aw-ecc 1.4.23 → 1.4.31

package/.cursor/skills/using-aw-skills/evals/test-skill-triggers.sh

@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# Test harness for verifying SDLC skill auto-triggering across AI CLIs.
+# Public AW surface under test: /aw:plan, /aw:build, /aw:investigate,
+# /aw:test, /aw:review, /aw:deploy, and /aw:ship.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+RESULTS_DIR="$SCRIPT_DIR/results"
+CASES_FILE="$SCRIPT_DIR/skill-trigger-cases.tsv"
+DEFAULT_WORKSPACE_DIR="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+WORKSPACE_DIR="${WORKSPACE_DIR:-$DEFAULT_WORKSPACE_DIR}"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+MAX_TURNS=3
+QUICK_MODE=false
+
+mkdir -p "$RESULTS_DIR"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[0;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+run_with_timeout() {
+  local secs="$1"
+  shift
+  if command -v gtimeout &>/dev/null; then
+    gtimeout "$secs" "$@"
+  else
+    perl -e "
+      alarm $secs;
+      \$SIG{ALRM} = sub { kill 9, \$pid; exit 124 };
+      \$pid = fork;
+      if (\$pid == 0) { exec @ARGV; }
+      waitpid \$pid, 0;
+      exit \$? >> 8;
+    " "$@"
+  fi
+}
+
+load_test_cases() {
+  local mode_filter="$1"
+  local -n out_cases="$2"
+
+  if [ ! -f "$CASES_FILE" ]; then
+    echo "Missing cases file: $CASES_FILE" >&2
+    exit 1
+  fi
+
+  while IFS=$'\t' read -r mode prompt expected_pattern description expected_route primary_skill supporting_skills; do
+    if [ -z "${mode:-}" ] || [[ "$mode" == \#* ]]; then
+      continue
+    fi
+
+    if [ "$mode_filter" = "quick" ] && [ "$mode" != "quick" ]; then
+      continue
+    fi
+
+    out_cases+=("$prompt|$expected_pattern|$description|$expected_route|$primary_skill|$supporting_skills")
+  done < "$CASES_FILE"
+}
+
+run_prompt() {
+  local cli="$1"
+  local prompt="$2"
+  local output_file="$3"
+
+  cd "$WORKSPACE_DIR"
+
+  case "$cli" in
+    claude)
+      run_with_timeout 120 claude -p "$prompt" \
+        --output-format text \
+        --max-turns "$MAX_TURNS" \
+        > "$output_file" 2>&1 || true
+      ;;
+    codex)
+      run_with_timeout 120 codex exec --skip-git-repo-check --sandbox read-only "$prompt" \
+        > "$output_file" 2>&1 || true
+      ;;
+    cursor)
+      run_with_timeout 120 cursor -p "$prompt" > "$output_file" 2>&1 || true
+      ;;
+    opencode)
+      run_with_timeout 120 opencode -p "$prompt" > "$output_file" 2>&1 || true
+      ;;
+    *)
+      echo "Unknown CLI: $cli" > "$output_file"
+      return 1
+      ;;
+  esac
+}
+
+check_skill_triggered() {
+  local output_file="$1"
+  local expected_pattern="$2"
+
+  if [ ! -f "$output_file" ] || [ ! -s "$output_file" ]; then
+    echo "no_output"
+    return
+  fi
+
+  local content
+  content=$(cat "$output_file")
+
+  local grep_pattern="${expected_pattern//;/|}"
+  if echo "$content" | grep -qiE "$grep_pattern"; then
+    echo "triggered"
+    return
+  fi
+
+  if echo "$content" | grep -qiE "using.*skill|invoking.*skill|Skill\(skill:|I'm using the"; then
+    echo "skill_invoked_different"
+    return
+  fi
+
+  if echo "$content" | grep -qi "max turns"; then
+    echo "max_turns_hit"
+    return
+  fi
+
+  if [ ${#content} -gt 50 ]; then
+    echo "responded_no_skill"
+    return
+  fi
+
+  echo "no_response"
+}
+
+run_test() {
+  local cli="$1"
+  local prompt="$2"
+  local expected_pattern="$3"
+  local description="$4"
+  local test_id="$5"
+
+  local output_file="$RESULTS_DIR/${cli}_${test_id}_${TIMESTAMP}.txt"
+
+  printf "  [%d] %-45s " "$test_id" "$description"
+
+  run_prompt "$cli" "$prompt" "$output_file"
+
+  local result
+  result=$(check_skill_triggered "$output_file" "$expected_pattern")
+
+  case "$result" in
+    triggered)
+      printf "${GREEN}PASS${NC}\n"
+      return 0
+      ;;
+    skill_invoked_different)
+      printf "${YELLOW}PARTIAL${NC} — different skill invoked\n"
+      return 0
+      ;;
+    max_turns_hit)
+      printf "${YELLOW}PARTIAL${NC} — hit max turns (tried to use tools)\n"
+      return 0
+      ;;
+    responded_no_skill)
+      printf "${RED}FAIL${NC} — responded without skill\n"
+      head -c 100 "$output_file" 2>/dev/null | tr '\n' ' '
+      echo ""
+      return 1
+      ;;
+    no_response|no_output)
+      printf "${RED}FAIL${NC} — no output\n"
+      return 1
+      ;;
+  esac
+}

package/.cursor/skills/using-aw-skills/hooks/hooks.json

@@ -0,0 +1,9 @@
+{
+  "hooks": [
+    {
+      "type": "SessionStart",
+      "script": "./session-start.sh",
+      "description": "Discovers all available AW skills and commands, loads the using-aw-skills routing skill, and injects context into the session."
+    }
+  ]
+}

package/.cursor/skills/using-aw-skills/hooks/session-start.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LOCAL_ROOT=""
+SEARCH_ROOT="$SCRIPT_DIR"
+while [[ "$SEARCH_ROOT" != "/" ]]; do
+  if [[ -f "$SEARCH_ROOT/skills/using-aw-skills/SKILL.md" ]]; then
+    LOCAL_ROOT="$SEARCH_ROOT"
+    break
+  fi
+  SEARCH_ROOT="$(dirname "$SEARCH_ROOT")"
+done
+
+AW_REGISTRY_ROOT=""
+SEARCH_ROOT="$SCRIPT_DIR"
+while [[ "$SEARCH_ROOT" != "/" ]]; do
+  if [[ -d "$SEARCH_ROOT/.aw_registry" ]]; then
+    AW_REGISTRY_ROOT="$SEARCH_ROOT/.aw_registry"
+    break
+  fi
+  if [[ "$(basename "$SEARCH_ROOT")" == ".aw_registry" ]]; then
+    AW_REGISTRY_ROOT="$SEARCH_ROOT"
+    break
+  fi
+  SEARCH_ROOT="$(dirname "$SEARCH_ROOT")"
+done
+
+if [[ -z "$LOCAL_ROOT" && -z "$AW_REGISTRY_ROOT" ]]; then
+  echo '{"hookSpecificOutput": {"hookEventName": "SessionStart", "additionalContext": "WARNING: .aw_registry not found. AW skills unavailable."}}'
+  exit 0
+fi
+
+CONTEXT="# AW Session Context
+
+## First Response Rule
+Before any substantive response, select the smallest correct AW skill stack from the repo-local router.
+Honor an explicit AW command and its mapped stage skill first.
+Otherwise choose the needed process skill, primary stage skill, and matching route by intent, then load deeper domain skills.
+Do not start with generic implementation, review, or deploy advice before skill selection.
+
+## Primary Routes
+- /aw:plan -> ideas, specs, task breakdown, architecture direction
+- /aw:build -> approved implementation work
+- /aw:investigate -> bugs, alerts, or unclear runtime failures
+- /aw:test -> QA proof and regression evidence
+- /aw:review -> findings, risk review, and readiness
+- /aw:deploy -> rollout or release execution
+- /aw:ship -> release closeout and final handoff
+
+## Compatibility Routes
+- /aw:execute -> compatibility route; resolve to /aw:build
+- /aw:verify -> compatibility route; resolve to /aw:test or /aw:review
+
+## Router Source
+Use skills/using-aw-skills/SKILL.md as the repo-local router.
+Load domain, platform, and craft skills only after the smallest correct AW route is selected."
+
+# --- Output in Claude Code hookSpecificOutput format ---
+# Escape for JSON: newlines, quotes, backslashes
+JSON_CONTEXT=$(printf '%s' "$CONTEXT" | python3 -c '
+import sys, json
+content = sys.stdin.read()
+print(json.dumps(content))
+' 2>/dev/null || printf '%s' "$CONTEXT" | sed 's/\\/\\\\/g; s/"/\\"/g; s/\t/\\t/g' | awk '{printf "%s\\n", $0}')
+
+echo "{\"hookSpecificOutput\": {\"hookEventName\": \"SessionStart\", \"additionalContext\": ${JSON_CONTEXT}}}"

package/.cursor/skills/using-platform-skills/SKILL.md

@@ -0,0 +1,163 @@
+---
+name: using-platform-skills
+description: Select the smallest correct GHL platform skill stack after the AW stage is known. Use when the task touches backend services, frontend MFAs, data systems, infra, review, test, or product-specific platform context.
+---
+
+# Using Platform Skills
+
+## Overview
+
+This is the second-hop router for GHL-specific work.
+Use it after `using-aw-skills` has already selected the primary AW stage.
+
+Its job is to:
+
+- identify the touched GHL domain
+- pick the smallest correct platform family
+- choose the first supporting platform skills for the selected stage
+- avoid loading every platform playbook by default
+
+## When to Use
+
+- the primary AW stage is already known
+- the task touches a real GHL backend, worker, frontend, data, infra, test, review, or product surface
+- platform-specific conventions materially change how the stage should be done
+
+Do not use:
+
+- before the primary AW stage is selected
+- for generic non-GHL work
+- when no platform family materially changes the implementation, test, review, or deploy path
+
+## Skill Discovery
+
+After the AW stage is selected, choose the platform family:
+
+```text
+Primary AW stage selected
+    │
+    ├── Backend service or worker? ───────────────→ platform-services:*
+    ├── Frontend MFA or design-system work? ─────→ platform-frontend:* + platform-design:*
+    ├── Data store, analytics, search, cache,
+    │   or data migration work? ──────────────────────→ platform-data:*
+    ├── Infra or deploy path work? ──────────────→ platform-infra:*
+    ├── Test system or QA governance work? ──────→ platform-sdet:*
+    ├── Formal review or readiness work? ────────→ platform-review:*
+    └── Product-context ambiguity? ──────────────→ platform-product:*
+```
+
+Then choose the smallest supporting skills for the current stage.
+
+## Workflow
+
+1. Confirm the AW stage first.
+   Do not pick platform skills until the primary route is clear.
+2. Identify the touched surface.
+   Backend, frontend, data, infra, review, test, or product context.
+3. Choose the first platform family.
+   Start from the family that most directly changes the current stage behavior.
+4. Add only the first supporting platform skills.
+   Prefer the smallest stack that changes implementation quality, test evidence, review depth, or release safety.
+   Do not duplicate planning-process skills already owned by `aw-plan`, `aw-spec`, `aw-tasks`, or Addy-style planning helpers.
+5. Add craft skills only if they sharpen the same stage.
+   Do not let craft skills replace platform families or vice versa.
+
+## Stage-to-Platform Matrix
+
+### Backend services and workers
+
+| AW stage | First platform skills to load |
+|---|---|
+| `aw-plan` | `platform-services:development` |
+| `aw-build` | `platform-services:development` |
+| `aw-investigate` | `platform-infra:grafana` |
+| `aw-test` | `platform-sdet:quality-gates` |
+| `aw-review` | `platform-review:code-review-pr`, `platform-sdet:quality-gates` |
+| `aw-deploy` | `platform-infra:staging-deploy`, `platform-infra:deployment-strategies`, `platform-infra:production-readiness` |
+| `aw-ship` | `platform-review:code-review-pr`, `platform-infra:staging-deploy`, `platform-infra:production-readiness` |
+
+### Frontend MFAs and design-system work
+
+| AW stage | First platform skills to load |
+|---|---|
+| `aw-plan` | `platform-design:system`, `platform-frontend:vue-development` |
+| `aw-build` | `platform-frontend:vue-development`, `highrise-ui-governance`, `quality-gate-coder` |
+| `aw-investigate` | `platform-infra:grafana` when runtime signals matter; otherwise use the smallest relevant frontend family |
+| `aw-test` | `platform-frontend:a11y-review`, `platform-sdet:quality-gates` |
+| `aw-review` | `platform-review:code-review-pr`, `platform-design:review`, `platform-frontend:a11y-review`, `platform-sdet:quality-gates` |
+| `aw-deploy` | `deploy-versioned-mfa`, `platform-infra:staging-deploy`, `platform-infra:production-readiness` |
+| `aw-ship` | `deploy-versioned-mfa`, `platform-infra:staging-deploy`, `platform-infra:production-readiness` |
+
+### Data, migration, and storage work
+
+`platform-data:*` is the family for the data team surface.
+Use it for:
+
+- transactional databases
+- document stores
+- analytical databases and warehouses
+- search indexes
+- realtime data stores
+- cache and key-value systems
+- migration and cross-database movement
+
+Current concrete data families include:
+
+- `platform-data:cloudsql-clickhouse` for CloudSQL and ClickHouse
+- `platform-data:mongodb-patterns`
+- `platform-data:firestore-patterns`
+- `platform-data:redis-patterns`
+- `platform-data:elasticsearch-patterns`
+- `platform-data:migration-patterns`
+
+Keep infra ownership separate:
+
+- provisioning clusters, secrets, Helm, Terraform, Jenkins, or deploy topology -> `platform-infra:*`
+- modeling schemas, indexes, migrations, sync workers, queries, or search mappings -> `platform-data:*`
+
+| AW stage | First platform skills to load |
+|---|---|
+| `aw-plan` | `platform-data:migration-patterns` or the narrow storage family |
+| `aw-build` | `platform-data:migration-patterns`, `platform-data:mongodb-patterns`, `platform-data:redis-patterns`, `platform-data:elasticsearch-patterns`, `platform-data:cloudsql-clickhouse`, or another narrow data family |
+| `aw-test` | `platform-sdet:quality-gates` |
+| `aw-review` | `platform-review:code-review-pr` plus the narrow data family when contracts or safety need checking |
+| `aw-deploy` / `aw-ship` | `platform-infra:deployment-strategies`, plus the narrow data family when rollout safety depends on it |
+
+### Infra, release, and operational work
+
+| AW stage | First platform skills to load |
+|---|---|
+| `aw-plan` | `platform-infra:deployment-strategies` |
+| `aw-build` | `platform-infra:jenkins-pipelines`, `platform-infra:kubernetes-workloads`, `platform-infra:terraform-iac`, or another narrow infra family |
+| `aw-investigate` | `platform-infra:grafana`, `platform-infra:log-analysis` |
+| `aw-test` | `platform-sdet:quality-gates` |
+| `aw-review` | `platform-review:code-review-pr`, `platform-infra:production-readiness` |
+| `aw-deploy` | `platform-infra:staging-deploy`, `platform-infra:deployment-strategies`, `platform-infra:production-readiness` |
+| `aw-ship` | `platform-infra:deployment-strategies`, `platform-infra:production-readiness` |
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| "The AW stage is enough; platform rules can be implied." | Platform families encode real org behavior and should be selected explicitly when they matter. |
+| "I'll just load everything platform-related to be safe." | Flooding the session makes routing less clear and increases noise. |
+| "Frontend only needs frontend skills." | Real frontend work often also needs design, accessibility, quality-gate, or deploy support. |
+| "Review and test don't need platform families." | Review depth and test evidence are some of the most platform-specific parts of the workflow. |
+
+## Red Flags
+
+- platform skills are chosen before the AW stage is known
+- every task loads multiple platform families with no clear reason
+- frontend tasks skip `platform-design:*` or accessibility support when UI quality matters
+- backend tasks skip platform service conventions and jump straight to generic coding
+- deploy and ship work proceed without platform infra or readiness support
+
+## Verification
+
+Before leaving platform selection, confirm:
+
+- [ ] the AW stage was chosen first
+- [ ] exactly one primary platform family was selected first
+- [ ] the first supporting platform skills match the current AW stage
+- [ ] only the smallest useful platform stack was loaded
+- [ ] craft skills complement the platform stack instead of replacing it

package/.cursor/skills/using-platform-skills/evals/platform-selection-cases.json

@@ -0,0 +1,52 @@
+{
+  "cases": [
+    {
+      "id": "backend-plan",
+      "prompt": "Create the implementation spec for the approved Communities moderation API contract.",
+      "awStage": "aw-plan",
+      "surface": "backend-service",
+      "expectedPlatformFamilies": ["platform-services:*"],
+      "expectedSupportingSkills": ["platform-services:development"]
+    },
+    {
+      "id": "frontend-plan",
+      "prompt": "Create the implementation spec for the approved Communities feed MFA change.",
+      "awStage": "aw-plan",
+      "surface": "frontend-mfa",
+      "expectedPlatformFamilies": ["platform-frontend:*", "platform-design:*"],
+      "expectedSupportingSkills": ["platform-design:system", "platform-frontend:vue-development"]
+    },
+    {
+      "id": "backend-investigate",
+      "prompt": "Investigate this Communities moderation worker retry failure before patching.",
+      "awStage": "aw-investigate",
+      "surface": "backend-worker",
+      "expectedPlatformFamilies": ["platform-infra:*"],
+      "expectedSupportingSkills": ["platform-infra:grafana"]
+    },
+    {
+      "id": "frontend-test",
+      "prompt": "Test the approved Communities feed MFA UI change for responsive and accessibility regressions.",
+      "awStage": "aw-test",
+      "surface": "frontend-mfa",
+      "expectedPlatformFamilies": ["platform-frontend:*", "platform-sdet:*"],
+      "expectedSupportingSkills": ["platform-frontend:a11y-review", "platform-sdet:quality-gates"]
+    },
+    {
+      "id": "service-deploy",
+      "prompt": "Deploy this verified Communities moderation API service to staging.",
+      "awStage": "aw-deploy",
+      "surface": "backend-service",
+      "expectedPlatformFamilies": ["platform-infra:*"],
+      "expectedSupportingSkills": ["platform-infra:staging-deploy", "platform-infra:deployment-strategies", "platform-infra:production-readiness"]
+    },
+    {
+      "id": "data-build",
+      "prompt": "Add the new analytics projection and search mapping for this reporting workflow.",
+      "awStage": "aw-build",
+      "surface": "data-analytics-search",
+      "expectedPlatformFamilies": ["platform-data:*"],
+      "expectedSupportingSkills": ["platform-data:cloudsql-clickhouse", "platform-data:elasticsearch-patterns"]
+    }
+  ]
+}

package/.opencode/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecc-universal",
-  "version": "1.4.23",
+  "version": "1.4.25",
   "description": "Everything Claude Code (ECC) plugin for OpenCode - agents, commands, hooks, and skills",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aw-ecc",
-  "version": "1.4.23",
+  "version": "1.4.31",
   "description": "GoHighLevel Agentic Workspace Engine — forked from Everything Claude Code (ecc-universal)",
   "keywords": [
     "claude-code",
@@ -110,6 +110,10 @@
     "orchestrate:status": "node scripts/orchestration-status.js",
     "orchestrate:worker": "bash scripts/orchestrate-codex-worker.sh",
     "orchestrate:tmux": "node scripts/orchestrate-worktrees.js",
+    "test:hook-contracts": "node tests/hooks/harness-hook-output-contracts.test.js",
+    "eval:aw:fresh-env-cli-smoke": "bash tests/evals/run-aw-fresh-env-cli-smoke.sh",
+    "eval:aw:published-package-e2e": "bash tests/evals/run-aw-published-package-e2e.sh",
+    "eval:aw:release-gate": "bash tests/evals/run-aw-release-gate.sh",
     "test": "node scripts/ci/validate-agents.js && node scripts/ci/validate-commands.js && node scripts/ci/validate-rules.js && node scripts/ci/validate-skills.js && node scripts/ci/validate-hooks.js && node scripts/ci/validate-install-manifests.js && node scripts/ci/validate-no-personal-paths.js && node scripts/ci/catalog.js --text && node tests/run-all.js",
     "coverage": "c8 --all --include=\"scripts/**/*.js\" --check-coverage --lines 80 --functions 80 --branches 80 --statements 80 --reporter=text --reporter=lcov node tests/run-all.js"
   },

package/scripts/cursor-aw-home/hooks.json

@@ -3,14 +3,14 @@
   "hooks": {
     "sessionStart": [
       {
-        "command": "node .cursor/hooks/session-start.js",
+        "command": "bash -lc \"for candidate in \\\"$PWD/.cursor/hooks/session-start.sh\\\" \\\"$HOME/.cursor/hooks/session-start.sh\\\"; do if [ -f \\\"$candidate\\\" ]; then exec bash \\\"$candidate\\\"; fi; done; exit 0\"",
         "event": "sessionStart",
         "description": "Load previous context and detect environment"
       }
     ],
     "sessionEnd": [
       {
-        "command": "node .cursor/hooks/session-end.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"session-end.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "sessionEnd",
         "description": "Persist session state and evaluate patterns"
       }
@@ -22,91 +22,91 @@
         "description": "Block git hook-bypass flag to protect pre-commit, commit-msg, and pre-push hooks from being skipped"
       },
       {
-        "command": "node .cursor/hooks/before-shell-execution.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"before-shell-execution.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "beforeShellExecution",
         "description": "Tmux dev server blocker, tmux reminder, git push review"
       }
     ],
     "afterShellExecution": [
       {
-        "command": "node .cursor/hooks/after-shell-execution.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"after-shell-execution.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "afterShellExecution",
         "description": "PR URL logging, build analysis"
       }
     ],
     "afterFileEdit": [
       {
-        "command": "node .cursor/hooks/after-file-edit.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"after-file-edit.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "afterFileEdit",
         "description": "Auto-format, TypeScript check, console.log warning"
       }
     ],
     "beforeMCPExecution": [
       {
-        "command": "node .cursor/hooks/before-mcp-execution.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"before-mcp-execution.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "beforeMCPExecution",
         "description": "MCP audit logging and untrusted server warning"
       }
     ],
     "afterMCPExecution": [
       {
-        "command": "node .cursor/hooks/after-mcp-execution.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"after-mcp-execution.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "afterMCPExecution",
         "description": "MCP result logging"
       }
     ],
     "beforeReadFile": [
       {
-        "command": "node .cursor/hooks/before-read-file.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"before-read-file.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "beforeReadFile",
         "description": "Warn when reading sensitive files (.env, .key, .pem)"
       }
     ],
     "beforeSubmitPrompt": [
       {
-        "command": "node .cursor/hooks/before-submit-prompt.js",
+        "command": "bash -lc \"for candidate in \\\"$PWD/.cursor/hooks/before-submit-prompt.sh\\\" \\\"$HOME/.cursor/hooks/before-submit-prompt.sh\\\"; do if [ -f \\\"$candidate\\\" ]; then exec bash \\\"$candidate\\\"; fi; done; exit 0\"",
         "event": "beforeSubmitPrompt",
         "description": "Detect secrets in prompts (sk-, ghp_, AKIA patterns)"
       }
     ],
     "subagentStart": [
       {
-        "command": "node .cursor/hooks/subagent-start.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"subagent-start.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "subagentStart",
         "description": "Log agent spawning for observability"
       }
     ],
     "subagentStop": [
       {
-        "command": "node .cursor/hooks/subagent-stop.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"subagent-stop.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "subagentStop",
         "description": "Log agent completion"
       }
     ],
     "beforeTabFileRead": [
       {
-        "command": "node .cursor/hooks/before-tab-file-read.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"before-tab-file-read.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "beforeTabFileRead",
         "description": "Block Tab from reading secrets (.env, .key, .pem, credentials)"
       }
     ],
     "afterTabFileEdit": [
       {
-        "command": "node .cursor/hooks/after-tab-file-edit.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"after-tab-file-edit.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "afterTabFileEdit",
         "description": "Auto-format Tab edits"
       }
     ],
     "preCompact": [
       {
-        "command": "node .cursor/hooks/pre-compact.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"pre-compact.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "preCompact",
         "description": "Save state before context compaction"
       }
     ],
     "stop": [
       {
-        "command": "node .cursor/hooks/stop.js",
+        "command": "node -e \"const fs=require('fs');const path=require('path');const os=require('os');const scriptName=\\\"stop.js\\\";const candidates=[path.join(process.cwd(), '.cursor', 'hooks', scriptName),path.join(os.homedir(), '.cursor', 'hooks', scriptName)];const target=candidates.find(candidate => fs.existsSync(candidate));if(!target) process.exit(0);require(target)\"",
         "event": "stop",
         "description": "Console.log audit on all modified files"
       }