chati-dev 4.2.1 → 4.2.2

package/scripts/validate-package.js

@@ -309,12 +309,146 @@ function checkEntityCount(packageRoot, results) {
   }
 }
 
+/**
+ * v4.2.2: Validate that generateClaudeSettings() produces a settings.json
+ * that wires all 10 chati hooks via the canonical hookSpecificOutput schema
+ * — at the right events and with paths that resolve to existing files.
+ *
+ * This catches the v4.2.0/v4.2.1 catastrophe (hooks dormant because the
+ * installer never wrote .claude/settings.json) at validation time.
+ */
+async function checkClaudeHooksWired(packageRoot, results) {
+  results.checks++;
+  try {
+    const genPath = join(packageRoot, 'src', 'config', 'claude-settings-generator.js');
+    if (!existsSync(genPath)) {
+      results.errors.push('claude-settings-generator.js missing — Claude hooks would not be wired in installs.');
+      return;
+    }
+
+    const mod = await import(genPath);
+    if (typeof mod.generateClaudeSettings !== 'function') {
+      results.errors.push('claude-settings-generator.js does not export generateClaudeSettings.');
+      return;
+    }
+
+    const settings = JSON.parse(mod.generateClaudeSettings());
+
+    // Verify required events
+    const requiredEvents = ['UserPromptSubmit', 'PreToolUse', 'PreCompact'];
+    const missingEvents = requiredEvents.filter(e => !settings.hooks?.[e]);
+    if (missingEvents.length > 0) {
+      results.errors.push(`generateClaudeSettings missing events: ${missingEvents.join(', ')}`);
+      return;
+    }
+
+    // Collect all referenced hook commands
+    const allCommands = [];
+    for (const event of Object.values(settings.hooks)) {
+      for (const group of event) {
+        for (const hook of group.hooks || []) {
+          allCommands.push(hook.command || '');
+        }
+      }
+    }
+
+    // Verify all 10 chati hooks are referenced
+    const requiredHooks = [
+      'license-guard', 'prism-engine', 'model-governance',
+      'read-protection', 'constitution-guard', 'mode-governance',
+      'style-guard', 'undercover-guard', 'team-quality-gate', 'session-digest',
+    ];
+    const missingHooks = requiredHooks.filter(h => !allCommands.some(c => c.includes(h)));
+    if (missingHooks.length > 0) {
+      results.errors.push(`generateClaudeSettings missing hook references: ${missingHooks.join(', ')}`);
+      return;
+    }
+
+    // Verify each referenced hook file exists in framework/hooks/
+    const hooksDir = join(packageRoot, 'framework', 'hooks');
+    if (existsSync(hooksDir)) {
+      const missingFiles = [];
+      for (const cmd of allCommands) {
+        const match = cmd.match(/hooks\/([^\s]+\.js)/);
+        if (match && !existsSync(join(hooksDir, match[1]))) {
+          missingFiles.push(match[1]);
+        }
+      }
+      if (missingFiles.length > 0) {
+        results.errors.push(`Claude settings reference hook files missing from bundle: ${missingFiles.join(', ')}`);
+        return;
+      }
+    }
+
+    results.passed++;
+  } catch (err) {
+    results.errors.push(`checkClaudeHooksWired failed: ${err.message}`);
+  }
+}
+
+/**
+ * v4.2.2: Verify license-guard is wired for ALL three providers.
+ * Without this, an expired trial keeps working forever — exactly the bug
+ * the user flagged in v4.2.1 (they could see chati.dev with no license check).
+ */
+async function checkLicenseEntryPointAcrossProviders(packageRoot, results) {
+  results.checks++;
+  try {
+    const missing = [];
+
+    // Claude — settings.json must include license-guard in UserPromptSubmit
+    const genPath = join(packageRoot, 'src', 'config', 'claude-settings-generator.js');
+    if (existsSync(genPath)) {
+      const mod = await import(genPath);
+      const settings = JSON.parse(mod.generateClaudeSettings());
+      const ups = settings.hooks?.UserPromptSubmit || [];
+      const claudeCmds = ups.flatMap(g => (g.hooks || []).map(h => h.command || ''));
+      if (!claudeCmds.some(c => c.includes('license-guard'))) {
+        missing.push('Claude (UserPromptSubmit)');
+      }
+    } else {
+      missing.push('Claude (generator file missing)');
+    }
+
+    // Gemini — HOOK_MAP must include license-guard at BeforeModel
+    const geminiPath = join(packageRoot, 'src', 'config', 'gemini-hooks-generator.js');
+    if (existsSync(geminiPath)) {
+      const mod = await import(geminiPath);
+      if (!mod.HOOK_MAP?.['license-guard'] || mod.HOOK_MAP['license-guard'].event !== 'BeforeModel') {
+        missing.push('Gemini (HOOK_MAP missing license-guard at BeforeModel)');
+      }
+    } else {
+      missing.push('Gemini (generator file missing)');
+    }
+
+    // Codex — installer/core.js must write .codex/hooks.json with license-guard
+    const corePath = join(packageRoot, 'src', 'installer', 'core.js');
+    if (existsSync(corePath)) {
+      const coreContent = readFileSync(corePath, 'utf-8');
+      if (!coreContent.includes('.codex/hooks.json') || !coreContent.includes("license-guard")) {
+        missing.push('Codex (.codex/hooks.json not wired with license-guard in core.js)');
+      }
+    } else {
+      missing.push('Codex (core.js missing)');
+    }
+
+    if (missing.length > 0) {
+      results.errors.push(`License enforcement gaps: ${missing.join('; ')}`);
+      return;
+    }
+
+    results.passed++;
+  } catch (err) {
+    results.errors.push(`checkLicenseEntryPointAcrossProviders failed: ${err.message}`);
+  }
+}
+
 /**
  * Validate the npm package completeness.
  * @param {string} packageRoot - Root of the package (packages/chati-dev/)
- * @returns {{ errors: string[], warnings: string[], checks: number, passed: number }}
+ * @returns {Promise<{ errors: string[], warnings: string[], checks: number, passed: number }>}
  */
-export function validatePackage(packageRoot) {
+export async function validatePackage(packageRoot) {
   const results = { errors: [], warnings: [], checks: 0, passed: 0 };
 
   checkFrameworkExists(packageRoot, results);
@@ -326,6 +460,8 @@ export function validatePackage(packageRoot) {
   checkEntityCount(packageRoot, results);
   checkHooksParity(packageRoot, results);
   checkSourceBundleParity(packageRoot, results);
+  await checkClaudeHooksWired(packageRoot, results);
+  await checkLicenseEntryPointAcrossProviders(packageRoot, results);
 
   return results;
 }
@@ -357,11 +493,13 @@ function formatResults(results) {
 // CLI entry point
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
   const packageRoot = join(__dirname, '..');
-  const results = validatePackage(packageRoot);
-
-  console.log(formatResults(results));
-
-  if (results.errors.length > 0) {
+  validatePackage(packageRoot).then(results => {
+    console.log(formatResults(results));
+    if (results.errors.length > 0) {
+      process.exit(1);
+    }
+  }).catch(err => {
+    console.error('validate-package failed:', err);
     process.exit(1);
-  }
+  });
 }

package/src/config/claude-settings-generator.js

@@ -0,0 +1,206 @@
+/**
+ * Claude Code settings.json generator.
+ *
+ * Produces .claude/settings.json content that wires the 10 chati.dev hooks
+ * into Claude Code's hook system and applies a baseline permission policy.
+ *
+ * Background: prior to v4.2.2, the installer wrote hooks to
+ * chati.dev/hooks/settings.json — but Claude Code reads .claude/settings.json,
+ * not the framework's bundled file. As a result, every hook was dormant for
+ * every Claude Code user since the project started. This generator is the fix:
+ * it produces the file Claude Code actually loads, registers all 10 hooks at
+ * the canonical events, and applies a generic permission policy modeled on
+ * production Claude Code setups.
+ *
+ * Hook output schema (v4.2.2): all PreToolUse hooks now use the canonical
+ * `hookSpecificOutput.permissionDecision` field per Anthropic docs at
+ * https://code.claude.com/docs/en/hooks.md. The previous `decision` field
+ * was silently no-op'd by Claude Code.
+ */
+
+/**
+ * Hook registration map. Each entry is one hook script and the events it
+ * should fire on. Source of truth lives in chati.dev/hooks/.
+ */
+const HOOK_REGISTRY = [
+  // UserPromptSubmit — fires on every user message turn.
+  // license-guard MUST be first so license check runs before any other work.
+  { name: 'license-guard',     event: 'UserPromptSubmit', matcher: '.*' },
+  { name: 'prism-engine',      event: 'UserPromptSubmit', matcher: '.*' },
+  { name: 'model-governance',  event: 'UserPromptSubmit', matcher: '.*' },
+
+  // PreToolUse — fires before each tool call. Matcher targets specific tools.
+  { name: 'read-protection',   event: 'PreToolUse', matcher: 'Read' },
+  { name: 'constitution-guard',event: 'PreToolUse', matcher: 'Bash|Write|Edit' },
+  { name: 'mode-governance',   event: 'PreToolUse', matcher: 'Write|Edit' },
+  { name: 'style-guard',       event: 'PreToolUse', matcher: 'Write|Edit|Bash' },
+  { name: 'undercover-guard',  event: 'PreToolUse', matcher: 'Write|Edit|Bash' },
+  { name: 'team-quality-gate', event: 'PreToolUse', matcher: 'Write|Edit' },
+
+  // PreCompact — fires before context compaction (observational).
+  { name: 'session-digest',    event: 'PreCompact', matcher: '' },
+];
+
+/**
+ * Baseline permission allow list.
+ * Modeled on production Claude Code setups: lets the assistant work freely
+ * inside the project without prompting for every tool call. Personal MCP
+ * permissions are intentionally NOT included — those are user-specific.
+ */
+const PERMISSIONS_ALLOW = [
+  'Read(**/*)',
+  'Write(**/*)',
+  'Edit(**/*)',
+  'Bash',
+  'WebFetch',
+  'WebSearch',
+  'Task',
+  'Glob',
+  'Grep',
+  'NotebookEdit',
+  'Skill(*)',
+  'TodoWrite',
+  'AskUserQuestion',
+  'EnterPlanMode',
+  'ExitPlanMode',
+  'KillShell',
+];
+
+/**
+ * Baseline permission deny list.
+ *
+ * Categories:
+ * - Catastrophic filesystem: deletes that hit root, mass-format, recursive chmod
+ * - Git destructive: force push, hard reset, .git removal, hook bypass
+ * - System path writes: /etc, /usr, /System, /bin, /sbin (note `//` prefix
+ *   means absolute filesystem path, not project-relative)
+ * - Secret reads: SSH keys, AWS/GCP credentials, npm tokens, GitHub tokens
+ * - Accidental publish: npm/yarn/pnpm/pip/cargo publish commands
+ *
+ * Path syntax (from Claude Code docs):
+ * - `Bash(cmd:*)`  matches "cmd" with any args
+ * - `~/path/**`    expands ~ to home dir, ** matches recursive
+ * - `//etc/**`     double-slash means absolute filesystem path
+ * - `/path/**`     single-slash is project-root-relative (NOT absolute)
+ */
+const PERMISSIONS_DENY = [
+  // Catastrophic filesystem
+  'Bash(rm -rf /)',
+  'Bash(rm -rf /*)',
+  'Bash(rm -rf ~)',
+  'Bash(rm -rf ~/*)',
+  'Bash(rm -rf $HOME)',
+  'Bash(rm -rf $HOME/*)',
+  'Bash(sudo rm -rf:*)',
+  'Bash(mkfs:*)',
+  'Bash(dd if=/dev/zero:*)',
+  'Bash(dd if=/dev/random:*)',
+  'Bash(chmod -R 777 /)',
+  'Bash(chown -R:*  /)',
+
+  // Git destructive
+  'Bash(git push --force:*)',
+  'Bash(git push -f:*)',
+  'Bash(git push --force-with-lease:*)',
+  'Bash(git reset --hard:*)',
+  'Bash(git clean -fd:*)',
+  'Bash(git clean -fdx:*)',
+  'Bash(git clean -fx:*)',
+  'Bash(rm -rf .git)',
+  'Bash(rm -rf .git/*)',
+
+  // Bypass hooks (always suspect)
+  'Bash(git commit --no-verify:*)',
+  'Bash(git commit -n:*)',
+  'Bash(git commit --no-gpg-sign:*)',
+  'Bash(git rebase --no-verify:*)',
+
+  // System path writes — `//` prefix = absolute filesystem
+  'Write(//etc/**)',
+  'Write(//usr/**)',
+  'Write(//System/**)',
+  'Write(//bin/**)',
+  'Write(//sbin/**)',
+  'Write(//Library/**)',
+  'Edit(//etc/**)',
+  'Edit(//usr/**)',
+  'Edit(//System/**)',
+  'Edit(//bin/**)',
+  'Edit(//sbin/**)',
+  'Edit(//Library/**)',
+
+  // Credentials and secrets
+  'Read(~/.ssh/**)',
+  'Read(~/.aws/credentials)',
+  'Read(~/.aws/config)',
+  'Read(~/.gnupg/**)',
+  'Read(~/.config/gh/hosts.yml)',
+  'Read(~/.docker/config.json)',
+  'Read(~/.npmrc)',
+  'Read(~/.pypirc)',
+  'Read(~/.netrc)',
+
+  // Accidental publish
+  'Bash(npm publish:*)',
+  'Bash(yarn publish:*)',
+  'Bash(pnpm publish:*)',
+  'Bash(pip upload:*)',
+  'Bash(twine upload:*)',
+  'Bash(cargo publish:*)',
+];
+
+/**
+ * Group HOOK_REGISTRY entries by event, then by matcher within each event.
+ * Returns the shape Claude Code expects under the top-level "hooks" key.
+ */
+function buildHooksObject() {
+  const events = {};
+
+  for (const entry of HOOK_REGISTRY) {
+    if (!events[entry.event]) events[entry.event] = new Map();
+    const matcherGroups = events[entry.event];
+    if (!matcherGroups.has(entry.matcher)) {
+      matcherGroups.set(entry.matcher, []);
+    }
+    matcherGroups.get(entry.matcher).push({
+      type: 'command',
+      command: `node chati.dev/hooks/${entry.name}.js`,
+    });
+  }
+
+  const result = {};
+  for (const [event, matcherGroups] of Object.entries(events)) {
+    result[event] = [];
+    for (const [matcher, hooks] of matcherGroups.entries()) {
+      const group = { hooks };
+      if (matcher) group.matcher = matcher;
+      result[event].push(group);
+    }
+  }
+  return result;
+}
+
+/**
+ * Generate the full settings.json content.
+ *
+ * @returns {string} JSON string with trailing newline, ready to write to disk.
+ */
+export function generateClaudeSettings() {
+  const settings = {
+    $schema: 'https://json.schemastore.org/claude-code-settings.json',
+    permissions: {
+      allow: PERMISSIONS_ALLOW,
+      deny: PERMISSIONS_DENY,
+      defaultMode: 'default',
+    },
+    hooks: buildHooksObject(),
+  };
+
+  return JSON.stringify(settings, null, 2) + '\n';
+}
+
+export {
+  HOOK_REGISTRY,
+  PERMISSIONS_ALLOW,
+  PERMISSIONS_DENY,
+};

package/src/config/gemini-hooks-generator.js

@@ -22,6 +22,10 @@
  * Maps each chati.dev hook to its Gemini CLI equivalent event.
  */
 export const HOOK_MAP = {
+  // license-guard MUST be first on BeforeModel so license check runs before
+  // any model call. Without this, an expired trial could keep using Gemini
+  // indefinitely from a long-running session.
+  'license-guard': { event: 'BeforeModel', description: 'Validate license on every turn (chati.dev governance)' },
   'prism-engine': { event: 'BeforeModel', description: 'Inject PRISM context into model prompt' },
   'model-governance': { event: 'BeforeModel', description: 'Advisory: recommended model per agent' },
   'mode-governance': { event: 'BeforeTool', description: 'Block writes outside current mode scope' },
@@ -611,6 +615,7 @@ main();
  */
 export function generateAllGeminiHooks() {
   return {
+    'license-guard.js': generateLicenseGuard(),
     'prism-engine.js': generatePrismEngine(),
     'model-governance.js': generateModelGovernance(),
     'mode-governance.js': generateModeGovernance(),
@@ -622,6 +627,59 @@ export function generateAllGeminiHooks() {
   };
 }
 
+/**
+ * Generate the license guard hook for Gemini CLI.
+ * BeforeModel event — validates license on every turn.
+ *
+ * Delegates to chati.dev/hooks/license-guard.js (canonical implementation)
+ * via dynamic import of checkLicense(). Translates the verdict object to
+ * Gemini's blocking schema (exit code 2 + stderr is the universal block).
+ */
+function generateLicenseGuard() {
+  return `${HOOK_HEADER}
+async function main() {
+  let input = '';
+  for await (const chunk of process.stdin) {
+    input += chunk;
+  }
+
+  try {
+    const event = JSON.parse(input);
+    const cwd = event.cwd || process.cwd();
+
+    // Delegate to canonical license check
+    const hookPath = join(cwd, 'chati.dev', 'hooks', 'license-guard.js');
+    if (!existsSync(hookPath)) {
+      // No canonical hook present — fail open
+      console.log(JSON.stringify({}));
+      return;
+    }
+
+    const mod = await import(hookPath);
+    if (typeof mod.checkLicense !== 'function') {
+      console.log(JSON.stringify({}));
+      return;
+    }
+
+    const result = await mod.checkLicense();
+    if (result.valid) {
+      console.log(JSON.stringify({}));
+      return;
+    }
+
+    // Block via exit code 2 (universal Gemini block) + stderr message.
+    process.stderr.write(result.reason || 'License invalid');
+    process.exit(2);
+  } catch {
+    // Fail open on any parse/import error — never block on bugs.
+    console.log(JSON.stringify({}));
+  }
+}
+
+main();
+`;
+}
+
 /**
  * Generate .gemini/settings.json content with hook configuration.
  *

package/src/installer/core.js

@@ -6,6 +6,7 @@ import { generateClaudeMCPConfig } from '../config/mcp-configs.js';
 import { generateSessionYaml, generateConfigYaml, generateClaudeMd, generateClaudeLocalMd, generateCodexSkill, generateGeminiRouter, generateGeminiSessionLock, generateAgentsOverrideMd, generateCodexConstitutionGuardRules, generateCodexReadProtectionRules } from './templates.js';
 import { generateContextFiles } from '../config/context-file-generator.js';
 import { adaptFrameworkFile, ADAPTABLE_FILES } from '../config/framework-adapter.js';
+import { generateClaudeSettings } from '../config/claude-settings-generator.js';
 import { generateProviderOverlays } from './provider-overlay.js';
 import { verifyManifest } from './manifest.js';
 
@@ -290,6 +291,12 @@ Pass through all context: session state, handoffs, artifacts, and user input.
 `;
     writeFileSync(join(targetDir, '.claude', 'commands', 'chati.md'), routerContent, 'utf-8');
 
+    // .claude/settings.json — wires the 10 chati.dev hooks into Claude Code's
+    // hook system and applies a baseline permission policy. THIS IS THE FILE
+    // CLAUDE CODE READS — without it, every hook in chati.dev/hooks/ is dormant.
+    // (Pre-v4.2.2 bug: this file was never written, hooks never ran.)
+    writeClaudeSettingsWithMerge(join(targetDir, '.claude', 'settings.json'));
+
     // MCP config
     if (selectedMCPs.length > 0) {
       const mcpConfig = generateClaudeMCPConfig(selectedMCPs);
@@ -307,10 +314,35 @@ Pass through all context: session state, handoffs, artifacts, and user input.
     // Session lock override file (equivalent to CLAUDE.local.md)
     writeFileSync(join(targetDir, 'AGENTS.override.md'), generateAgentsOverrideMd(), 'utf-8');
 
-    // Starlark execution policies (equivalent to Claude hooks for constitution guard + read protection)
+    // Starlark execution policies (Codex sandboxed rule engine)
     createDir(join(targetDir, '.codex', 'rules'));
     writeFileSync(join(targetDir, '.codex', 'rules', 'constitution-guard.rules'), generateCodexConstitutionGuardRules(), 'utf-8');
     writeFileSync(join(targetDir, '.codex', 'rules', 'read-protection.rules'), generateCodexReadProtectionRules(), 'utf-8');
+
+    // .codex/hooks.json — license-guard wired to UserPromptSubmit (per-turn enforcement).
+    // Codex hooks.json is experimental (requires [features] codex_hooks = true in
+    // codex config). Without it, license enforcement only happens at slash command
+    // entry — a long-running terminal session would not be re-validated.
+    writeFileSync(
+      join(targetDir, '.codex', 'hooks.json'),
+      JSON.stringify({
+        $comment: 'chati.dev v4.2.2 — experimental Codex hooks. Requires [features] codex_hooks = true.',
+        hooks: {
+          UserPromptSubmit: [
+            {
+              matcher: '.*',
+              hooks: [
+                {
+                  type: 'command',
+                  command: 'node chati.dev/hooks/license-guard.js',
+                },
+              ],
+            },
+          ],
+        },
+      }, null, 2) + '\n',
+      'utf-8'
+    );
   } else if (ideKey === 'gemini-cli') {
     // Gemini CLI: TOML command file (native format for /chati command)
     writeFileSync(join(targetDir, '.gemini', 'commands', 'chati.toml'), generateGeminiRouter({ orchestratorPath }), 'utf-8');
@@ -430,3 +462,106 @@ function createDir(dir) {
     mkdirSync(dir, { recursive: true });
   }
 }
+
+/**
+ * Write .claude/settings.json with safe merge against existing user content.
+ *
+ * If the file does not exist: write fresh chati settings.
+ * If the file exists and is valid JSON: merge — chati hooks/permissions are
+ * UNIONED into existing values rather than replacing them. User customizations
+ * (env, statusLine, plugins, language, alwaysThinkingEnabled, etc.) are preserved.
+ * If the file exists but is malformed: leave it alone, log a warning. We will
+ * not silently destroy user data.
+ */
+function writeClaudeSettingsWithMerge(settingsPath) {
+  createDir(dirname(settingsPath));
+  const fresh = JSON.parse(generateClaudeSettings());
+
+  if (!existsSync(settingsPath)) {
+    writeFileSync(settingsPath, JSON.stringify(fresh, null, 2) + '\n', 'utf-8');
+    return;
+  }
+
+  let existing;
+  try {
+    existing = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+  } catch (err) {
+    process.stderr.write(`[chati] WARNING: .claude/settings.json exists but is not valid JSON (${err.message}). Skipping merge — chati hooks will NOT be wired. Fix the file and re-run install.\n`);
+    return;
+  }
+
+  const merged = mergeClaudeSettings(existing, fresh);
+  writeFileSync(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
+}
+
+/**
+ * Merge two Claude Code settings.json objects.
+ *
+ * - permissions.allow / permissions.deny: array union (de-duplicated)
+ * - permissions.defaultMode: keep existing if set, else use fresh
+ * - hooks: per-event union — chati hook commands are appended to existing
+ *   matcher groups; user's hooks for the same events are preserved
+ * - $schema: prefer fresh (always our canonical URL)
+ * - all other top-level keys (env, statusLine, plugins, language, etc.):
+ *   keep existing untouched
+ */
+export function mergeClaudeSettings(existing, fresh) {
+  const merged = { ...existing };
+
+  // $schema — chati's canonical URL wins
+  if (fresh.$schema) merged.$schema = fresh.$schema;
+
+  // permissions
+  const existingPerms = existing.permissions || {};
+  const freshPerms = fresh.permissions || {};
+  merged.permissions = {
+    ...existingPerms,
+    allow: unionArrays(existingPerms.allow, freshPerms.allow),
+    deny: unionArrays(existingPerms.deny, freshPerms.deny),
+    defaultMode: existingPerms.defaultMode || freshPerms.defaultMode || 'default',
+  };
+
+  // hooks — per-event merge
+  const existingHooks = existing.hooks || {};
+  const freshHooks = fresh.hooks || {};
+  merged.hooks = { ...existingHooks };
+
+  for (const [eventName, freshGroups] of Object.entries(freshHooks)) {
+    const existingGroups = existingHooks[eventName] || [];
+    // Append fresh groups; we don't dedup at the group level (different
+    // matchers are different groups). Within a single fresh group, the
+    // hook commands are unique to chati so duplication risk is minimal.
+    // To be safe, dedup by command string across the merged event.
+    const seen = new Set();
+    const collected = [];
+    for (const group of [...existingGroups, ...freshGroups]) {
+      const dedupedHooks = (group.hooks || []).filter(h => {
+        const key = `${group.matcher || ''}|${h.command}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      });
+      if (dedupedHooks.length > 0) {
+        collected.push({
+          ...(group.matcher !== undefined ? { matcher: group.matcher } : {}),
+          hooks: dedupedHooks,
+        });
+      }
+    }
+    merged.hooks[eventName] = collected;
+  }
+
+  return merged;
+}
+
+function unionArrays(a, b) {
+  const out = [];
+  const seen = new Set();
+  for (const item of [...(a || []), ...(b || [])]) {
+    if (!seen.has(item)) {
+      seen.add(item);
+      out.push(item);
+    }
+  }
+  return out;
+}

package/src/installer/templates.js

@@ -134,8 +134,12 @@ export function generateConfigYaml(config) {
     model_fallback: true,
     frustration_detection: true,
     bash_security_checks: true,
-    // Agent Teams (v4.2.0 — Article XXI)
-    agent_teams: false,
+    // Agent Teams (Article XXI) — default ON in v4.2.2.
+    // Only effective when provider === 'claude' (gated in cli.js
+    // isAgentTeamsEnabled). Gemini and Codex always fall back to sequential
+    // pipeline silently. See plan: was previously false for "safe rollout"
+    // but the v4.2.0 launch never actually shipped, so this is a fresh start.
+    agent_teams: true,
     team_planning_size: 3,
     team_build_size: 2,
     team_echo_threshold: 0.92,