@luanpdd/kit-mcp 1.29.0 → 1.30.1

package/kit/hooks/check-update.js

@@ -1,118 +1,118 @@
-#!/usr/bin/env node
-// hook-version: 1.30.0
-// SEC-13-05: flush-before-exit category = E (parent returns after spawn unref; child uses sync fs writes) — no fix needed
-// Check for framework updates in background, write result to cache
-// Called by SessionStart hook - runs once per session
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const { spawn } = require('child_process');
-
-const homeDir = os.homedir();
-const cwd = process.cwd();
-
-// Detect runtime config directory (supports Claude, OpenCode, Gemini)
-// Respects CLAUDE_CONFIG_DIR for custom config directory setups
-function detectConfigDir(baseDir) {
-  // Check env override first (supports multi-account setups)
-  const envDir = process.env.CLAUDE_CONFIG_DIR;
-  if (envDir && fs.existsSync(path.join(envDir, 'framework', 'VERSION'))) {
-    return envDir;
-  }
-  for (const dir of ['.config/opencode', '.opencode', '.gemini', '.claude']) {
-    if (fs.existsSync(path.join(baseDir, dir, 'framework', 'VERSION'))) {
-      return path.join(baseDir, dir);
-    }
-  }
-  return envDir || path.join(baseDir, '.claude');
-}
-
-const globalConfigDir = detectConfigDir(homeDir);
-const projectConfigDir = detectConfigDir(cwd);
-const cacheDir = path.join(globalConfigDir, 'cache');
-const cacheFile = path.join(cacheDir, 'update-check.json');
-
-// VERSION file locations (check project first, then global)
-const projectVersionFile = path.join(projectConfigDir, 'framework', 'VERSION');
-const globalVersionFile = path.join(globalConfigDir, 'framework', 'VERSION');
-
-// Ensure cache directory exists
-if (!fs.existsSync(cacheDir)) {
-  fs.mkdirSync(cacheDir, { recursive: true });
-}
-
-// Run check in background (spawn background process, windowsHide prevents console flash)
-// SEC-13-05: parent process retorna imediatamente após child.unref() — não
-// há buffered I/O no parent. Child usa fs.writeFileSync (sync), sem race.
-// Categoria E na taxonomia da Phase 80.
-const child = spawn(process.execPath, ['-e', `
-  const fs = require('fs');
-  const path = require('path');
-  const { execSync } = require('child_process');
-
-  const cacheFile = ${JSON.stringify(cacheFile)};
-  const projectVersionFile = ${JSON.stringify(projectVersionFile)};
-  const globalVersionFile = ${JSON.stringify(globalVersionFile)};
-
-  // Check project directory first (local install), then global
-  let installed = '0.0.0';
-  let configDir = '';
-  try {
-    if (fs.existsSync(projectVersionFile)) {
-      installed = fs.readFileSync(projectVersionFile, 'utf8').trim();
-      configDir = path.dirname(path.dirname(projectVersionFile));
-    } else if (fs.existsSync(globalVersionFile)) {
-      installed = fs.readFileSync(globalVersionFile, 'utf8').trim();
-      configDir = path.dirname(path.dirname(globalVersionFile));
-    }
-  } catch (e) {}
-
-  // Check for stale hooks — compare hook version headers against installed VERSION
-  // Hooks live inside framework/hooks/, not configDir/hooks/
-  let staleHooks = [];
-  if (configDir) {
-    const hooksDir = path.join(configDir, 'framework', 'hooks');
-    try {
-      if (fs.existsSync(hooksDir)) {
-        const hookFiles = fs.readdirSync(hooksDir).filter(f => f.startsWith('framework-') && f.endsWith('.js'));
-        for (const hookFile of hookFiles) {
-          try {
-            const content = fs.readFileSync(path.join(hooksDir, hookFile), 'utf8');
-            const versionMatch = content.match(/\\/\\/ hook-version:\\s*(.+)/);
-            if (versionMatch) {
-              const hookVersion = versionMatch[1].trim();
-              if (hookVersion !== installed && !hookVersion.includes('{{')) {
-                staleHooks.push({ file: hookFile, hookVersion, installedVersion: installed });
-              }
-            } else {
-              // No version header at all — definitely stale (pre-version-tracking)
-              staleHooks.push({ file: hookFile, hookVersion: 'unknown', installedVersion: installed });
-            }
-          } catch (e) {}
-        }
-      }
-    } catch (e) {}
-  }
-
-  let latest = null;
-  try {
-    latest = execSync('npm view framework-cc version', { encoding: 'utf8', timeout: 10000, windowsHide: true }).trim();
-  } catch (e) {}
-
-  const result = {
-    update_available: latest && installed !== latest,
-    installed,
-    latest: latest || 'unknown',
-    checked: Math.floor(Date.now() / 1000),
-    stale_hooks: staleHooks.length > 0 ? staleHooks : undefined
-  };
-
-  fs.writeFileSync(cacheFile, JSON.stringify(result));
-`], {
-  stdio: 'ignore',
-  windowsHide: true,
-  detached: true  // Required on Windows for proper process detachment
-});
-
-child.unref();
+#!/usr/bin/env node
+// hook-version: 1.30.0
+// SEC-13-05: flush-before-exit category = E (parent returns after spawn unref; child uses sync fs writes) — no fix needed
+// Check for framework updates in background, write result to cache
+// Called by SessionStart hook - runs once per session
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawn } = require('child_process');
+
+const homeDir = os.homedir();
+const cwd = process.cwd();
+
+// Detect runtime config directory (supports Claude, OpenCode, Gemini)
+// Respects CLAUDE_CONFIG_DIR for custom config directory setups
+function detectConfigDir(baseDir) {
+  // Check env override first (supports multi-account setups)
+  const envDir = process.env.CLAUDE_CONFIG_DIR;
+  if (envDir && fs.existsSync(path.join(envDir, 'framework', 'VERSION'))) {
+    return envDir;
+  }
+  for (const dir of ['.config/opencode', '.opencode', '.gemini', '.claude']) {
+    if (fs.existsSync(path.join(baseDir, dir, 'framework', 'VERSION'))) {
+      return path.join(baseDir, dir);
+    }
+  }
+  return envDir || path.join(baseDir, '.claude');
+}
+
+const globalConfigDir = detectConfigDir(homeDir);
+const projectConfigDir = detectConfigDir(cwd);
+const cacheDir = path.join(globalConfigDir, 'cache');
+const cacheFile = path.join(cacheDir, 'update-check.json');
+
+// VERSION file locations (check project first, then global)
+const projectVersionFile = path.join(projectConfigDir, 'framework', 'VERSION');
+const globalVersionFile = path.join(globalConfigDir, 'framework', 'VERSION');
+
+// Ensure cache directory exists
+if (!fs.existsSync(cacheDir)) {
+  fs.mkdirSync(cacheDir, { recursive: true });
+}
+
+// Run check in background (spawn background process, windowsHide prevents console flash)
+// SEC-13-05: parent process retorna imediatamente após child.unref() — não
+// há buffered I/O no parent. Child usa fs.writeFileSync (sync), sem race.
+// Categoria E na taxonomia da Phase 80.
+const child = spawn(process.execPath, ['-e', `
+  const fs = require('fs');
+  const path = require('path');
+  const { execSync } = require('child_process');
+
+  const cacheFile = ${JSON.stringify(cacheFile)};
+  const projectVersionFile = ${JSON.stringify(projectVersionFile)};
+  const globalVersionFile = ${JSON.stringify(globalVersionFile)};
+
+  // Check project directory first (local install), then global
+  let installed = '0.0.0';
+  let configDir = '';
+  try {
+    if (fs.existsSync(projectVersionFile)) {
+      installed = fs.readFileSync(projectVersionFile, 'utf8').trim();
+      configDir = path.dirname(path.dirname(projectVersionFile));
+    } else if (fs.existsSync(globalVersionFile)) {
+      installed = fs.readFileSync(globalVersionFile, 'utf8').trim();
+      configDir = path.dirname(path.dirname(globalVersionFile));
+    }
+  } catch (e) {}
+
+  // Check for stale hooks — compare hook version headers against installed VERSION
+  // Hooks live inside framework/hooks/, not configDir/hooks/
+  let staleHooks = [];
+  if (configDir) {
+    const hooksDir = path.join(configDir, 'framework', 'hooks');
+    try {
+      if (fs.existsSync(hooksDir)) {
+        const hookFiles = fs.readdirSync(hooksDir).filter(f => f.startsWith('framework-') && f.endsWith('.js'));
+        for (const hookFile of hookFiles) {
+          try {
+            const content = fs.readFileSync(path.join(hooksDir, hookFile), 'utf8');
+            const versionMatch = content.match(/\\/\\/ hook-version:\\s*(.+)/);
+            if (versionMatch) {
+              const hookVersion = versionMatch[1].trim();
+              if (hookVersion !== installed && !hookVersion.includes('{{')) {
+                staleHooks.push({ file: hookFile, hookVersion, installedVersion: installed });
+              }
+            } else {
+              // No version header at all — definitely stale (pre-version-tracking)
+              staleHooks.push({ file: hookFile, hookVersion: 'unknown', installedVersion: installed });
+            }
+          } catch (e) {}
+        }
+      }
+    } catch (e) {}
+  }
+
+  let latest = null;
+  try {
+    latest = execSync('npm view framework-cc version', { encoding: 'utf8', timeout: 10000, windowsHide: true }).trim();
+  } catch (e) {}
+
+  const result = {
+    update_available: latest && installed !== latest,
+    installed,
+    latest: latest || 'unknown',
+    checked: Math.floor(Date.now() / 1000),
+    stale_hooks: staleHooks.length > 0 ? staleHooks : undefined
+  };
+
+  fs.writeFileSync(cacheFile, JSON.stringify(result));
+`], {
+  stdio: 'ignore',
+  windowsHide: true,
+  detached: true  // Required on Windows for proper process detachment
+});
+
+child.unref();

package/kit/hooks/context-monitor.js

@@ -1,163 +1,163 @@
-#!/usr/bin/env node
-// hook-version: 1.30.1
-// SEC-13-05: flush-before-exit category = A (stdout.write + immediate exit)
-// Fix applied: process.stdout.write(payload, () => process.exit(0)) on warning path.
-// Context Monitor - PostToolUse/AfterTool hook (Gemini uses AfterTool)
-// Reads context metrics from the statusline bridge file and injects
-// warnings when context usage is high. This makes the AGENT aware of
-// context limits (the statusline only shows the user).
-//
-// How it works:
-// 1. The statusline hook writes metrics to /tmp/claude-ctx-{session_id}.json
-// 2. This hook reads those metrics after each tool use
-// 3. When remaining context drops below thresholds, it injects a warning
-//    as additionalContext, which the agent sees in its conversation
-//
-// Thresholds:
-//   WARNING  (remaining <= 35%): Agent should wrap up current task
-//   CRITICAL (remaining <= 25%): Agent should stop immediately and save state
-//
-// Debounce: 5 tool uses between warnings to avoid spam
-// Severity escalation bypasses debounce (WARNING -> CRITICAL fires immediately)
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const WARNING_THRESHOLD = 35;  // remaining_percentage <= 35%
-const CRITICAL_THRESHOLD = 25; // remaining_percentage <= 25%
-const STALE_SECONDS = 60;      // ignore metrics older than 60s
-const DEBOUNCE_CALLS = 5;      // min tool uses between warnings
-
-let input = '';
-// Timeout guard: if stdin doesn't close within 10s (e.g. pipe issues on
-// Windows/Git Bash, or slow Claude Code piping during large outputs),
-// exit silently instead of hanging until Claude Code kills the process
-// and reports "hook error". See #775, #1162.
-const stdinTimeout = setTimeout(() => process.exit(0), 10000);
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', chunk => input += chunk);
-process.stdin.on('end', () => {
-  clearTimeout(stdinTimeout);
-  try {
-    const data = JSON.parse(input);
-    const sessionId = data.session_id;
-
-    if (!sessionId) {
-      process.exit(0);
-    }
-
-    // Check if context warnings are disabled via config
-    const cwd = data.cwd || process.cwd();
-    const configPath = path.join(cwd, '.planning', 'config.json');
-    if (fs.existsSync(configPath)) {
-      try {
-        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-        if (config.hooks?.context_warnings === false) {
-          process.exit(0);
-        }
-      } catch (e) {
-        // Ignore config parse errors
-      }
-    }
-
-    const tmpDir = os.tmpdir();
-    const metricsPath = path.join(tmpDir, `claude-ctx-${sessionId}.json`);
-
-    // If no metrics file, this is a subagent or fresh session -- exit silently
-    if (!fs.existsSync(metricsPath)) {
-      process.exit(0);
-    }
-
-    const metrics = JSON.parse(fs.readFileSync(metricsPath, 'utf8'));
-    const now = Math.floor(Date.now() / 1000);
-
-    // Ignore stale metrics
-    if (metrics.timestamp && (now - metrics.timestamp) > STALE_SECONDS) {
-      process.exit(0);
-    }
-
-    const remaining = metrics.remaining_percentage;
-    const usedPct = metrics.used_pct;
-
-    // No warning needed
-    if (remaining > WARNING_THRESHOLD) {
-      process.exit(0);
-    }
-
-    // Debounce: check if we warned recently
-    const warnPath = path.join(tmpDir, `claude-ctx-${sessionId}-warned.json`);
-    let warnData = { callsSinceWarn: 0, lastLevel: null };
-    let firstWarn = true;
-
-    if (fs.existsSync(warnPath)) {
-      try {
-        warnData = JSON.parse(fs.readFileSync(warnPath, 'utf8'));
-        firstWarn = false;
-      } catch (e) {
-        // Corrupted file, reset
-      }
-    }
-
-    warnData.callsSinceWarn = (warnData.callsSinceWarn || 0) + 1;
-
-    const isCritical = remaining <= CRITICAL_THRESHOLD;
-    const currentLevel = isCritical ? 'critical' : 'warning';
-
-    // Emit immediately on first warning, then debounce subsequent ones
-    // Severity escalation (WARNING -> CRITICAL) bypasses debounce
-    const severityEscalated = currentLevel === 'critical' && warnData.lastLevel === 'warning';
-    if (!firstWarn && warnData.callsSinceWarn < DEBOUNCE_CALLS && !severityEscalated) {
-      // Update counter and exit without warning
-      fs.writeFileSync(warnPath, JSON.stringify(warnData));
-      process.exit(0);
-    }
-
-    // Reset debounce counter
-    warnData.callsSinceWarn = 0;
-    warnData.lastLevel = currentLevel;
-    fs.writeFileSync(warnPath, JSON.stringify(warnData));
-
-    // Detect if framework is active (has .planning/STATE.md in working directory)
-    const isFrameworkActive = fs.existsSync(path.join(cwd, '.planning', 'STATE.md'));
-
-    // Build advisory warning message (never use imperative commands that
-    // override user preferences — see #884)
-    let message;
-    if (isCritical) {
-      message = isFrameworkActive
-        ? `CONTEXTO CRÍTICO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
-          'O contexto está quase esgotado. NÃO inicie novo trabalho complexo nem escreva arquivos de handoff — ' +
-          'o estado do framework já está rastreado no STATE.md. Informe o usuário para que possa executar ' +
-          '/pause-work no próximo ponto de parada natural.'
-        : `CONTEXTO CRÍTICO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
-          'O contexto está quase esgotado. Informe o usuário que o contexto está baixo e pergunte como ' +
-          'deseja prosseguir. NÃO salve estado nem escreva arquivos de handoff de forma autônoma sem que o usuário solicite.';
-    } else {
-      message = isFrameworkActive
-        ? `AVISO DE CONTEXTO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
-          'O contexto está ficando limitado. Evite iniciar novo trabalho complexo. Se não estiver entre ' +
-          'passos definidos do plano, informe o usuário para que possa se preparar para pausar.'
-        : `AVISO DE CONTEXTO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
-          'Esteja ciente de que o contexto está ficando limitado. Evite exploração desnecessária ou ' +
-          'iniciar novo trabalho complexo.';
-    }
-
-    const output = {
-      hookSpecificOutput: {
-        hookEventName: process.env.GEMINI_API_KEY ? "AfterTool" : "PostToolUse",
-        additionalContext: message
-      }
-    };
-
-    // SEC-13-05: aguardar flush do stdout antes do exit. Sem callback, em
-    // pipes lentos (CI/Windows/Git Bash) o JSON pode ser dropado quando o
-    // process termina antes do kernel drenar o buffer.
-    process.stdout.write(JSON.stringify(output), () => {
-      process.exit(0);
-    });
-  } catch (e) {
-    // Silent fail -- never block tool execution
-    process.exit(0);
-  }
-});
+#!/usr/bin/env node
+// hook-version: 1.30.1
+// SEC-13-05: flush-before-exit category = A (stdout.write + immediate exit)
+// Fix applied: process.stdout.write(payload, () => process.exit(0)) on warning path.
+// Context Monitor - PostToolUse/AfterTool hook (Gemini uses AfterTool)
+// Reads context metrics from the statusline bridge file and injects
+// warnings when context usage is high. This makes the AGENT aware of
+// context limits (the statusline only shows the user).
+//
+// How it works:
+// 1. The statusline hook writes metrics to /tmp/claude-ctx-{session_id}.json
+// 2. This hook reads those metrics after each tool use
+// 3. When remaining context drops below thresholds, it injects a warning
+//    as additionalContext, which the agent sees in its conversation
+//
+// Thresholds:
+//   WARNING  (remaining <= 35%): Agent should wrap up current task
+//   CRITICAL (remaining <= 25%): Agent should stop immediately and save state
+//
+// Debounce: 5 tool uses between warnings to avoid spam
+// Severity escalation bypasses debounce (WARNING -> CRITICAL fires immediately)
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const WARNING_THRESHOLD = 35;  // remaining_percentage <= 35%
+const CRITICAL_THRESHOLD = 25; // remaining_percentage <= 25%
+const STALE_SECONDS = 60;      // ignore metrics older than 60s
+const DEBOUNCE_CALLS = 5;      // min tool uses between warnings
+
+let input = '';
+// Timeout guard: if stdin doesn't close within 10s (e.g. pipe issues on
+// Windows/Git Bash, or slow Claude Code piping during large outputs),
+// exit silently instead of hanging until Claude Code kills the process
+// and reports "hook error". See #775, #1162.
+const stdinTimeout = setTimeout(() => process.exit(0), 10000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => input += chunk);
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    const data = JSON.parse(input);
+    const sessionId = data.session_id;
+
+    if (!sessionId) {
+      process.exit(0);
+    }
+
+    // Check if context warnings are disabled via config
+    const cwd = data.cwd || process.cwd();
+    const configPath = path.join(cwd, '.planning', 'config.json');
+    if (fs.existsSync(configPath)) {
+      try {
+        const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        if (config.hooks?.context_warnings === false) {
+          process.exit(0);
+        }
+      } catch (e) {
+        // Ignore config parse errors
+      }
+    }
+
+    const tmpDir = os.tmpdir();
+    const metricsPath = path.join(tmpDir, `claude-ctx-${sessionId}.json`);
+
+    // If no metrics file, this is a subagent or fresh session -- exit silently
+    if (!fs.existsSync(metricsPath)) {
+      process.exit(0);
+    }
+
+    const metrics = JSON.parse(fs.readFileSync(metricsPath, 'utf8'));
+    const now = Math.floor(Date.now() / 1000);
+
+    // Ignore stale metrics
+    if (metrics.timestamp && (now - metrics.timestamp) > STALE_SECONDS) {
+      process.exit(0);
+    }
+
+    const remaining = metrics.remaining_percentage;
+    const usedPct = metrics.used_pct;
+
+    // No warning needed
+    if (remaining > WARNING_THRESHOLD) {
+      process.exit(0);
+    }
+
+    // Debounce: check if we warned recently
+    const warnPath = path.join(tmpDir, `claude-ctx-${sessionId}-warned.json`);
+    let warnData = { callsSinceWarn: 0, lastLevel: null };
+    let firstWarn = true;
+
+    if (fs.existsSync(warnPath)) {
+      try {
+        warnData = JSON.parse(fs.readFileSync(warnPath, 'utf8'));
+        firstWarn = false;
+      } catch (e) {
+        // Corrupted file, reset
+      }
+    }
+
+    warnData.callsSinceWarn = (warnData.callsSinceWarn || 0) + 1;
+
+    const isCritical = remaining <= CRITICAL_THRESHOLD;
+    const currentLevel = isCritical ? 'critical' : 'warning';
+
+    // Emit immediately on first warning, then debounce subsequent ones
+    // Severity escalation (WARNING -> CRITICAL) bypasses debounce
+    const severityEscalated = currentLevel === 'critical' && warnData.lastLevel === 'warning';
+    if (!firstWarn && warnData.callsSinceWarn < DEBOUNCE_CALLS && !severityEscalated) {
+      // Update counter and exit without warning
+      fs.writeFileSync(warnPath, JSON.stringify(warnData));
+      process.exit(0);
+    }
+
+    // Reset debounce counter
+    warnData.callsSinceWarn = 0;
+    warnData.lastLevel = currentLevel;
+    fs.writeFileSync(warnPath, JSON.stringify(warnData));
+
+    // Detect if framework is active (has .planning/STATE.md in working directory)
+    const isFrameworkActive = fs.existsSync(path.join(cwd, '.planning', 'STATE.md'));
+
+    // Build advisory warning message (never use imperative commands that
+    // override user preferences — see #884)
+    let message;
+    if (isCritical) {
+      message = isFrameworkActive
+        ? `CONTEXTO CRÍTICO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
+          'O contexto está quase esgotado. NÃO inicie novo trabalho complexo nem escreva arquivos de handoff — ' +
+          'o estado do framework já está rastreado no STATE.md. Informe o usuário para que possa executar ' +
+          '/pause-work no próximo ponto de parada natural.'
+        : `CONTEXTO CRÍTICO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
+          'O contexto está quase esgotado. Informe o usuário que o contexto está baixo e pergunte como ' +
+          'deseja prosseguir. NÃO salve estado nem escreva arquivos de handoff de forma autônoma sem que o usuário solicite.';
+    } else {
+      message = isFrameworkActive
+        ? `AVISO DE CONTEXTO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
+          'O contexto está ficando limitado. Evite iniciar novo trabalho complexo. Se não estiver entre ' +
+          'passos definidos do plano, informe o usuário para que possa se preparar para pausar.'
+        : `AVISO DE CONTEXTO: Uso em ${usedPct}%. Restando: ${remaining}%. ` +
+          'Esteja ciente de que o contexto está ficando limitado. Evite exploração desnecessária ou ' +
+          'iniciar novo trabalho complexo.';
+    }
+
+    const output = {
+      hookSpecificOutput: {
+        hookEventName: process.env.GEMINI_API_KEY ? "AfterTool" : "PostToolUse",
+        additionalContext: message
+      }
+    };
+
+    // SEC-13-05: aguardar flush do stdout antes do exit. Sem callback, em
+    // pipes lentos (CI/Windows/Git Bash) o JSON pode ser dropado quando o
+    // process termina antes do kernel drenar o buffer.
+    process.stdout.write(JSON.stringify(output), () => {
+      process.exit(0);
+    });
+  } catch (e) {
+    // Silent fail -- never block tool execution
+    process.exit(0);
+  }
+});

package/kit/hooks/kit-attribution-reminder.cjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+// hook-version: 1.30.1
+// kit-mcp · Kit Attribution Reminder (UserPromptSubmit)
+//
+// Injeta `additionalContext` no envelope do prompt do usuário com diretiva
+// canônica v1.30.1: sempre que Claude usar comandos/agents/skills do kit-mcp
+// no turno corrente, deve abrir o sidecar (auto-spawn já cuida disso na 1ª
+// tool call) e listar os recursos usados em bloco final do output.
+//
+// Objetivo: dar feedback visual + textual de uso real do kit-mcp para o
+// usuário detectar bugs no fluxo precocemente.
+//
+// Pipeline: UserPromptSubmit hook → reads stdin envelope → writes JSON com
+// `{ continue: true, hookSpecificOutput: { hookEventName: "UserPromptSubmit",
+//    additionalContext: "<diretiva>" } }` → exit 0.
+//
+// SOFT failure: qualquer erro → exit 0 sem bloquear. Skip se
+// KIT_MCP_NO_ATTRIBUTION=1.
+//
+// Module format: CommonJS (.cjs) — compatível com qualquer setup Node.
+//
+// Enable em settings.json (project ou user):
+//   {
+//     "hooks": {
+//       "UserPromptSubmit": [{
+//         "matcher": "*",
+//         "hooks": [{
+//           "type": "command",
+//           "command": "node /abs/path/to/kit-attribution-reminder.cjs"
+//         }]
+//       }]
+//     }
+//   }
+
+'use strict';
+
+// Opt-out via env var
+if (process.env.KIT_MCP_NO_ATTRIBUTION === '1' || process.env.KIT_MCP_NO_ATTRIBUTION === 'true') {
+  process.exit(0);
+}
+
+const DIRECTIVE = [
+  '🔧 KIT-MCP ATTRIBUTION — directive ativa neste turno (v1.30.1):',
+  '',
+  'Se ao responder este turno você usar QUALQUER recurso do kit-mcp (qualquer',
+  'subagent_type listado em /agents kit-mcp, qualquer skill cujo nome começa',
+  'com supabase-/legacy-/cascading-/etc. do kit, ou qualquer /slash-command',
+  'do kit), SEMPRE faça duas coisas:',
+  '',
+  '1. **Sidecar visual:** o kit-mcp abre o sidecar automaticamente na primeira',
+  '   tool call do MCP server (browser tab em 127.0.0.1:<porta>). Você NÃO',
+  '   precisa abrir manualmente — é fire-and-forget no MCP. Apenas confirme',
+  '   que foi disparado e mencione se o usuário precisar conferir.',
+  '',
+  '2. **Bloco de atribuição no final do output** — adicione ao final da sua',
+  '   resposta um bloco markdown listando TODOS os recursos kit-mcp usados:',
+  '',
+  '   ```',
+  '   ---',
+  '   🔧 **Kit-mcp resources usados neste turno:**',
+  '   - Commands: /<command> (motivo: ...)',
+  '   - Agents: <agent-name> (via Task — motivo: ...)',
+  '   - Skills: <skill-name> (auto-trigger / consultada — motivo: ...)',
+  '   - Sidecar: http://127.0.0.1:<porta>/ (opened on first MCP tool call)',
+  '   ```',
+  '',
+  '   Omita seções vazias. Se NÃO usou nenhum recurso kit-mcp neste turno,',
+  '   **não adicione o bloco** — silêncio é melhor que ruído.',
+  '',
+  'Disable temporário: env KIT_MCP_NO_ATTRIBUTION=1.',
+  '',
+].join('\n');
+
+let input = '';
+const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => { input += chunk; });
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    // Aceita envelope vazio; só precisamos retornar o JSON com additionalContext.
+    JSON.parse(input || '{}');
+  } catch {
+    // Envelope inválido — não bloquear; sair sem inject.
+    process.exit(0);
+  }
+  const payload = JSON.stringify({
+    continue: true,
+    hookSpecificOutput: {
+      hookEventName: 'UserPromptSubmit',
+      additionalContext: DIRECTIVE,
+    },
+  });
+  // SEC-13-05 (category A): flush antes de exit
+  process.stdout.write(payload, () => process.exit(0));
+});
+
+process.stdin.on('error', () => process.exit(0));