@yeison.restrepo.r/code-conductor 1.23.0

package/project-template/.claude/commands/cc-resume.md

@@ -0,0 +1,142 @@
+---
+description: "(Conductor) Restore full session context in a fresh Claude Code session"
+---
+
+## Step 1 — Verify project initialization
+
+Check if `CLAUDE.md` exists in the current directory.
+
+- If **absent**: stop immediately and output — `"Project not initialized. Run /cc-init first."`
+- If **present but `## Project Identity` fields are all empty**: continue and include this warning at the top of the final report: `"⚠ Project identity incomplete — run /cc-init to fill it in."`
+
+## Step 2 — Read project identity
+
+Read `CLAUDE.md`. Extract:
+- **Name** (from `- **Name:**`)
+- **Description** (from `- **Description:**`)
+- **Stack** (from `- **Stack:**`)
+- **Language** (from `- **Language:**`)
+
+Use `—` for any missing fields.
+
+**Auto-fill blank command fields (BUG-015):** After reading the identity fields, check if any of `Build`, `Test`, `Lint`, `Format`, `Setup` in CLAUDE.md are still `<command>` (any case) or blank after the colon. If at least one is blank AND `scripts/detect-stack.mjs` exists at `$PWD`:
+
+1. Run `node scripts/detect-stack.mjs "$PWD"` and capture the JSON output.
+2. For each blank/placeholder command field, if the JSON contains a matching key (`build`, `test`, `lint`, `format`, `setup`), replace the placeholder with the detected value using a single `Edit` call.
+3. Never overwrite a field that already contains a non-placeholder value.
+4. If all five fields are already populated, or if `scripts/detect-stack.mjs` does not exist, skip this step silently.
+5. If the JSON is `{}` or node exits non-zero, skip silently.
+
+Re-read the updated CLAUDE.md fields after this step so the session resume report reflects the filled values.
+
+## Step 3 — Read project memory
+
+Read `.claude/memory/project.md`.
+
+Extract:
+- The content of the most recent `## Checkpoint [...]` block (3 bullets max)
+- Any entries under `## Active Conventions`
+- Any entries under `## Technical Debt`
+
+If the file is absent or has no `## Checkpoint` block, note `"No checkpoints yet"`.
+
+## Step 4 — Read personal preferences
+
+Read `.claude/memory/personal.md`. Extract developer preferences (verbosity, shortcuts, habits).
+
+If the file is absent, skip silently.
+
+## Step 5 — Find latest spec
+
+List files in `docs/superpowers/specs/`. Select the file with the most recent modification time (`mtime`). Extract its first `#` heading as a one-line summary.
+
+If the directory is absent or empty, use `none`.
+
+## Step 6 — Find latest plan
+
+List files in `docs/superpowers/plans/`. Select the file with the most recent modification time (`mtime`). Extract its first `#` heading as a one-line summary.
+
+If the directory is absent or empty, use `none`.
+
+## Step 6a: Scan active plan for in-progress and failed tasks
+
+If a plan file was found in Step 6, scan it for active-state markers:
+
+Run `Grep` with:
+- `pattern`: `\[>\]|\[!\]`
+- `path`: the plan file path found in Step 6
+- `output_mode`: `content`
+
+Collect results:
+- Lines containing `[>]` are **in-progress tasks** (execution interrupted mid-flight)
+- Lines containing `[!]` are **failed tasks** (execution halted; manual resolution required)
+
+Extract the task ID (e.g. `[T-001-A]`) from each matching line. Store counts and IDs for the report.
+
+If no `[>]` or `[!]` lines are found, skip these fields in the report.
+
+## Step 7 — Read git state
+
+Run:
+
+```bash
+git log --oneline -10
+git status --short
+git branch --show-current
+```
+
+Count the lines in the `git status --short` output — each line represents one uncommitted file. If the output is empty, the count is `"none"`.
+
+If not inside a git repository, skip silently.
+
+## Step 8 — Check for updates
+
+Read the local installed version from `~/.claude/memory/conductor-version.md`.
+
+Fetch the remote version:
+
+```bash
+curl -fsSL --max-time 5 https://raw.githubusercontent.com/yeisonrestrepo/code-conductor/main/VERSION 2>/dev/null
+```
+
+If the remote version differs from the local version, store this notice for the report:
+`"⚡ code-conductor [remote version] available — run: bash install.sh to update"`
+
+If the fetch fails or times out, skip silently. Do not stop the session.
+
+## Step 9 — Render report
+
+Output this report, populating each field from the steps above:
+
+```
+## Session Resume — [Name] · [YYYY-MM-DD]
+
+[⚠ Project identity incomplete — run /cc-init to fill it in.]  ← include only if applicable
+[⚡ code-conductor X.Y.Z available — run: bash install.sh to update]  ← include only if applicable
+
+### Active Work
+Spec:  [spec filename] — [spec title]
+Plan:  [plan filename] — [plan title]
+In-progress: [count] task(s) - [task IDs]   (include only if [>] tasks were found in Step 6a)
+Failed:      [count] task(s) - [task IDs]   (include only if [!] tasks were found in Step 6a)
+
+### Recent Commits
+[git log --oneline -10 output]
+
+### Open Changes
+Branch: [branch name]  ·  Uncommitted: [count, or "none"]
+
+### Memory Highlights
+[latest checkpoint block — 3 bullets max]
+
+### Session Preferences
+[personal.md relevant lines]
+```
+
+## Step 10 — Load stack profile
+
+Run `/cc-stack` to detect and load the matching stack profile.
+
+If `/cc-stack` cannot detect a stack or reports an error, append this line to the report:
+`"⚠ Stack could not be detected — run /cc-stack manually."`
+Do not stop the session.

package/project-template/.claude/commands/cc-review.md

@@ -0,0 +1,77 @@
+---
+description: "(Conductor) Review code changes against spec and standards"
+---
+
+## Phase entry - Handoff enforcement
+
+Before doing anything else, perform this blocking check:
+
+1. Count the number of turns in the current conversation history.
+2. If turn count exceeds 5, halt immediately and output:
+
+   > "Phase boundary detected. Please execute /compact to clear history before proceeding."
+
+   Do not start any review tasks. Enter standby. Wait for the user to confirm `/compact` has been run before continuing.
+
+3. If turn count ≤ 5 AND `.claude/memory/session-snapshot.md` exists, proceed to the Destructive Read Invariant below.
+4. If turn count ≤ 5 AND `.claude/memory/session-snapshot.md` is absent, skip the Destructive Read Invariant and proceed directly - no snapshot context available (read-if-present fallback).
+
+## Phase entry - Destructive Read Invariant
+
+Applies only when snapshot exists (step 3 above).
+
+1. Read `.claude/memory/session-snapshot.md` into context.
+2. Delete the file immediately.
+3. Use the snapshot contents as the starting context for this phase.
+
+If the file cannot be deleted after reading, report the error and halt.
+
+---
+
+## Phase 0 — Skill activation
+
+Before doing anything else, invoke both skills in order:
+
+```
+Skill({ skill: "subagent-driven-development", args: "$ARGUMENTS" })
+Skill({ skill: "critical-review" })
+```
+
+`subagent-driven-development` spawns one `Explore` sub-agent per review layer (Critical / Important / Suggestions) — each returns findings, the main context aggregates only. `critical-review` then runs Phases 2–4: Adversarial Review (RESILIENCE / EFFICIENCY / FRICTION checks), Self-Correction Loop for any weakness found, and the mandatory `[VALIDATION]` section at the end.
+
+---
+
+Determine what to review:
+- No argument → `git diff HEAD`
+- File path → review that file
+- Directory → review all changed files in that directory
+
+Review in three layers:
+
+### 🔴 Critical — Blocks merge
+Issues that will cause bugs, security vulnerabilities, data loss, or breaking changes:
+- Logic errors or incorrect algorithm
+- SQL injection, XSS, hardcoded secrets, missing auth checks
+- Mutations that bypass validation
+- Breaking changes to public API without versioning
+
+### 🟡 Important — Must fix before shipping
+Issues that degrade quality or create risk:
+- Missing error handling for real failure cases
+- Missing tests for new behavior
+- Convention violations that will confuse future readers
+- N+1 queries or obvious performance problems
+- Missing input validation at system boundaries
+
+### 🟢 Suggestions — Optional improvements
+Style, clarity, or minor improvements that would be nice but don't block the merge.
+
+---
+
+**Verdict:**
+- `APPROVED` — no critical or important issues
+- `APPROVED WITH CHANGES` — important issues found, fix before shipping
+- `BLOCKED` — critical issues found, do not merge
+
+After showing the report, offer:
+"Want me to auto-fix the critical and important issues?"

package/project-template/.claude/commands/cc-spec.md

@@ -0,0 +1,138 @@
+---
+description: "(Conductor) Define the problem and generate an approved spec"
+---
+
+## Phase entry - Resume Read
+
+Before doing anything else, restore any stored context for the current commit by running `scripts/resume-read.mjs`. It resolves the current git hash, prefers a valid DB snapshot (`conductor-db get-snapshot`), falls back to the `.claude/memory/session-snapshot.json` handoff file, and prints a `RESUME_HIT` block on a hit / nothing on a miss. Capture its stdout **and** its exit code with the canonical per-platform form (each first probes for `node` and treats its absence as a clean miss, never an error):
+
+- **Unix / Git Bash:**
+  ```sh
+  if command -v node >/dev/null 2>&1; then
+    resume_out="$(node scripts/resume-read.mjs 2>>.conductor/last-write.log)"; resume_rc=$?
+  else resume_rc=3; resume_out=""; fi
+  ```
+- **PowerShell:**
+  ```powershell
+  if (Get-Command node -ErrorAction SilentlyContinue) {
+    $__eap = $ErrorActionPreference; $ErrorActionPreference = 'Continue'
+    if (Test-Path variable:PSNativeCommandUseErrorActionPreference) {
+      $__nap = $PSNativeCommandUseErrorActionPreference; $PSNativeCommandUseErrorActionPreference = $false
+    }
+    try {
+      $resume_out = node scripts/resume-read.mjs 2>> .conductor/last-write.log; $resume_rc = $LASTEXITCODE
+    } catch { $resume_rc = 3; $resume_out = "" }
+    finally {
+      $ErrorActionPreference = $__eap
+      if (Test-Path variable:__nap) { $PSNativeCommandUseErrorActionPreference = $__nap }
+    }
+  } else { $resume_rc = 3; $resume_out = "" }
+  ```
+
+Branch on `resume_rc` - **only `0` and `4` are meaningful; every other code proceeds fresh:**
+
+- **`0`** → parse the captured block and adopt it as this phase's starting context, then echo one banner to the user: `> Resumed from stored snapshot @ <commit> (phase: <phase>)`, appending ` (checkpoint prose available)` when the block reports `prose: available`. Parsing (the command owns normalization): split on `\n`; strip a trailing `\r` from every line; drop leading/trailing wholly-blank lines; require `lines[0].trim() === 'RESUME_HIT'` (anything else = miss); `key: value` lines split on the first `': '` (both sides trimmed); the `pending:` block is every subsequent `^\s*-\s+` line up to the first blank line or EOF, each item trimmed. Unknown keys are ignored. In PowerShell, `node …` binds `string[]` for multi-line output - normalize with `$lines = @($resume_out)`; a `$null`/empty capture with `resume_rc = 3` is a miss.
+- **`4`** → **operational halt.** Do not run this phase's normal work. Emit exactly: `SNAP_INVALID: corrupt handoff at .claude/memory/session-snapshot.json - inspect or remove it, then re-run.` and enter standby awaiting user action. The corrupt file is left on disk (the script did not delete it).
+- **`3` or any other code** → **proceed fresh** (clean miss, bypass, degrade, absent `node`, or any unexpected runtime code). Ignore the capture.
+
+`resume-read.mjs` writes its own trace lines to `.conductor/last-write.log` via `appendFileSync`; the `2>>` redirect above only sinks the incidental exit-4 halt reason away from the UI - it is not the trace channel.
+
+---
+
+## Phase 0 — Skill activation
+
+Before doing anything else, invoke both skills in order:
+
+```
+Skill({ skill: "brainstorming", args: "$ARGUMENTS" })
+Skill({ skill: "critical-review" })
+```
+
+`brainstorming` explores the problem space and surfaces unknowns. `critical-review` Phase 1 then runs the Pre-Flight Analysis (Happy Path / Failure Points / Boundary Conditions) on the proposed solution before the spec is written. Do not write the spec until both have completed.
+
+---
+
+## Spec Read Budget
+
+Before reading any file:
+1. Run Grep or Glob to locate relevant files. Skip this step only if the user's prompt names the exact file path.
+2. Apply the correct read rule based on file type:
+
+**Capped source files** - read the first 30 lines only (`offset` omitted, `limit: 30`). Starting at any offset other than the beginning is forbidden; if the first 30 lines are insufficient, defer the file. Multiple reads of the same file at any offset are forbidden.
+Extensions: `.ts` `.tsx` `.js` `.jsx` `.mjs` `.cjs` `.py` `.go` `.rs` `.java` `.rb` `.cs` `.cpp` `.c` `.h` `.swift` `.kt` `.php` `.sh` `.html` `.css` `.scss` `.sass` `.less` `.svelte` `.vue`
+
+**Exempt files** - may be read in full:
+Named manifests/config: `package.json` `package-lock.json` `yarn.lock` `pnpm-lock.yaml` `bun.lockb` `go.mod` `go.sum` `Cargo.toml` `Cargo.lock` `pyproject.toml` `requirements.txt` `Pipfile` `Gemfile` `Gemfile.lock` `tsconfig.json` `tsconfig.*.json` `.gitignore` `.eslintrc.*` `.prettierrc.*` `.env.example` `.nvmrc` `.node-version` `.python-version` `.tool-versions`
+Patterns: `*.yaml` `*.yml` `*.toml` `*.json` (config/manifest root files only - do not apply to data or generated JSON) `*.md` `CLAUDE.md` `Makefile` `Dockerfile` `Dockerfile.*` `*.dockerfile` `Jenkinsfile` `Procfile` `Brewfile`
+Note: `.env`, `.env.local`, `.env.*` (real values) are **not exempt** - the agent should not read them during spec phase.
+
+**Extensionless files** - exempt only when the exact name appears in the Named manifests/config list or Patterns above. All other extensionless files (including unknown dotfiles) default to capped.
+
+**Default** - any file not matched by the above rules defaults to capped.
+
+**Deferred reads** - if a capped source file cannot be understood from 30 lines, record it in `### Files Requiring Full Read (deferred to /cc-plan)` and move on. Do not slice-read it.
+
+---
+
+Search the codebase for existing code related to `$ARGUMENTS` before asking any questions.
+
+Run: `grep -r "$ARGUMENTS" src/ --include="*.{ts,js,py,java,go,rs}" -l 2>/dev/null | head -20`
+
+Then ask only for missing context. You need to understand:
+1. **Problem** — what is broken or missing?
+2. **User** — who is affected and what do they expect?
+3. **Constraints** — performance, security, backward compatibility?
+4. **Similar features** — anything in the codebase to stay consistent with?
+
+Generate a spec with these sections:
+
+## Problem
+[What is broken or missing, from the user's perspective]
+
+## Solution
+[What will be built, one paragraph]
+
+## Behavior
+
+### Main path
+[Step-by-step: what happens in the happy path]
+
+### Alternative paths
+[Edge cases the user might hit]
+
+### Error cases
+[What happens when things go wrong]
+
+## Acceptance Criteria
+- [ ] [Testable criterion]
+- [ ] [Testable criterion]
+
+## Out of Scope
+[Explicitly list what this spec does NOT cover]
+
+## System Impact
+[What existing code will be affected or needs to be reviewed]
+
+### Files Requiring Full Read (deferred to /cc-plan)
+
+_None. List any source files that could not be understood within the 30-line cap. /cc-plan will perform full reads of these files before task breakdown._
+
+## Complexity Estimate
+[S / M / L — with one sentence justification]
+
+---
+
+Wait for explicit approval before proceeding to `/cc-plan`.
+
+Once approved, append a summary to `.claude/memory/project.md` under:
+`## Spec: [name] [YYYY-MM-DD]`
+
+---
+
+## Phase exit
+
+Once the spec is approved and the summary has been appended to `.claude/memory/project.md`, instruct the user:
+
+> "Spec complete. Run `/cc-compact` now before starting `/cc-plan`."
+
+Do not proceed to plan phase without user confirmation that `/cc-compact` has been run.

package/project-template/.claude/commands/cc-test.md

@@ -0,0 +1,56 @@
+---
+description: "(Conductor) Analyze coverage gaps and write missing tests"
+---
+
+## Phase 0 — Skill activation
+
+Before doing anything else, invoke the `subagent-driven-development` Superpowers skill:
+
+```
+Skill({ skill: "subagent-driven-development", args: "$ARGUMENTS" })
+```
+
+Delegate coverage analysis to an `Explore` sub-agent. Delegate each test file to a separate sub-agent. The main context receives summaries and final file paths only.
+
+---
+
+Analyze coverage gaps first. Run:
+```bash
+# language-specific coverage command
+# e.g.: pnpm test --coverage | tail -20
+# e.g.: pytest --cov=src --cov-report=term-missing
+```
+
+Identify what is untested. Prioritize:
+1. Public functions and API endpoints with no tests
+2. Error paths and edge cases in critical paths
+3. Integration points between modules
+
+**Strategy:**
+- Unit: logic with no I/O dependencies
+- Integration: modules that talk to a database, API, or file system
+- E2E: user-facing flows (use Playwright)
+
+**All tests use AAA structure:**
+```
+// Arrange
+// Act
+// Assert
+```
+
+**Test names:** "should [expected behavior] when [condition]"
+
+**For E2E with Playwright:**
+1. Confirm the app is running: `curl -f http://localhost:3000 || echo "App not running"`
+2. Navigate to the relevant page
+3. Interact with the UI to trigger the flow
+4. Capture a screenshot
+5. Generate the Playwright test
+
+**Run tests after writing them.** Confirm before running.
+
+**Report:**
+- Passed: N
+- Failed: N (with failure messages)
+- Skipped: N
+- Coverage delta: before → after (if available)

package/project-template/.claude/hooks/context-guard.ps1

@@ -0,0 +1,55 @@
+try {
+  $root = if ($env:CC_PROJECT_ROOT) { $env:CC_PROJECT_ROOT } else { '.' }
+  $mem  = Join-Path $root '.claude\memory'
+  if ((Test-Path $mem) -and -not (Test-Path $mem -PathType Container)) { exit 0 }
+  New-Item -ItemType Directory -Force $mem -ErrorAction SilentlyContinue | Out-Null
+  if (-not (Test-Path $mem -PathType Container)) { exit 0 }
+
+  $critical = 25
+  $threshFile = Join-Path $mem 'context-threshold.txt'
+  try {
+    $raw = [System.IO.File]::ReadAllText($threshFile, [System.Text.Encoding]::UTF8)
+    $val = $raw.Split("`n")[0].TrimEnd("`r").Trim()
+    if ($val -match '^[1-9][0-9]*$') { $critical = [int]$val }
+  } catch { }
+
+  $count = 0
+  $countFile = Join-Path $mem 'turn-count.txt'
+  try {
+    $raw = [System.IO.File]::ReadAllText($countFile, [System.Text.Encoding]::UTF8)
+    $val = $raw.Split("`n")[0].TrimEnd("`r").Trim()
+    if ($val -match '^[0-9]+$') { $count = [int]$val }
+  } catch { }
+
+  $warning  = [Math]::Truncate($critical * 80 / 100)
+  $newCount = [Math]::Min($count + 1, 99999)
+
+  $target = Join-Path $mem 'turn-count.txt'
+  $tmp    = Join-Path $mem 'turn-count.txt.tmp'
+  $enc    = [System.Text.UTF8Encoding]::new($false)
+  [System.IO.File]::WriteAllText($tmp, "$newCount`n", $enc)
+  try {
+    [System.IO.File]::Replace($tmp, $target, $null)
+  } catch [System.IO.FileNotFoundException] {
+    try {
+      [System.IO.File]::Move($tmp, $target)
+    } catch {
+      Remove-Item $tmp -Force -ErrorAction SilentlyContinue
+      exit 0
+    }
+  }
+
+  if ($env:CC_GUARD_DEBUG) {
+    Write-Host "[context-guard] root=$root count=$newCount critical=$critical warning=$warning"
+  }
+
+  if ($newCount -ge 99999) {
+    "[!!] CONTEXT CRITICAL: Turn 99999/$critical (counter saturated) -- run /cc-compact NOW."
+  } elseif ($newCount -ge $critical) {
+    "[!!] CONTEXT CRITICAL: Turn $newCount/$critical -- run /cc-compact NOW before context overflows."
+  } elseif ($warning -gt 0 -and $newCount -ge $warning) {
+    "[!] CONTEXT WARNING: Turn $newCount/$critical -- consider running /cc-compact soon."
+  }
+} catch {
+  exit 0
+}

package/project-template/.claude/hooks/context-guard.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set +e
+main() {
+  _mem="${CC_PROJECT_ROOT:-.}/.claude/memory"
+  if [ -e "$_mem" ] && [ ! -d "$_mem" ]; then exit 0; fi
+  mkdir -p "$_mem" 2>/dev/null || exit 0
+
+  # Read threshold
+  _thresh=""
+  IFS= read -r _thresh < "${_mem}/context-threshold.txt" 2>/dev/null || _thresh=""
+  _thresh="${_thresh%$'\r'}"
+  _thresh="${_thresh#$'\xef\xbb\xbf'}"
+  [[ "$_thresh" =~ ^[1-9][0-9]*$ ]] || _thresh=25
+  critical=$_thresh
+  warning=$(( (critical * 80) / 100 ))
+
+  # Read count
+  _c=""
+  IFS= read -r _c < "${_mem}/turn-count.txt" 2>/dev/null || _c=""
+  _c="${_c%$'\r'}"
+  _c="${_c#$'\xef\xbb\xbf'}"
+  [[ "$_c" =~ ^[0-9]+$ ]] || _c=0
+  count=$_c
+
+  new_count=$(( count < 99999 ? count + 1 : 99999 ))
+
+  _target="${_mem}/turn-count.txt"
+  _tmp="${_mem}/turn-count.txt.tmp"
+  printf '%d\n' "$new_count" > "$_tmp" && mv -f "$_tmp" "$_target" \
+    || { rm -f "$_tmp" 2>/dev/null; exit 0; }
+
+  [ -n "${CC_GUARD_DEBUG:-}" ] && printf '[context-guard] root=%s count=%d critical=%d warning=%d\n' \
+    "${CC_PROJECT_ROOT:-.}" "$new_count" "$critical" "$warning" >&2
+
+  if [ "$new_count" -ge 99999 ]; then
+    printf '🚨 CONTEXT CRITICAL: Turn 99999/%d (counter saturated) — run /cc-compact NOW.\n' "$critical"
+  elif [ "$new_count" -ge "$critical" ]; then
+    printf '🚨 CONTEXT CRITICAL: Turn %d/%d — run /cc-compact NOW before context overflows.\n' "$new_count" "$critical"
+  elif [ "$warning" -gt 0 ] && [ "$new_count" -ge "$warning" ]; then
+    printf '⚠ CONTEXT WARNING: Turn %d/%d — consider running /cc-compact soon.\n' "$new_count" "$critical"
+  fi
+}
+main || exit 0

package/project-template/.claude/hooks/post-compact.ps1

@@ -0,0 +1,41 @@
+try {
+  $root = if ($env:CC_PROJECT_ROOT) { $env:CC_PROJECT_ROOT } else { '.' }
+  $mem  = Join-Path $root '.claude\memory'
+  if ((Test-Path $mem) -and -not (Test-Path $mem -PathType Container)) { exit 0 }
+  New-Item -ItemType Directory -Force $mem -ErrorAction SilentlyContinue | Out-Null
+  if (-not (Test-Path $mem -PathType Container)) { exit 0 }
+
+  $target = Join-Path $mem 'turn-count.txt'
+  $tmp    = Join-Path $mem 'turn-count.txt.tmp'
+  $enc    = [System.Text.UTF8Encoding]::new($false)
+  [System.IO.File]::WriteAllText($tmp, "0`n", $enc)
+  try {
+    [System.IO.File]::Replace($tmp, $target, $null)
+  } catch [System.IO.FileNotFoundException] {
+    try {
+      [System.IO.File]::Move($tmp, $target)
+    } catch {
+      Remove-Item $tmp -Force -ErrorAction SilentlyContinue
+      exit 0
+    }
+  }
+
+  ""
+  "[PKG] Conversation compacted. Context counter reset to 0."
+  $projMd = Join-Path $root '.claude\memory\project.md'
+  if (Test-Path $projMd) {
+    $lastMatch = Select-String '## Checkpoint' $projMd | Select-Object -Last 1
+    if ($lastMatch) { "   Last checkpoint: $($lastMatch.Line)" } else { "   No checkpoints recorded yet in project.md." }
+  } else { "   No project.md found." }
+  ""
+  "   [TIP] If this session had important decisions, run /checkpoint before continuing."
+
+  $cond = Join-Path $root '.conductor'
+  Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $cond 'session-id')
+  Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $cond 'session-id.*.tmp')
+  Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $cond 'resume-validate.*.tmp.json')
+
+  ""
+} catch {
+  exit 0
+}

package/project-template/.claude/hooks/post-compact.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set +e
+main() {
+  _mem="${CC_PROJECT_ROOT:-.}/.claude/memory"
+  if [ -e "$_mem" ] && [ ! -d "$_mem" ]; then exit 0; fi
+  mkdir -p "$_mem" 2>/dev/null || exit 0
+
+  _target="${_mem}/turn-count.txt"
+  _tmp="${_mem}/turn-count.txt.tmp"
+  printf '0\n' > "$_tmp" && mv -f "$_tmp" "$_target" \
+    || { rm -f "$_tmp" 2>/dev/null; exit 0; }
+
+  echo ""
+  echo "📦 Conversation compacted. Context counter reset to 0."
+
+  _mem_file="${CC_PROJECT_ROOT:-.}/.claude/memory/project.md"
+  if [ -f "$_mem_file" ]; then
+    _last=$(grep "## Checkpoint" "$_mem_file" | tail -1 || true)
+    [ -n "$_last" ] && echo "   Last checkpoint: $_last" \
+      || echo "   No checkpoints recorded yet in project.md."
+  else
+    echo "   No project.md found."
+  fi
+
+  echo ""
+  echo "   💡 If this session had important decisions or conventions,"
+  echo "      run /checkpoint before continuing."
+
+  _cond="${CC_PROJECT_ROOT:-.}/.conductor"
+  rm -f "${_cond}/session-id" 2>/dev/null
+  rm -f "${_cond}"/session-id.*.tmp 2>/dev/null
+  rm -f "${_cond}"/resume-validate.*.tmp.json 2>/dev/null
+
+  echo ""
+}
+main || exit 0

package/project-template/.claude/hooks/pre-tool-use.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# Guards: (1) large-file Read without limit, (2) duplicate file creation.
+
+set -euo pipefail
+
+# ── Guard 1: Large-file Read without limit ─────────────────────────────────────
+if [ "${CLAUDE_TOOL_NAME:-}" = "Read" ]; then
+  READ_PATH=$(echo "${CLAUDE_TOOL_INPUT:-}" | grep -o '"file_path":"[^"]*"' | head -1 | sed 's/"file_path":"//;s/"//' || true)
+  if [ -n "$READ_PATH" ] && [ -f "$READ_PATH" ]; then
+    LINE_COUNT=$(wc -l < "$READ_PATH" 2>/dev/null || echo "0")
+    HAS_LIMIT=$(echo "${CLAUDE_TOOL_INPUT:-}" | grep -c '"limit"' || true)
+    if [ "$LINE_COUNT" -gt 150 ] && [ "$HAS_LIMIT" -eq 0 ]; then
+      echo ""
+      echo "⛔ LARGE FILE READ BLOCKED"
+      echo "   File:  $READ_PATH"
+      echo "   Lines: $LINE_COUNT (>150 — no limit specified)"
+      echo ""
+      echo "   Follow the orchestrator lookup chain:"
+      echo "   1. Check .claude/memory/project.md"
+      echo "   2. Query graphify for structural questions"
+      echo "   3. Use Grep/Glob for pattern searches"
+      echo "   4. Read with explicit offset + limit"
+      echo ""
+      exit 1
+    fi
+  fi
+fi
+
+# ── Guard 4 — block Read on graphify-out/ and node_modules/ (BUG-017) ─────────────────────
+# To reset to GitHub upstream: delete .claude/hooks/pre-tool-use.sh, then re-run installer.
+if [ "$CLAUDE_TOOL_NAME" = "Read" ]; then
+    _g4_result=$(printf '%s' "$CLAUDE_TOOL_INPUT" | python3 -c '
+import json, sys, posixpath
+raw = sys.stdin.buffer.read().decode("utf-8", errors="replace")
+d = json.loads(raw)
+fp = d.get("file_path", "").strip()
+fp_n = posixpath.normpath(fp.replace("\\", "/"))
+parts = [p.lower() for p in fp_n.split("/") if p and p != "."]
+blocked = {"graphify-out", "node_modules"}
+print("BLOCK" if any(p in blocked for p in parts) else "OK")
+' 2>/dev/null) || true
+    if [ "$_g4_result" = "BLOCK" ]; then
+        echo '{"decision":"block","reason":"Guard 4: direct reads of graphify-out/ and node_modules/ are forbidden. Use Glob for existence checks or the graphify skill: /graphify query \"<question>\"."}'
+        exit 1
+    fi
+    # Debug: set CC_GUARD4_DEBUG=1 to log fail-open events to stderr for diagnostics.
+    if [ -n "${CC_GUARD4_DEBUG:-}" ] && [ "$_g4_result" != "OK" ]; then
+        printf '[Guard 4 debug] fail-open: _g4_result="%s"\n' "$_g4_result" >&2
+    fi
+fi
+
+# ── Guard 2: Duplicate file creation ──────────────────────────────────────────
+FILE_PATH=""
+if [ -n "${CLAUDE_TOOL_INPUT:-}" ]; then
+  FILE_PATH=$(echo "$CLAUDE_TOOL_INPUT" | grep -o '"path":"[^"]*"' | head -1 | sed 's/"path":"//;s/"//' || true)
+fi
+
+if [ -z "$FILE_PATH" ]; then
+  exit 0
+fi
+
+if [ ! -f "$FILE_PATH" ]; then
+  exit 0
+fi
+
+LINE_COUNT=$(wc -l < "$FILE_PATH" 2>/dev/null || echo "?")
+LAST_MODIFIED=$(date -r "$FILE_PATH" "+%Y-%m-%d %H:%M" 2>/dev/null || stat -c "%y" "$FILE_PATH" 2>/dev/null | cut -d. -f1 || echo "unknown")
+
+echo ""
+echo "⚠️  FILE ALREADY EXISTS"
+echo "   Path:          $FILE_PATH"
+echo "   Lines:         $LINE_COUNT"
+echo "   Last modified: $LAST_MODIFIED"
+echo ""
+echo "   Choose an action:"
+echo "   1. Edit the existing file instead of overwriting"
+echo "   2. Confirm you want to overwrite (re-issue the command)"
+echo "   3. Cancel"
+echo ""
+
+exit 1