@toolu/opencode 6.8.0

package/plugins/python-quality/.claude-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "name": "python-quality",
+  "version": "6.8.0",
+  "description": "Python PostToolUse quality checks registered into the toolu hook engine.",
+  "author": {
+    "name": "Falconiere Barbosa",
+    "email": "hello@falconiere.io"
+  },
+  "homepage": "https://github.com/falconiere/toolu",
+  "repository": "https://github.com/falconiere/toolu.git",
+  "license": "MIT",
+  "keywords": [
+    "claude-code",
+    "python",
+    "quality",
+    "hooks"
+  ],
+  "dependencies": [
+    {
+      "name": "toolu",
+      "marketplace": "toolu"
+    }
+  ]
+}

package/plugins/python-quality/.codex-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "python-quality",
+  "version": "6.8.0",
+  "description": "Python PostToolUse quality checks registered into the toolu hook engine.",
+  "hooks": "./hooks/hooks.json"
+}

package/plugins/python-quality/README.md

@@ -0,0 +1,23 @@
+# python-quality
+
+Python `PostToolUse` quality checks registered into the toolu hook engine.
+
+## Install
+
+```
+/plugin install python-quality@toolu
+```
+
+Requires the `toolu` plugin.
+
+## What it provides
+
+Every Python file the agent edits is checked on the spot, contributing to toolu's quality gate. The checks (assembled from ordered `hooks/concerns/` fragments into one module at `SessionStart`) are static-only — the gate never invokes `ruff`, `pylint`, or any other linter:
+
+- File / function line limits (config-driven).
+- No suppression: bare `except:`, one-line `except ...: pass`, blanket `# noqa`, bare `# type: ignore`.
+- Colocated `test_*.py` next to every module it tests.
+- No mocks in tests (`unittest.mock`/`mock`/`pytest_mock` imports — covering `MagicMock` — plus `mocker`/`monkeypatch` fixtures).
+- Docstring checks on public functions and classes.
+
+The fragments register into the core toolu dispatcher and run only while this plugin is installed — uninstall it and the Python rules vanish, fail-closed.

package/plugins/python-quality/hooks/check-toolu.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Codex lacks a plugin-dependency manifest field. Warn when this dependent
+# plugin is installed without the toolu core, using Codex's authoritative list.
+set -u
+
+[ "${TOOLU_HOST_OVERRIDE:-}" != claude ] || exit 0
+[ -n "${PLUGIN_ROOT:-}" ] || exit 0
+command -v codex >/dev/null 2>&1 || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+
+installed=$(codex plugin list --json 2>/dev/null) || exit 0
+jq -e 'any(.installed[]?; .pluginId == "toolu@toolu" and
+  ((has("installed") | not) or (.installed == true)) and
+  ((has("enabled") | not) or (.enabled == true)))' \
+  <<<"$installed" >/dev/null 2>&1 && exit 0
+
+jq -n '{hookSpecificOutput:{
+  hookEventName:"SessionStart",
+  additionalContext:"WARN: this plugin requires the toolu core. Install it first with: codex plugin add toolu@toolu"
+}}'

package/plugins/python-quality/hooks/concerns/00-preamble.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Post-tool check: Python quality rules.
+# Project-agnostic: no-op outside Python projects or when python3 is missing.
+#
+# Inputs (from parent dispatcher post-tools/mod.sh, via `export`):
+#   $tool_name     - name of the tool being invoked
+#   $input         - raw JSON payload on stdin
+#   $PROJECT_ROOT  - repository root
+
+: "${tool_name:=}"
+: "${input:=}"
+: "${PROJECT_ROOT:=$(pwd)}"
+
+# Core lib comes from the toolu dispatcher via TOOLU_LIB_DIR (set by
+# plugins/toolu/hooks/post-tools/mod.sh before registry dispatch). Outside
+# that pipeline there is no relative path to it — fail SOFT: a quality check
+# must never break a tool call by erroring.
+[ -n "${TOOLU_LIB_DIR:-}" ] && [ -f "$TOOLU_LIB_DIR/detect.sh" ] || exit 0
+# shellcheck source=../../../toolu/hooks/lib/detect.sh
+. "$TOOLU_LIB_DIR/detect.sh"
+# Threshold resolver (defaults + project/native overrides). Soft if absent.
+# shellcheck source=../../../toolu/hooks/lib/quality-config.sh
+[ -f "$TOOLU_LIB_DIR/quality-config.sh" ] && . "$TOOLU_LIB_DIR/quality-config.sh"
+# Multi-slot gate writer (entries keyed by file — one hook's failure no longer
+# clobbers another's). Soft if absent: fallbacks below keep the legacy
+# single-slot behavior when the toolu lib predates gate-file.sh.
+# shellcheck source=../../../toolu/hooks/lib/gate-file.sh
+[ -f "$TOOLU_LIB_DIR/gate-file.sh" ] && . "$TOOLU_LIB_DIR/gate-file.sh"
+command -v gate_record_failure >/dev/null 2>&1 || gate_record_failure() {
+  jq -n --arg reason "$4" --arg source "$3" --arg file "$2" --arg violations "$5" \
+    --arg updatedAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    '{status: "failing", reason: $reason, source: $source, file: $file,
+      violations: $violations, updatedAt: $updatedAt}' > "$1"
+}
+command -v gate_clear_file >/dev/null 2>&1 || gate_clear_file() {
+  [ -f "$1" ] || return 0
+  local _src _file
+  _src=$(jq -r '.source // ""' "$1" 2>/dev/null || echo "")
+  _file=$(jq -r '.file // ""' "$1" 2>/dev/null || echo "")
+  if [ "$_src" = "$3" ] && [ "$_file" = "$2" ]; then
+    jq -n --arg source "$3" --arg updatedAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+      '{status: "passing", source: $source, updatedAt: $updatedAt}' > "$1"
+  fi
+}
+command -v python_max_file_lines >/dev/null 2>&1 || python_max_file_lines() { echo "${DEFAULT_PYTHON_MAX_FILE_LINES:-400}"; }
+command -v python_max_fn_lines   >/dev/null 2>&1 || python_max_fn_lines()   { echo "${DEFAULT_PYTHON_MAX_FN_LINES:-50}"; }
+# Boolean flag reader (e.g. noMocks) — falls back to the caller's default when
+# quality-config.sh predates this reader.
+command -v quality_flag >/dev/null 2>&1 || quality_flag() { printf '%s' "$3"; }
+# count_python_code_lines comes from detect.sh (sourced above) — no fallback needed.
+
+# Load the merged config ONCE so TOOLU_CFG_LOADED sticks for the threshold
+# lookups below — each runs in a $(...) subshell that inherits it and skips
+# re-merging (otherwise every wrapper re-spawns the jq merge).
+command -v toolu_load_config >/dev/null 2>&1 && toolu_load_config 2>/dev/null || true
+
+[ "$(detect_python)" = "python" ] || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+command -v jq      >/dev/null 2>&1 || exit 0
+
+fp_from_input=""
+if [[ "$tool_name" == "Write" || "$tool_name" == "Edit" || "$tool_name" == "MultiEdit" ]]; then
+  fp_from_input=$(echo "$input" | jq -r '.tool_input.path // .tool_input.file_path // .tool_input.target_file // empty' 2>/dev/null || echo "")
+fi
+FILE_PATH="${CLAUDE_FILE_PATHS:-$fp_from_input}"
+
+# Deleted files and move sources cannot be linted after apply_patch completes,
+# but their path-owned quality failure must not remain active forever.
+EDIT_OPERATION="${TOOLU_EDIT_OPERATION:-$(echo "$input" | jq -r '.tool_input.toolu_edit_operation // ""' 2>/dev/null || echo "")}"
+EDIT_MOVED_TO="${TOOLU_EDIT_MOVED_TO:-$(echo "$input" | jq -r '.tool_input.toolu_edit_moved_to // ""' 2>/dev/null || echo "")}"
+if [[ "$EDIT_OPERATION" == delete || -n "$EDIT_MOVED_TO" ]]; then
+  if [[ -n "$FILE_PATH" && "$FILE_PATH" =~ \.py$ ]]; then
+    GATE_FILE="$(toolu_project_state_root "$PROJECT_ROOT")/quality-gate-status.json"
+    gate_clear_file "$GATE_FILE" "$FILE_PATH" "python-quality-hook"
+  fi
+  exit 0
+fi
+
+[[ -z "$FILE_PATH" || ! -f "$FILE_PATH" ]] && exit 0
+[[ ! "$FILE_PATH" =~ \.py$ ]] && exit 0
+
+MESSAGES=""
+add_error() {
+  MESSAGES="${MESSAGES}${1}"$'\n'
+}

package/plugins/python-quality/hooks/concerns/10-size-file.sh

@@ -0,0 +1,6 @@
+PY_MAX_FILE=$(python_max_file_lines)
+LINE_COUNT=$(count_python_code_lines "$FILE_PATH")
+if [[ "$LINE_COUNT" -gt "$PY_MAX_FILE" ]]; then
+  add_error "File exceeds ${PY_MAX_FILE}-line limit: $FILE_PATH ($LINE_COUNT code lines, blanks/comments excluded) — split into submodules. Override via lang.python.maxFileLines."
+fi
+

package/plugins/python-quality/hooks/concerns/20-tests.sh

@@ -0,0 +1,37 @@
+# Test placement: colocated `test_*.py` / `*_test.py` convention (module-sibling,
+# not a separate tests/ tree — the TS __tests__/ colocation principle, applied to
+# Python's own naming idiom). Two rules:
+#   (a) a test-bearing file (top-level `def test_...`/`async def test_...`, or a
+#       pytest/unittest import) whose basename does not follow the convention.
+#   (b) a `test_*.py` sitting in a directory with no non-test .py sibling — it
+#       has nothing to be "colocated" with.
+# `conftest.py` (pytest's fixture-sharing file — imports pytest but is not
+# itself a test) and `__init__.py` (package marker, never a test) are exempt
+# from both rules.
+_py_base="$(basename "$FILE_PATH")"
+_is_python_test_file=0
+case "$_py_base" in
+  test_*.py|*_test.py) _is_python_test_file=1 ;;
+esac
+
+case "$_py_base" in
+  conftest.py|__init__.py) ;;
+  *)
+    _has_test_marker=0
+    grep -qE '^(async[[:space:]]+)?def[[:space:]]+test_[A-Za-z0-9_]*[[:space:]]*\(' "$FILE_PATH" 2>/dev/null && _has_test_marker=1
+    grep -qE '^(import|from)[[:space:]]+(pytest|unittest)\b' "$FILE_PATH" 2>/dev/null && _has_test_marker=1
+    if [[ "$_has_test_marker" -eq 1 && "$_is_python_test_file" -eq 0 ]]; then
+      add_error "Test-bearing file not named test_*.py or *_test.py: $FILE_PATH — rename to follow the colocated test convention"
+    fi
+
+    if [[ "$_py_base" == test_*.py ]]; then
+      _py_dir="$(dirname "$FILE_PATH")"
+      if ! find "$_py_dir" -maxdepth 1 -type f -name '*.py' \
+          ! -name 'test_*.py' ! -name '*_test.py' ! -name 'conftest.py' ! -name '__init__.py' \
+          2>/dev/null | grep -q .; then
+        add_error "Test not co-located with a module: $FILE_PATH — colocate test_*.py next to the module it tests"
+      fi
+    fi
+    ;;
+esac
+

package/plugins/python-quality/hooks/concerns/30-suppression.sh

@@ -0,0 +1,33 @@
+
+# Forbidden suppression markers — fix the underlying issue in code, never
+# silence the tool. Four zero-false-positive forms, one awk pass (mirrors
+# 40-unsafe.sh's single-process style). No \b anywhere — BSD awk (macOS) has
+# none; explicit boundary characters are used instead:
+#   - bare `except:`             (no exception type — swallows EVERYTHING,
+#                                  including KeyboardInterrupt/SystemExit)
+#   - one-line `except ...: pass` (catches and silently discards)
+#   - blanket `# noqa`           (no `:CODE` suffix — suppresses every rule on
+#                                  the line, not a scoped `# noqa: E501`)
+#   - blanket `# type: ignore`   (no `[code]` suffix — suppresses every mypy
+#                                  error on the line, not a scoped
+#                                  `# type: ignore[arg-type]`)
+# Scoped forms are distinguished from blanket ones by a SECOND regex on the
+# same line rather than a lookahead (POSIX/BSD awk has none).
+SUPPRESSION_HITS=$(awk '
+  /^[[:space:]]*except[[:space:]]*:[[:space:]]*(#.*)?$/ {
+    print NR": bare except: (swallows everything)"; next
+  }
+  /^[[:space:]]*except[^:]*:[[:space:]]*pass[[:space:]]*(#.*)?$/ {
+    print NR": one-line except ...: pass (silently discarded)"; next
+  }
+  /#[ \t]*noqa/ && !/#[ \t]*noqa[ \t]*:[ \t]*[A-Za-z0-9]/ {
+    print NR": blanket # noqa (no :CODE suffix)"; next
+  }
+  /#[ \t]*type:[ \t]*ignore/ && !/#[ \t]*type:[ \t]*ignore\[/ {
+    print NR": blanket # type: ignore (no [code] suffix)"; next
+  }
+' "$FILE_PATH" 2>/dev/null | head -5)
+if [[ -n "$SUPPRESSION_HITS" ]]; then
+  add_error "Forbidden suppression in $FILE_PATH — remove it and fix the underlying issue. Scoped forms (except SpecificError:, # noqa: E501, # type: ignore[arg-type]) are fine; blanket ones are not:"$'\n'"${SUPPRESSION_HITS}"
+fi
+

package/plugins/python-quality/hooks/concerns/50-size-fn.sh

@@ -0,0 +1,49 @@
+PY_MAX_FN=$(python_max_fn_lines)
+# Indent-based span (Python has no braces): a `def `/`async def ` line opens a
+# span at its OWN indent; the span closes at the next nonblank line whose
+# indent is <= the def's (decorators above are never counted — they sit at
+# the same indent as the def and simply close the PRIOR span before the def
+# line opens a new one). Only code lines count (blanks and full-line `#`
+# comments are skipped), matching count_python_code_lines. Known limitation:
+# a line continuation or multi-line string containing a dedented look-alike
+# line is not tokenized here — same heuristic class as the rust brace counter.
+LONG_PY_FUNCS=$(awk -v max="$PY_MAX_FN" '
+  function lead(s,   i,c,n) {
+    n = 0
+    for (i = 1; i <= length(s); i++) {
+      c = substr(s, i, 1)
+      if (c == " " || c == "\t") n++
+      else break
+    }
+    return n
+  }
+  {
+    raw = $0
+    trimmed = raw
+    sub(/^[ \t]+/, "", trimmed)
+    blank = (length(trimmed) == 0)
+    if (infn && !blank) {
+      if (lead(raw) <= def_indent) {
+        if (count > max) printf "%s:%d (%d lines)\n", name, start, count
+        infn = 0
+      }
+    }
+    if (!infn && raw ~ /^[ \t]*(async[ \t]+)?def[ \t]/) {
+      infn = 1
+      def_indent = lead(raw)
+      start = NR
+      match(trimmed, /def[ \t]+[A-Za-z_][A-Za-z0-9_]*/)
+      name = substr(trimmed, RSTART, RLENGTH)
+      sub(/^def[ \t]+/, "", name)
+      count = 0
+    }
+    if (infn && !blank && substr(trimmed, 1, 1) != "#") count++
+  }
+  END {
+    if (infn && count > max) printf "%s:%d (%d lines)\n", name, start, count
+  }
+' "$FILE_PATH" 2>/dev/null)
+if [[ -n "$LONG_PY_FUNCS" ]]; then
+  add_error "Function too long in $FILE_PATH (>${PY_MAX_FN} lines) — extract helpers."$'\n'"${LONG_PY_FUNCS}"
+fi
+

package/plugins/python-quality/hooks/concerns/70-no-mocks.sh

@@ -0,0 +1,76 @@
+# --- No-mocks (zero tolerance): forbid mock frameworks — real data/fixtures
+# only. Test files ONLY (test_*.py / *_test.py / conftest.py, per the shared
+# $_is_python_test_file set in 20-tests.sh) — a no-op elsewhere, mirroring
+# rust's test-scope split in 70-no-mocks.sh. Same ast-grep-scan pattern: ONE
+# process, severity warning (a matching rule and a clean run both exit 0 —
+# only a genuine crash is distinguishable from a clean pass), jq flattens
+# every hit to its def/import line, add_error on a match or on tool breakage.
+#
+# Opt-out: lang.python.noMocks (default true) via quality_flag.
+if [[ "${_is_python_test_file:-0}" -eq 1 ]] \
+   && [[ "$(quality_flag python noMocks true)" == "true" ]] \
+   && command -v ast-grep >/dev/null 2>&1; then
+  NM_RULES=$(cat <<'PY_NOMOCK_RULES'
+id: mock-import
+language: python
+severity: warning
+message: 'mock import'
+rule:
+  any:
+    - kind: import_statement
+      has: {kind: dotted_name, regex: '^(unittest\.mock|mock|pytest_mock)$'}
+    - kind: import_from_statement
+      has: {field: module_name, kind: dotted_name, regex: '^(unittest\.mock|mock)$'}
+    - kind: import_from_statement
+      all:
+        - has: {field: module_name, kind: dotted_name, regex: '^unittest$'}
+        - has: {field: name, kind: dotted_name, regex: '^mock$'}
+---
+id: mocker-param
+language: python
+severity: warning
+message: 'mocker/monkeypatch fixture parameter'
+rule:
+  kind: function_definition
+  has:
+    field: parameters
+    has: {kind: identifier, regex: '^(mocker|monkeypatch)$'}
+PY_NOMOCK_RULES
+)
+
+  nm_err_file="$(mktemp)"
+  nm_json=$(ast-grep scan --inline-rules "$NM_RULES" --json "$FILE_PATH" 2>"$nm_err_file")
+  nm_rc=$?
+  nm_grep_failed=0
+  nm_fail_detail=""
+  nm_lines=""
+  if [[ "$nm_rc" -ne 0 || -s "$nm_err_file" ]]; then
+    nm_grep_failed=1
+    nm_stderr_first=$(head -n 1 "$nm_err_file" 2>/dev/null | cut -c1-200)
+    nm_fail_detail="ast-grep exit ${nm_rc}${nm_stderr_first:+: $nm_stderr_first}"
+  elif [[ -z "$(printf '%s' "$nm_json" | tr -d '[:space:]')" ]]; then
+    nm_grep_failed=1
+    nm_fail_detail="ast-grep exited 0 with empty output (expected at least the JSON array \"[]\")"
+  elif ! nm_lines=$(printf '%s' "$nm_json" | jq -r '
+        .[] | "\(.ruleId)\t\(.range.start.line + 1): \(.lines | split("\n")[0])"
+      ' 2>/dev/null); then
+    nm_grep_failed=1
+    nm_fail_detail="ast-grep exited 0 but its output did not parse as the documented JSON array"
+    nm_lines=""
+  fi
+  rm -f "$nm_err_file"
+
+  IMPORT_HITS=$(printf '%s\n' "$nm_lines" | awk -F'\t' '$1=="mock-import"{print $2}' | head -5)
+  if [[ -n "$IMPORT_HITS" ]]; then
+    add_error "no-mocks: mock import in $FILE_PATH — write against real data/fixtures instead"$'\n'"${IMPORT_HITS}"
+  fi
+  PARAM_HITS=$(printf '%s\n' "$nm_lines" | awk -F'\t' '$1=="mocker-param"{print $2}' | head -5)
+  if [[ -n "$PARAM_HITS" ]]; then
+    add_error "no-mocks: mocker/monkeypatch fixture parameter in $FILE_PATH — write against real data/fixtures instead"$'\n'"${PARAM_HITS}"
+  fi
+
+  if [[ "$nm_grep_failed" -ne 0 ]]; then
+    add_error "ast-grep failed while scanning $FILE_PATH — ${nm_fail_detail:-unknown error}; no-mocks rules could not be verified. Fix the tool/file and re-edit"
+  fi
+fi
+

package/plugins/python-quality/hooks/concerns/90-docs.sh

@@ -0,0 +1,52 @@
+# --- Docs (soft advisory, never blocks) ---
+# A top-level, non-underscore-prefixed `def`/`class` should open with a
+# docstring. Advisory only — collected separately from MESSAGES so it never
+# sets the failing gate. Column-0 (top-level) only: indented defs/methods are
+# exempt (noise control — every private helper method would otherwise need
+# one). The signature may span multiple lines; it is tracked forward to the
+# line that actually ends with `:` before the docstring check runs. Known
+# limitation: a `def`/`class`-shaped line quoted inside a module docstring at
+# column 0 would be mis-read as a real definition — same class of heuristic
+# limit as the other line-based scans in this plugin.
+DOC_ADVISORY=""
+_undoc=$(awk -v sq="'" '
+  function isblank(s,    t) { t = s; gsub(/^[ \t]+|[ \t]+$/, "", t); return (length(t) == 0) }
+  function stripcomment(s,    t) { t = s; sub(/[ \t]#.*$/, "", t); return t }
+  function endswithcolon(s,    t) {
+    t = stripcomment(s); gsub(/[ \t]+$/, "", t)
+    return (length(t) > 0 && substr(t, length(t), 1) == ":")
+  }
+  function opens_docstring(s,    t, p, body) {
+    t = s; gsub(/^[ \t]+/, "", t)
+    p = 0
+    if (t ~ /^[rRfF]/) p = 1
+    body = substr(t, p + 1, 3)
+    return (body == "\"\"\"" || body == sq sq sq)
+  }
+  {
+    line = $0
+    if (waitbody) {
+      if (isblank(line)) next
+      if (!opens_docstring(line)) printf "%d: %s\n", defline, defname
+      waitbody = 0; next
+    }
+    if (insig) {
+      if (endswithcolon(line)) { insig = 0; waitbody = 1 }
+      next
+    }
+    if (line ~ /^(async[ \t]+def|def|class)[ \t]+[A-Za-z_][A-Za-z0-9_]*/) {
+      tmp = line
+      sub(/^(async[ \t]+def|def|class)[ \t]+/, "", tmp)
+      match(tmp, /^[A-Za-z_][A-Za-z0-9_]*/)
+      name = substr(tmp, RSTART, RLENGTH)
+      if (substr(name, 1, 1) != "_") {
+        defline = NR; defname = name
+        if (endswithcolon(line)) { waitbody = 1 } else { insig = 1 }
+      }
+    }
+  }
+' "$FILE_PATH" 2>/dev/null | head -3)
+if [[ -n "$_undoc" ]]; then
+  DOC_ADVISORY="Public def/class missing a docstring in $FILE_PATH — add a concise one:"$'\n'"${_undoc}"
+fi
+

package/plugins/python-quality/hooks/concerns/99-finalize.sh

@@ -0,0 +1,36 @@
+# --- Output ---
+
+if [[ -n "$MESSAGES" ]]; then
+  # Record this file's violation in the gate status file (entry keyed by file
+  # path — does not clobber failures recorded for other files or hooks).
+  GATE_DIR="$(toolu_project_state_root "$PROJECT_ROOT")"
+  GATE_FILE="$GATE_DIR/quality-gate-status.json"
+  mkdir -p "$GATE_DIR"
+  gate_record_failure "$GATE_FILE" "$FILE_PATH" "python-quality-hook" \
+    "Post-edit Python quality violation(s) detected" "$MESSAGES"
+
+  jq -n --arg ctx "$MESSAGES" '{
+    "hookSpecificOutput": {
+      "hookEventName": "PostToolUse",
+      "additionalContext": ("QUALITY VIOLATION — fix before proceeding:\n" + $ctx)
+    }
+  }'
+else
+  # Clear this file's entry now that it passes (only if this hook set it).
+  # Other files' failures stay recorded; the gate only flips to passing when
+  # no entry remains.
+  GATE_FILE="$(toolu_project_state_root "$PROJECT_ROOT")/quality-gate-status.json"
+  gate_clear_file "$GATE_FILE" "$FILE_PATH" "python-quality-hook"
+
+  # Docs advisory (non-blocking — no gate write).
+  if [[ -n "$DOC_ADVISORY" ]]; then
+    jq -n --arg ctx "$DOC_ADVISORY" '{
+      "hookSpecificOutput": {
+        "hookEventName": "PostToolUse",
+        "additionalContext": $ctx
+      }
+    }'
+  fi
+fi
+
+exit 0

package/plugins/python-quality/hooks/hooks.json

@@ -0,0 +1,19 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/register.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/check-toolu.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/plugins/python-quality/hooks/register.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# SessionStart registry sync for the python-quality plugin.
+#
+# Assembles hooks/concerns/[0-9][0-9]-*.sh (ordered preamble → concern partials
+# → finalize) into ONE runtime module in the toolu registry
+# (${TOOLU_CONFIG_DIR:-${CLAUDE_CONFIG_DIR:-$HOME/.claude}}/toolu/post-tools.d/) under the
+# namespaced filename python-quality@toolu__python-quality.sh. The fragments are
+# partials of a single script; concatenating them in numeric order yields the
+# one module that runs as a single process doing one gate write (authored
+# fragment-first — unlike rust/ts-quality there was never a pre-split monolith). Prunes any stale entry bearing OUR prefix, and
+# clears our own crashed tmp residue. Other plugins' entries are never touched.
+#
+# Silent on success (SessionStart stdout becomes context); errors are
+# non-fatal — a failed sync means the registry copy is stale, not broken.
+
+SPEC="python-quality@toolu"
+OUT="python-quality.sh"
+SELF_DIR="$(cd "$(dirname "$0")" && pwd)"
+SRC_DIR="$SELF_DIR/concerns"
+if [ -n "${TOOLU_CONFIG_DIR:-}" ]; then
+  CONFIG_ROOT="$TOOLU_CONFIG_DIR"
+elif [ "${TOOLU_HOST_OVERRIDE:-}" = codex ] || { [ -z "${TOOLU_HOST_OVERRIDE:-}" ] && [ -n "${PLUGIN_ROOT:-}" ]; }; then
+  CONFIG_ROOT="${CODEX_HOME:-$HOME/.codex}"
+else
+  CONFIG_ROOT="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+fi
+REG_DIR="$CONFIG_ROOT/toolu/post-tools.d"
+
+# Consume stdin so Claude Code's hook IPC never stalls.
+cat > /dev/null 2>&1 || true
+
+[ -d "$SRC_DIR" ] || exit 0
+mkdir -p "$REG_DIR" 2>/dev/null || exit 0
+
+# Clear OUR orphaned atomic-write residue from prior crashed runs. Age-gated
+# so a concurrent SessionStart's in-flight tmp (seconds old) is never clobbered.
+find "$REG_DIR" -maxdepth 1 -name "${SPEC}__*.sh.tmp.*" -mmin +1 -delete 2>/dev/null
+
+# Assemble: concatenate the numeric-prefixed fragments in lexical order into one
+# module. A newline guard between fragments keeps a fragment that lacks a
+# trailing newline from running into the next. __tests__/ and any non-prefixed
+# .sh are skipped by the glob.
+dst="$REG_DIR/${SPEC}__${OUT}"
+tmp="${dst}.tmp.$$"
+: > "$tmp"
+for src in "$SRC_DIR"/[0-9][0-9]-*.sh; do
+  [ -f "$src" ] || continue
+  cat "$src" >> "$tmp" 2>/dev/null || { rm -f "$tmp"; exit 0; }
+  printf '\n' >> "$tmp" 2>/dev/null || { rm -f "$tmp"; exit 0; }
+done
+if [ -s "$tmp" ] && { [ ! -f "$dst" ] || ! cmp -s "$tmp" "$dst"; }; then
+  mv "$tmp" "$dst" 2>/dev/null || rm -f "$tmp"
+else
+  rm -f "$tmp"
+fi
+
+# Prune: remove any entry bearing OUR prefix that is not the current assembled
+# module (e.g. per-concern files left by an older version). Never glob outside
+# our own spec prefix.
+for old in "$REG_DIR/${SPEC}__"*.sh; do
+  [ -f "$old" ] || continue
+  [ "$(basename "$old")" = "${SPEC}__${OUT}" ] || rm -f "$old"
+done
+
+exit 0

package/plugins/rust-quality/.claude-plugin/plugin.json

@@ -0,0 +1,24 @@
+{
+  "name": "rust-quality",
+  "version": "6.8.0",
+  "description": "Rust PostToolUse quality checks registered into the toolu hook engine.",
+  "author": {
+    "name": "Falconiere Barbosa",
+    "email": "hello@falconiere.io"
+  },
+  "homepage": "https://github.com/falconiere/toolu",
+  "repository": "https://github.com/falconiere/toolu.git",
+  "license": "MIT",
+  "keywords": [
+    "claude-code",
+    "rust",
+    "quality",
+    "hooks"
+  ],
+  "dependencies": [
+    {
+      "name": "toolu",
+      "marketplace": "toolu"
+    }
+  ]
+}

package/plugins/rust-quality/.codex-plugin/plugin.json

@@ -0,0 +1,6 @@
+{
+  "name": "rust-quality",
+  "version": "6.8.0",
+  "description": "Rust PostToolUse quality checks registered into the toolu hook engine.",
+  "hooks": "./hooks/hooks.json"
+}

package/plugins/rust-quality/README.md

@@ -0,0 +1,24 @@
+# rust-quality
+
+Rust `PostToolUse` quality checks registered into the toolu hook engine.
+
+## Install
+
+```
+/plugin install rust-quality@toolu
+```
+
+Requires the `toolu` plugin.
+
+## What it provides
+
+Every Rust file the agent edits is checked on the spot, contributing to toolu's quality gate. The checks (assembled from ordered `hooks/concerns/` fragments into one module at `SessionStart`):
+
+- File / function / `impl` line limits (config-driven).
+- No `.unwrap()` / `.expect()` — use `?` or `match`.
+- No `unsafe` blocks.
+- No `#[allow]` / `#[expect]` lint suppression — except a `tests/` file's file-level `#![allow(...)]` header, for the lints test code violates on purpose.
+- Unit tests in a module-sibling `tests/` (wired by a bodyless `#[cfg(test)] mod tests;`, `#[path]`-attributed or not); crate-root `tests/` for integration. No inline test bodies in `src/`.
+- Doc-comment checks on public items.
+
+The fragments register into the core toolu dispatcher and run only while this plugin is installed — uninstall it and the Rust rules vanish, fail-closed.

package/plugins/rust-quality/hooks/check-toolu.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Codex lacks a plugin-dependency manifest field. Warn when this dependent
+# plugin is installed without the toolu core, using Codex's authoritative list.
+set -u
+
+[ "${TOOLU_HOST_OVERRIDE:-}" != claude ] || exit 0
+[ -n "${PLUGIN_ROOT:-}" ] || exit 0
+command -v codex >/dev/null 2>&1 || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+
+installed=$(codex plugin list --json 2>/dev/null) || exit 0
+jq -e 'any(.installed[]?; .pluginId == "toolu@toolu" and
+  ((has("installed") | not) or (.installed == true)) and
+  ((has("enabled") | not) or (.enabled == true)))' \
+  <<<"$installed" >/dev/null 2>&1 && exit 0
+
+jq -n '{hookSpecificOutput:{
+  hookEventName:"SessionStart",
+  additionalContext:"WARN: this plugin requires the toolu core. Install it first with: codex plugin add toolu@toolu"
+}}'