@oneie/claude 0.3.1 → 0.3.2

package/hooks/hooks.json

@@ -9,6 +9,20 @@
           "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/gate-guard.sh\"",
           "timeout": 5000,
           "blocking": true
+        },
+        {
+          "id": "hook:config-protect",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/config-protect.sh\"",
+          "timeout": 5000,
+          "blocking": true
+        },
+        {
+          "id": "hook:compact-hint",
+          "type": "command",
+          "command": "bash \"$CLAUDE_PLUGIN_ROOT/hooks/scripts/compact-hint.sh\"",
+          "timeout": 3000,
+          "blocking": false
         }
       ]
     }

package/hooks/scripts/compact-hint.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# COMPACT-HINT — PreToolUse: suggest /compact when context is large.
+#
+# Non-blocking — writes one line to stderr, fires at most once per session.
+# Threshold: 400KB transcript (~80-120k tokens depending on content density).
+#
+# Disable: ECC_DISABLED_HOOKS=hook:compact-hint
+
+# shellcheck source=lib/hook.sh
+_HOOK_LIB="${CLAUDE_PLUGIN_ROOT:-$CLAUDE_PROJECT_DIR/.claude}/hooks/lib"
+source "$_HOOK_LIB/hook.sh"
+is_hook_disabled "hook:compact-hint" && exit 0
+
+PAYLOAD="${1:-}"
+[[ -z "$PAYLOAD" ]] && exit 0
+
+# Locate the transcript — from hook JSON or env var (Claude Code sets both)
+TRANSCRIPT=$(printf '%s' "$PAYLOAD" | jq -r '.transcript_path // .transcriptPath // empty' 2>/dev/null)
+[[ -z "$TRANSCRIPT" ]] && TRANSCRIPT="${CLAUDE_TRANSCRIPT_PATH:-}"
+[[ -z "$TRANSCRIPT" || ! -f "$TRANSCRIPT" ]] && exit 0
+
+SIZE=$(wc -c < "$TRANSCRIPT" 2>/dev/null | tr -d ' ')
+[[ -z "$SIZE" || "$SIZE" -lt 400000 ]] && exit 0
+
+# Fire at most once per session
+SESSION_KEY=$(hook_session_key "$PAYLOAD")
+FLAG="/tmp/oneie-compact-hint-${SESSION_KEY}"
+[[ -f "$FLAG" ]] && exit 0
+touch "$FLAG"
+
+SIZE_KB=$(( SIZE / 1024 ))
+echo "" >&2
+echo "⚡ Context is ~${SIZE_KB}KB — run /compact before the next big edit to keep responses fast and cheap." >&2
+echo "" >&2
+
+exit 0

package/hooks/scripts/config-protect.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# CONFIG-PROTECT — PreToolUse(Edit|Write): block lint/type config weakening.
+#
+# Prevents introducing "off"/"warn" rules or disabling strict flags in
+# biome.json, tsconfig*.json, or .eslintrc* files.
+#
+# Why: W4 verify uses biome + tsc as hard gates. Weakening the config
+# is equivalent to deleting the gate. Fix the code — not the rules.
+# If a rule genuinely needs changing, explain it in the PR description.
+#
+# Disable: ECC_DISABLED_HOOKS=hook:config-protect
+
+# shellcheck source=lib/hook.sh
+_HOOK_LIB="${CLAUDE_PLUGIN_ROOT:-$CLAUDE_PROJECT_DIR/.claude}/hooks/lib"
+source "$_HOOK_LIB/hook.sh"
+is_hook_disabled "hook:config-protect" && exit 0
+
+PAYLOAD="${1:-}"
+[[ -z "$PAYLOAD" ]] && exit 0
+
+TOOL=$(printf '%s' "$PAYLOAD" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in Edit|Write) ;; *) exit 0 ;; esac
+
+FILE=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.file_path // empty' 2>/dev/null)
+[[ -z "$FILE" ]] && exit 0
+
+# Only gate known config files
+case "$(basename "$FILE")" in
+  biome.json|biome.*.json|\
+  tsconfig.json|tsconfig.*.json|\
+  .eslintrc|.eslintrc.json|.eslintrc.js|.eslintrc.cjs|.eslintrc.mjs) ;;
+  *) exit 0 ;;
+esac
+
+# For Edit: compare old_string vs new_string — block only if weakening is NEW.
+# For Write: check the whole content.
+if [[ "$TOOL" == "Edit" ]]; then
+  OLD=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.old_string // empty' 2>/dev/null)
+  NEW=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.new_string // empty' 2>/dev/null)
+  [[ -z "$NEW" ]] && exit 0
+  # Only block if the weakening pattern appears in NEW but not in OLD
+  _has_weakening() { printf '%s' "$1" | grep -qE '"(off|warn)"|"noErrors":\s*true|"strict":\s*false|"skipLibCheck":\s*true|"noUnusedLocals":\s*false|"noImplicitAny":\s*false|"allowJs":\s*true'; }
+  _has_weakening "$OLD" && exit 0   # already present — not introducing it
+  _has_weakening "$NEW" || exit 0   # not in new content — safe
+else
+  # Write: check full content
+  CONTENT=$(printf '%s' "$PAYLOAD" | jq -r '.tool_input.content // empty' 2>/dev/null)
+  [[ -z "$CONTENT" ]] && exit 0
+  printf '%s' "$CONTENT" | grep -qE '"(off|warn)"|"noErrors":\s*true|"strict":\s*false|"skipLibCheck":\s*true|"noUnusedLocals":\s*false|"noImplicitAny":\s*false|"allowJs":\s*true' || exit 0
+fi
+
+FNAME=$(basename "$FILE")
+printf '%s' "$(jq -nc --arg f "$FNAME" --arg path "$FILE" \
+  '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":
+    ("[Config-Guard] Weakening \($f) is not allowed.\n\nW4 verify uses biome + tsc as hard gates — disabling rules deletes the gate.\nFix the code, not the config.\n\nIf this change is genuinely intentional, explain it in the PR description, then\ndisable for this session:  ECC_DISABLED_HOOKS=hook:config-protect")}}')"
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneie/claude",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "ONE Claude Code plugin — /do lifecycle, W1-W4 BUILD engine, ONE substrate via MCP, signals, and rules",
   "files": [
     ".claude-plugin",