claude-code-arcane 2.12.0 → 2.14.0

package/hooks/pre-compact.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set +e
 main() {
-  [[ -d production/session-state ]] && echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] pre-compact" >> production/session-state/sessions.log
+  [[ -d .claude/session-state ]] && echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] pre-compact" >> .claude/session-state/sessions.log
 }
 main 2>/dev/null
 exit 0

package/hooks/session-start.sh

@@ -3,13 +3,49 @@
 # Graceful: wraps in main(), never blocks session
 set +e
 
-main() {
-  mkdir -p production/session-state 2>/dev/null
+STATE_DIR=".claude/session-state"
+LEGACY_STATE_DIR="production/session-state"
+
+# The folder holds session notes, never project files: a .gitignore with `*` keeps it
+# out of every commit without touching the project's own .gitignore.
+ensure_state_dir() {
+  mkdir -p "$STATE_DIR" 2>/dev/null
+  [ -f "$STATE_DIR/.gitignore" ] || echo '*' > "$STATE_DIR/.gitignore" 2>/dev/null
+}
+
+# active.md used to live in production/session-state/. Move it once, so a task left
+# half done before the update still shows up here.
+migrate_legacy_state() {
+  [ -f "$LEGACY_STATE_DIR/active.md" ] || return 0
+  [ -f "$STATE_DIR/active.md" ] && return 0
+  ensure_state_dir
+  mv "$LEGACY_STATE_DIR/active.md" "$STATE_DIR/active.md" 2>/dev/null &&
+    echo "Moved $LEGACY_STATE_DIR/active.md to $STATE_DIR/active.md"
+}
 
-  SESSION_LOG="production/session-state/sessions.log"
-  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Session started" >> "$SESSION_LOG" 2>/dev/null
+# A session started inside a worktree should know it, and where the main checkout is.
+worktree_notice() {
+  local DIRS GIT_DIR COMMON_DIR TOP BRANCH MAIN MAIN_BRANCH
+  DIRS=$(git rev-parse --path-format=absolute --git-dir --git-common-dir 2>/dev/null) || return 0
+  GIT_DIR=$(echo "$DIRS" | sed -n 1p)
+  COMMON_DIR=$(echo "$DIRS" | sed -n 2p)
+  [ -z "$COMMON_DIR" ] || [ "$GIT_DIR" = "$COMMON_DIR" ] && return 0
+  TOP=$(git rev-parse --show-toplevel 2>/dev/null)
+  BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+  MAIN=$(dirname "$COMMON_DIR")
+  MAIN_BRANCH=$(git -C "$MAIN" rev-parse --abbrev-ref HEAD 2>/dev/null)
+  echo "Worktree: you are in $TOP on branch $BRANCH."
+  echo "Main checkout: $MAIN on branch $MAIN_BRANCH. See the git-worktrees rule before pulling or switching branches."
+  echo ""
+}
+
+main() {
+  migrate_legacy_state
+  [ -d "$STATE_DIR" ] && ensure_state_dir
+  [ -d "$STATE_DIR" ] && echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Session started" >> "$STATE_DIR/sessions.log" 2>/dev/null
 
   echo "=== Claude Code Arcane — Session Context ==="
+  worktree_notice
 
   BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
   if [ -n "$BRANCH" ]; then
@@ -55,7 +91,7 @@ main() {
     fi
   fi
 
-  STATE_FILE="production/session-state/active.md"
+  STATE_FILE="$STATE_DIR/active.md"
   if [ -f "$STATE_FILE" ]; then
     echo ""
     echo "=== ACTIVE SESSION STATE DETECTED ==="

package/hooks/session-stop.sh

@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
 set +e
 main() {
-  [[ -d production/session-state ]] && echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Session stopped" >> production/session-state/sessions.log
+  [[ -d .claude/session-state ]] || return 0
+  # Claude creates the folder the first time it writes active.md; keep it out of
+  # commits from that same turn on.
+  [[ -f .claude/session-state/.gitignore ]] || echo '*' > .claude/session-state/.gitignore
+  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] Session stopped" >> .claude/session-state/sessions.log
 }
 main 2>/dev/null
 exit 0

package/hooks/validate-commit.sh

@@ -5,12 +5,20 @@ main() {
   local INPUT
   INPUT=$(cat 2>/dev/null) || true
 
-  local COMMAND
-  COMMAND=$(echo "$INPUT" | grep -oE '"command"\s*:\s*"[^"]*"' | head -1 | sed 's/.*"command"\s*:\s*"//;s/"$//') || true
+  local COMMAND GUARDED=1
+  # guard.sh parses the JSON properly; the regex is only a fallback without Python
+  # and stops at the first escaped quote.
+  COMMAND=$(printf '%s' "$INPUT" | bash "$(dirname "${BASH_SOURCE[0]}")/guard.sh" --command 2>/dev/null) || true
+  if [[ -z "$COMMAND" ]]; then
+    GUARDED=0
+    COMMAND=$(echo "$INPUT" | grep -oE '"command"\s*:\s*"[^"]*"' | head -1 | sed 's/.*"command"\s*:\s*"//;s/"$//') || true
+  fi
 
   [[ -z "$COMMAND" || "$COMMAND" != *"git commit"* ]] && return 0
 
-  if [[ "$COMMAND" == *"--no-verify"* ]]; then
+  # With Python the guard denies --no-verify on the parsed command; this substring
+  # check would also fire on a commit message that only mentions the flag.
+  if [[ "$GUARDED" == 0 && "$COMMAND" == *"--no-verify"* ]]; then
     echo "BLOCK: --no-verify is not allowed. Fix the underlying issue instead of bypassing hooks." >&2
     exit 2
   fi

package/hooks/worktree-stop.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Hook: worktree-stop.sh — Stop
+#
+# A session that enters a worktree with EnterWorktree tends to stay there after the
+# task is done, and the next pull or branch switch fails inside it. When the turn
+# ends inside such a worktree with everything committed, block the stop once and ask
+# Claude to leave with ExitWorktree (keep), or to say the task continues.
+#
+# Fires once per commit: a new commit means new progress, so it may ask again.
+# Never fires when the session itself started inside the worktree (ExitWorktree
+# could not leave it) or while there are uncommitted changes (work in progress).
+set +e
+
+main() {
+  local INPUT PROJECT TOP BRANCH HEAD MARKER_DIR MARKER REASON
+  INPUT=$(cat 2>/dev/null)
+  # Second stop of the same turn: Claude already answered the block.
+  echo "$INPUT" | grep -qE '"stop_hook_active"[[:space:]]*:[[:space:]]*true' && return 0
+
+  PROJECT="${CLAUDE_PROJECT_DIR:-}"
+  [ -n "$PROJECT" ] || return 0
+  TOP=$(git rev-parse --show-toplevel 2>/dev/null) || return 0
+
+  # Only worktrees EnterWorktree creates: under the project the session started in.
+  case "$TOP" in
+    "$PROJECT"/.claude/worktrees/*) ;;
+    *) return 0 ;;
+  esac
+
+  [ -z "$(git status --porcelain 2>/dev/null)" ] || return 0
+
+  BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+  HEAD=$(git rev-parse HEAD 2>/dev/null)
+  MARKER_DIR="$PROJECT/.claude/session-state"
+  MARKER="$MARKER_DIR/.worktree-stop"
+  [ "$(cat "$MARKER" 2>/dev/null)" = "$TOP $HEAD" ] && return 0
+  mkdir -p "$MARKER_DIR" 2>/dev/null
+  [ -f "$MARKER_DIR/.gitignore" ] || echo '*' > "$MARKER_DIR/.gitignore"
+  echo "$TOP $HEAD" > "$MARKER"
+
+  REASON="You are still inside the worktree $TOP (branch $BRANCH) and its changes are committed. If the task is finished, push the branch if the task included pushing, then leave with ExitWorktree (action: keep) and tell the user the worktree path and branch. If the task continues, say so in one line and stop."
+  REASON=${REASON//\\/\/}
+  REASON=${REASON//\"/\'}
+  printf '{"decision": "block", "reason": "%s"}\n' "$REASON"
+}
+
+main
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-arcane",
-  "version": "2.12.0",
+  "version": "2.14.0",
   "description": "Skills, agents, hooks and rules for Claude Code — installable via npx claude-code-arcane",
   "type": "module",
   "bin": {

package/profiles/audio.yaml

@@ -41,5 +41,4 @@ permissions:
     - "Glob(*)"
     - "Grep(*)"
   deny:
-    - "Bash(rm -rf *)"
     - "Bash(git push --force*)"

package/profiles/core.yaml

@@ -50,14 +50,14 @@ hooks:
   - detect-division.sh
   - detect-gaps.sh
   - validate-commit.sh
-  - validate-push.sh
-  - validate-secrets.sh
+  - guard.sh
   - validate-assets.sh
   - validate-skill-change.sh
   - notify.sh
   - pre-compact.sh
   - post-compact.sh
   - session-stop.sh
+  - worktree-stop.sh
   - log-agent.sh
   - log-agent-stop.sh
 
@@ -70,10 +70,15 @@ permissions:
     - "Bash(git rev-parse*)"
     - "Bash(ls *)"
     - "Bash(dir *)"
-    - "Bash(gh *)"
+    - "Bash(gh pr *)"
+    - "Bash(gh issue *)"
+    - "Bash(gh run *)"
+    - "Bash(gh repo view*)"
+    - "Bash(gh release view*)"
+    - "Bash(gh search *)"
+    - "Bash(gh auth status*)"
     - "Bash(curl -s*)"
   deny:
-    - "Bash(rm -rf *)"
     - "Bash(git push --force*)"
     - "Bash(git push -f *)"
     - "Bash(git reset --hard*)"

package/profiles/visual-novel.yaml

@@ -51,5 +51,4 @@ permissions:
     - "Glob(*)"
     - "Grep(*)"
   deny:
-    - "Bash(rm -rf *)"
     - "Bash(git push --force*)"

package/rules/implementation-workflow.md

@@ -39,6 +39,30 @@ Use AskUserQuestion exactly like this:
 - **Goal-driven:** Help the user define a verifiable goal statement and 2-4 checkpoints, create tasks, implement toward each checkpoint. No formal plan.
 - **Directo:** Proceed immediately without ceremony.
 
+## Progress file
+
+In **Plan + Goal** and **Goal-driven** mode, keep `.claude/session-state/active.md` up to date. A compaction or a new session loses the conversation, not this file: `session-start.sh` shows its first lines when a session starts and after every compaction.
+
+- **Create it** when the goal is set. If `.claude/session-state/` does not exist yet, create it with a `.gitignore` containing `*`, so the file never lands in a commit.
+- **Update it** at every checkpoint, and always before a compaction.
+- **Close it** when the task ends: set `Status: closed` and record the final verification result.
+- Keep it under 30 lines:
+
+```markdown
+# <task>
+Status: in progress | closed
+Goal: <verifiable outcome>
+Criteria: <how we know it is done>
+Plan:
+- [x] <step done>
+- [ ] <step pending>
+Decisions: <decision> — <why>
+Next: <the next concrete step>
+Not verified: <what has not been checked yet>
+```
+
+Directo and Action Plan tasks do not need it.
+
 ## Before writing new code
 
 In every mode, search in this order and take the first option that fully works:

package/skills/help/SKILL.md

@@ -14,7 +14,7 @@ model: haiku
 
 - Stage: !`cat production/stage.txt 2>/dev/null | tr -d '[:space:]' || echo 'not set'`
 - Latest sprint: !`ls -t production/sprints/*.md 2>/dev/null | head -1 || echo 'none'`
-- Session state: !`head -5 production/session-state/active.md 2>/dev/null || echo 'none'`
+- Session state: !`head -5 .claude/session-state/active.md 2>/dev/null || echo 'none'`
 
 Read-only skill — reports findings, writes no files. Lightweight orientation; for a formal readiness check use `/gate-check`.
 
@@ -29,7 +29,7 @@ Read `.claude/docs/workflow-catalog.yaml` (authoritative phases/steps). Glob `.c
 
 ## Step 3: Read Session Context
 
-Read `production/session-state/active.md` — what was most recently worked on, in-progress tasks, open questions.
+Read `.claude/session-state/active.md` — what was most recently worked on, in-progress tasks, open questions.
 
 ## Step 4: Check Step Completion
 

package/skills/start/SKILL.md

@@ -12,7 +12,7 @@ Entry point para sesiones nuevas. Detecta contexto, hace preguntas clave, rutea
 
 ## Paso 1: Detectar contexto
 
-Escanear en paralelo: Unity (`ProjectSettings/ProjectVersion.txt`), Unreal (`*.uproject`), Web/Node (`package.json`), Go (`go.mod`), Python (`pyproject.toml`/`requirements.txt`), Flutter (`pubspec.yaml`), Rust (`Cargo.toml`), docs (`README.md`, `CLAUDE.md`, `design/`, `docs/`), session state (`production/session-state/active.md`).
+Escanear en paralelo: Unity (`ProjectSettings/ProjectVersion.txt`), Unreal (`*.uproject`), Web/Node (`package.json`), Go (`go.mod`), Python (`pyproject.toml`/`requirements.txt`), Flutter (`pubspec.yaml`), Rust (`Cargo.toml`), docs (`README.md`, `CLAUDE.md`, `design/`, `docs/`), session state (`.claude/session-state/active.md`).
 
 ## Paso 2: Determinar etapa
 
@@ -45,7 +45,7 @@ AskUserQuestion multi-tab:
 
 ## Paso 5: Set session state
 
-Crear `production/session-state/active.md`: project name, division, stage, user role, next action, stack detected, existing artifacts, recommended flow (3 commands).
+Crear `.claude/session-state/active.md`: project name, division, stage, user role, next action, stack detected, existing artifacts, recommended flow (3 commands).
 
 ## Paso 6: First action
 

package/skills/story-done/SKILL.md

@@ -12,7 +12,7 @@ Closes loop between design and implementation. Verifies acceptance criteria, che
 
 ## Phase 1: Find Story
 
-Resolve review mode: `--review` arg → `production/review-mode.txt` → default `lean`. Story source: arg path → `production/session-state/active.md` → most recent sprint file (IN PROGRESS stories) → AskUserQuestion.
+Resolve review mode: `--review` arg → `production/review-mode.txt` → default `lean`. Story source: arg path → `.claude/session-state/active.md` → most recent sprint file (IN PROGRESS stories) → AskUserQuestion.
 
 ## Phase 2: Read Story
 
@@ -55,7 +55,7 @@ BLOCKED → do not proceed, list fixes, offer help.
 
 ## Phase 7: Update Story
 
-Ask approval → edit story: `Status: Complete` + `## Completion Notes` (date, criteria, deviations, test evidence, code review status). Advisory deviations → offer to log in `docs/tech-debt-register.md`. Update `production/sprint-status.yaml` if exists. Append to `production/session-state/active.md`.
+Ask approval → edit story: `Status: Complete` + `## Completion Notes` (date, criteria, deviations, test evidence, code review status). Advisory deviations → offer to log in `docs/tech-debt-register.md`. Update `production/sprint-status.yaml` if exists. Append to `.claude/session-state/active.md`.
 
 ## Phase 8: Surface Next Story
 

package/skills/ux-design/SKILL.md

@@ -38,7 +38,7 @@ If output file exists → read it, show section status table (Complete/Empty/Pla
 
 ## Skeleton Creation
 
-Create output file with `[To be designed]` placeholders for all sections. Update `production/session-state/active.md`.
+Create output file with `[To be designed]` placeholders for all sections. Update `.claude/session-state/active.md`.
 
 > → Read references/spec-sections.md for [section inventories for UX spec, HUD, pattern library, and key section guidance]
 

package/hooks/validate-push.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set +e
-
-main() {
-  local INPUT
-  INPUT=$(cat 2>/dev/null) || true
-
-  local COMMAND
-  COMMAND=$(echo "$INPUT" | grep -oE '"command"\s*:\s*"[^"]*"' | head -1 | sed 's/.*"command"\s*:\s*"//;s/"$//') || true
-
-  [[ -z "$COMMAND" || "$COMMAND" != *"git push"* ]] && return 0
-
-  if [[ "$COMMAND" == *"--force"* || "$COMMAND" == *"-f "* ]]; then
-    if [[ "$COMMAND" == *"main"* || "$COMMAND" == *"master"* ]]; then
-      echo "BLOCK: force push to main/master is prohibited." >&2
-      exit 2
-    fi
-  fi
-}
-main
-exit 0

package/hooks/validate-secrets.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-set +e
-
-main() {
-  local INPUT
-  INPUT=$(cat 2>/dev/null) || true
-
-  local COMMAND
-  COMMAND=$(echo "$INPUT" | grep -oE '"command"\s*:\s*"[^"]*"' | head -1 | sed 's/.*"command"\s*:\s*"//;s/"$//') || true
-
-  [[ -z "$COMMAND" ]] && return 0
-
-  if echo "$COMMAND" | grep -qE '(cat|type|less|more|head|tail)\s+.*\.env' 2>/dev/null; then
-    echo "BLOCK: reading .env files is prohibited for security." >&2
-    exit 2
-  fi
-
-  if echo "$COMMAND" | grep -qE 'curl.*\-d.*(api_key|password|secret|token)=' 2>/dev/null; then
-    echo "WARN: command appears to send credentials over network. Review carefully." >&2
-  fi
-}
-main
-exit 0