@toolu/opencode 6.8.0

package/plugins/ts-quality/hooks/concerns/35-react-hooks.sh

@@ -0,0 +1,7 @@
+if [[ "$FILE_PATH" =~ use-.*\.ts$ || "$FILE_PATH" =~ use[A-Z].*\.ts$ ]]; then
+  HOOK_COUNT=$(grep -cE '^[[:space:]]*(const \[|useRef\(|useEffect\()' "$FILE_PATH" 2>/dev/null || true)
+  if [[ "$HOOK_COUNT" -gt 3 ]]; then
+    add_error "Hook does too many things in $FILE_PATH ($HOOK_COUNT useState/useRef/useEffect) — split into focused hooks"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/40-factory.sh

@@ -0,0 +1,5 @@
+FACTORY_COUNT=$(grep -cE '^export (async )?function create' "$FILE_PATH" 2>/dev/null || true)
+if [[ "$FACTORY_COUNT" -gt 2 ]]; then
+  add_error "Too many factory functions in $FILE_PATH ($FACTORY_COUNT) — simplify construction"
+fi
+

package/plugins/ts-quality/hooks/concerns/45-typeguard.sh

@@ -0,0 +1,6 @@
+if grep -qE 'function is[A-Z].*\): .* is [A-Z]' "$FILE_PATH" 2>/dev/null; then
+  if [[ -f "$PROJECT_ROOT/package.json" ]] && grep -q '"zod"' "$PROJECT_ROOT/package.json" 2>/dev/null; then
+    add_error "Manual type guard in $FILE_PATH — use Zod schema instead"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/50-type-dup.sh

@@ -0,0 +1,16 @@
+NEW_TYPES=$(grep -oE '^export (interface|type) [A-Z][a-zA-Z]+' "$FILE_PATH" 2>/dev/null | awk '{print $NF}')
+if [[ -n "$NEW_TYPES" ]]; then
+  # git grep instead of grep -r: uses the index, skips .gitignore'd trees
+  # (node_modules, dist) — the recursive walk was a per-edit hot-path cost on
+  # large monorepos. --untracked keeps brand-new files visible.
+  _ts_rel_fp="${FILE_PATH#"$PROJECT_ROOT"/}"
+  for TYPE_NAME in $NEW_TYPES; do
+    DUPE_FILE=$(git -C "$PROJECT_ROOT" grep -l --untracked -E \
+      "^export (interface|type) ${TYPE_NAME}[ <{]" -- 'packages/*.ts' 'packages/*.tsx' 'apps/*.ts' 'apps/*.tsx' 2>/dev/null \
+      | grep -vFx "$_ts_rel_fp" | head -1)
+    if [[ -n "$DUPE_FILE" ]]; then
+      add_error "Type '$TYPE_NAME' in $FILE_PATH already defined in $DUPE_FILE — import instead of redefining"
+    fi
+  done
+fi
+

package/plugins/ts-quality/hooks/concerns/55-naming.sh

@@ -0,0 +1,11 @@
+# Check: forbidden sub-component file names (must match the exported function)
+_basename="$(basename "$FILE_PATH" .tsx)"
+_basename="${_basename%.ts}"
+if [[ "$FILE_PATH" =~ \.(tsx)$ ]]; then
+  if echo "$_basename" | grep -qE '^(parts|components|helpers|items|sections|elements)$|-(parts|sections|items|elements)$'; then
+    add_error "Forbidden component filename '$_basename.tsx' in $FILE_PATH — name file after its exported function (e.g. api-key-create-button.tsx)"
+  fi
+fi
+
+# --- New checks ---
+

package/plugins/ts-quality/hooks/concerns/60-console.sh

@@ -0,0 +1,6 @@
+# Check: console.log — capture once, then test (not grep-twice).
+CONSOLE_LINES=$(grep -nE '^[[:space:]]*console\.log\(' "$FILE_PATH" 2>/dev/null | grep -vE '^[0-9]+:[[:space:]]*//' | head -3)
+if [[ -n "$CONSOLE_LINES" ]]; then
+  add_error "Forbidden console.log in $FILE_PATH — use console.error/warn/info"$'\n'"${CONSOLE_LINES}"
+fi
+

package/plugins/ts-quality/hooks/concerns/65-suppression.sh

@@ -0,0 +1,12 @@
+# Check: suppression comments — fix the issue in code, never silence the tool.
+# @ts-expect-error is exempt in test/spec files, where asserting a compile error
+# is a legitimate test; banned everywhere else like the rest.
+SUPPRESS_TOKENS='@ts-ignore|@ts-nocheck|eslint-disable|biome-ignore'
+if [[ ! "$FILE_PATH" =~ \.(test|spec)\.(ts|tsx)$ ]]; then
+  SUPPRESS_TOKENS="${SUPPRESS_TOKENS}|@ts-expect-error"
+fi
+DISABLE_LINES=$(grep -nE "(//|/\*+)[[:space:]]*(${SUPPRESS_TOKENS})" "$FILE_PATH" 2>/dev/null | head -3)
+if [[ -n "$DISABLE_LINES" ]]; then
+  add_error "Forbidden suppression comment in $FILE_PATH — fix the underlying issue in code, never silence it"$'\n'"${DISABLE_LINES}"
+fi
+

package/plugins/ts-quality/hooks/concerns/70-ui-confirm.sh

@@ -0,0 +1,8 @@
+# Check: confirm()/alert() in frontend files
+if [[ "$FILE_PATH" == */components/* || "$FILE_PATH" == */routes/* ]]; then
+  CONFIRM_LINES=$(grep -nE '\b(confirm|alert)[[:space:]]*\(' "$FILE_PATH" 2>/dev/null | grep -vE '^[0-9]+:[[:space:]]*//' | grep -vE '(ConfirmDeleteAlert|AlertDialog|customAlert|customConfirm)' | head -3)
+  if [[ -n "$CONFIRM_LINES" ]]; then
+    add_error "Forbidden confirm()/alert() in $FILE_PATH — use AlertDialog component"$'\n'"${CONFIRM_LINES}"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/72-ui-radix.sh

@@ -0,0 +1,12 @@
+# Check: raw radix AlertDialog/Dialog imports. Drop leading-`//` comment lines
+# first (same filter as the AS_LINES check above) so a commented-out import does
+# not false-positive. Like AS_LINES, only whole-line `//` comments are dropped —
+# a radix path inside a trailing comment after real code still matches (rare:
+# imports are standalone). Kept consistent with the sibling rules on purpose.
+if grep -nE "from ['\"]@radix-ui/react-(alert-dialog|dialog)['\"]" "$FILE_PATH" 2>/dev/null \
+     | grep -qvE '^[0-9]+:[[:space:]]*//'; then
+  if [[ "$FILE_PATH" != */packages/ui/* ]]; then
+    add_error "Raw radix import in $FILE_PATH — use shared components from @/components/ui/"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/74-react-props.sh

@@ -0,0 +1,6 @@
+# Check: mutable props (Props type param without Readonly)
+PROPS_LINES=$(grep -nE '\((props|[a-z]+Props):[[:space:]]+[A-Z][a-zA-Z]+Props\)' "$FILE_PATH" 2>/dev/null | grep -v 'Readonly' | head -3)
+if [[ -n "$PROPS_LINES" ]]; then
+  add_error "Mutable props in $FILE_PATH — wrap in Readonly<Props>"$'\n'"${PROPS_LINES}"
+fi
+

package/plugins/ts-quality/hooks/concerns/76-toast.sh

@@ -0,0 +1,10 @@
+# Check: manual try/catch+toast pattern in components
+if [[ "$FILE_PATH" == */components/* || "$FILE_PATH" == */routes/* ]]; then
+  # [[:space:]] not \s: BSD awk (macOS) has no \s and reads it as a literal `s`,
+  # which silently killed this rule for the universal `catch (` spelling.
+  CATCH_TOAST=$(awk '/catch[[:space:]]*\(/{found=1} found && /toast\(/{print NR": "$0; found=0}' "$FILE_PATH" 2>/dev/null | head -3)
+  if [[ -n "$CATCH_TOAST" ]]; then
+    add_error "Manual try/catch+toast in $FILE_PATH — use shared error handling"$'\n'"${CATCH_TOAST}"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/78-error-ast.sh

@@ -0,0 +1,242 @@
+# shellcheck shell=bash
+# --- Error-handling rules (zero tolerance) ---
+
+if command -v ast-grep >/dev/null 2>&1; then
+  # ONE ast-grep process for ALL the rules below, not one per rule. The previous shape ran
+  # `ast-grep run -p <pattern>` once per pattern — 14 spawns, each re-parsing the
+  # same file — and measured ~170ms of the TS gate's ~300ms on every edit.
+  # `scan --inline-rules` parses once and returns every rule's hits as JSON
+  # (~13ms). The excerpt lines rebuilt from .file/.range/.lines below are
+  # byte-identical to what `run -p` printed for every pattern rule. The one
+  # exception is swallow-bare, which had to become a catch_clause match (see its
+  # comment): its excerpt is the catch clause rather than the whole try
+  # statement, which is narrower, not malformed.
+  #
+  # severity is `warning` on purpose: `scan` exits non-zero when an ERROR-level
+  # rule matches, which would be indistinguishable from a crashed tool. At
+  # warning level both a clean and a matching run exit 0, so a non-zero exit (or
+  # any stderr) still means the tool genuinely broke — preserving the fail-loud
+  # contract the old per-pattern ast_scan had.
+  ts_ast_err_file="$(mktemp)"
+  ts_ast_rules=$(cat <<'TS_AST_RULES'
+id: empty-catch
+language: ts
+severity: warning
+message: empty catch
+rule:
+  pattern: 'try { $$$ } catch ($_) { }'
+---
+id: empty-catch-noarg
+language: ts
+severity: warning
+message: empty catch (no binding)
+rule:
+  pattern: 'try { $$$ } catch { }'
+---
+id: empty-catch-handler
+language: ts
+severity: warning
+message: empty promise catch handler
+rule:
+  pattern: '$_.catch(() => { })'
+---
+id: null-catch-handler
+language: ts
+severity: warning
+message: promise catch handler returning null
+rule:
+  pattern: '$_.catch(() => null)'
+---
+id: undef-catch-handler
+language: ts
+severity: warning
+message: promise catch handler returning undefined
+rule:
+  pattern: '$_.catch(() => undefined)'
+---
+id: swallow-null-arg
+language: ts
+severity: warning
+message: catch returns null
+rule:
+  pattern: 'try { $$$ } catch ($_) { return null }'
+---
+id: swallow-undef-arg
+language: ts
+severity: warning
+message: catch returns undefined
+rule:
+  pattern: 'try { $$$ } catch ($_) { return undefined }'
+---
+id: swallow-null
+language: ts
+severity: warning
+message: catch returns null (no binding)
+rule:
+  pattern: 'try { $$$ } catch { return null }'
+---
+id: swallow-undef
+language: ts
+severity: warning
+message: catch returns undefined (no binding)
+rule:
+  pattern: 'try { $$$ } catch { return undefined }'
+---
+# A bare `return` in an ast-grep pattern acts as a WILDCARD over the optional
+# argument: `catch { return }` also matched `return []`, `return 42` and
+# `return null`, i.e. every non-nullish fallback got reported as "returns a
+# nullish value". Match the catch clause itself, then require that its single
+# return statement carries no argument at all.
+id: swallow-bare
+language: ts
+severity: warning
+message: catch returns nothing
+rule:
+  all:
+    - any:
+        - pattern:
+            context: 'try {} catch { return }'
+            selector: catch_clause
+        - pattern:
+            context: 'try {} catch ($_) { return }'
+            selector: catch_clause
+    - not:
+        has:
+          stopBy: end
+          kind: return_statement
+          has:
+            stopBy: neighbor
+            pattern: $X
+---
+id: throw-empty-error
+language: ts
+severity: warning
+message: throw new Error() with no message
+rule:
+  pattern: 'throw new Error()'
+---
+id: throw-string
+language: ts
+severity: warning
+message: throw of a string literal
+rule:
+  pattern: 'throw "$S"'
+---
+id: throw-template
+language: ts
+severity: warning
+message: throw of a template literal
+rule:
+  pattern: 'throw `$S`'
+TS_AST_RULES
+)
+
+  ts_ast_failed=0
+  ts_ast_fail_detail=""
+  ts_ast_lines=""
+  ts_ast_json=$(ast-grep scan --inline-rules "$ts_ast_rules" --json "$FILE_PATH" 2>"$ts_ast_err_file")
+  ts_ast_rc=$?
+  # Flatten every hit to "<ruleId>\t<file>:<line>:<source line>", one output line
+  # per matched source line — the exact shape `run -p` emitted, now tagged with
+  # the rule that produced it.
+  #
+  # Two distinct failure modes, reported distinctly: ast-grep itself broke, or it
+  # exited 0 and returned something that is not the documented JSON array. Both
+  # mean the rules could not be verified, but collapsing them into one message
+  # sends the reader to the wrong tool.
+  ts_ast_fail_stage=""
+  if [[ "$ts_ast_rc" -ne 0 || -s "$ts_ast_err_file" ]]; then
+    ts_ast_failed=1
+    ts_ast_fail_stage="ast-grep"
+  elif ! ts_ast_lines=$(printf '%s' "$ts_ast_json" | jq -r '
+        .[] | . as $m
+        | ((($m.lines // "") | split("\n")) | to_entries[])
+        | "\($m.ruleId)\t\($m.file):\($m.range.start.line + 1 + .key):\(.value)"
+      ' 2>/dev/null); then
+    ts_ast_failed=1
+    ts_ast_fail_stage="jq"
+    ts_ast_lines=""
+  fi
+  if [[ "$ts_ast_failed" -ne 0 ]]; then
+    # Exit code plus the first stderr line (capped) so the agent learns WHAT
+    # broke, not just THAT it did.
+    ts_ast_stderr_first=$(head -n 1 "$ts_ast_err_file" 2>/dev/null | cut -c1-200)
+    if [[ "$ts_ast_fail_stage" == "jq" ]]; then
+      ts_ast_fail_detail="ast-grep exited 0 but its output did not parse as the documented JSON array"
+    else
+      ts_ast_fail_detail="ast-grep exit ${ts_ast_rc}${ts_ast_stderr_first:+: $ts_ast_stderr_first}"
+    fi
+  fi
+
+  # ts_join_hits BLOCK... — concatenate non-empty hit blocks into $TS_JOINED with
+  # one newline between them. Each block comes from a $(...) capture, which strips
+  # the trailing newline, so plain concatenation glued one block's last line onto
+  # the next block's first line. Sets a variable instead of printing to avoid a
+  # fork on a path that runs after every edit.
+  ts_join_hits() {
+    local _part
+    TS_JOINED=""
+    for _part in "$@"; do
+      [ -z "$_part" ] && continue
+      [ -n "$TS_JOINED" ] && TS_JOINED="${TS_JOINED}"$'\n'
+      TS_JOINED="${TS_JOINED}${_part}"
+    done
+  }
+
+  # ts_ast_hits RULE_ID LIMIT — this rule's excerpt lines, capped like before.
+  ts_ast_hits() {
+    local _id="$1" _limit="$2" _row _rest
+    [ -n "$ts_ast_lines" ] || return 0
+    while IFS=$'\t' read -r _row _rest; do
+      [ "$_row" = "$_id" ] && printf '%s\n' "$_rest"
+    done <<< "$ts_ast_lines" | head -n "$_limit"
+  }
+
+  # Empty catch — swallowed error
+  EMPTY_CATCH=$(ts_ast_hits empty-catch 3)
+  EMPTY_CATCH_NOARG=$(ts_ast_hits empty-catch-noarg 3)
+  if [[ -n "$EMPTY_CATCH" || -n "$EMPTY_CATCH_NOARG" ]]; then
+    ts_join_hits "$EMPTY_CATCH" "$EMPTY_CATCH_NOARG"
+    add_error "Empty catch block in $FILE_PATH — handle the error or rethrow; do not swallow"$'\n'"${TS_JOINED}"
+  fi
+
+  # Silent promise rejection — .catch(() => {}) / .catch(() => null)
+  EMPTY_CATCH_HANDLER=$(ts_ast_hits empty-catch-handler 3)
+  NULL_CATCH_HANDLER=$(ts_ast_hits null-catch-handler 3)
+  UNDEF_CATCH_HANDLER=$(ts_ast_hits undef-catch-handler 3)
+  if [[ -n "$EMPTY_CATCH_HANDLER" || -n "$NULL_CATCH_HANDLER" || -n "$UNDEF_CATCH_HANDLER" ]]; then
+    ts_join_hits "$EMPTY_CATCH_HANDLER" "$NULL_CATCH_HANDLER" "$UNDEF_CATCH_HANDLER"
+    add_error "Silent promise rejection in $FILE_PATH — log or rethrow the error"$'\n'"${TS_JOINED}"
+  fi
+
+  # Swallow via a catch that just returns a nullish value — error vanishes.
+  SWALLOW_CATCH=""
+  for _rule in swallow-null-arg swallow-undef-arg \
+               swallow-null swallow-undef swallow-bare; do
+    _h=$(ts_ast_hits "$_rule" 2)
+    ts_join_hits "$SWALLOW_CATCH" "$_h"
+    SWALLOW_CATCH="$TS_JOINED"
+  done
+  if [[ -n "$SWALLOW_CATCH" ]]; then
+    add_error "Catch swallows the error by returning a nullish value in $FILE_PATH — handle, log, or rethrow it"$'\n'"${SWALLOW_CATCH}"
+  fi
+
+  # throw new Error() with no message
+  THROW_EMPTY_ERROR=$(ts_ast_hits throw-empty-error 3)
+  if [[ -n "$THROW_EMPTY_ERROR" ]]; then
+    add_error "throw new Error() with no message in $FILE_PATH — include a descriptive message"$'\n'"${THROW_EMPTY_ERROR}"
+  fi
+
+  # throw of string literal — breaks instanceof Error
+  THROW_STRING=$(ts_ast_hits throw-string 3)
+  THROW_TSTR=$(ts_ast_hits throw-template 3)
+  if [[ -n "$THROW_STRING" || -n "$THROW_TSTR" ]]; then
+    ts_join_hits "$THROW_STRING" "$THROW_TSTR"
+    add_error "throw of string literal in $FILE_PATH — throw an Error (or subclass) instead"$'\n'"${TS_JOINED}"
+  fi
+
+  rm -f "$ts_ast_err_file"
+  if [[ "$ts_ast_failed" -ne 0 ]]; then
+    add_error "ast-grep failed while scanning $FILE_PATH — ${ts_ast_fail_detail:-unknown error}; error-handling rules could not be verified. Fix the tool/file and re-edit"
+  fi
+fi

package/plugins/ts-quality/hooks/concerns/80-throw-literal.sh

@@ -0,0 +1,23 @@
+# throw of numeric/boolean/null/undefined literal — match anywhere on line,
+# strip line comments and inline /* */ blocks first so `// throw 5` style
+# annotations and example code in comments don't trigger.
+THROW_LITERAL=$(awk '
+  {
+    line = $0
+    # Strip /* ... */ blocks on a single line (heuristic; multi-line not handled).
+    # Greedy on purpose: a line with TWO inline blocks sandwiching real code
+    # (`/* a */ throw 5; /* b */`) erases the `throw 5` and misses it. Vanishingly
+    # rare; accepted over a count_code_lines-style state machine here.
+    gsub(/\/\*.*\*\//, "", line)
+    # Strip // line comments (heuristic — does not preserve `//` inside a string,
+    # which is rare in real code).
+    sub(/\/\/.*$/, "", line)
+    if (match(line, /(^|[^a-zA-Z_$])throw[ \t]+(-?[0-9]+(\.[0-9]+)?|null|undefined|true|false)([ \t]|;|}|$)/)) {
+      print NR ": " $0
+    }
+  }
+' "$FILE_PATH" 2>/dev/null | head -3)
+if [[ -n "$THROW_LITERAL" ]]; then
+  add_error "throw of non-Error literal in $FILE_PATH — throw an Error (or subclass) instead"$'\n'"${THROW_LITERAL}"
+fi
+

package/plugins/ts-quality/hooks/concerns/85-no-mocks.sh

@@ -0,0 +1,109 @@
+# Check: no-mocks — tests must exercise real data/services, not mocked stand-ins.
+# Scope: test files only — *.test.ts(x) / *.spec.ts(x), or any file under a
+# __tests__/ directory — excluding e2e specs, which follow the platform's own
+# fixture conventions (same carve-out as 20-tests.sh / 65-suppression.sh).
+# Opt-out: lang.ts.noMocks=false in the merged config (default true — blocking).
+if [[ "$FILE_PATH" != */e2e/* ]] && { [[ "$FILE_PATH" =~ \.(test|spec)\.(ts|tsx)$ ]] || [[ "$FILE_PATH" == */__tests__/* ]]; } \
+   && [ "$(quality_flag ts noMocks true)" = "true" ]; then
+
+  NOMOCKS_LINES=""
+  if command -v ast-grep >/dev/null 2>&1; then
+    # ONE ast-grep process for all the mock-call rules below, same shape as
+    # 78-error-ast.sh: `scan --inline-rules` parses once and returns every
+    # rule's hits as JSON. severity is `warning` on purpose — `scan` exits
+    # non-zero on an ERROR-level match, which would be indistinguishable from a
+    # crashed tool; at `warning` a non-zero exit (or any stderr) always means
+    # the tool itself broke.
+    ts_nomocks_err_file="$(mktemp)"
+    ts_nomocks_rules=$(cat <<'TS_NOMOCKS_RULES'
+id: jest-mock
+language: ts
+severity: warning
+message: jest.mock() call
+rule:
+  pattern: jest.mock($$$)
+---
+id: vi-mock
+language: ts
+severity: warning
+message: vi.mock() call
+rule:
+  pattern: vi.mock($$$)
+---
+id: jest-fn
+language: ts
+severity: warning
+message: jest.fn() call
+rule:
+  pattern: jest.fn($$$)
+---
+id: vi-fn
+language: ts
+severity: warning
+message: vi.fn() call
+rule:
+  pattern: vi.fn($$$)
+---
+id: sinon-method
+language: ts
+severity: warning
+message: sinon mock method call
+rule:
+  pattern: sinon.$M($$$)
+TS_NOMOCKS_RULES
+)
+
+    ts_nomocks_failed=0
+    ts_nomocks_fail_stage=""
+    ts_nomocks_json=$(ast-grep scan --inline-rules "$ts_nomocks_rules" --json "$FILE_PATH" 2>"$ts_nomocks_err_file")
+    ts_nomocks_rc=$?
+    if [[ "$ts_nomocks_rc" -ne 0 || -s "$ts_nomocks_err_file" ]]; then
+      ts_nomocks_failed=1
+      ts_nomocks_fail_stage="ast-grep"
+    elif [[ -z "$(printf '%s' "$ts_nomocks_json" | tr -d '[:space:]')" ]]; then
+      # ast-grep exited 0 with genuinely empty stdout — jq also exits 0 on
+      # empty input with empty output, so left unchecked this would be
+      # indistinguishable from a clean "[]" scan and silently swallow a real
+      # breakage as "no hits". A well-behaved scan always emits at least "[]".
+      ts_nomocks_failed=1
+      ts_nomocks_fail_stage="empty-output"
+    elif ! NOMOCKS_LINES=$(printf '%s' "$ts_nomocks_json" | jq -r '
+          .[] | . as $m
+          | ((($m.lines // "") | split("\n")) | to_entries[])
+          | "\($m.ruleId)\t\($m.file):\($m.range.start.line + 1 + .key):\(.value)"
+        ' 2>/dev/null); then
+      ts_nomocks_failed=1
+      ts_nomocks_fail_stage="jq"
+      NOMOCKS_LINES=""
+    fi
+
+    if [[ "$ts_nomocks_failed" -ne 0 ]]; then
+      ts_nomocks_stderr_first=$(head -n 1 "$ts_nomocks_err_file" 2>/dev/null | cut -c1-200)
+      if [[ "$ts_nomocks_fail_stage" == "jq" ]]; then
+        add_error "ast-grep failed while scanning $FILE_PATH for mocks — its output did not parse as the documented JSON array; no-mocks rule could not be verified. Fix the tool/file and re-edit"
+      elif [[ "$ts_nomocks_fail_stage" == "empty-output" ]]; then
+        add_error "ast-grep failed while scanning $FILE_PATH for mocks — exited 0 with empty output (expected at least the JSON array \"[]\"); no-mocks rule could not be verified. Fix the tool/file and re-edit"
+      else
+        add_error "ast-grep failed while scanning $FILE_PATH for mocks — exit ${ts_nomocks_rc}${ts_nomocks_stderr_first:+: $ts_nomocks_stderr_first}; no-mocks rule could not be verified. Fix the tool/file and re-edit"
+      fi
+    fi
+    rm -f "$ts_nomocks_err_file"
+
+    if [[ -n "$NOMOCKS_LINES" ]]; then
+      # Strip the leading "<ruleId>\t" — only the excerpt (file:line:source) is shown.
+      NOMOCKS_EXCERPT=$(printf '%s\n' "$NOMOCKS_LINES" | cut -f2- | head -5)
+      add_error "Mocked test double in $FILE_PATH — tests must exercise real data/services, not mocks/stubs (jest.mock/vi.mock/jest.fn/vi.fn/sinon)"$'\n'"${NOMOCKS_EXCERPT}"
+    fi
+  fi
+  # ast-grep absent: the mock-call rules above are skipped, same fail-soft
+  # posture as 78-error-ast.sh — but the ts-mockito import check below needs no
+  # external tool, so it still runs.
+
+  # ts-mockito is a whole mocking LIBRARY imported by name — a plain grep for
+  # the import specifier, same idiom as the `../` import check in 10-imports.sh
+  # (quote-agnostic via a bracket class).
+  if grep -qE "from[[:space:]]+[\"']ts-mockito[\"']" "$FILE_PATH" 2>/dev/null; then
+    add_error "Import from ts-mockito in $FILE_PATH — tests must exercise real data/services, not mocks/stubs"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/90-duplication.sh

@@ -0,0 +1,30 @@
+# Check: code duplication (jscpd, scoped to package directory)
+# Advisory only — warns but does NOT block (pre-existing duplication is not the editor's fault).
+DUPLICATION_WARNING=""
+if [[ -z "$MESSAGES" && ! "$FILE_PATH" =~ \.(test|spec)\. ]]; then
+  _pkg_rel="${FILE_PATH#"$PROJECT_ROOT"/}"
+  _pkg_dir=""
+  if [[ "$_pkg_rel" == apps/* || "$_pkg_rel" == packages/* ]]; then
+    _pkg_dir="$PROJECT_ROOT/$(echo "$_pkg_rel" | cut -d/ -f1-2)"
+  fi
+  # jscpd runner — use whatever package manager runner is available.
+  jscpd_runner=""
+  case "$pm" in
+    bun)  command -v bunx >/dev/null 2>&1 && jscpd_runner="bunx jscpd" ;;
+    pnpm) command -v pnpm >/dev/null 2>&1 && jscpd_runner="pnpm dlx jscpd" ;;
+    yarn) command -v yarn >/dev/null 2>&1 && jscpd_runner="yarn dlx jscpd" ;;
+    npm)  command -v npx  >/dev/null 2>&1 && jscpd_runner="npx jscpd" ;;
+  esac
+  if [[ -n "$_pkg_dir" && -d "$_pkg_dir" && -f "$PROJECT_ROOT/.jscpd.json" && -n "$jscpd_runner" ]]; then
+    # shellcheck disable=SC2086  # $jscpd_runner is a multi-word command (e.g. "pnpm dlx jscpd") — intentional word split
+    _jscpd_out=$(timeout 10 $jscpd_runner "$_pkg_dir" \
+      --config "$PROJECT_ROOT/.jscpd.json" \
+      2>&1 || true)
+    _file_base=$(basename "$FILE_PATH")
+    if echo "$_jscpd_out" | grep -qi "found.*clone\|duplicat" && \
+       echo "$_jscpd_out" | grep -q "$_file_base"; then
+      DUPLICATION_WARNING="Code duplication detected involving $FILE_PATH — deduplicate or run '$TYPECHECK_CMD' before commit"
+    fi
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/92-docs.sh

@@ -0,0 +1,36 @@
+# --- Docs (soft advisory, never blocks) ---
+# Exported API should carry a concise JSDoc. Advisory only — kept out of
+# MESSAGES so it never sets the failing gate. Skips tests, barrels, declarations.
+DOC_ADVISORY=""
+_ts_base="$(basename "$FILE_PATH")"
+if [[ ! "$FILE_PATH" =~ \.(test|spec)\.(ts|tsx)$ && ! "$FILE_PATH" =~ \.d\.ts$ \
+      && "$_ts_base" != "index.ts" && "$_ts_base" != "index.tsx" ]]; then
+  _undoc=$(awk '
+    /^[[:space:]]*$/   { next }   # blanks do not reset the doc context
+    /^[[:space:]]*\/\// { next }  # line comments / pragmas sit between doc and export
+    {
+      if ($0 ~ /^export (async )?function / || $0 ~ /^export (abstract )?class / \
+          || $0 ~ /^export default / || $0 ~ /^export (const|interface|type|enum) [A-Z]/ \
+          || $0 ~ /^export const [a-z_][A-Za-z0-9_]* = (async )?(\(|function)/) {
+        if (prev !~ /\*\/[[:space:]]*$/ && prev !~ /^[[:space:]]*\/\*\*/) printf "%d: %s\n", NR, $0
+      }
+      prev=$0
+    }
+  ' "$FILE_PATH" 2>/dev/null | head -3)
+  if [[ -n "$_undoc" ]]; then
+    DOC_ADVISORY="Exported API missing a JSDoc in $FILE_PATH — add a concise /** */ doc:"$'\n'"${_undoc}"
+  fi
+  _verbose_doc=$(awk '
+    !inb && /\/\*\*/ { inb=1; start=NR; cnt=0 }   # !inb: a /** in prose must not reset the count mid-block
+    inb { cnt++ }
+    inb && /\*\// { if (cnt>12) printf "%d: JSDoc block is %d lines — trim to the essentials\n", start, cnt; inb=0 }
+  ' "$FILE_PATH" 2>/dev/null | head -2)
+  if [[ -n "$_verbose_doc" ]]; then
+    # Separator appended on its own line: ANSI-C quoting is NOT honored inside a
+    # ${var:+word} expansion, so the old one-liner would have emitted a literal
+    # $'\n' there.
+    [[ -n "$DOC_ADVISORY" ]] && DOC_ADVISORY="${DOC_ADVISORY}"$'\n'
+    DOC_ADVISORY="${DOC_ADVISORY}Verbose JSDoc in $FILE_PATH — docs must be present but concise:"$'\n'"${_verbose_doc}"
+  fi
+fi
+

package/plugins/ts-quality/hooks/concerns/94-handler.sh

@@ -0,0 +1,15 @@
+# Handler-presence advisory (non-blocking): the file awaits but has no try/catch
+# and no .catch anywhere — rejections may be unhandled. Advisory, not a block,
+# because the handler can legitimately live in every caller.
+ERR_ADVISORY=""
+# Comment-only lines are stripped first: a commented-out `await` must not raise
+# the advisory, and a `try`/`.catch` that only appears in a comment must not
+# suppress it. (`*`-prefixed lines are JSDoc/block-comment continuations; a
+# CODE line starting with `*` — a multiplication continuation holding the only
+# await — is stripped too, accepted: advisory-only, fails open.)
+_ts_noncomment=$(grep -vE '^[[:space:]]*(//|/\*|\*)' "$FILE_PATH" 2>/dev/null)
+if printf '%s\n' "$_ts_noncomment" | grep -qE '\bawait[[:space:]]' \
+   && ! printf '%s\n' "$_ts_noncomment" | grep -qE '\btry\b|\.catch\('; then
+  ERR_ADVISORY="Async code in $FILE_PATH uses await with no try/catch or .catch in the file — ensure rejections are handled here or by every caller."
+fi
+

package/plugins/ts-quality/hooks/concerns/99-finalize.sh

@@ -0,0 +1,46 @@
+# --- Output ---
+
+if [[ -n "$MESSAGES" ]]; then
+  # Record this file's violation in the gate status file (entry keyed by file
+  # path — does not clobber failures recorded for other files or hooks).
+  GATE_DIR="$(toolu_project_state_root "$PROJECT_ROOT")"
+  GATE_FILE="$GATE_DIR/quality-gate-status.json"
+  mkdir -p "$GATE_DIR"
+  gate_record_failure "$GATE_FILE" "$FILE_PATH" "ts-quality-hook" \
+    "Post-edit quality violation(s) detected" "$MESSAGES"
+
+  jq -n --arg ctx "$MESSAGES" '{
+    "hookSpecificOutput": {
+      "hookEventName": "PostToolUse",
+      "additionalContext": ("QUALITY VIOLATION — fix before proceeding:\n" + $ctx)
+    }
+  }'
+else
+  # Clear this file's entry now that it passes (only if this hook set it).
+  # Other files' failures stay recorded; the gate only flips to passing when
+  # no entry remains.
+  GATE_FILE="$(toolu_project_state_root "$PROJECT_ROOT")/quality-gate-status.json"
+  gate_clear_file "$GATE_FILE" "$FILE_PATH" "ts-quality-hook"
+
+  # Advisories (non-blocking — no gate write). Duplication + docs combined into
+  # a single additionalContext so the hook emits exactly one JSON object.
+  # Joined with REAL newlines. `${ADVISORY:+$ADVISORY\n}` appended a literal
+  # backslash-n (and ANSI-C quoting is not honored inside a :+ expansion either),
+  # so stacked advisories reached the agent as one run-on line.
+  ADVISORY="$DUPLICATION_WARNING"
+  for _adv in "$DOC_ADVISORY" "$ERR_ADVISORY"; do
+    [[ -z "$_adv" ]] && continue
+    [[ -n "$ADVISORY" ]] && ADVISORY="${ADVISORY}"$'\n'
+    ADVISORY="${ADVISORY}${_adv}"
+  done
+  if [[ -n "$ADVISORY" ]]; then
+    jq -n --arg ctx "$ADVISORY" '{
+      "hookSpecificOutput": {
+        "hookEventName": "PostToolUse",
+        "additionalContext": $ctx
+      }
+    }'
+  fi
+fi
+
+exit 0

package/plugins/ts-quality/hooks/hooks.json

@@ -0,0 +1,19 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/register.sh"
+          },
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT}/hooks/check-toolu.sh"
+          }
+        ]
+      }
+    ]
+  }
+}