@spardutti/claude-skills 2.33.6 → 2.33.8

package/bin/cli.mjs

@@ -2,7 +2,7 @@
 
 import { confirm } from "@inquirer/prompts";
 import chalk from "chalk";
-import { readFileSync } from "node:fs";
+import { readFileSync, existsSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 import { fetchSkills, fetchCommands, fetchAgents } from "../lib/github.mjs";
@@ -10,6 +10,7 @@ import { promptSkillSelection, promptCommandSelection, promptRemoval } from "../
 import { installSkills, installCommands, installRequiredAgents } from "../lib/install.mjs";
 import { makeLocalSource } from "../lib/local.mjs";
 import { runPostInstall } from "../lib/post-install.mjs";
+import { setupHook } from "../lib/setup-hook.mjs";
 import {
   readManifest, writeManifest, computeOrphans, computeRemovals, scanInstalled, removeArtifacts,
   MANIFEST_FILE,
@@ -20,7 +21,7 @@ const pkg = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf-
 const CWD = process.cwd();
 
 // `--sync`: re-install everything the manifest records (refreshed to the latest
-// catalog) and prune anything removed upstream — no interactive menu.
+// catalog), refresh hooks the project already has, and prune anything removed upstream.
 async function runSync(manifest, catalog) {
   if (!manifest) {
     console.log(`  ${chalk.yellow("Nothing to sync")} — no manifest in this project. Run without --sync first.\n`);
@@ -38,6 +39,7 @@ async function runSync(manifest, catalog) {
   if (skills.length > 0) { console.log(); await installSkills(skills); }
   if (commands.length > 0) { console.log(); await installCommands(commands); }
   const { installed } = await installRequiredAgents(commands, catalog.agents, CWD);
+  if (existsSync(join(CWD, ".claude", "hooks", "skill-gate.sh"))) { console.log(); await setupHook(CWD); }
 
   await writeManifest(CWD, {
     catalogVersion: pkg.version,

package/hooks/skill-gate-automark.sh

@@ -26,6 +26,12 @@ if [ -n "$SKILL_NAME" ]; then
   SAFE_NAME=$(printf '%s' "$SKILL_NAME" | tr -cd 'A-Za-z0-9_-')
   if [ -n "$SAFE_NAME" ]; then
     touch "/tmp/claude-skill-loaded-$KEY-$SAFE_NAME"
+    # The ack path holds a key the model cannot know, so without this line its
+    # first write is always denied just to learn it.
+    if [ ! -f "/tmp/claude-skill-acked-$KEY-$SAFE_NAME" ]; then
+      CTX="Skill $SAFE_NAME is loaded. Before your next code write, say which of its rules bear on that file, or that it does not apply. Then run this Bash call, or the write is blocked:\\n  touch /tmp/claude-skill-acked-$KEY-$SAFE_NAME\\nLoaded several skills? Put every path in one touch."
+      printf '{"hookSpecificOutput":{"hookEventName":"PostToolUse","additionalContext":"%s"}}\n' "$CTX"
+    fi
   fi
 fi
 

package/hooks/skill-gate.sh

@@ -108,6 +108,7 @@ fi
 # without both fields keep the old behaviour, so this tightens nothing that was
 # not deliberately declared.
 MISSING=""
+ACKS=""
 MANIFESTS=""
 if [ -n "$TARGETS" ]; then
   MANIFESTS=$(find "$PROJECT_DIR" -maxdepth 4 \( -name node_modules -o -name .git -o -name .venv -o -name dist \) -prune -o \( -name package.json -o -name pyproject.toml -o -name requirements.txt \) -print 2>/dev/null)
@@ -168,7 +169,7 @@ if [ -n "$TARGETS" ]; then
 
     SAFE=$(printf '%s' "$SNAME" | tr -cd 'A-Za-z0-9_-')
     [ -f "/tmp/claude-skill-loaded-$KEY-$SAFE" ] && continue
-    case " $MISSING " in *" $SNAME "*) ;; *) MISSING="$MISSING $SNAME" ;; esac
+    case " $MISSING " in *" $SNAME "*) ;; *) MISSING="$MISSING $SNAME"; ACKS="$ACKS /tmp/claude-skill-acked-$KEY-$SAFE" ;; esac
   done
 fi
 
@@ -176,7 +177,7 @@ if [ -n "$MISSING" ]; then
   LIST=$(printf '%s' "$MISSING" | sed 's/^ //; s/ /, /g')
   FIRST=$(printf '%s' "$MISSING" | awk '{print $1}')
   cat <<EOF
-{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: this file's stack has mandatory skills that are not loaded: $LIST.\n\nThere is no SKIP for these. The file matches each skill's declared paths AND this project depends on a package that skill tracks, so they apply as a matter of fact, not judgement. Touching the gate marker will not clear them.\n\nCall Skill($FIRST) now — then every other name in the list — and retry the edit."}}
+{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: this file's stack has mandatory skills that are not loaded: $LIST.\n\nThere is no SKIP for these. The file matches each skill's declared paths AND this project depends on a package that skill tracks, so they apply as a matter of fact, not judgement. Touching the gate marker will not clear them.\n\nCall Skill($FIRST) now — then every other name in the list. Then say which of their rules bear on this file, ack them in one Bash call, and retry the edit:\n  touch$ACKS"}}
 EOF
   exit 0
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.33.6",
+  "version": "2.33.8",
   "description": "Guardrails for Claude Code — best-practice skills, planning commands, and delivery gates.",
   "type": "module",
   "repository": {