@ryuenn3123/agentic-senior-core 5.8.26 → 6.0.0

package/.agents/plugins/agentic-senior-core/commands/asc-dedup.md

@@ -0,0 +1 @@
+Run the duplicate code audit from skills/asc-dedup/SKILL.md. Scan the specified scope (directory, package, or full repo) for near-duplicate code blocks using jscpd token-level clone detection. Report clusters ranked by duplicated lines, and suggest consolidation only for patterns appearing 3+ times (Rule of Three).

package/.agents/plugins/agentic-senior-core/commands/asc-dedup.toml

@@ -0,0 +1,2 @@
+description = "On-demand duplicate code audit using token-level clone detection"
+prompt = "Load and follow the asc-dedup skill. Scan the current project (or specified scope) for near-duplicate code blocks using jscpd. Report clusters ranked by duplicated lines. Suggest consolidation only for patterns appearing 3+ times per the Rule of Three."

package/.agents/plugins/agentic-senior-core/hooks/constants.cjs

@@ -0,0 +1,21 @@
+// Agentic Senior Core — shared constants for hook modules
+// Single source of truth for thresholds and extension sets used by
+// post-edit-enforce.js and dedup-gate.js.
+
+const SOURCE_EXTENSIONS = new Set([
+  'js', 'ts', 'mjs', 'cjs', 'jsx', 'tsx',
+  'py', 'rb', 'go', 'rs', 'java', 'kt', 'swift', 'cs',
+]);
+
+const LOC_DELTA_THRESHOLD = 30;
+const NEW_FILE_LINE_THRESHOLD = 50;
+const SESSION_DRIFT_THRESHOLD = 4;
+const LADDER_PULSE_INTERVAL = 3;
+
+module.exports = {
+  SOURCE_EXTENSIONS,
+  LOC_DELTA_THRESHOLD,
+  NEW_FILE_LINE_THRESHOLD,
+  SESSION_DRIFT_THRESHOLD,
+  LADDER_PULSE_INTERVAL,
+};

package/.agents/plugins/agentic-senior-core/hooks/dedup-gate.js

@@ -0,0 +1,283 @@
+#!/usr/bin/env node
+// Agentic Senior Core — PostToolUse duplicate-code detection hook
+// Fires after Edit/Write on qualifying source files. Runs a scoped jscpd scan
+// to detect near-duplicate code blocks. Advisory by default; configurable to block.
+// Supports Claude Code, Codex CLI, GitHub Copilot CLI, and Antigravity IDE.
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execSync } = require('child_process');
+
+const {
+  SOURCE_EXTENSIONS,
+  LOC_DELTA_THRESHOLD,
+  NEW_FILE_LINE_THRESHOLD,
+} = require('./constants.cjs');
+
+const JSCPD_TIMEOUT_MS = 10000;
+
+// Recognized source root directories — scan scope walks up to the first match
+const SOURCE_ROOTS = ['src', 'lib', 'app'];
+
+let inputBuffer = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {
+  inputBuffer += chunk;
+  try {
+    const data = JSON.parse(inputBuffer);
+
+    let toolName = '';
+    let toolInput = {};
+    let isAntigravity = false;
+
+    if (data.toolCall) {
+      // Antigravity PreToolUse shape (has toolCall directly)
+      isAntigravity = true;
+      toolName = data.toolCall.name;
+      toolInput = data.toolCall.args || {};
+    } else if (data.stepIdx !== undefined && data.transcriptPath) {
+      // Antigravity PostToolUse shape — no toolCall in payload,
+      // read the tool call details from the transcript at stepIdx
+      isAntigravity = true;
+      var extracted = extractToolCallFromTranscript(data.transcriptPath, data.stepIdx);
+      if (!extracted) { process.exit(0); return; }
+      toolName = extracted.toolName;
+      toolInput = extracted.toolInput;
+    } else {
+      // Claude Code / Codex / Copilot path
+      toolName = data.tool_name || data.toolName || '';
+      toolInput = data.tool_input || data.toolInput || {};
+    }
+
+    const filePath = toolInput.file_path || toolInput.TargetFile || toolInput.path || toolInput.target_file || '';
+    if (!filePath) { process.exit(0); return; }
+
+    const ext = path.extname(filePath).slice(1);
+    if (!SOURCE_EXTENSIONS.has(ext)) { process.exit(0); return; }
+
+    if (!isQualifyingEdit(toolName, toolInput)) { process.exit(0); return; }
+
+    const config = loadDedupConfig();
+    const scanDir = resolveScanDir(filePath, config);
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'asc-dedup-'));
+
+    const ignoreFlags = (config.ignoreDirs || []).map(function (d) { return '--ignore "' + d + '"'; }).join(' ');
+    const minTokens = config.minTokens || 30;
+    const scanCmd = ' "' + scanDir + '" --min-tokens ' + minTokens
+      + ' --reporters json --silent --output "' + tmpDir + '" ' + ignoreFlags;
+
+    const report = runJscpdScan(scanCmd, tmpDir);
+    if (!report) { cleanup(tmpDir); process.exit(0); return; }
+
+    const finding = checkForDuplicates(report, filePath);
+    if (!finding) { cleanup(tmpDir); process.exit(0); return; }
+
+    const nudge = '[ASC Dedup] ' + path.basename(filePath) + ' looks similar to '
+      + finding.matchedFile + ' (' + finding.percent + '% overlap, '
+      + finding.lines + ' lines). Ladder step 2: does the codebase already have this? '
+      + 'Reuse it, or confirm this is intentional.';
+
+    if (config.mode === 'block') {
+      emitDeny(nudge, isAntigravity);
+    } else {
+      emitAdvisory(nudge, isAntigravity);
+    }
+
+    cleanup(tmpDir);
+    process.exit(0);
+  } catch (e) {
+    // incomplete json, wait for more chunks
+  }
+});
+
+// Extract tool call details from the Antigravity transcript at a given step index.
+// PostToolUse on Antigravity only provides stepIdx — the actual tool call args
+// must be recovered from the transcript log. Same approach as post-edit-enforce.js.
+function extractToolCallFromTranscript(transcriptPath, stepIdx) {
+  try {
+    if (!fs.existsSync(transcriptPath)) return null;
+    var lines = fs.readFileSync(transcriptPath, 'utf8').split('\n').filter(Boolean);
+
+    // Find the step with matching step_index that contains tool_calls
+    for (var i = lines.length - 1; i >= 0; i--) {
+      var step = JSON.parse(lines[i]);
+      if (step.step_index !== stepIdx || !step.tool_calls) continue;
+
+      for (var j = 0; j < step.tool_calls.length; j++) {
+        var tc = step.tool_calls[j];
+        if (tc.name === 'replace_file_content' || tc.name === 'multi_replace_file_content') {
+          return {
+            toolName: 'Edit',
+            toolInput: {
+              file_path: tc.args.TargetFile || '',
+              new_string: tc.args.ReplacementContent || '',
+              old_string: tc.args.TargetContent || '',
+            },
+          };
+        } else if (tc.name === 'write_to_file') {
+          return {
+            toolName: 'Write',
+            toolInput: {
+              file_path: tc.args.TargetFile || '',
+              content: tc.args.CodeContent || '',
+            },
+          };
+        }
+      }
+    }
+    return null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function isQualifyingEdit(toolName, toolInput) {
+  var isWrite = ['Write', 'write_to_file', 'write_file'].indexOf(toolName) !== -1;
+  var isEdit = ['Edit', 'replace_file_content', 'multi_replace_file_content'].indexOf(toolName) !== -1;
+
+  if (isWrite) {
+    var content = toolInput.content || toolInput.CodeContent || '';
+    return content.split('\n').length > NEW_FILE_LINE_THRESHOLD;
+  }
+  if (isEdit) {
+    var newStr = toolInput.new_string || toolInput.ReplacementContent || toolInput.content || '';
+    var oldStr = toolInput.old_string || toolInput.TargetContent || '';
+    var delta = newStr.split('\n').length - oldStr.split('\n').length;
+    return delta > LOC_DELTA_THRESHOLD;
+  }
+  return false;
+}
+
+function resolveScanDir(filePath, config) {
+  var cwd = process.cwd();
+
+  // User override takes priority
+  if (config.scanRoot) {
+    var override = path.resolve(cwd, config.scanRoot);
+    if (fs.existsSync(override)) return override;
+  }
+
+  // Walk up from the file's directory to find a recognized source root
+  var dir = path.dirname(path.resolve(filePath));
+  while (dir.length >= cwd.length) {
+    var basename = path.basename(dir);
+    if (SOURCE_ROOTS.indexOf(basename) !== -1) return dir;
+    var parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+
+  // Fallback: project root
+  return cwd;
+}
+
+function loadDedupConfig() {
+  var candidates = [
+    path.join(process.cwd(), '.asc', 'dedup-config.json'),
+    path.join(process.cwd(), '.agents', 'dedup-config.json'),
+  ];
+  for (var i = 0; i < candidates.length; i++) {
+    try {
+      if (fs.existsSync(candidates[i])) {
+        return JSON.parse(fs.readFileSync(candidates[i], 'utf8'));
+      }
+    } catch (_) {}
+  }
+  return { mode: 'advisory', minTokens: 30, ignoreDirs: ['tests', 'migrations', 'generated', 'node_modules'] };
+}
+
+// minimal: attempt-then-fallback — try scan directly, fall back on failure.
+// No separate --version probes. Upgrade if jscpd provides a stable JS API.
+function runJscpdScan(scanCmd, tmpDir) {
+  var binaries = ['bunx jscpd', 'npx jscpd@5', 'npx jscpd'];
+  for (var i = 0; i < binaries.length; i++) {
+    try {
+      execSync(binaries[i] + scanCmd, {
+        timeout: JSCPD_TIMEOUT_MS,
+        stdio: 'pipe',
+        cwd: process.cwd(),
+      });
+      return loadReport(tmpDir);
+    } catch (_) {
+      // Try next binary
+    }
+  }
+  return null;
+}
+
+function loadReport(tmpDir) {
+  var reportPath = path.join(tmpDir, 'jscpd-report.json');
+  if (!fs.existsSync(reportPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+  } catch (_) {
+    return null;
+  }
+}
+
+function checkForDuplicates(report, filePath) {
+  var duplicates = report.duplicates || [];
+  if (duplicates.length === 0) return null;
+
+  var normalizedTarget = path.resolve(filePath).replace(/\\/g, '/').toLowerCase();
+
+  for (var i = 0; i < duplicates.length; i++) {
+    var dup = duplicates[i];
+    var firstName = path.resolve(dup.firstFile.name).replace(/\\/g, '/').toLowerCase();
+    var secondName = path.resolve(dup.secondFile.name).replace(/\\/g, '/').toLowerCase();
+
+    if (firstName === normalizedTarget || secondName === normalizedTarget) {
+      var matchedFile = firstName === normalizedTarget
+        ? path.basename(dup.secondFile.name)
+        : path.basename(dup.firstFile.name);
+      var lines = dup.lines || 0;
+      // jscpd v5 reports fragments; estimate overlap percentage from line count
+      var totalLines = (report.statistics && report.statistics.total && report.statistics.total.lines) || 1;
+      var percent = Math.round((lines / totalLines) * 100);
+      return { matchedFile: matchedFile, lines: lines, percent: percent };
+    }
+  }
+  return null;
+}
+
+function emitAdvisory(nudge, isAntigravity) {
+  if (isAntigravity) {
+    process.stdout.write(JSON.stringify({
+      injectSteps: [{ ephemeralMessage: nudge }],
+    }) + '\n');
+  } else {
+    var isCopilot = Boolean(process.env.COPILOT_PLUGIN_DATA);
+    if (isCopilot) {
+      process.stdout.write(JSON.stringify({ additionalContext: nudge }) + '\n');
+    } else {
+      process.stdout.write(JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: 'PostToolUse',
+          additionalContext: nudge,
+        },
+      }) + '\n');
+    }
+  }
+}
+
+function emitDeny(reason, isAntigravity) {
+  if (isAntigravity) {
+    process.stdout.write(JSON.stringify({ decision: 'deny', reason: reason }) + '\n');
+  } else {
+    process.stdout.write(JSON.stringify({
+      allow_tool: false,
+      deny_reason: reason,
+      hookSpecificOutput: {
+        hookEventName: 'PostToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: reason,
+      },
+    }) + '\n');
+  }
+  process.exit(2);
+}
+
+function cleanup(tmpDir) {
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_) {}
+}

package/.agents/plugins/agentic-senior-core/hooks/ladder-pulse.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// Agentic Senior Core — PreInvocation ladder persistence hook
+// Counters context rot by re-injecting a short decision-ladder reminder
+// periodically, late in context, rather than relying only on rules/ content
+// that sits at the start of the conversation.
+// Antigravity-only: PreInvocation fires before every model call with
+// invocationNum in the input payload. For other hosts, the equivalent
+// pulse is integrated into post-edit-enforce.js via the sourceEditCount counter.
+
+const { LADDER_PULSE_INTERVAL } = require('./constants.cjs');
+
+const LADDER_REMINDER = '[ASC] Ladder check: (1) needed? (2) exists already \u2014 reuse? '
+  + '(3) stdlib/native? (4) existing dep? (5) one function? Then minimal code.';
+
+let inputBuffer = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {
+    inputBuffer += chunk;
+    try {
+        const payload = JSON.parse(inputBuffer);
+        
+        let shouldInject = false;
+        const invNum = payload.invocationNum || 0;
+        if (invNum > 0 && invNum % LADDER_PULSE_INTERVAL === 0) {
+            shouldInject = true;
+        }
+
+        if (shouldInject) {
+            process.stdout.write(JSON.stringify({
+                injectSteps: [{
+                    ephemeralMessage: `**ASC LADDER PULSE**: You have completed several steps. Remember to review the 1-6 decision ladder. Document deferred debt if you take shortcuts.`
+                }]
+            }) + '\n');
+        } else {
+            process.stdout.write('{}\n');
+        }
+        process.exit(0);
+    } catch (e) {
+        // wait for more chunks
+    }
+});

package/.agents/plugins/agentic-senior-core/hooks/lib/known-security-patterns.json

@@ -0,0 +1,26 @@
+{
+  "description": "Regex patterns for recurring security anti-patterns",
+  "patterns": [
+    {
+      "id": "insecure-redirect",
+      "regex": "location\\.href\\s*=\\s*(?!['\"`])([^;\\n]+)",
+      "message": "Unvalidated redirect target assigned to location.href. Ensure the variable is sanitized or use a safe routing method."
+    },
+    {
+      "id": "timing-unsafe-compare",
+      "regex": "(password|secret|token|key)\\s*(===|!==|==|!=)",
+      "message": "Non-timing-safe string comparison on a secret variable. Use crypto.timingSafeEqual instead."
+    },
+    {
+      "id": "user-input-http",
+      "regex": "(axios|fetch|got|superagent)\\s*\\(\\s*.*?(req\\.(query|body|params)|process\\.env)",
+      "message": "Potentially unsafe input passed directly into an HTTP client. Validate and sanitize URL parameters first."
+    }
+  ],
+  "fileSpecific": {
+    "Dockerfile": {
+      "require": "^(?=.*\\nUSER\\s).*$",
+      "message": "Missing USER instruction in Dockerfile. The container will run as root by default."
+    }
+  }
+}

package/.agents/plugins/agentic-senior-core/hooks/post-edit-enforce.js

@@ -29,22 +29,29 @@ try {
   }
 } catch (_) {}
 
-const SOURCE_EXTENSIONS = new Set([
-  'js', 'ts', 'mjs', 'cjs', 'jsx', 'tsx',
-  'py', 'rb', 'go', 'rs', 'java', 'kt', 'swift', 'cs',
-]);
+let SECURITY_PATTERNS = { patterns: [], fileSpecific: {} };
+try {
+  const secPath = path.join(__dirname, 'lib', 'known-security-patterns.json');
+  if (fs.existsSync(secPath)) {
+    SECURITY_PATTERNS = JSON.parse(fs.readFileSync(secPath, 'utf8'));
+  }
+} catch (_) {}
 
-const LOC_DELTA_THRESHOLD = 30;
-const NEW_FILE_LINE_THRESHOLD = 50;
-const SESSION_DRIFT_THRESHOLD = 4;
+const {
+  SOURCE_EXTENSIONS,
+  LOC_DELTA_THRESHOLD,
+  NEW_FILE_LINE_THRESHOLD,
+  SESSION_DRIFT_THRESHOLD,
+  LADDER_PULSE_INTERVAL,
+} = require('./constants.cjs');
 
 // Module-level counter for Claude Code path (resets per process spawn)
 let sourceEditCount = 0;
 
 let inputBuffer = '';
 process.stdin.setEncoding('utf8');
-process.stdin.on('data', function (chunk) { inputBuffer += chunk; });
-process.stdin.on('end', function () {
+process.stdin.on('data', chunk => {
+  inputBuffer += chunk;
   try {
     const data = JSON.parse(inputBuffer);
     
@@ -58,8 +65,9 @@ process.stdin.on('end', function () {
     processSingleEdit(toolName, toolInput, function(nudge) {
       emitClaude(nudge);
     });
-  } catch (_) {
-    // Silent fail
+    process.exit(0);
+  } catch (e) {
+    // incomplete json, wait for more chunks
   }
 });
 
@@ -138,6 +146,9 @@ function processSingleEdit(toolName, toolInput, emitFn, skipArray) {
       findings.push('[ASC Session Drift] ' + SESSION_DRIFT_THRESHOLD + '+ source file edits this session. '
         + 'Re-read the decision ladder before continuing: (1) Does this need to be built? '
         + '(2) Does the codebase already have this? (3) Stdlib/native? (4) Existing dependency?');
+    } else if (sourceEditCount > 0 && sourceEditCount % LADDER_PULSE_INTERVAL === 0) {
+      findings.push('[ASC] Ladder check: (1) needed? (2) exists already \u2014 reuse? '
+        + '(3) stdlib/native? (4) existing dep? (5) one function? Then minimal code.');
     }
   }
 
@@ -145,7 +156,6 @@ function processSingleEdit(toolName, toolInput, emitFn, skipArray) {
     checkDependencyAddition(toolName, toolInput, findings);
   }
 
-  const ext = path.extname(filePath).slice(1);
   if (SOURCE_EXTENSIONS.has(ext)) {
     if (toolName === 'Edit') {
       checkLocDelta(toolInput, filePath, findings);
@@ -154,6 +164,11 @@ function processSingleEdit(toolName, toolInput, emitFn, skipArray) {
     }
   }
 
+  checkSecurityPatterns(toolName, toolInput, filePath, findings);
+  if (ext === 'js' || ext === 'ts' || ext === 'jsx' || ext === 'tsx' || ext === 'mjs' || ext === 'cjs') {
+    checkLinter(filePath, findings);
+  }
+
   checkLivingDocNudge(filePath, findings);
 
   if (ext !== 'md') {
@@ -231,13 +246,67 @@ function checkLocDelta(toolInput, filePath, findings) {
 function checkNewFileSize(toolInput, filePath, findings) {
   var lines = (toolInput.content || '').split('\n').length;
   if (lines > NEW_FILE_LINE_THRESHOLD) {
+    // Step 1-2 coverage ("does this already exist?") moved to dedup-gate.js
+    // which provides concrete file-name + overlap-percentage feedback.
     findings.push(
       'New file ' + path.basename(filePath) + ' created with ' + lines + ' lines. '
-      + 'Ladder step 1-2: does this need to be built? Does the codebase already have this?'
+      + 'Ladder step 5: can this be one straightforward function?'
     );
   }
 }
 
+function checkSecurityPatterns(toolName, toolInput, filePath, findings) {
+  var target = toolName === 'Edit' ? (toolInput.new_string || '') : (toolInput.content || '');
+  if (!target) return;
+  
+  if (SECURITY_PATTERNS.patterns) {
+    SECURITY_PATTERNS.patterns.forEach(function (p) {
+      try {
+        var regex = new RegExp(p.regex, 'ig');
+        if (regex.test(target)) {
+          findings.push('[ASC Security] ' + p.message);
+        }
+      } catch (_) {}
+    });
+  }
+
+  var basename = path.basename(filePath);
+  if (SECURITY_PATTERNS.fileSpecific && SECURITY_PATTERNS.fileSpecific[basename]) {
+    var spec = SECURITY_PATTERNS.fileSpecific[basename];
+    try {
+      var regex = new RegExp(spec.require, 'g');
+      if (target.trim().length > 0 && !regex.test(target)) {
+        findings.push('[ASC Security] ' + spec.message);
+      }
+    } catch (_) {}
+  }
+}
+
+function checkLinter(filePath, findings) {
+  try {
+    var cwd = process.cwd();
+    var hasEslint = fs.existsSync(path.join(cwd, '.eslintrc.json')) || 
+                    fs.existsSync(path.join(cwd, '.eslintrc.js')) || 
+                    fs.existsSync(path.join(cwd, 'eslint.config.js')) ||
+                    (fs.existsSync(path.join(cwd, 'package.json')) && fs.readFileSync(path.join(cwd, 'package.json'), 'utf8').includes('eslintConfig'));
+    
+    if (hasEslint) {
+      var execSync = require('child_process').execSync;
+      execSync('npx eslint "' + filePath + '" --format json', { cwd: cwd, stdio: 'pipe' });
+    }
+  } catch (error) {
+    if (error.stdout) {
+      try {
+        var out = JSON.parse(error.stdout.toString());
+        if (Array.isArray(out) && out.length > 0 && out[0].messages && out[0].messages.length > 0) {
+          var firstErr = out[0].messages[0];
+          findings.push('[ASC Linter] ' + firstErr.message + ' at line ' + firstErr.line + '.');
+        }
+      } catch (_) {}
+    }
+  }
+}
+
 function checkLivingDocNudge(filePath, findings) {
   var lower = filePath.toLowerCase();
   if (lower.includes('schema') || lower.includes('migration') || lower.includes('model') || lower.includes('prisma')) {

package/.agents/plugins/agentic-senior-core/hooks/pre-tool-dependency-gate.js

@@ -23,8 +23,8 @@ try {
 
 let inputBuffer = '';
 process.stdin.setEncoding('utf8');
-process.stdin.on('data', function (chunk) { inputBuffer += chunk; });
-process.stdin.on('end', function () {
+process.stdin.on('data', chunk => {
+  inputBuffer += chunk;
   try {
     const data = JSON.parse(inputBuffer);
     const isAntigravity = !!data.toolCall;
@@ -117,10 +117,10 @@ process.stdin.on('end', function () {
       process.exit(2);
       return;
     }
-  } catch (_) {
-    // Silent fail to ensure session stability
+    process.exit(0);
+  } catch (e) {
+    // incomplete json, wait for more chunks
   }
-  process.exit(0);
 });
 
 function isGitCommitOrPush(command) {

package/.agents/plugins/agentic-senior-core/hooks/session-pulse.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// Agentic Senior Core — PreInvocation session pulse hook (Antigravity-specific)
+// Antigravity has no SessionStart event. This fires on the FIRST model call
+// (invocationNum === 0) to inject AGENTS.md into the conversation — the same
+// role session-start.js fills for Claude Code / Codex / Copilot via their
+// real SessionStart hook.
+// Does NOT replace session-start.js — that file still serves other hosts.
+
+const fs = require('fs');
+const path = require('path');
+
+const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || path.resolve(__dirname, '..');
+
+let inputBuffer = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => {
+    inputBuffer += chunk;
+    try {
+        const data = JSON.parse(inputBuffer);
+        
+        // Only fire on the very first model call of the session
+        if (data.invocationNum !== 0) {
+            process.stdout.write(JSON.stringify({}) + '\n');
+            process.exit(0);
+            return;
+        }
+
+        const agentsPath = path.join(pluginRoot, 'rules', 'agentic-senior-core.md');
+        let content;
+        try {
+            content = fs.readFileSync(agentsPath, 'utf8');
+        } catch (_) {
+            // Fallback to AGENTS.md at plugin root
+            content = fs.readFileSync(path.join(pluginRoot, 'AGENTS.md'), 'utf8');
+        }
+
+        process.stdout.write(JSON.stringify({
+            injectSteps: [{ ephemeralMessage: content }],
+        }) + '\n');
+        process.exit(0);
+    } catch (e) {
+        // wait for more chunks
+    }
+});

package/.agents/plugins/agentic-senior-core/hooks.json

@@ -74,14 +74,31 @@
             "statusMessage": "ASC ladder & spec gate check..."
           },
           {
-            "type": "prompt",
-            "if": "Edit(**/package.json)",
-            "prompt": "A new dependency '$ARGUMENTS' was added to package.json. Does it duplicate Node.js standard library or platform features? If yes, return JSON: {\"hookSpecificOutput\": {\"hookEventName\": \"PostToolUse\", \"additionalContext\": \"[ASC Advisory] The newly added dependency appears to duplicate stdlib or platform features. Consider native alternatives.\"}}. If no, return {}.",
-            "timeout": 30
+            "type": "command",
+            "command": "node -e \"const p=require('path'),fs=require('fs'),os=require('os');const local=p.join(process.cwd(),'.agents','plugins','agentic-senior-core','hooks','dedup-gate.js');const global=p.join(os.homedir(),'.gemini','config','plugins','agentic-senior-core','hooks','dedup-gate.js');require(fs.existsSync(local)?local:global);\"",
+            "commandWindows": "if (Get-Command node -ErrorAction SilentlyContinue) { $root = if ($env:CLAUDE_PLUGIN_ROOT) { $env:CLAUDE_PLUGIN_ROOT } else { \"$env:USERPROFILE\\.gemini\\config\\plugins\\agentic-senior-core\" }; node \"$root\\hooks\\dedup-gate.js\" }",
+            "timeout": 15,
+            "statusMessage": "ASC duplicate-code scan..."
           }
         ]
       }
     ],
+    "PreInvocation": [
+      {
+        "type": "command",
+        "command": "node -e \"const p=require('path'),fs=require('fs'),os=require('os');const local=p.join(process.cwd(),'.agents','plugins','agentic-senior-core','hooks','session-pulse.js');const global=p.join(os.homedir(),'.gemini','config','plugins','agentic-senior-core','hooks','session-pulse.js');require(fs.existsSync(local)?local:global);\"",
+        "commandWindows": "if (Get-Command node -ErrorAction SilentlyContinue) { $root = if ($env:CLAUDE_PLUGIN_ROOT) { $env:CLAUDE_PLUGIN_ROOT } else { \"$env:USERPROFILE\\.gemini\\config\\plugins\\agentic-senior-core\" }; node \"$root\\hooks\\session-pulse.js\" }",
+        "timeout": 5,
+        "statusMessage": "Loading ASC rules..."
+      },
+      {
+        "type": "command",
+        "command": "node -e \"const p=require('path'),fs=require('fs'),os=require('os');const local=p.join(process.cwd(),'.agents','plugins','agentic-senior-core','hooks','ladder-pulse.js');const global=p.join(os.homedir(),'.gemini','config','plugins','agentic-senior-core','hooks','ladder-pulse.js');require(fs.existsSync(local)?local:global);\"",
+        "commandWindows": "if (Get-Command node -ErrorAction SilentlyContinue) { $root = if ($env:CLAUDE_PLUGIN_ROOT) { $env:CLAUDE_PLUGIN_ROOT } else { \"$env:USERPROFILE\\.gemini\\config\\plugins\\agentic-senior-core\" }; node \"$root\\hooks\\ladder-pulse.js\" }",
+        "timeout": 5,
+        "statusMessage": "ASC ladder pulse..."
+      }
+    ],
     "PostInvocation": [
       {
         "type": "command",

package/.agents/plugins/agentic-senior-core/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.8.26",
-  "description": "Universal AI coding rules. Write code like a staff engineer.",
+  "version": "6.0.0",
+  "description": "Universal AI coding rules. Because your AI writes code like it gets paid by the line.",
   "contextFileName": "rules/agentic-senior-core.md",
   "rules": [
     "rules/"

package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md

@@ -80,6 +80,10 @@ whether to invoke it. Skip this for trivial edits.
 - Non-trivial feature in an existing codebase → `/asc-add-feature` (research/plan gate before implementation)
 - Refactor spanning multiple files or changing architecture → `/asc-refactor` (classifies scope, gates on high-level changes)
 
+### Enforcement Fallbacks (For hosts without hook support)
+- **Duplicate-Code Check**: When creating new functions or components, actively check for existing near-duplicates across directories (not just siblings) before implementing. If a similar pattern exists, reuse it. Apply the Rule of Three: consolidate only if a pattern appears 3+ times.
+- **Ladder Persistence**: Before completing a task, explicitly verify you have selected the lowest feasible step on the 1-6 decision ladder. Document deferred technical debt (via `/asc-debt` or inline comment) if a shortcut is taken.
+
 ## Response Style
 
 Lead with what the developer needs to act: the command, file path, code change, or decision point. Follow with context only when the action depends on it.