claude-launchpad 1.10.1 → 1.12.0

package/dist/{chunk-3OFOCOXM.js → chunk-KPO4YURF.js}

@@ -32,23 +32,31 @@ async function readJsonOrNull(path) {
 }
 
 // src/lib/settings.ts
-import { readFile as readFile6, writeFile as writeFile5, mkdir as mkdir4 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile5, mkdir as mkdir4 } from "fs/promises";
 import { join as join8 } from "path";
 
 // src/lib/output.ts
 import chalk from "chalk";
 
 // src/commands/doctor/fixer.ts
-import { readFile as readFile5, writeFile as writeFile4, mkdir as mkdir3, access as access2 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile4, mkdir as mkdir3 } from "fs/promises";
 import { join as join7 } from "path";
 import { homedir } from "os";
 
 // src/lib/sections.ts
 var SESSION_START_CONTENT = "- ALWAYS read @TASKS.md first \u2014 it tracks progress across sessions\n- Check the Session Log at the bottom of TASKS.md for where we left off\n- Update TASKS.md as you complete work";
 var BACKLOG_CONTENT = "- When a feature is discussed but deferred, add it to BACKLOG.md immediately\n- Never leave future ideas only in TASKS.md or conversation \u2014 they get lost\n- BACKLOG.md is the single source of truth for parked features\n- Every WP uses the 7-field template in BACKLOG.md \u2014 no freeform entries\n- Pull a WP into a sprint = **move**, not copy. A WP lives in exactly one file at a time";
-var STOP_AND_SWARM_CONTENT = "Three failed iterations on the same problem = stop iterating alone.\nOn the fourth attempt, spin up at least 3 parallel agents via the Agent tool, each investigating from a different angle:\n1. Root-cause debug agent\n2. Upstream library/docs research agent\n3. Alternative architecture agent\nWait for all agents to return, synthesize their findings, then act.\nDon't keep guessing in circles \u2014 rotate perspectives.";
+var STOP_AND_SWARM_CONTENT = 'Three failed iterations on the same problem = stop iterating alone.\n(An iteration = an attempted fix that did not change the failing symptom. Announce "Attempt N" when retrying so the count stays visible.)\nFirst, one systematic pass \u2014 it usually resolves the loop without the swarm:\nreproduce the failure, read the FULL error output, state one hypothesis about the root cause, and verify it BEFORE writing any fix.\nOnly if that pass fails, swarm: dispatch at least 3 parallel subagents via the Task tool \u2014 in a single message so they run concurrently \u2014 each investigating from a different angle:\n1. Root-cause debug agent\n2. Upstream library/docs research agent\n3. Alternative architecture agent\nHand each agent the exact repro command, the full error text, and the list of already-failed fixes \u2014 subagents start with empty context.\nWait for all agents to return, synthesize their findings, then act.\nFor re-planning after repeated failure, switch to plan mode instead of attempting again.';
+var STALE_SWARM_PHRASE = "spin up at least 3 parallel agents via the Agent tool";
+var SWARM_PHRASE_REPLACEMENT = "dispatch at least 3 parallel subagents via the Task tool (in a single message so they run concurrently)";
 var OFF_LIMITS_CONTENT = "- Never hardcode secrets \u2014 use environment variables\n- Never write to `.env` files\n- Never expose internal error details in API responses";
 var SKILL_AUTHORING_CONTENT = 'When creating Claude Code skills (.claude/skills/*/SKILL.md):\n\n- Keep SKILL.md under 500 lines \u2014 move reference material to supporting files in the same directory\n- Front-load description (first 250 chars shown in listings) with TRIGGER when / DO NOT TRIGGER when clauses\n- Add allowed-tools in frontmatter to restrict tool access (e.g. Read, Glob, Grep for read-only skills)\n- Add argument-hint in frontmatter showing the expected input format (use $ARGUMENTS or $0, $1 for dynamic input)\n- Set disable-model-invocation: true for skills with side effects (deploy, send messages)\n- Structure as phases: Research, Plan, Execute, Verify with "Done when:" success criteria per phase\n- Handle edge cases and preconditions before execution';
+function sprintReviewsContent(testCommand, lintCommand, superpowers = false) {
+  const known = [testCommand, lintCommand].filter((c) => !!c).map((c) => `\`${c}\``).join(" and ");
+  const verifyLine = known ? `- Run ${known} \u2014 must pass before the sprint-ending commit` : "- Run the project's test and typecheck commands \u2014 they must pass before the sprint-ending commit";
+  return "When all tasks in the current sprint are complete, review before the closing commit:\n- Find the sprint base: `git log --grep 'chore(sprint-' -n 1 --format=%H`\n- Run /code-review on the diff from that base; fix all Critical and Important findings before committing\n- Run /security-review if the sprint touched auth, input handling, or dependencies\n" + verifyLine + "\n- If /code-review is unavailable, do a manual pass: dead code, debug logs, TODO hacks, convention violations, hardcoded values\n" + (superpowers ? "- superpowers detected: invoke superpowers:requesting-code-review for the independent pass (severity-gated)\n" : "- For an independent second pass, dispatch the code-reviewer agent (.claude/agents/code-reviewer.md) with the base/head SHAs\n") + "- Skip only if the sprint was trivial (docs or config-only changes)";
+}
+var TESTING_DISCIPLINE_CONTENT = "Hard-TDD surfaces \u2014 write the failing test BEFORE any implementation for:\n- A new module, command, or public API\n- Any bug fix (regression test from the minimal repro first)\n- Any algorithm or scoring change\nFlexible (tests land in the same commit, order free): docs, config, version bumps, log messages.\nIf unsure which bucket a change falls into, default to test-first.";
 
 // src/lib/detect.ts
 import { join, basename } from "path";
@@ -350,7 +358,7 @@ DerivedData/
 }
 
 // src/commands/init/generators/skill-enhance.ts
-var ENHANCE_SKILL_VERSION = 9;
+var ENHANCE_SKILL_VERSION = 10;
 function generateEnhanceSkill() {
   return [
     "---",
@@ -359,7 +367,7 @@ function generateEnhanceSkill() {
     "  AI-improve your CLAUDE.md based on codebase analysis. Fills in architecture, conventions, guardrails, and suggests hooks and MCP servers.",
     '  TRIGGER when: user runs /lp-enhance, asks to "improve CLAUDE.md", "fill in architecture", or after major refactors.',
     "  DO NOT TRIGGER when: user is editing CLAUDE.md manually, doing normal coding, or running doctor/eval.",
-    "allowed-tools: Read, Glob, Grep, Edit, Write",
+    "allowed-tools: Read, Glob, Grep, Edit, Write, Bash(claude-launchpad doctor:*)",
     "argument-hint: (no arguments needed)",
     "---",
     "",
@@ -467,21 +475,13 @@ function generateEnhanceSkill() {
     "",
     "## Skill Authoring",
     "",
-    "When creating Claude Code skills (.claude/skills/*/SKILL.md):",
-    "",
-    "- Keep SKILL.md under 500 lines - move reference material to supporting files in the same directory",
-    "- Front-load description (first 250 chars shown in listings) with TRIGGER when / DO NOT TRIGGER when clauses",
-    "- Add allowed-tools in frontmatter to restrict tool access (e.g. Read, Glob, Grep for read-only skills)",
-    "- Add argument-hint in frontmatter showing the expected input format (use $ARGUMENTS or $0, $1 for dynamic input)",
-    "- Set disable-model-invocation: true for skills with side effects (deploy, send messages)",
-    '- Structure as phases: Research, Plan, Execute, Verify with "Done when:" success criteria per phase',
-    "- Handle edge cases and preconditions before execution",
+    ...SKILL_AUTHORING_CONTENT.split("\n"),
     "",
     "## Hook review",
     "",
     "Review .claude/settings.json hooks:",
     "- If you see project-specific patterns that deserve hooks, suggest them",
-    "- If no PostCompact hook exists, suggest one that re-injects TASKS.md",
+    "- If the SessionStart matcher misses compact/clear, suggest widening it to startup|resume|compact|clear (PostCompact stdout is never injected into context - context re-injection belongs on SessionStart)",
     "- If no SessionStart hook exists, suggest one that injects TASKS.md",
     "- DO NOT modify settings.json directly. Print exact JSON to add.",
     "",
@@ -683,7 +683,7 @@ ${LP_STUB_CLOSE}`;
 }
 
 // src/commands/doctor/fixer-sprint.ts
-import { writeFile as writeFile2 } from "fs/promises";
+import { writeFile as writeFile2, readFile as readFile2 } from "fs/promises";
 import { join as join3 } from "path";
 
 // src/lib/hook-builder.ts
@@ -696,6 +696,22 @@ function addOrUpdateHook(existingHooks, options) {
   if (alreadyHas) {
     return { hooks: existingHooks ?? {}, added: false };
   }
+  const matcher = options.entry.matcher ?? "";
+  const sameMatcherIdx = hookList.findIndex((g) => String(g.matcher ?? "") === matcher);
+  if (sameMatcherIdx >= 0) {
+    const group = hookList[sameMatcherIdx];
+    const existing = group.hooks ?? [];
+    const incoming = options.entry.hooks;
+    const merged = {
+      ...group,
+      hooks: options.prepend ? [...incoming, ...existing] : [...existing, ...incoming]
+    };
+    const updated2 = hookList.map((g, i) => i === sameMatcherIdx ? merged : g);
+    return {
+      hooks: { ...existingHooks ?? {}, [options.event]: updated2 },
+      added: true
+    };
+  }
   const newEntry = options.entry;
   const updated = options.prepend ? [newEntry, ...hookList] : [...hookList, newEntry];
   return {
@@ -714,7 +730,12 @@ async function addHookToSettings(root, event, dedupKeyword, entry, successMsg) {
   return true;
 }
 
+// src/lib/hook-scripts.ts
+import { writeFile, mkdir, chmod } from "fs/promises";
+import { join as join2 } from "path";
+
 // src/lib/hook-input.ts
+import { execFileSync } from "child_process";
 function jqField(field, fromVar) {
   if (fromVar) {
     return `$(echo "$${fromVar}" | jq -r '.tool_input.${field} // empty' 2>/dev/null)`;
@@ -725,13 +746,24 @@ var ENV_VAR_PATTERN = /\$\{?TOOL_INPUT_(FILE_PATH|COMMAND|NEW_TEXT|CONTENT)/;
 function hasEnvVarHookPattern(commandString) {
   return ENV_VAR_PATTERN.test(commandString);
 }
+var jqChecked = null;
+function isJqAvailable() {
+  if (jqChecked !== null) return jqChecked;
+  try {
+    execFileSync("jq", ["--version"], { stdio: "ignore" });
+    jqChecked = true;
+  } catch {
+    jqChecked = false;
+  }
+  return jqChecked;
+}
 
 // src/lib/hook-scripts.ts
-import { writeFile, mkdir, chmod } from "fs/promises";
-import { join as join2 } from "path";
 var SPRINT_SIZE_CHECK = `#!/usr/bin/env bash
-# Warns when the current sprint is too small (<3) or too large (>7).
-# Sweet spot is 3-6 work packages per sprint. Non-blocking (always exits 0).
+# Warns when the current sprint is too small (<3) or too large (>7 soft; 15 is
+# the hard split trigger enforced by workflow-check). Sweet spot is 3-6 work
+# packages. Runs on SessionStart, whose stdout is injected into context.
+# Non-blocking (always exits 0).
 
 set -u
 tasks="\${1:-TASKS.md}"
@@ -740,8 +772,9 @@ tasks="\${1:-TASKS.md}"
 section=$(sed -n '/^## Current/,/^## /p' "$tasks" 2>/dev/null)
 [ -z "$section" ] && exit 0
 
-unchecked=$(echo "$section" | grep -cF -e '- [ ]' || true)
-checked=$(echo "$section" | grep -cF -e '- [x]' || true)
+# Anchored so placeholder comments containing "- [ ]" don't count as WPs.
+unchecked=$(echo "$section" | grep -cE '^[[:space:]]*- \\[ \\]' || true)
+checked=$(echo "$section" | grep -cE '^[[:space:]]*- \\[[xX]\\]' || true)
 total=$((unchecked + checked))
 
 if [ "$total" -eq 0 ]; then
@@ -757,99 +790,128 @@ if [ "$unchecked" -lt 3 ]; then
 fi
 
 if [ "$unchecked" -gt 7 ]; then
-  echo "NOTE: Current sprint has $unchecked open work packages \u2014 oversized. Move some back to BACKLOG.md (aim 3-6)."
+  echo "NOTE: Current sprint has $unchecked open work packages \u2014 oversized (soft target 3-6; above 15, workflow-check requires a split)."
   exit 0
 fi
 
 exit 0
 `;
 var SPRINT_OPEN_CHECK = `#!/usr/bin/env bash
-# Warns when TASKS.md opens a new sprint block but BACKLOG.md has no staged
-# deletions, i.e. the "remove pulled WPs from BACKLOG in the same edit" rule
-# from CLAUDE.md was skipped. Non-blocking (always exits 0).
+# After a git commit, warns when the commit adds WP checkboxes to
+# '## Current Sprint' without deleting anything from BACKLOG.md \u2014 i.e. the
+# "pull = move, not copy" rule was skipped. Runs on PostToolUse (Bash):
+# PreToolUse has no non-blocking way to reach the model, so instead of
+# blocking the commit we suggest an amend. Warning is emitted as
+# additionalContext JSON \u2014 bare stdout on PostToolUse never reaches the model.
+# Non-blocking (always exits 0).
 
 set -u
+command -v jq >/dev/null 2>&1 || exit 0
 cmd=$(jq -r '.tool_input.command // empty' 2>/dev/null)
 
-# Only act on \`git commit\`, word-boundary match.
+# Only act on \\\`git commit\\\`, word-boundary match.
 echo "$cmd" | grep -qE '(^|[^a-zA-Z0-9_-])git[[:space:]]+commit([[:space:]]|$)' || exit 0
 
-# Nothing staged
-git diff --cached --quiet 2>/dev/null && exit 0
-
-# TASKS.md not staged
-git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -q '^TASKS\\.md$' || exit 0
-
-# Does the staged TASKS.md diff ADD a new \`## Current\` block?
-new_sprint=$(git diff --cached TASKS.md 2>/dev/null | grep -cE '^\\+## Current')
-[ "$new_sprint" -eq 0 ] && exit 0
-
-# If a new sprint was opened, BACKLOG.md should have net deletions.
-backlog_deletions=$(git diff --cached BACKLOG.md 2>/dev/null | grep -cE '^-[^-]')
-if [ "$backlog_deletions" -eq 0 ]; then
-  echo ""
-  echo "WARNING: sprint-open hygiene"
-  echo ""
-  echo "TASKS.md stages a new '## Current' block, but BACKLOG.md has no"
-  echo "staged deletions. When a WP is pulled from BACKLOG.md into a sprint,"
-  echo "remove it from BACKLOG.md in the same edit. Overlap = drift."
-  echo ""
-  echo "If you opened a fresh-scope sprint with no BACKLOG pulls, ignore"
-  echo "this. Otherwise scrub BACKLOG.md before committing."
-  echo ""
+git rev-parse --verify HEAD >/dev/null 2>&1 || exit 0
+
+# The commit must touch TASKS.md and add unchecked WP lines to it.
+git show --name-only --format= HEAD 2>/dev/null | grep -qx 'TASKS.md' || exit 0
+pulled=$(git show --format= HEAD -- TASKS.md 2>/dev/null | grep -cE '^\\+[[:space:]]*- \\[ \\] WP-' || true)
+[ "\${pulled:-0}" -eq 0 ] && exit 0
+
+# A pull commit should also delete the WP bodies from BACKLOG.md.
+backlog_deletions=$(git show --format= HEAD -- BACKLOG.md 2>/dev/null | grep -cE '^-[^-]' || true)
+if [ "\${backlog_deletions:-0}" -eq 0 ]; then
+  jq -n --arg ctx "Sprint-open hygiene: the commit you just made adds WP checkbox(es) to '## Current Sprint' but deletes nothing from BACKLOG.md. Pulling a WP means MOVING it \u2014 delete its entry from BACKLOG.md in the same commit. If these WPs came from BACKLOG.md, scrub it now and run 'git commit --amend'. If this is a fresh-scope sprint with no backlog pulls, ignore this." '{hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:$ctx}}'
 fi
 
 exit 0
 `;
 var WORKFLOW_CHECK = `#!/usr/bin/env bash
 # Warns on BACKLOG.md / TASKS.md drift. Non-blocking (always exits 0).
-#   1. Same WP ID present in BOTH BACKLOG.md and TASKS.md (violates move-not-copy).
+# Warnings are emitted as PostToolUse additionalContext JSON so they reach
+# the model \u2014 bare stdout on PostToolUse only reaches the transcript view.
+#   1. A WP entry lives in a BACKLOG.md P-section AND in '## Current Sprint'
+#      (violates move-not-copy). Changelog + "Depends on:" mentions are fine.
 #   2. TASKS.md longer than 80 lines.
-#   3. \\\`## Current Sprint\\\` contains more than 15 items.
-#   4. \\\`## Session Log\\\` has more than 3 entries.
+#   3. '## Current Sprint' has more than 15 items (hard split trigger).
+#   4. '## Session Log' has more than 3 entries.
+#   5. A pulled WP's "Depends on:" dependency still sits in a P-section.
 
 set -u
+command -v jq >/dev/null 2>&1 || exit 0
 fp=$(jq -r '.tool_input.file_path // empty' 2>/dev/null)
 
 # Only act on edits to BACKLOG.md or TASKS.md.
 echo "$fp" | grep -qE '(^|/)(BACKLOG|TASKS)\\.md$' || exit 0
 
-warn() { printf '%s\\n' "$*"; }
+warnings=""
+warn() { warnings="\${warnings}$*
+"; }
 
-# 1. Duplicate WP IDs across both files.
-if [ -f BACKLOG.md ] && [ -f TASKS.md ]; then
-  dupes=$(grep -oE 'WP-[0-9]{3}' BACKLOG.md 2>/dev/null | sort -u | while read -r wp; do
-    grep -q "$wp" TASKS.md 2>/dev/null && echo "$wp"
-  done)
+# WP IDs that live as entries in BACKLOG P-sections (not Changelog, not Depends-on).
+backlog_ids=""
+if [ -f BACKLOG.md ]; then
+  backlog_ids=$(awk '/^## P[0-3]/{f=1;next} /^## /{f=0} f' BACKLOG.md 2>/dev/null | grep -E '^### ' | grep -oE 'WP-[0-9]{3,}' | sort -u || true)
+fi
+
+# WP IDs in the Current Sprint checklist.
+sprint_ids=""
+if [ -f TASKS.md ]; then
+  sprint_ids=$(awk '/^## Current/{f=1;next} /^## /{f=0} f' TASKS.md 2>/dev/null | grep -oE 'WP-[0-9]{3,}' | sort -u || true)
+fi
+
+# 1. Same WP as a live entry in both files.
+if [ -n "$backlog_ids" ] && [ -n "$sprint_ids" ]; then
+  dupes=$(comm -12 <(printf '%s\\n' "$backlog_ids") <(printf '%s\\n' "$sprint_ids"))
   if [ -n "$dupes" ]; then
-    warn "Workflow bug: WP ID present in BOTH BACKLOG.md and TASKS.md (violates move-not-copy \u2014 see .claude/rules/workflow.md):"
-    printf '%s\\n' "$dupes"
-    warn "Move each listed WP to exactly one file."
+    warn "Workflow bug: WP present in BOTH a BACKLOG.md P-section and '## Current Sprint' (violates move-not-copy \u2014 see .claude/rules/workflow.md): $(printf '%s ' $dupes)\u2014 move each listed WP to exactly one file."
   fi
 fi
 
-# 2. TASKS.md length.
 if [ -f TASKS.md ]; then
+  # 2. TASKS.md length.
   tasks_lines=$(wc -l < TASKS.md 2>/dev/null | tr -d ' ')
   if [ "\${tasks_lines:-0}" -gt 80 ]; then
     warn "TASKS.md is $tasks_lines lines \u2014 should stay under 80. Prune Completed Sprints or Session Log."
   fi
 
-  # 3. Current Sprint size.
-  current_count=$(awk '/^## Current/{flag=1; next} /^## /{flag=0} flag' TASKS.md 2>/dev/null | grep -cE '^[[:space:]]*- \\[[ x]\\]' || true)
+  # 3. Current Sprint size (hard trigger; the soft target is 3-6).
+  current_count=$(awk '/^## Current/{flag=1; next} /^## /{flag=0} flag' TASKS.md 2>/dev/null | grep -cE '^[[:space:]]*- \\[[ xX]\\]' || true)
   if [ "\${current_count:-0}" -gt 15 ]; then
-    warn "## Current Sprint has $current_count items \u2014 split the sprint (see .claude/rules/workflow.md)."
+    warn "'## Current Sprint' has $current_count items \u2014 split the sprint (see .claude/rules/workflow.md)."
   fi
 
   # 4. Session Log size.
   log_count=$(awk '/^## Session Log/{flag=1; next} /^## /{flag=0} flag' TASKS.md 2>/dev/null | grep -cE '^- \\*\\*' || true)
   if [ "\${log_count:-0}" -gt 3 ]; then
-    warn "## Session Log has $log_count entries \u2014 keep to 3 max."
+    warn "'## Session Log' has $log_count entries \u2014 keep to 3 max."
   fi
 fi
 
+# 5. Dependency-aware pulls: the pulled WP's 7-field body left BACKLOG.md, but
+# HEAD's copy (pre-pull) still records its "Depends on:" line.
+if [ -n "$sprint_ids" ] && git rev-parse --verify HEAD >/dev/null 2>&1; then
+  for wp in $sprint_ids; do
+    deps=$( { git show HEAD:BACKLOG.md 2>/dev/null; cat BACKLOG.md 2>/dev/null; } | awk -v id="$wp" '$0 ~ "^### "id" "{f=1;next} /^### /{f=0} f && /Depends on:/{print}' | grep -oE 'WP-[0-9]{3,}' | sort -u || true)
+    for dep in $deps; do
+      if printf '%s\\n' "$backlog_ids" | grep -qx "$dep"; then
+        warn "$wp was pulled into the sprint but its dependency $dep is still in BACKLOG.md \u2014 pull $dep too, or move $wp back until $dep ships."
+      fi
+    done
+  done
+fi
+
+if [ -n "$warnings" ]; then
+  jq -n --arg ctx "$warnings" '{hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:$ctx}}'
+fi
 exit 0
 `;
+var SPRINT_COMPLETE_NUDGE = `fp=${jqField("file_path")}; echo "$fp" | grep -q TASKS.md || exit 0; section=$(sed -n '/^## Current/,/^## /p' TASKS.md 2>/dev/null); [ -z "$section" ] && exit 0; unchecked=$(echo "$section" | grep -cE '^[[:space:]]*- \\[ \\]' || true); checked=$(echo "$section" | grep -cE '^[[:space:]]*- \\[[xX]\\]' || true); [ "$unchecked" -eq 0 ] && [ "$checked" -gt 0 ] && jq -n --arg ctx 'Sprint complete - all Current Sprint tasks are checked off. Run /code-review on the sprint diff (base: the last chore(sprint- commit)) and fix Critical/Important findings before the closing commit. Skip if the sprint was trivial (docs/config only).' '{hookSpecificOutput:{hookEventName:"PostToolUse",additionalContext:$ctx}}'; exit 0`;
+var WORKFLOW_CHECK_WRAPPER = "bash .claude/hooks/workflow-check.sh; exit 0";
+var SPRINT_OPEN_WRAPPER = "bash .claude/hooks/sprint-open-check.sh; exit 0";
+var SPRINT_SIZE_WRAPPER = "bash .claude/hooks/sprint-size-check.sh TASKS.md 2>/dev/null; exit 0";
+var SESSION_START_MATCHER = "startup|resume|compact|clear";
 async function writeSprintHygieneScripts(root) {
   const hooksDir = join2(root, ".claude", "hooks");
   await mkdir(hooksDir, { recursive: true });
@@ -889,40 +951,93 @@ async function createWorktreeInclude(root) {
 async function addSprintSizeHook(root) {
   await writeSprintHygieneScripts(root);
   return addHookToSettings(root, "SessionStart", "sprint-size-check.sh", {
-    matcher: "startup|resume",
-    hooks: [{ type: "command", command: "bash .claude/hooks/sprint-size-check.sh TASKS.md 2>/dev/null; exit 0" }]
+    matcher: SESSION_START_MATCHER,
+    hooks: [{ type: "command", command: SPRINT_SIZE_WRAPPER }]
   }, "Added sprint-size-check hook (warns on microsprint/oversized sprints)");
 }
 async function addSprintOpenHook(root) {
   await writeSprintHygieneScripts(root);
-  return addHookToSettings(root, "PreToolUse", "sprint-open-check.sh", {
+  return addHookToSettings(root, "PostToolUse", "sprint-open-check.sh", {
     matcher: "Bash",
-    hooks: [{ type: "command", command: "bash .claude/hooks/sprint-open-check.sh 2>/dev/null; exit 0" }]
-  }, "Added sprint-open-check hook (warns on new sprint without BACKLOG cleanup)");
+    hooks: [{ type: "command", command: SPRINT_OPEN_WRAPPER }]
+  }, "Added sprint-open-check hook (warns on WP pulls without BACKLOG cleanup)");
 }
 async function addSprintCompleteNudge(root) {
   return addHookToSettings(root, "PostToolUse", "Sprint complete", {
     matcher: "Edit|Write",
-    hooks: [{
-      type: "command",
-      command: `fp=${jqField("file_path")}; echo "$fp" | grep -q TASKS.md || exit 0; section=$(sed -n '/^## Current/,/^## /p' TASKS.md 2>/dev/null); [ -z "$section" ] && exit 0; unchecked=$(echo "$section" | grep -cF '- [ ]' || true); checked=$(echo "$section" | grep -cF '- [x]' || true); [ "$unchecked" -eq 0 ] && [ "$checked" -gt 0 ] && echo 'Sprint complete \u2014 all current tasks done. Consider a quick quality check before committing: scan for dead code, debug artifacts, TODO hacks, and convention violations. Run tests if available. Skip if trivial.'; exit 0`
-    }]
+    hooks: [{ type: "command", command: SPRINT_COMPLETE_NUDGE }]
   }, "Added sprint-complete nudge hook");
 }
 async function addWorkflowCheckHook(root) {
   await writeWorkflowCheckScript(root);
   return addHookToSettings(root, "PostToolUse", "workflow-check.sh", {
     matcher: "Edit|Write",
-    hooks: [{ type: "command", command: "bash .claude/hooks/workflow-check.sh 2>/dev/null; exit 0" }]
+    hooks: [{ type: "command", command: WORKFLOW_CHECK_WRAPPER }]
   }, "Added workflow-check hook (BACKLOG/TASKS staleness warnings)");
 }
+async function migrateSprintOpenHookEvent(root) {
+  const settings = await readSettingsJson(root);
+  if (settings === null) return false;
+  const hooks = settings.hooks ?? {};
+  const preToolUse = hooks.PreToolUse ?? [];
+  let removed = false;
+  const cleaned = preToolUse.map((group) => {
+    const nested = group.hooks ?? [];
+    const filtered = nested.filter((h) => !String(h.command ?? "").includes("sprint-open-check.sh"));
+    if (filtered.length !== nested.length) removed = true;
+    return { ...group, hooks: filtered };
+  }).filter((group) => group.hooks.length > 0);
+  if (!removed) return false;
+  await writeSettingsJson(root, { ...settings, hooks: { ...hooks, PreToolUse: cleaned } });
+  await writeSprintHygieneScripts(root);
+  await addSprintOpenHook(root);
+  log.success("Moved sprint-open-check to PostToolUse (context injection is impossible on PreToolUse)");
+  return true;
+}
+async function upgradeStaleNudge(root) {
+  const settings = await readSettingsJson(root);
+  if (settings === null) return false;
+  const hooks = settings.hooks ?? {};
+  let changed = false;
+  const upgraded = Object.fromEntries(Object.entries(hooks).map(([event, groups]) => [
+    event,
+    groups.map((group) => ({
+      ...group,
+      hooks: (group.hooks ?? []).map((h) => {
+        const cmd = String(h.command ?? "");
+        if (cmd.includes("Sprint complete") && !cmd.includes("additionalContext")) {
+          changed = true;
+          return { ...h, command: SPRINT_COMPLETE_NUDGE };
+        }
+        return h;
+      })
+    }))
+  ]));
+  if (!changed) return false;
+  await writeSettingsJson(root, { ...settings, hooks: upgraded });
+  log.success("Upgraded sprint-complete nudge to additionalContext JSON (was invisible bare stdout)");
+  return true;
+}
+async function refreshHygieneScripts(root) {
+  const scripts = [".claude/hooks/workflow-check.sh", ".claude/hooks/sprint-open-check.sh"];
+  let stale = false;
+  for (const rel of scripts) {
+    const content = await readFile2(join3(root, rel), "utf-8").catch(() => null);
+    if (content !== null && !content.includes("hookSpecificOutput")) stale = true;
+  }
+  if (!stale) return false;
+  await writeSprintHygieneScripts(root);
+  await writeWorkflowCheckScript(root);
+  log.success("Refreshed hygiene scripts (warnings now emitted as additionalContext JSON)");
+  return true;
+}
 
 // src/commands/doctor/fixer-quality.ts
-import { readFile as readFile2, writeFile as writeFile3, mkdir as mkdir2 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, mkdir as mkdir2 } from "fs/promises";
 import { join as join4 } from "path";
 
 // src/commands/init/generators/workflow-rule.ts
-var WORKFLOW_RULE_VERSION = 1;
+var WORKFLOW_RULE_VERSION = 2;
 function generateWorkflowRule() {
   return `---
 paths: ["BACKLOG.md", "TASKS.md"]
@@ -940,14 +1055,14 @@ These rules apply whenever editing \`BACKLOG.md\` or \`TASKS.md\`. The workflow
 
 - Pulled into a sprint \u2192 move (delete from BACKLOG.md, add to TASKS.md under \`## Current Sprint\`) in a single edit.
 - Sprint closed \u2192 the WP leaves TASKS.md entirely (summarized into \`## Completed Sprints\`) and does not return to the backlog.
-- A WP ID appearing in both files at once = bug. A PostToolUse hook warns.
+- A WP entry appearing in both files at once = bug. \`workflow-check.sh\` injects a warning into context when it sees one (Changelog and \`Depends on:\` mentions are fine).
 
 ## WP IDs
 
-- Format: \`WP-NNN\` (three digits, zero-padded).
-- Minted on first entry to \`BACKLOG.md\`.
+- Format: \`WP-NNN\` (three digits, zero-padded; grows to four digits past WP-999).
+- Minted on first entry to \`BACKLOG.md\`; log every mint in \`## Changelog\`: \`YYYY-MM-DD: WP-NNN added (P1)\`.
 - Never reused, never renamed.
-- Highest-used ID lives at the end of \`BACKLOG.md ## Changelog\` \u2014 check there before minting a new one.
+- To find the highest used ID before minting: \`grep -ohE 'WP-[0-9]+' BACKLOG.md TASKS.md | sort -V | tail -1\`.
 
 ## BACKLOG.md structure (mandatory sections, in order)
 
@@ -980,7 +1095,7 @@ These rules apply whenever editing \`BACKLOG.md\` or \`TASKS.md\`. The workflow
 
 ### Changelog discipline
 
-- Every WP promotion, demotion, or deletion gets a one-line entry with the date.
+- Every WP mint, promotion, demotion, or deletion gets a one-line entry with the date.
 - A backlog audit that finds no changelog entries for 30+ days = staleness; force a review.
 
 ## TASKS.md structure (mandatory sections, in order)
@@ -1011,7 +1126,8 @@ These rules apply whenever editing \`BACKLOG.md\` or \`TASKS.md\`. The workflow
 ### Size discipline
 
 - Whole file stays under 80 lines.
-- If \`## Current Sprint\` exceeds 15 checkboxes, the sprint is too big \u2014 split it (move some WPs back to \`BACKLOG.md\` P0).
+- Aim for 3-6 WPs per sprint (soft target \u2014 \`sprint-size-check.sh\` nudges at session start).
+- If \`## Current Sprint\` exceeds 15 checkboxes, the sprint is too big \u2014 split it (hard trigger; \`workflow-check.sh\` warns).
 
 ## Sprint lifecycle (the exact edit sequence)
 
@@ -1021,13 +1137,13 @@ These rules apply whenever editing \`BACKLOG.md\` or \`TASKS.md\`. The workflow
 2. **Same edit:** delete them from \`BACKLOG.md\`, add them to \`TASKS.md ## Current Sprint\`.
 3. Update \`BACKLOG.md ## Changelog\`: \`YYYY-MM-DD: WP-NNN pulled into Sprint SN\`.
 4. Write the sprint plan (outline approach, success criteria, tests to add).
-5. For hard-TDD surfaces, write the test spec **before** implementation.
+5. For hard-TDD surfaces (see "Testing Discipline" in \`.claude/rules/conventions.md\`), write the test spec **before** implementation.
 6. Commit the pull + plan together: \`chore(sprint-N): pull WP-NNN into sprint + plan\`.
 
 ### Closing a sprint (one session, one commit)
 
 1. All \`## Current Sprint\` items checked off, or explicitly moved back to backlog with rationale.
-2. Run your review workflow \u2014 verify typecheck, tests, and convention compliance before declaring done.
+2. Review the sprint diff: find the base with \`git log --grep 'chore(sprint-' -n 1 --format=%H\`, run \`/code-review\` against it, and fix all Critical/Important findings. Then run the project's test and typecheck commands \u2014 both must pass.
 3. Add one-line summary to \`## Completed Sprints\`.
 4. Empty \`## Current Sprint\` back to the placeholder comment.
 5. Update \`## Session Log\` (prune to 3 entries).
@@ -1035,12 +1151,15 @@ These rules apply whenever editing \`BACKLOG.md\` or \`TASKS.md\`. The workflow
 
 ## What triggers a staleness warning
 
-A PostToolUse hook fires warnings on these conditions (treat as bugs):
+\`workflow-check.sh\` (PostToolUse on BACKLOG/TASKS edits) injects warnings into context \u2014 as \`additionalContext\`, so the model actually sees them \u2014 on these conditions (treat as bugs):
 
-- A WP ID appears in both \`BACKLOG.md\` and \`TASKS.md\`.
+- A WP entry lives in both a \`BACKLOG.md\` P-section and \`## Current Sprint\`.
 - \`TASKS.md\` exceeds 80 lines.
 - \`## Current Sprint\` has >15 items.
 - \`## Session Log\` has >3 entries.
+- A pulled WP's \`Depends on:\` dependency still sits in a BACKLOG P-section.
+
+\`sprint-open-check.sh\` (PostToolUse on Bash) additionally warns after a \`git commit\` that pulls WPs into the sprint without deleting anything from \`BACKLOG.md\` \u2014 fix with \`git commit --amend\` before pushing.
 
 ## Do not
 
@@ -1084,7 +1203,7 @@ Reference: https://code.claude.com/docs/en/hooks
 }
 \`\`\`
 
-- \`EventName\`: \`SessionStart\`, \`SessionEnd\`, \`PreToolUse\`, \`PostToolUse\`, \`PostCompact\`, \`PreCompact\`, \`UserPromptSubmit\`, \`Stop\`, etc.
+- \`EventName\`: \`SessionStart\`, \`SessionEnd\`, \`PreToolUse\`, \`PostToolUse\`, \`PostToolUseFailure\`, \`UserPromptSubmit\`, \`Stop\`, \`PermissionRequest\`, \`PreCompact\`, \`PostCompact\`. PostCompact is side-effect-only (stdout is never injected) \u2014 to re-inject context after compaction, use SessionStart with matcher \`compact\`.
 - \`matcher\`: a regex-style string matching tool names (e.g. \`Bash\`, \`Read|Write|Edit\`). Empty string matches all tools for the event. For SessionStart use \`startup\`, \`resume\`, \`clear\`, or \`compact\`.
 - \`hooks\` array: every entry runs in parallel when the matcher fires. Identical command strings are deduplicated automatically.
 
@@ -1253,6 +1372,52 @@ Output goes into the session's context. Always exit 0; SessionStart blocking is
 `;
 }
 
+// src/commands/init/generators/agent-reviewer.ts
+var REVIEWER_AGENT_VERSION = 1;
+function generateReviewerAgent() {
+  return `---
+name: code-reviewer
+description: Independent, fresh-context review of a diff. Use PROACTIVELY before sprint-ending commits. Pass base and head SHAs (find the base with \`git log --grep 'chore(sprint-' -n 1 --format=%H\`).
+tools: Read, Glob, Grep, Bash
+---
+
+<!-- lp-reviewer-version: ${REVIEWER_AGENT_VERSION} -->
+
+You are an independent senior code reviewer. You did NOT write this code \u2014
+review it with fresh eyes and no attachment to the choices made.
+
+## Input
+
+Base and head SHAs (or a branch/range). If none given, review the working
+tree against HEAD.
+
+## Process
+
+1. \`git diff --stat <base>..<head>\` for the shape, then read the full diff.
+2. Read surrounding source for anything the diff touches \u2014 a hunk that looks
+   fine in isolation can break an invariant defined two functions up.
+3. For each suspected bug, verify against the actual code before reporting \u2014
+   no findings from pattern-matching alone.
+4. Check: correctness, security (injection, secrets, permissions), error
+   handling, convention violations (see CLAUDE.md and .claude/rules/), dead
+   code, debug artifacts, missing or weakened tests.
+
+## Output (exactly these sections)
+
+- **Strengths** \u2014 what is genuinely good; be brief.
+- **Critical** \u2014 bugs, security holes, data loss. Must be fixed before commit.
+- **Important** \u2014 incorrect edge cases, convention breaks, silent failures.
+  Must be fixed before commit.
+- **Minor** \u2014 polish; may be deferred to the backlog.
+- **Assessment** \u2014 2-3 sentences: ship, fix-then-ship, or rethink.
+
+For every Critical/Important finding give file:line and a concrete failure
+scenario (inputs/state \u2192 wrong behavior). Do not pad: an empty Critical
+section is a valid, good result. Never soften a finding because the fix is
+inconvenient.
+`;
+}
+
 // src/commands/doctor/fixer-quality.ts
 async function createWorkflowRule(root) {
   const rulesDir = join4(root, ".claude", "rules");
@@ -1263,6 +1428,32 @@ async function createWorkflowRule(root) {
   log.success("Created .claude/rules/workflow.md (path-scoped BACKLOG/TASKS workflow rules)");
   return true;
 }
+async function createReviewerAgent(root) {
+  const agentsDir = join4(root, ".claude", "agents");
+  const agentPath = join4(agentsDir, "code-reviewer.md");
+  if (await fileExists(agentPath)) return false;
+  await mkdir2(agentsDir, { recursive: true });
+  await writeFile3(agentPath, generateReviewerAgent());
+  log.success("Created .claude/agents/code-reviewer.md (fresh-context independent reviewer)");
+  return true;
+}
+async function updateWorkflowRule(root) {
+  const workflowPath = join4(root, ".claude", "rules", "workflow.md");
+  const content = await readFile3(workflowPath, "utf-8").catch(() => null);
+  if (content === null) return false;
+  if (!/<!-- lp-workflow-version: \d+ -->/.test(content)) return false;
+  await writeFile3(workflowPath, generateWorkflowRule());
+  log.success("Updated .claude/rules/workflow.md to the latest version");
+  return true;
+}
+async function fixStaleSwarmPhrase(root) {
+  const claudeMdPath = join4(root, "CLAUDE.md");
+  const content = await readFile3(claudeMdPath, "utf-8").catch(() => null);
+  if (content === null || !content.includes(STALE_SWARM_PHRASE)) return false;
+  await writeFile3(claudeMdPath, content.replaceAll(STALE_SWARM_PHRASE, SWARM_PHRASE_REPLACEMENT));
+  log.success("Modernized Stop-and-Swarm wording (Agent tool \u2192 Task tool subagents)");
+  return true;
+}
 async function createHooksRule(root) {
   const rulesDir = join4(root, ".claude", "rules");
   const hooksPath = join4(rulesDir, "hooks.md");
@@ -1295,7 +1486,7 @@ async function collapseMemoryHeadings(root) {
   const claudeMdPath = join4(root, "CLAUDE.md");
   let content;
   try {
-    content = await readFile2(claudeMdPath, "utf-8");
+    content = await readFile3(claudeMdPath, "utf-8");
   } catch {
     return false;
   }
@@ -1366,21 +1557,63 @@ async function addForcePushProtection(root) {
     }]
   }, "Added force-push protection hook (PreToolUse \u2192 Bash)");
 }
-async function addPostCompactHook(root) {
-  return addHookToSettings(root, "PostCompact", "TASKS.md", {
-    matcher: "",
-    hooks: [{ type: "command", command: "cat TASKS.md 2>/dev/null; exit 0" }]
-  }, "Added PostCompact hook (re-injects TASKS.md after compaction)");
+async function migratePostCompactHook(root) {
+  const settings = await readSettingsJson(root);
+  if (settings === null) return false;
+  const hooks = settings.hooks ?? {};
+  let changed = false;
+  const postCompact = hooks.PostCompact ?? [];
+  const kept = postCompact.map((group) => {
+    const nested = group.hooks ?? [];
+    const filtered = nested.filter((h) => !String(h.command ?? "").includes("TASKS.md"));
+    if (filtered.length !== nested.length) changed = true;
+    return { ...group, hooks: filtered };
+  }).filter((group) => group.hooks.length > 0);
+  const rest = { ...hooks };
+  if (kept.length > 0) rest.PostCompact = kept;
+  else delete rest.PostCompact;
+  const withMatcher = ensureCompactMatcher(rest);
+  if (withMatcher.changed) changed = true;
+  if (!changed) return false;
+  await writeSettingsJson(root, { ...settings, hooks: withMatcher.hooks });
+  log.success("Moved TASKS.md re-injection off PostCompact (stdout not injected there) \u2192 SessionStart compact/clear matcher");
+  return true;
+}
+async function addCompactMatcherHook(root) {
+  const settings = await readSettingsJson(root);
+  if (settings === null) return false;
+  const hooks = settings.hooks ?? {};
+  const result = ensureCompactMatcher(hooks);
+  if (!result.changed) return false;
+  await writeSettingsJson(root, { ...settings, hooks: result.hooks });
+  log.success("SessionStart matcher now covers compact/clear (session continuity after compaction)");
+  return true;
+}
+function ensureCompactMatcher(hooks) {
+  const sessionStart = hooks.SessionStart ?? [];
+  if (sessionStart.some((g) => String(g.matcher ?? "").includes("compact"))) {
+    return { hooks, changed: false };
+  }
+  const idx = sessionStart.findIndex((g) => {
+    const nested = g.hooks;
+    return nested?.some((h) => String(h.command ?? "").includes("TASKS.md"));
+  });
+  if (idx === -1) {
+    const entry = { matcher: SESSION_START_MATCHER, hooks: [{ type: "command", command: "cat TASKS.md 2>/dev/null; exit 0" }] };
+    return { hooks: { ...hooks, SessionStart: [...sessionStart, entry] }, changed: true };
+  }
+  const widened = sessionStart.map((g, i) => i === idx ? { ...g, matcher: SESSION_START_MATCHER } : g);
+  return { hooks: { ...hooks, SessionStart: widened }, changed: true };
 }
 async function addSessionStartHook(root) {
   return addHookToSettings(root, "SessionStart", "TASKS.md", {
-    matcher: "startup|resume",
+    matcher: SESSION_START_MATCHER,
     hooks: [{ type: "command", command: "cat TASKS.md 2>/dev/null; exit 0" }]
-  }, "Added SessionStart hook (injects TASKS.md at startup)");
+  }, "Added SessionStart hook (injects TASKS.md at startup/resume/compact/clear)");
 }
 
 // src/commands/doctor/fixer-hook-input.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import { join as join5 } from "path";
 function rewriteEnvVarHookCommand(cmd) {
   if (!hasEnvVarHookPattern(cmd)) return null;
@@ -1394,7 +1627,7 @@ function rewriteEnvVarHookCommand(cmd) {
     return `cmd=${jqField("command")}; echo "$cmd" | grep -qE 'push.*--force|push.*-f' && { echo 'WARNING: Force push detected \u2014 this can destroy remote history' >&2; exit 2; }; exit 0`;
   }
   if (cmd.includes("Sprint complete") && cmd.includes("TASKS.md")) {
-    return `fp=${jqField("file_path")}; echo "$fp" | grep -q TASKS.md || exit 0; section=$(sed -n '/^## Current/,/^## /p' TASKS.md 2>/dev/null); [ -z "$section" ] && exit 0; unchecked=$(echo "$section" | grep -cF '- [ ]' || true); checked=$(echo "$section" | grep -cF '- [x]' || true); [ "$unchecked" -eq 0 ] && [ "$checked" -gt 0 ] && echo 'Sprint complete \u2014 all current tasks done. Consider a quick quality check before committing: scan for dead code, debug artifacts, TODO hacks, and convention violations. Run tests if available. Skip if trivial.'; exit 0`;
+    return SPRINT_COMPLETE_NUDGE;
   }
   const formatMatch = cmd.match(/ext=\$\{TOOL_INPUT_FILE_PATH##\*\.\};\s*\((.+?)\)\s*&&\s*(.+?)\s*"\$TOOL_INPUT_FILE_PATH"/);
   if (formatMatch) {
@@ -1428,7 +1661,7 @@ function rewriteSettingsHooks(settings) {
 async function rewriteWrapperScript(scriptPath, rewriter) {
   let content;
   try {
-    content = await readFile3(scriptPath, "utf-8");
+    content = await readFile4(scriptPath, "utf-8");
   } catch {
     return false;
   }
@@ -1461,7 +1694,7 @@ async function rewriteEnvVarHooks(root) {
 }
 
 // src/commands/doctor/fixer-memory.ts
-import { readFile as readFile4 } from "fs/promises";
+import { readFile as readFile5 } from "fs/promises";
 import { join as join6 } from "path";
 async function addPlacementHook(root, placement, event, dedupKeyword, entry, prepend, successMsg) {
   const read = placement === "local" ? readSettingsLocalJson : readSettingsJson;
@@ -1618,7 +1851,7 @@ async function addAllowedMcpServers(root, placement) {
   }
   const mcpJsonPath = join6(root, ".mcp.json");
   try {
-    const mcpJson = JSON.parse(await readFile4(mcpJsonPath, "utf-8"));
+    const mcpJson = JSON.parse(await readFile5(mcpJsonPath, "utf-8"));
     const mcpServers = mcpJson.mcpServers;
     if (mcpServers && typeof mcpServers === "object") {
       for (const name of Object.keys(mcpServers)) serverNames.add(name);
@@ -1679,20 +1912,27 @@ var FIX_TABLE = [
   } },
   { analyzer: "Quality", match: "Session Start", fix: (root) => addClaudeMdSection(root, "## Session Start", wrapStub(SESSION_START_CONTENT)) },
   { analyzer: "Quality", match: "Backlog", fix: (root) => addClaudeMdSection(root, "## Backlog", wrapStub(BACKLOG_CONTENT)) },
+  { analyzer: "Quality", match: "Stop-and-Swarm section is outdated", fix: (root) => fixStaleSwarmPhrase(root) },
   { analyzer: "Quality", match: "Stop-and-Swarm", fix: (root) => addClaudeMdSection(root, "## Stop-and-Swarm", wrapStub(STOP_AND_SWARM_CONTENT)) },
+  { analyzer: "Rules", match: "workflow.md rule is outdated", fix: (root) => updateWorkflowRule(root) },
+  { analyzer: "Rules", match: "No .claude/agents/code-reviewer.md", fix: (root) => createReviewerAgent(root) },
   { analyzer: "Quality", match: "Duplicate ## Memory", fix: (root) => collapseMemoryHeadings(root) },
   { analyzer: "Rules", match: "No BACKLOG.md", fix: (root) => createBacklogMd(root) },
   { analyzer: "Rules", match: "No .claudeignore", fix: (root, detected) => createClaudeignore(root, detected) },
   { analyzer: "Rules", match: "No .claude/rules/workflow.md", fix: (root) => createWorkflowRule(root) },
   { analyzer: "Rules", match: "No .claude/rules/hooks.md", fix: (root) => createHooksRule(root) },
   { analyzer: "Rules", match: "No .claude/rules/", fix: (root) => createStarterRules(root) },
-  { analyzer: "Hooks", match: "PostCompact", fix: (root) => addPostCompactHook(root) },
+  { analyzer: "Hooks", match: "PostCompact hooks can't inject context", fix: (root) => migratePostCompactHook(root) },
+  { analyzer: "Hooks", match: "compact matcher", fix: (root) => addCompactMatcherHook(root) },
   { analyzer: "Permissions", match: "force-push", fix: (root) => addForcePushProtection(root) },
   { analyzer: "Permissions", match: "Credential files not blocked", fix: (root) => addCredentialDenyRules(root) },
   { analyzer: "Permissions", match: "Bypass permissions mode", fix: (root) => addBypassDisable(root) },
-  { analyzer: "Permissions", match: "Filesystem sandbox enabled", fix: (root) => removeSandboxSettings(root) },
+  { analyzer: "Permissions", match: "Sandbox lacks a write grant", fix: (root) => addSandboxMemoryWriteGrant(root) },
   { analyzer: "Permissions", match: ".env is protected by hooks but not in .claudeignore", fix: (root) => addEnvToClaudeignore(root) },
   { analyzer: "Permissions", match: ".worktreeinclude is missing or empty", fix: (root) => createWorktreeInclude(root) },
+  { analyzer: "Hooks", match: "registered on PreToolUse", fix: (root) => migrateSprintOpenHookEvent(root) },
+  { analyzer: "Hooks", match: "nudge uses bare stdout", fix: (root) => upgradeStaleNudge(root) },
+  { analyzer: "Hooks", match: "Outdated hygiene script", fix: (root) => refreshHygieneScripts(root) },
   { analyzer: "Hooks", match: "sprint-size-check", fix: (root) => addSprintSizeHook(root) },
   { analyzer: "Hooks", match: "sprint-open-check", fix: (root) => addSprintOpenHook(root) },
   { analyzer: "Hooks", match: "sprint-complete nudge", fix: (root) => addSprintCompleteNudge(root) },
@@ -1759,20 +1999,30 @@ async function addBypassDisable(root) {
   log.success("Added disableBypassPermissionsMode: disable");
   return true;
 }
-async function removeSandboxSettings(root) {
+async function addSandboxMemoryWriteGrant(root) {
   const settings = await readSettingsJson(root);
   if (settings === null) return false;
-  if (settings.sandbox === void 0) return false;
-  const { sandbox: _sandbox, ...rest } = settings;
-  await writeSettingsJson(root, rest);
-  log.success("Removed sandbox block from settings.json");
+  const sandbox = settings.sandbox;
+  if (sandbox === void 0) return false;
+  const filesystem = sandbox.filesystem ?? {};
+  const allowWrite = filesystem.allowWrite ?? [];
+  if (allowWrite.some((p) => p.includes(".agentic-memory"))) return false;
+  const updated = {
+    ...settings,
+    sandbox: {
+      ...sandbox,
+      filesystem: { ...filesystem, allowWrite: [...allowWrite, "~/.agentic-memory"] }
+    }
+  };
+  await writeSettingsJson(root, updated);
+  log.success("Added ~/.agentic-memory to sandbox.filesystem.allowWrite (sandbox stays enabled)");
   return true;
 }
 async function addEnvToClaudeignore(root) {
   const ignorePath = join7(root, ".claudeignore");
   let content;
   try {
-    content = await readFile5(ignorePath, "utf-8");
+    content = await readFile6(ignorePath, "utf-8");
   } catch {
     return false;
   }
@@ -1786,7 +2036,7 @@ async function addClaudeMdSection(root, heading, content, targetPath) {
   const claudeMdPath = targetPath ?? join7(root, "CLAUDE.md");
   let existing;
   try {
-    existing = await readFile5(claudeMdPath, "utf-8");
+    existing = await readFile6(claudeMdPath, "utf-8");
   } catch {
     if (!targetPath) return false;
     await mkdir3(join7(root, ".claude"), { recursive: true });
@@ -1808,11 +2058,7 @@ ${content}
 }
 async function createBacklogMd(root) {
   const backlogPath = join7(root, "BACKLOG.md");
-  try {
-    await access2(backlogPath);
-    return false;
-  } catch {
-  }
+  if (await fileExists(backlogPath)) return false;
   const name = root.split("/").pop() ?? "Project";
   await writeFile4(backlogPath, generateBacklogMd({ name, description: "" }));
   log.success("Generated BACKLOG.md (WP template + P0\u2013P3 sections + changelog)");
@@ -1820,11 +2066,7 @@ async function createBacklogMd(root) {
 }
 async function createClaudeignore(root, detected) {
   const ignorePath = join7(root, ".claudeignore");
-  try {
-    await access2(ignorePath);
-    return false;
-  } catch {
-  }
+  if (await fileExists(ignorePath)) return false;
   const content = generateClaudeignore(detected);
   await writeFile4(ignorePath, content);
   log.success("Generated .claudeignore with language-specific ignore patterns");
@@ -1837,11 +2079,7 @@ ${SKILL_AUTHORING_CONTENT}
 `;
 async function createStarterRules(root) {
   const rulesDir = join7(root, ".claude", "rules");
-  try {
-    await access2(rulesDir);
-    return false;
-  } catch {
-  }
+  if (await fileExists(rulesDir)) return false;
   await mkdir3(rulesDir, { recursive: true });
   await writeFile4(
     join7(rulesDir, "conventions.md"),
@@ -1860,7 +2098,7 @@ async function addSkillAuthoringConventions(root) {
   const conventionsPath = join7(root, ".claude", "rules", "conventions.md");
   let content;
   try {
-    content = await readFile5(conventionsPath, "utf-8");
+    content = await readFile6(conventionsPath, "utf-8");
   } catch {
     return false;
   }
@@ -1997,7 +2235,7 @@ function renderDoctorReport(results, options) {
 async function readJsonFile(path) {
   let raw;
   try {
-    raw = await readFile6(path, "utf-8");
+    raw = await readFile7(path, "utf-8");
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") return {};
@@ -2033,8 +2271,11 @@ export {
   SESSION_START_CONTENT,
   BACKLOG_CONTENT,
   STOP_AND_SWARM_CONTENT,
+  STALE_SWARM_PHRASE,
   OFF_LIMITS_CONTENT,
   SKILL_AUTHORING_CONTENT,
+  sprintReviewsContent,
+  TESTING_DISCIPLINE_CONTENT,
   fileExists,
   readFileOrNull,
   detectProject,
@@ -2051,14 +2292,22 @@ export {
   addOrUpdateHook,
   jqField,
   hasEnvVarHookPattern,
+  isJqAvailable,
+  SPRINT_COMPLETE_NUDGE,
+  WORKFLOW_CHECK_WRAPPER,
+  SPRINT_OPEN_WRAPPER,
+  SPRINT_SIZE_WRAPPER,
+  SESSION_START_MATCHER,
   writeSprintHygieneScripts,
   writeWorkflowCheckScript,
+  WORKFLOW_RULE_VERSION,
   generateWorkflowRule,
   generateHooksRule,
+  generateReviewerAgent,
   applyFixes,
   log,
   printBanner,
   printScoreCard,
   renderDoctorReport
 };
-//# sourceMappingURL=chunk-3OFOCOXM.js.map
+//# sourceMappingURL=chunk-KPO4YURF.js.map