@oneie/claude 0.1.0

package/hooks/scripts/design-check.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# DESIGN CHECK — enforces the 6-token design system on every Write/Edit.
+#
+# Fires after Write/Edit/MultiEdit on web/**/*.{tsx,astro,css}.
+# Greps the touched file for banned palette classes (zinc, indigo, ...),
+# hex literals, raw hsl()/rgb() calls, and off-scale arbitrary values
+# (p-[13px], rounded-[7px], text-[15px]) that escape the spacing/radius
+# /typography scales. CSS var refs (text-[var(--size)]) are allowed.
+#
+# Exit 2 on violation — Claude Code feeds stderr back to the model so it
+# self-corrects on the next turn. The edit already landed; the model fixes it.
+#
+# Allowlist: Layout.astro (token source) and design.astro (showcase).
+# Spec: /Users/toc/Server/one-ie/one/design.md
+# Rule: .claude/rules/design.md
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+FILE=$(echo "$1" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+
+# Scope: only web source files in the design system
+if [[ -z "$FILE" ]]; then exit 0; fi
+if [[ ! "$FILE" =~ /web/src/.*\.(tsx|astro|css)$ ]]; then exit 0; fi
+
+# Allowlist — the token source and the showcase intentionally use raw HSL
+BASE=$(basename "$FILE")
+if [[ "$BASE" == "Layout.astro" ]] || [[ "$BASE" == "design.astro" ]]; then
+  emit_signal "hook:design-check:skip" 0 "file=$BASE allowlisted"
+  exit 0
+fi
+
+PALETTE='zinc|slate|gray|neutral|stone|red|orange|amber|yellow|lime|green|emerald|teal|cyan|sky|blue|indigo|violet|purple|fuchsia|pink|rose'
+PROPS='bg|text|border|ring|from|to|via|fill|stroke|placeholder|caret|accent|decoration|divide|outline|shadow'
+CLASS_RE="(${PROPS})-(${PALETTE})-[0-9]+"
+LITERAL_RE='#[0-9a-fA-F]{3}([0-9a-fA-F]{3})?([0-9a-fA-F]{2})?\b|\b(hsl|rgb|hsla|rgba)\('
+
+# Off-scale escape hatches: arbitrary spacing/sizing/radius/typography values.
+# Spacing scale (design.md): 4/8/12/16/20/24/32. Radius: sm/md/lg (6/10/16).
+# `text-[var(--size)]` is fine — only literal pixel/rem/em values get flagged.
+# Width/height/size deliberately omitted — layout math (h-[calc(100vh-73px)],
+# w-[380px] for a fixed widget) legitimately needs values off the 4-step scale.
+ARBITRARY_PROPS='p|px|py|pt|pr|pb|pl|m|mx|my|mt|mr|mb|ml|gap|gap-x|gap-y|space-x|space-y|rounded|rounded-t|rounded-b|rounded-l|rounded-r|rounded-tl|rounded-tr|rounded-bl|rounded-br|text|leading|tracking'
+ARBITRARY_RE="(^|[[:space:]\"'])(${ARBITRARY_PROPS})-\[[^]]+\]"
+
+VIOLATIONS=$(
+  {
+    grep -nE "$CLASS_RE" "$FILE" 2>/dev/null
+    grep -nE "$LITERAL_RE" "$FILE" 2>/dev/null
+    grep -nE "$ARBITRARY_RE" "$FILE" 2>/dev/null | grep -v 'var(--'
+  } | head -20
+)
+
+if [[ -z "$VIOLATIONS" ]]; then
+  emit_signal "hook:design-check:ok" 1 "file=$BASE"
+  exit 0
+fi
+
+COUNT=$(echo "$VIOLATIONS" | wc -l | tr -d ' ')
+emit_signal "hook:design-check:warn" -1 "file=$BASE violations=$COUNT"
+
+cat >&2 <<EOF
+✗ Design system violation in $BASE — $COUNT line(s) escape the token / scale system.
+
+$VIOLATIONS
+
+The design system is 6 tokens: background, foreground, font, primary, secondary, tertiary.
+Plus invariants: white, black, transparent.
+
+Replace banned utilities:
+  bg-zinc-*, bg-indigo-*, etc.  →  bg-{background|foreground|primary|secondary|tertiary}
+  text-zinc-*, text-emerald-*   →  text-{font|primary|tertiary}  (use /60, /40 for muted)
+  border-zinc-*                 →  border-font/10
+  Hex literals (#fff, #abc)     →  use a token
+  hsl()/rgb() in source         →  only allowed in Layout.astro
+  p-[13px], m-[7px], gap-[5px]  →  snap to 4/8/12/16/20/24/32 (p-1, p-2, p-3, p-4, ...)
+  rounded-[7px]                 →  rounded-md (10px) / rounded-lg (16px) / use --radius-*
+  text-[15px], leading-[18px]   →  Tailwind text-sm/base/lg or text-[var(--size-N)]
+
+Spec: design.md  ·  Rule: .claude/rules/design.md  ·  Showcase: /design
+EOF
+
+exit 2

package/hooks/scripts/post-edit-check.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# POST-EDIT CHECK — The deterministic sandwich around every file change
+#
+# Runs after Write/Edit. Checks the touched file with biome.
+# Non-blocking (exit 0) — reports issues as warnings, doesn't halt.
+# The W4 verify step does the blocking check.
+# Emits hook:post-edit:{ok,warn} signal per Rule 1 (see .claude/skills/signal.md).
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+FILE=$(echo "$1" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+
+# Only check .ts/.tsx/.js/.jsx files
+if [[ -z "$FILE" ]] || [[ ! "$FILE" =~ \.(ts|tsx|js|jsx)$ ]]; then
+  exit 0
+fi
+
+# Quick biome lint on the single file (non-blocking)
+RESULT=$(cd "$CLAUDE_PROJECT_DIR" && bun biome check "$FILE" 2>&1)
+EXIT=$?
+
+BASE=$(basename "$FILE")
+if [ $EXIT -ne 0 ]; then
+  ISSUES=$(echo "$RESULT" | grep -c "━━━" 2>/dev/null || echo "?")
+  echo "biome: ${ISSUES} issues in $BASE" >&2
+  emit_signal "hook:post-edit:warn" -0.5 "file=$BASE issues=$ISSUES"
+else
+  emit_signal "hook:post-edit:ok" 1 "file=$BASE"
+fi
+
+exit 0  # Never block — just inform

package/hooks/scripts/session-end-verify.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# SESSION-END VERIFY — Report regressions introduced during session
+#
+# Runs on Stop (session end). Non-blocking — just reports.
+# Lets human see what might have broken without blocking the session.
+# Emits hook:session-end:{ok,warn} signal per Rule 1 (see .claude/skills/signal.md).
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+echo ""
+echo "┌─────────────────────────────────────────────────────────────┐"
+echo "│ SESSION-END VERIFICATION                                    │"
+echo "└─────────────────────────────────────────────────────────────┘"
+echo ""
+
+# Run only biome (fast, ~0.3s). Skip tsc/vitest to avoid blocking session exit.
+RESULT=$(bun biome check . 2>&1)
+EXIT=$?
+
+if [ $EXIT -eq 0 ]; then
+  echo "✓ All checks passed. Baseline is green."
+  echo ""
+  emit_signal "hook:session-end:ok" 1 "biome=clean"
+  exit 0
+fi
+
+# Extract test counts
+PASSED=$(echo "$RESULT" | grep -o '[0-9]* pass' | head -1 | awk '{print $1}')
+FAILED=$(echo "$RESULT" | grep -o '[0-9]* fail' | head -1 | awk '{print $1}')
+ERRORS=$(echo "$RESULT" | grep -c "error TS" || echo "0")
+
+echo "⚠ Issues detected:"
+if [ -n "$FAILED" ] && [ "$FAILED" -gt 0 ]; then
+  echo "  · Tests: $FAILED failed (was passing before?)"
+fi
+if [ "$ERRORS" -gt 0 ]; then
+  echo "  · TypeScript: $ERRORS type errors"
+fi
+
+echo ""
+echo "Next session should start with: bun run verify"
+echo ""
+
+# Mild warn — baseline dirty but session continuing
+emit_signal "hook:session-end:warn" -0.5 "failed=${FAILED:-0} errors=${ERRORS:-0}"
+
+# Non-blocking — always exit 0
+exit 0

package/hooks/scripts/session-start.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# SESSION-START — surface unaddressed proposals + module-specific context.
+#
+# Closes the loop with stop-reflect.sh: stop emits proposals into
+# .claude/improvements.queue.md; this surfaces them at next session start so
+# they don't rot. Article calls this the self-improving harness pattern.
+#
+# Also prints the relevant skill list for the most recently touched module,
+# so dev context loads dynamically rather than every-session.
+#
+# Output is brief — every line costs context.
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+QUEUE="$CLAUDE_PROJECT_DIR/.claude/improvements.queue.md"
+PROPOSAL_COUNT=0
+
+# Count unaddressed proposals (every "-" bullet under a session header)
+if [ -f "$QUEUE" ]; then
+  PROPOSAL_COUNT=$(grep -c '^- \*\*' "$QUEUE" 2>/dev/null || echo 0)
+fi
+
+# Detect most-recently touched module — use mtime on a stable per-module marker.
+# Falls back silently if nothing identifiable.
+HOT_MODULE=""
+HOT_HINT=""
+
+# Parallel arrays — bash 3.2 compatible (macOS default).
+MODULES=(
+  "one.ie/web"
+  "agents"
+  "api"
+  "packages/sdk"
+  "packages/mcp"
+  "packages/cli"
+  "sync"
+  "backup"
+)
+HINTS=(
+  "/astro · /react19 · /shadcn · /dev · /build"
+  "/cloudflare · /ai-sdk · /signal"
+  "/cloudflare · /typedb · /signal"
+  "/typecheck · /signal (substrate verbs)"
+  "/typecheck · MCP server"
+  "/typecheck · CLI bins"
+  "/cloudflare (Scheduled Worker)"
+  "/cloudflare (Scheduled Worker)"
+)
+
+NEWEST_TS=0
+i=0
+while [ $i -lt ${#MODULES[@]} ]; do
+  module="${MODULES[$i]}"
+  if [ -d "$module" ]; then
+    TS=$(find "$module" -type f \( -name '*.ts' -o -name '*.tsx' -o -name '*.astro' -o -name '*.md' \) \
+      -not -path '*/node_modules/*' -not -path '*/dist/*' -not -path '*/.wrangler/*' \
+      2>/dev/null | head -200 | xargs -I{} stat -f '%m' {} 2>/dev/null | sort -rn | head -1)
+    if [ -n "$TS" ] && [ "$TS" -gt "$NEWEST_TS" ]; then
+      NEWEST_TS=$TS
+      HOT_MODULE=$module
+      HOT_HINT="${HINTS[$i]}"
+    fi
+  fi
+  i=$((i + 1))
+done
+
+# Render — keep it short. Only print if there's something to say.
+OUT=""
+
+if [ "$PROPOSAL_COUNT" -gt 0 ]; then
+  OUT+="📋 ${PROPOSAL_COUNT} unaddressed proposal(s) in .claude/improvements.queue.md\n"
+fi
+
+if [ -n "$HOT_MODULE" ]; then
+  OUT+="🔥 hot module: \`${HOT_MODULE}\` — relevant skills: ${HOT_HINT}\n"
+fi
+
+if [ -n "$OUT" ]; then
+  echo ""
+  printf "%b" "$OUT"
+  echo ""
+fi
+
+emit_signal "hook:session-start:ok" 1 "proposals=$PROPOSAL_COUNT hot=$HOT_MODULE"
+exit 0

package/hooks/scripts/stop-reflect.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# STOP-REFLECT — capture session learnings while context is fresh.
+#
+# Runs on Stop alongside session-end-verify. Non-blocking.
+# Scans the session's git delta for signals of new conventions and appends
+# proposals to .claude/improvements.queue.md for batch review.
+#
+# Heuristics (intentionally conservative — false positives = noise):
+#   1. CLAUDE.md / rules / skills changed → record the change as a candidate
+#      convention for upstream propagation.
+#   2. Code touched but no doc touched in same family → flag for doc-drift.
+#   3. New file created under .claude/skills/ or .claude/rules/ → flag as new
+#      primitive (likely deserves a one-line README mention).
+#
+# Per Rule 1 (closed loop) — emits hook:stop-reflect:{ok,warn} with counts.
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 0
+
+QUEUE="$CLAUDE_PROJECT_DIR/.claude/improvements.queue.md"
+mkdir -p "$(dirname "$QUEUE")"
+
+# What changed this session? Use unstaged + staged + untracked.
+CHANGED=$(git status --porcelain 2>/dev/null | awk '{print $2}')
+[ -z "$CHANGED" ] && { emit_signal "hook:stop-reflect:ok" 1 "changed=0"; exit 0; }
+
+# Header for this session's block (idempotent — appends if file exists)
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+PROPOSALS=0
+
+# Buffer proposals; only write if non-empty
+BUF=""
+
+# (1) Convention-bearing files
+CONVENTION_HITS=$(echo "$CHANGED" | grep -E '(CLAUDE\.md$|\.claude/rules/|\.claude/skills/|\.claude/agents/)' || true)
+if [ -n "$CONVENTION_HITS" ]; then
+  while IFS= read -r f; do
+    BUF+="- **convention** \`$f\` — review: did this change introduce a rule the broader team should know? If yes, surface it in root \`CLAUDE.md\` or the relevant skill.\n"
+    PROPOSALS=$((PROPOSALS + 1))
+  done <<< "$CONVENTION_HITS"
+fi
+
+# (2) New primitives (untracked files in .claude/)
+NEW_PRIMITIVES=$(echo "$CHANGED" | grep -E '^\.claude/(skills|rules|agents|hooks)/[^/]+\.(md|sh)$' | while read -r f; do
+  git ls-files --error-unmatch "$f" >/dev/null 2>&1 || echo "$f"
+done)
+if [ -n "$NEW_PRIMITIVES" ]; then
+  while IFS= read -r f; do
+    BUF+="- **new primitive** \`$f\` — add a one-line entry to the index (\`.claude/CLAUDE.md\` or root README skills table).\n"
+    PROPOSALS=$((PROPOSALS + 1))
+  done <<< "$NEW_PRIMITIVES"
+fi
+
+# (3) Doc drift — code touched in a family but no doc touched
+#    Family map: agents/src ↔ agents/CLAUDE.md, packages/sdk/src ↔ packages/sdk/CLAUDE.md,
+#                one.ie/web/src ↔ one.ie/web/CLAUDE.md
+check_drift() {
+  local code_glob="$1"; local doc_file="$2"
+  local code_changed
+  code_changed=$(echo "$CHANGED" | grep -E "$code_glob" || true)
+  if [ -n "$code_changed" ] && ! echo "$CHANGED" | grep -qF "$doc_file"; then
+    local count
+    count=$(echo "$code_changed" | wc -l | awk '{print $1}')
+    if [ "$count" -ge 3 ]; then
+      BUF+="- **doc-drift** \`$doc_file\` not updated despite $count file changes under \`$code_glob\`. Review.\n"
+      PROPOSALS=$((PROPOSALS + 1))
+    fi
+  fi
+}
+check_drift '^agents/src/'         'agents/CLAUDE.md'
+check_drift '^packages/sdk/src/'   'packages/sdk/CLAUDE.md'
+check_drift '^one\.ie/web/src/'    'one.ie/web/CLAUDE.md'
+check_drift '^api/src/'            'api/CLAUDE.md'
+
+# Only write the file if we found something worth reviewing
+if [ "$PROPOSALS" -gt 0 ]; then
+  {
+    echo ""
+    echo "## $TS"
+    printf "%b" "$BUF"
+  } >> "$QUEUE"
+
+  echo ""
+  echo "┌─────────────────────────────────────────────────────────────┐"
+  echo "│ STOP-REFLECT: $PROPOSALS proposal(s) queued                          │"
+  echo "│ Review: .claude/improvements.queue.md                       │"
+  echo "└─────────────────────────────────────────────────────────────┘"
+
+  emit_signal "hook:stop-reflect:warn" 0.5 "proposals=$PROPOSALS"
+else
+  emit_signal "hook:stop-reflect:ok" 1 "changed=$(echo "$CHANGED" | wc -l | awk '{print $1}') proposals=0"
+fi
+
+exit 0

package/hooks/scripts/sync-todo-docs.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+# SYNC-TODO-DOCS — Keep TODO.md + todo.json in sync with TODO-*.md edits.
+#
+# Fires after Write/Edit on any docs/TODO*.md file.
+# Best-effort, non-blocking: pings POST /api/tasks/sync on the dev server
+# if it's running (full pipeline: KV → TypeDB → regenerate TODO.md + todo.json).
+# If the dev server isn't up, we silently skip — the sandwich's deterministic
+# PRE check fails closed without breaking the edit flow.
+#
+# The dev server does all the real work; this hook is just a trigger.
+# To run the full sync manually: `/sync` (or `POST /api/tasks/sync`).
+# Emits hook:todo-sync:{ok,dissolved} signal per Rule 1 (see .claude/skills/signal.md).
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+FILE=$(echo "$1" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+
+# Only fire for TODO markdown files under docs/
+case "$FILE" in
+  */docs/TODO*.md) ;;
+  *) exit 0 ;;
+esac
+
+# Don't recurse: if the edit IS TODO.md itself, it was likely regenerated. Skip.
+case "$FILE" in
+  */docs/TODO.md) exit 0 ;;
+esac
+
+# Best-effort POST with a 2s cap so edits stay snappy.
+# Silently swallow all output — this is a background sync, not a gate.
+DEV_URL="${ONE_DEV_URL:-http://localhost:4321}"
+RESP=$(curl -s -o /dev/null -w "%{http_code}" \
+  --max-time 2 \
+  -X POST "${DEV_URL}/api/tasks/sync" 2>/dev/null)
+
+BASE=$(basename "$FILE")
+if [ "$RESP" = "200" ]; then
+  echo "todo-sync: regenerated TODO.md + todo.json from $BASE" >&2
+  emit_signal "hook:todo-sync:ok" 1 "file=$BASE"
+else
+  # Server down/timeout/error → dissolved (missing unit semantics, mild warn)
+  emit_signal "hook:todo-sync:dissolved" -0.5 "file=$BASE http=$RESP"
+fi
+
+exit 0

package/hooks/scripts/task-complete-verify.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# TASK-COMPLETE VERIFY — The W4 Gate
+#
+# Runs on TaskCompleted. Blocks task mark if tests regress.
+# This is the gate between signal and pheromone — prevents corruption.
+#
+# Exit 0 = task marked (all checks pass)
+# Exit 1 = task blocked (tests regressed or type errors detected)
+# Emits hook:w4-verify:{ok,fail} signal per Rule 1 (see .claude/skills/signal.md).
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+cd "$CLAUDE_PROJECT_DIR" || exit 1
+
+# Run the full verify suite
+RESULT=$(bun run verify 2>&1)
+EXIT=$?
+
+# Extract test counts (used in both branches for the signal payload)
+PASSED=$(echo "$RESULT" | grep -o '[0-9]* pass' | head -1 | awk '{print $1}')
+FAILED=$(echo "$RESULT" | grep -o '[0-9]* fail' | head -1 | awk '{print $1}')
+ERRORS=$(echo "$RESULT" | grep -c "error TS" || echo "0")
+
+if [ $EXIT -eq 0 ]; then
+  # All checks passed — mark with deterministic receipts (Rule 3)
+  emit_signal "hook:w4-verify:ok" 1 "passed=${PASSED:-0} failed=0 errors=0"
+  exit 0
+fi
+
+# Verify failed — extract details
+echo "W4 GATE BLOCKED: Verification failed" >&2
+echo "" >&2
+
+if [ -n "$FAILED" ] && [ "$FAILED" -gt 0 ]; then
+  echo "Tests: $FAILED failed" >&2
+fi
+if [ "$ERRORS" -gt 0 ]; then
+  echo "TypeScript: $ERRORS type errors" >&2
+fi
+
+# Show last 15 lines of output for context
+echo "" >&2
+echo "Last output:" >&2
+echo "$RESULT" | tail -15 >&2
+echo "" >&2
+echo "Fix baseline before marking task done." >&2
+
+# Full warn — tests actually regressed, agent produced nothing usable
+emit_signal "hook:w4-verify:fail" -1 "passed=${PASSED:-0} failed=${FAILED:-0} errors=${ERRORS:-0}"
+
+exit 1

package/hooks/scripts/tool-signal.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Tool-call signal emitter — PostToolUse hook.
+# Emits tool:<ToolName>:{ok,fail} with +1/-1 weight. Receiver + weight
+# semantics: .claude/skills/signal.md.
+
+# shellcheck source=lib/signal.sh
+source "$CLAUDE_PROJECT_DIR/.claude/hooks/lib/signal.sh"
+
+PAYLOAD="$1"
+[[ -z "$PAYLOAD" ]] && exit 0
+
+TOOL=$(echo "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+[[ -z "$TOOL" ]] && exit 0
+
+# Receiver must match ^[a-zA-Z0-9:_-]+$ (validateUid in signal.ts).
+# MCP tools (mcp__server__tool) contain underscores — still safe.
+SAFE_TOOL="${TOOL//[^a-zA-Z0-9_-]/}"
+[[ -z "$SAFE_TOOL" ]] && exit 0
+
+# Outcome: error field → fail; Bash non-zero or interrupted → fail; else ok
+ERROR=$(echo "$PAYLOAD" | jq -r '.tool_response.error // empty' 2>/dev/null)
+OUTCOME="ok"
+WEIGHT=1
+
+if [[ -n "$ERROR" ]]; then
+  OUTCOME="fail"; WEIGHT=-1
+elif [[ "$TOOL" == "Bash" ]]; then
+  EXIT_CODE=$(echo "$PAYLOAD" | jq -r '.tool_response.exit_code // .tool_response.returncode // 0' 2>/dev/null)
+  INTERRUPTED=$(echo "$PAYLOAD" | jq -r '.tool_response.interrupted // false' 2>/dev/null)
+  [[ "$EXIT_CODE" != "0" || "$INTERRUPTED" == "true" ]] && { OUTCOME="fail"; WEIGHT=-1; }
+fi
+
+# Human-greppable crumb per tool family. Not structured — don't serialize objects.
+DATA=""
+case "$TOOL" in
+  Write|Edit|MultiEdit|Read|NotebookEdit)
+    FILE=$(echo "$PAYLOAD" | jq -r '.tool_input.file_path // .tool_input.notebook_path // .tool_input.path // empty' 2>/dev/null)
+    [[ -n "$FILE" ]] && DATA="file=$(basename "$FILE")" ;;
+  Bash)
+    CMD=$(echo "$PAYLOAD" | jq -r '.tool_input.command // empty' 2>/dev/null | head -c 60 | tr '\n' ' ')
+    [[ -n "$CMD" ]] && DATA="cmd=$CMD" ;;
+  Grep|Glob)
+    PATTERN=$(echo "$PAYLOAD" | jq -r '.tool_input.pattern // empty' 2>/dev/null | head -c 40)
+    [[ -n "$PATTERN" ]] && DATA="pattern=$PATTERN" ;;
+esac
+
+emit_signal "tool:${SAFE_TOOL}:${OUTCOME}" "$WEIGHT" "$DATA"
+exit 0

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@oneie/claude",
+  "version": "0.1.0",
+  "description": "ONE Claude Code plugin — /do lifecycle, W1-W4 BUILD engine, ONE substrate via MCP, signals, and rules",
+  "files": [
+    ".claude-plugin",
+    ".mcp.json",
+    "commands",
+    "agents",
+    "skills",
+    "rules",
+    "hooks",
+    "scripts",
+    "README.md"
+  ],
+  "peerDependencies": {
+    "@oneie/sdk": ">=0.3.0",
+    "@oneie/mcp": ">=0.3.0",
+    "@oneie/cli": ">=0.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@oneie/sdk": { "optional": true },
+    "@oneie/mcp": { "optional": true },
+    "@oneie/cli": { "optional": true }
+  },
+  "keywords": ["claude-code", "plugin", "do", "lifecycle", "mcp", "signals", "typedb", "agents", "one"],
+  "license": "SEE LICENSE IN https://one.ie/free-license",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/one-ie/claude.git"
+  },
+  "homepage": "https://github.com/one-ie/claude"
+}

package/rules/api.md

@@ -0,0 +1,50 @@
+---
+paths:
+  - "one.ie/web/src/pages/api/**/*.ts"
+  - "one.ie/web/src/hooks/**/*.ts"
+---
+
+# API Rules
+
+Apply to `src/pages/api/**/*.ts`, `src/hooks/**/*.ts`
+
+## The contract: no new endpoints for product features
+
+Four universal endpoints cover all product work. Before adding a new file to `src/pages/api/`, name which of these four cannot handle it and why.
+
+| Endpoint | Use for |
+|---|---|
+| `POST /api/signal/:receiver` | Fire-and-forget — trigger a workflow, record an event |
+| `POST /api/ask/:receiver` | Synchronous — get a result back (30s max) |
+| `POST /api/mark/:edge` / `/api/warn/:edge` | Pheromone on any path (`source>target` URL-encoded) |
+| `GET/PUT /api/settings?scope=X` | Any new setting — add a new `scope` value, not a new file |
+
+## When a new endpoint IS justified
+
+| Pattern | Why |
+|---|---|
+| Inbound webhook from external service | External system calls a fixed URL — cannot invert |
+| OAuth / redirect flow | Browser redirect URI must be a stable route |
+| Multi-step auth ceremony | Stateful challenge exchange (WebAuthn) |
+| Binary or streaming response | SSE stream, image gen, file upload, CSV export |
+| Resource-bound read/write (`/api/<resource>/:id`) | RESTful read/append against a specific persisted entity — e.g. `GET/POST /api/threads/:tid` for chat-thread history and owner inbox replies. The id is a stable handle (not a one-shot signal), and the same path participates in CDN cache + access control |
+| `/api/export/<dim>` family | Bulk read of a substrate dimension shaped for the inbox/CRM — already established (`actors`, `groups`, `skills`, `highways`, `conversations`). New dimensions extend the family rather than create ad-hoc routes |
+
+If the use case does not match one of these four patterns, route through `signal`, `ask`, `mark/warn`, or `settings?scope=`.
+
+## Edge format for mark/warn
+
+```ts
+const edge = encodeURIComponent(`${source}>${target}`)
+fetch(`/api/mark/${edge}`, { method: 'POST', body: JSON.stringify({ strength }) })
+```
+
+The `>` separator works as a fallback to `→`. Always pass `{ strength }` in the body.
+
+## State from highways, not localStorage
+
+Active state (saved, archived, completed) belongs on the pheromone path, not in `localStorage`. Poll `/api/export/highways?from=source&limit=200` and classify by strength/resistance thresholds. This keeps state honest across devices.
+
+## No stubs
+
+Do not create a no-op endpoint (one that always returns `[]` or `{ok:true}`) as a placeholder. If the backend isn't ready, the caller handles the empty response from `signal`/`ask`.