
+Leading `lit-typographic-motion` / `$lit-typographic-motion` selects the film-director skill,
+and so does a bare `lit` whose prompt asks to make something (the office and interface verbs, plus
+제작, 렌더링, render, produce, animate) and names a film: a compound (모션그래픽, 타이포 모션,
+키네틱 타이포, 타이포그래피 영상, 가사 영상, 뮤직비디오, 오프닝 타이틀, 타이틀 시퀀스, motion
+graphics, kinetic type, typographic motion, lyric video, music video, title sequence, opening
+titles) or a bare 영상 / 비디오 / 동영상 / 클립 / video / clip. This check runs before the office
+and interface routes, so "발표 영상" and "타이포그래피 영상" reach the film skill while "발표자료" and
+"타이포그래피 정리" keep theirs. It does not fire for editing, trimming or captioning existing
+footage, a video placed in a page or in slides, a script, thumbnail or summary about a video, UI
+motion (hover, motion tokens), video as a software feature (a player, an upload), or a bare 모션 /
+motion / 인트로 / intro. There is no token-free motion route, and the token-free interface fallback
+no longer claims a video prompt. The hook adds a neutral film context (a film request, the
+treatment first, the path rule between the type and stage renderers, never which path applies),
+the exact installed `SKILL.md` path and the installed `motion.mjs` named once with its `stage`,
+`make`, `sound`, `look` and `gate` subcommands, within 4,096 bytes. A type-led cue (a type
+compound, a kinetic-type or lyric request, or a quoted span of two or more words) adds one
+`type-led cue found` hint line. PostToolUse records every `motion.mjs` run, and the Stop hook holds
+the turn until the film is done: a valid treatment, gate PASS, at least two look rounds (a stills
+round with its change, then a round stamped with the final render's stills manifest), and every
+frame of that last round opened with Read. A missing or unreadable `treatment.json` or `look.json`
+blocks with a named reason. After two reminders the hook tells the model to say in the reply that
+the film is not done and why.

package/docs/migration.md

@@ -192,7 +192,9 @@ step so a stray English "lit" is recoverable.
 | `teammode` | `lit-team` |
 | `remove-ai-slops` | `lit-burnoff` |
 | `ai-slop-remover` | `lit-burnoff-file` |
-| `korean-ai-slop-remover` | `lit-korean` |
+| `korean-ai-slop-remover` | `lit-humanizer` |
+| `lit-korean` | `lit-humanizer` |
+| `text-naturalization` | `lit-humanizer` |
 | `programming` | `lit-code` |
 | `prometheus-planner` | `lit-planner` agent |
 | `boulder-executor` | `lit-executor` agent |
@@ -206,8 +208,9 @@ The emitted line encloses both ids in backticks. Leading-only routes remain
 leading-only; the established trailing planning and cleanup routes also accept
 their old names. Quoted, fenced, and compound-word mentions stay inert.
 
-The existing `/litclaude:init-deep` and `/litclaude:korean-ai-slop-remover`
-command files are one-paragraph redirects. They pass through the original scope
+The existing `/litclaude:init-deep`, `/litclaude:lit-korean`, and
+`/litclaude:korean-ai-slop-remover` command files are one-paragraph redirects.
+They pass through the original scope
 and print the same note once. Their `user-invocable: false` metadata hides them
 from the command menu, and `disable-model-invocation: true` keeps them out of
 automatic skill selection. Current listings and recommendations use the new ids.

package/docs/privacy.md

@@ -13,6 +13,7 @@ transcript, model request, or diagnostic report contains no sensitive informatio
 | Package installation | npm and its configured registry retrieve package metadata and package bytes; ordinary package-manager connection metadata is visible to those services. Global installation can run LitClaude's postinstall setup. | `LITCLAUDE_AUTO_INSTALL=0` or `LITCLAUDE_POSTINSTALL_SKIP=1` skips automatic plugin/HUD setup. It does not stop npm from fetching the package. |
 | Update notice | Interactive `install`, `update`, and `doctor` can schedule an HTTPS GET to `registry.npmjs.org` for the package's latest-version metadata. The request identifies the package and sends an update-notifier user-agent; the request body does not contain project files or prompts. | Attempts are throttled using a 24-hour local cache. `NO_UPDATE_NOTIFIER` or `LITCLAUDE_NO_UPDATE_CHECK` disables the notice/check path, even when the variable is empty. CI, JSON, dry-run, and non-TTY management calls are gated. |
 | Automatic update | An eligible cached newer version can trigger npm to fetch and run the installer, then doctor. This can occur on `SessionStart` or interactive management commands. | `LITCLAUDE_NO_AUTO_UPDATE` disables automatic installation but leaves update checks eligible. `LITCLAUDE_NO_UPDATE_CHECK` or `NO_UPDATE_NOTIFIER` disables both paths. SessionStart is a piped host hook, so it does not use the management TTY requirement. |
+| Jev skill hint | Off by default. With `LITCLAUDE_JEV=1` and your own `TYPESAFE_API_KEY`, the `UserPromptSubmit` hook sends one HTTPS POST per eligible prompt to `api.typesafe.ai`. The body holds the prompt truncated to 2,000 characters with home paths, e-mail addresses, and token-shaped strings redacted, plus the list of LitClaude skill names and descriptions. Anything in the prompt without a token shape, such as a hostname, a customer name, or a password not written as `password=…`, is sent as written. No files, tool output, or history are sent. TypeSafe bills the request to your account (about $0.04 per million input tokens). | Unset `LITCLAUDE_JEV` to turn it off. Slash commands, routed prompts, and prompts that name a skill are never sent. Each request has a 1.5-second timeout, no retry, no redirect, and a per-session cap of 200. Because `TYPESAFE_API_KEY` is exported in the shell that starts Claude Code, the agent's own tools can read it; use a key dedicated to this feature, with a low spend limit. |
 | Public source reader | `litclaude public-read` resolves DNS and sends HTTP(S) GET requests to the supplied public URL and validated redirects. Plain search text becomes a query to `duckduckgo.com/html/`. Requests use a LitClaude user-agent and Accept header. The destination sees the requested path and query, plus normal connection metadata. | The reader rejects credential-bearing URLs and private-network targets, revalidates redirects, and stops at detected authentication/paywall barriers. It does not use a browser login or cookie jar. Redacting a URL in returned evidence does not remove query values from the actual request. |
 
 For a process that should avoid LitClaude background update traffic, set
@@ -41,7 +42,10 @@ the features used, it contains session/rule receipts, plan and goal state, work
 ledgers, saved knowledge, and other feature-specific records. SessionStart
 context-pressure detection can inspect a supplied transcript path up to 256 KiB
 for a fixed set of pressure markers; it returns only a bounded advisory. No skill
-review reads transcript excerpts or sends them to a model. Existing
+review reads transcript excerpts or sends them to a model. The optional Jev skill hint keeps
+per-session request counts, the current turn's hinted skill ID and latency (shown by the
+HUD), and whether the once-per-session "on" line was shown in `.litclaude/jev/` and, only with `LITCLAUDE_JEV_TRACE=1`, a trace
+of hashes of the redacted prompt, timings, and status codes without prompt text. Existing
 `pending-review.json` and `skill-loop-state.json` files are inert after the
 automatic review feature's removal and may be deleted. No other state is affected.
 
@@ -76,6 +80,7 @@ for sensitive reports and [support guidance](../SUPPORT.md) for routine issues.
 - [Public requests and redirects](../plugins/litclaude/lib/public-source-reader/routes.mjs),
   [target validation](../plugins/litclaude/lib/public-source-reader/validator.mjs), and
   [receipt redaction](../plugins/litclaude/lib/public-source-reader/receipts.mjs).
+- [Jev skill hint request, redaction, and validation](../plugins/litclaude/lib/jev-skill-hint.mjs).
 - [Project state-root resolution](../plugins/litclaude/lib/project-state-root.mjs),
   [rules session receipts](../plugins/litclaude/lib/rules/session-state.mjs), and
   [litgoal state](../plugins/litclaude/lib/litgoal/state.mjs).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@litfamily/litclaude",
-  "version": "1.0.10",
+  "version": "1.0.13",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {
@@ -10,6 +10,8 @@
   "files": [
     "bin",
     "docs/agents.md",
+    "docs/ab",
+    "docs/assets/skills",
     "docs/hooks.md",
     "docs/lsp.md",
     "docs/migration.md",
@@ -52,7 +54,7 @@
   "scripts": {
     "prepublishOnly": "node scripts/prepublish-test-gate.mjs",
     "postinstall": "node scripts/postinstall.mjs",
-    "test": "node --test --test-concurrency=1 test/*.test.mjs",
+    "test": "node --test --test-concurrency=1 --import ./test/helpers/motion-offline-prewarm.mjs test/*.test.mjs",
     "validate:plugin": "node scripts/validate-plugin.mjs",
     "doctor": "node scripts/doctor.mjs",
     "qa:tmux": "bash scripts/qa-claude-plugin-smoke.sh",

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "litclaude",
   "description": "Claude Code-native workflow plugin with a bounded-authority start-work lifecycle.",
-  "version": "1.0.10",
+  "version": "1.0.13",
   "author": {
     "name": "LitClaude contributors"
   },

package/plugins/litclaude/agents/korean-prose-editor.md

@@ -4,6 +4,7 @@ description: Edits Korean prose for naturalness while preserving meaning.
 tools: Read, Grep, Glob
 permissionMode: default
 skills:
+  - lit-humanizer
   - rules
 ---
 

package/plugins/litclaude/agents/korean-style-analyzer.md

@@ -4,6 +4,7 @@ description: Analyzes Korean prose for machine-written texture and revision targ
 tools: Read, Grep, Glob
 permissionMode: plan
 skills:
+  - lit-humanizer
   - rules
 ---
 

package/plugins/litclaude/agents/meaning-preservation-auditor.md

@@ -4,6 +4,7 @@ description: Audits Korean revisions for meaning preservation and factual drift.
 tools: Read, Grep, Glob
 permissionMode: default
 skills:
+  - lit-humanizer
   - review-work
   - rules
 ---

package/plugins/litclaude/agents/native-flow-reviewer.md

@@ -4,6 +4,7 @@ description: Reviews Korean revisions for natural flow and native readability.
 tools: Read, Grep, Glob
 permissionMode: default
 skills:
+  - lit-humanizer
   - review-work
   - rules
 ---

package/plugins/litclaude/agents/polish-orchestrator.md

@@ -4,6 +4,7 @@ description: Coordinates strict Korean prose polish decisions and final summary.
 tools: Read, Grep, Glob
 permissionMode: default
 skills:
+  - lit-humanizer
   - review-work
   - rules
 ---