codebyplan 1.5.1 → 1.8.0

package/templates/hooks/cbp-test-hooks.sh

@@ -0,0 +1,320 @@
+#!/bin/bash
+# @hook: NOT-A-HOOK (test suite for plugin hooks; invoked by cbp-auto-test-hooks.sh)
+# Purpose: Test suite for plugin's shipped hooks. Invoked by cbp-auto-test-hooks.sh whenever a
+#          plugin hook file is edited. Not a PreToolUse/PostToolUse/Notification hook itself —
+#          do NOT register in hooks.json hooks[].
+# Run manually: bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-test-hooks.sh
+# Run by: ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-auto-test-hooks.sh (PostToolUse Edit|Write)
+#
+# Exit 0 = all tests pass, Exit 1 = some tests failed
+
+# Don't use set -e because ((VAR++)) returns 1 when VAR=0
+
+HOOKS_DIR="$(dirname "$0")"
+REPO_ROOT="${CLAUDE_PROJECT_DIR:-}"
+PASSED=0
+FAILED=0
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+test_result() {
+  local name="$1"
+  local expected="$2"
+  local actual="$3"
+
+  if [ "$expected" = "$actual" ]; then
+    echo -e "${GREEN}PASS${NC}: $name"
+    PASSED=$((PASSED + 1))
+  else
+    echo -e "${RED}FAIL${NC}: $name (expected: $expected, got: $actual)"
+    FAILED=$((FAILED + 1))
+  fi
+}
+
+echo "=== PLUGIN HOOK TEST SUITE ==="
+echo ""
+
+# ===== HOOK STRUCTURE VALIDATION =====
+echo "## Hook Structure Validation"
+
+# Check all hooks have required header comments (for documentation)
+for hook_file in "$HOOKS_DIR"/*.sh; do
+  hook_name=$(basename "$hook_file" .sh)
+
+  # Skip utility scripts (recursion-guard) and statusline (different header format)
+  case "$hook_name" in
+    cbp-test-hooks|cbp-auto-test-hooks)
+      continue
+      ;;
+    cbp-statusline)
+      # StatusLine script — not a hook, uses different header format
+      if grep -q '^# Claude Code Status Line' "$hook_file"; then
+        test_result "$hook_name has header comments" "passed" "passed"
+      else
+        test_result "$hook_name has header comments" "passed" "missing"
+      fi
+      continue
+      ;;
+  esac
+
+  # Check for header comments (required for documentation generation).
+  # Accept either marker convention used across the plugin's hooks:
+  #   - "# Hook:" + "# Purpose:" (used by notify, auto-test-hooks, etc.)
+  #   - "# @event:" + a description line (used by maestro-yaml-validate, etc.)
+  if (grep -q '^# Hook:' "$hook_file" && grep -q '^# Purpose:' "$hook_file") \
+     || grep -q '^# @event:' "$hook_file"; then
+    test_result "$hook_name has header comments" "passed" "passed"
+  else
+    test_result "$hook_name has header comments" "passed" "missing"
+  fi
+done
+
+echo ""
+
+# ===== FUNCTIONAL SMOKE TESTS =====
+echo "## Functional Smoke Tests"
+
+# cbp-notify.sh — graceful-degrade: exit 0 whether or not terminal-notifier is installed
+ACTUAL_EXIT=$(echo '{"message":"test","cwd":"/tmp"}' | bash "$HOOKS_DIR/cbp-notify.sh" >/dev/null 2>&1; echo $?)
+if [ "$ACTUAL_EXIT" = "0" ]; then
+  test_result "cbp-notify.sh graceful-degrade exits 0" "passed" "passed"
+else
+  test_result "cbp-notify.sh graceful-degrade exits 0" "passed" "failed"
+fi
+
+# cbp-lint-format-on-edit.sh — graceful-degrade: CLAUDE_PROJECT_DIR unset → exit 0
+if [ ! -f "$HOOKS_DIR/cbp-lint-format-on-edit.sh" ]; then
+  test_result "cbp-lint-format-on-edit.sh present" "passed" "missing"
+else
+  ACTUAL_EXIT=$(env -u CLAUDE_PROJECT_DIR bash "$HOOKS_DIR/cbp-lint-format-on-edit.sh" <<< '{"tool_input":{"file_path":"/tmp/dummy.ts"}}' >/dev/null 2>&1; echo $?)
+  if [ "$ACTUAL_EXIT" = "0" ]; then
+    test_result "cbp-lint-format-on-edit.sh graceful-degrade exits 0" "passed" "passed"
+  else
+    test_result "cbp-lint-format-on-edit.sh graceful-degrade exits 0" "passed" "failed"
+  fi
+fi
+
+# cbp-test-coverage-gate.sh — fast-path: not a commit → exit 0
+if [ ! -f "$HOOKS_DIR/cbp-test-coverage-gate.sh" ]; then
+  test_result "cbp-test-coverage-gate.sh present" "passed" "missing"
+else
+  ACTUAL_EXIT=$(echo '{"tool_input":{"command":"git status"}}' | bash "$HOOKS_DIR/cbp-test-coverage-gate.sh" >/dev/null 2>&1; echo $?)
+  if [ "$ACTUAL_EXIT" = "0" ]; then
+    test_result "cbp-test-coverage-gate.sh fast-path exits 0" "passed" "passed"
+  else
+    test_result "cbp-test-coverage-gate.sh fast-path exits 0" "passed" "failed"
+  fi
+fi
+
+# cbp-pre-commit-quality-gate.sh — fast-path: not a commit → exit 0
+if [ ! -f "$HOOKS_DIR/cbp-pre-commit-quality-gate.sh" ]; then
+  test_result "cbp-pre-commit-quality-gate.sh present" "passed" "missing"
+else
+  ACTUAL_EXIT=$(echo '{"tool_input":{"command":"git status"}}' | bash "$HOOKS_DIR/cbp-pre-commit-quality-gate.sh" >/dev/null 2>&1; echo $?)
+  if [ "$ACTUAL_EXIT" = "0" ]; then
+    test_result "cbp-pre-commit-quality-gate.sh fast-path exits 0" "passed" "passed"
+  else
+    test_result "cbp-pre-commit-quality-gate.sh fast-path exits 0" "passed" "failed"
+  fi
+fi
+
+# cbp-maestro-yaml-validate.sh — fast-path: not maestro YAML → exit 0
+if [ ! -f "$HOOKS_DIR/cbp-maestro-yaml-validate.sh" ]; then
+  test_result "cbp-maestro-yaml-validate.sh present" "passed" "missing"
+else
+  ACTUAL_EXIT=$(echo '{"tool_input":{"file_path":"/tmp/foo.txt"}}' | bash "$HOOKS_DIR/cbp-maestro-yaml-validate.sh" >/dev/null 2>&1; echo $?)
+  if [ "$ACTUAL_EXIT" = "0" ]; then
+    test_result "cbp-maestro-yaml-validate.sh fast-path exits 0" "passed" "passed"
+  else
+    test_result "cbp-maestro-yaml-validate.sh fast-path exits 0" "passed" "failed"
+  fi
+fi
+
+# cbp-auto-test-hooks.sh — fast-path: not a hook file → exit 0
+ACTUAL_EXIT=$(echo '{"tool_input":{"file_path":"/tmp/foo.txt"}}' | bash "$HOOKS_DIR/cbp-auto-test-hooks.sh" >/dev/null 2>&1; echo $?)
+if [ "$ACTUAL_EXIT" = "0" ]; then
+  test_result "cbp-auto-test-hooks.sh fast-path exits 0" "passed" "passed"
+else
+  test_result "cbp-auto-test-hooks.sh fast-path exits 0" "passed" "failed"
+fi
+
+echo ""
+
+# ===== NEW HOOK SMOKE TESTS =====
+echo "## New Hook Smoke Tests (CHK-131)"
+
+# --- validate-git-stash-deny.sh ---
+
+# Existence + shebang + scope marker
+if [ ! -f "$HOOKS_DIR/validate-git-stash-deny.sh" ]; then
+  test_result "validate-git-stash-deny.sh present" "passed" "missing"
+else
+  test_result "validate-git-stash-deny.sh present" "passed" "passed"
+
+  FIRST_LINE=$(head -1 "$HOOKS_DIR/validate-git-stash-deny.sh")
+  if echo "$FIRST_LINE" | grep -q '^#!/'; then
+    test_result "validate-git-stash-deny.sh has shebang" "passed" "passed"
+  else
+    test_result "validate-git-stash-deny.sh has shebang" "passed" "missing"
+  fi
+
+  if grep -q '@scope: org-shared' "$HOOKS_DIR/validate-git-stash-deny.sh"; then
+    test_result "validate-git-stash-deny.sh has @scope: org-shared" "passed" "passed"
+  else
+    test_result "validate-git-stash-deny.sh has @scope: org-shared" "passed" "missing"
+  fi
+
+  FIXTURES_DIR="$HOOKS_DIR/__test-fixtures__/validate-git-stash-deny"
+  if [ -d "$FIXTURES_DIR" ]; then
+    # stash-pop.json — should be blocked (exit 2)
+    ACTUAL_EXIT=$(bash "$HOOKS_DIR/validate-git-stash-deny.sh" < "$FIXTURES_DIR/stash-pop.json" >/dev/null 2>&1; echo $?)
+    if [ "$ACTUAL_EXIT" = "2" ]; then
+      test_result "validate-git-stash-deny.sh blocks git stash pop (exit 2)" "passed" "passed"
+    else
+      test_result "validate-git-stash-deny.sh blocks git stash pop (exit 2)" "passed" "failed (exit $ACTUAL_EXIT)"
+    fi
+
+    # stash-apply.json — should be blocked (exit 2)
+    ACTUAL_EXIT=$(bash "$HOOKS_DIR/validate-git-stash-deny.sh" < "$FIXTURES_DIR/stash-apply.json" >/dev/null 2>&1; echo $?)
+    if [ "$ACTUAL_EXIT" = "2" ]; then
+      test_result "validate-git-stash-deny.sh blocks git stash apply (exit 2)" "passed" "passed"
+    else
+      test_result "validate-git-stash-deny.sh blocks git stash apply (exit 2)" "passed" "failed (exit $ACTUAL_EXIT)"
+    fi
+
+    # git-status.json — should be allowed (exit 0)
+    ACTUAL_EXIT=$(bash "$HOOKS_DIR/validate-git-stash-deny.sh" < "$FIXTURES_DIR/git-status.json" >/dev/null 2>&1; echo $?)
+    if [ "$ACTUAL_EXIT" = "0" ]; then
+      test_result "validate-git-stash-deny.sh allows git status (exit 0)" "passed" "passed"
+    else
+      test_result "validate-git-stash-deny.sh allows git status (exit 0)" "passed" "failed (exit $ACTUAL_EXIT)"
+    fi
+
+    # stash-with-c.json — git -C <path> stash — should be blocked (exit 2)
+    if [ -f "$FIXTURES_DIR/stash-with-c.json" ]; then
+      EXIT_CODE=$(bash "$HOOKS_DIR/validate-git-stash-deny.sh" < "$FIXTURES_DIR/stash-with-c.json" >/dev/null 2>&1; echo $?)
+      if [ "$EXIT_CODE" = "2" ]; then
+        test_result "validate-git-stash-deny.sh blocks git -C <path> stash (exit 2)" "passed" "passed"
+      else
+        test_result "validate-git-stash-deny.sh blocks git -C <path> stash (exit 2)" "passed" "failed (exit $EXIT_CODE)"
+      fi
+    fi
+  else
+    test_result "validate-git-stash-deny.sh fixtures dir present" "passed" "missing"
+  fi
+fi
+
+# --- cbp-mcp-worktree-inject.sh ---
+
+if [ ! -f "$HOOKS_DIR/cbp-mcp-worktree-inject.sh" ]; then
+  test_result "cbp-mcp-worktree-inject.sh present" "passed" "missing"
+else
+  test_result "cbp-mcp-worktree-inject.sh present" "passed" "passed"
+
+  FIRST_LINE=$(head -1 "$HOOKS_DIR/cbp-mcp-worktree-inject.sh")
+  if echo "$FIRST_LINE" | grep -q '^#!/'; then
+    test_result "cbp-mcp-worktree-inject.sh has shebang" "passed" "passed"
+  else
+    test_result "cbp-mcp-worktree-inject.sh has shebang" "passed" "missing"
+  fi
+
+  if grep -q '@scope: org-shared' "$HOOKS_DIR/cbp-mcp-worktree-inject.sh"; then
+    test_result "cbp-mcp-worktree-inject.sh has @scope: org-shared" "passed" "passed"
+  else
+    test_result "cbp-mcp-worktree-inject.sh has @scope: org-shared" "passed" "missing"
+  fi
+
+  FIXTURES_DIR="$HOOKS_DIR/__test-fixtures__/cbp-mcp-worktree-inject"
+  if [ -d "$FIXTURES_DIR" ]; then
+    # already-has-id.json — expect exit 0 (passthrough)
+    ACTUAL_EXIT=$(bash "$HOOKS_DIR/cbp-mcp-worktree-inject.sh" < "$FIXTURES_DIR/already-has-id.json" >/dev/null 2>&1; echo $?)
+    if [ "$ACTUAL_EXIT" = "0" ]; then
+      test_result "cbp-mcp-worktree-inject.sh already-has-id exits 0" "passed" "passed"
+    else
+      test_result "cbp-mcp-worktree-inject.sh already-has-id exits 0" "passed" "failed (exit $ACTUAL_EXIT)"
+    fi
+
+    # missing-id-both-empty.json — resolvers return empty (in test env), expect exit 0
+    ACTUAL_EXIT=$(bash "$HOOKS_DIR/cbp-mcp-worktree-inject.sh" < "$FIXTURES_DIR/missing-id-both-empty.json" >/dev/null 2>&1; echo $?)
+    if [ "$ACTUAL_EXIT" = "0" ]; then
+      test_result "cbp-mcp-worktree-inject.sh missing-id passthrough exits 0" "passed" "passed"
+    else
+      test_result "cbp-mcp-worktree-inject.sh missing-id passthrough exits 0" "passed" "failed (exit $ACTUAL_EXIT)"
+    fi
+  else
+    test_result "cbp-mcp-worktree-inject.sh fixtures dir present" "passed" "missing"
+  fi
+fi
+
+# --- cbp-mcp-round-sync.sh ---
+
+if [ ! -f "$HOOKS_DIR/cbp-mcp-round-sync.sh" ]; then
+  test_result "cbp-mcp-round-sync.sh present" "passed" "missing"
+else
+  test_result "cbp-mcp-round-sync.sh present" "passed" "passed"
+
+  FIRST_LINE=$(head -1 "$HOOKS_DIR/cbp-mcp-round-sync.sh")
+  if echo "$FIRST_LINE" | grep -q '^#!/'; then
+    test_result "cbp-mcp-round-sync.sh has shebang" "passed" "passed"
+  else
+    test_result "cbp-mcp-round-sync.sh has shebang" "passed" "missing"
+  fi
+
+  if grep -q '@scope: org-shared' "$HOOKS_DIR/cbp-mcp-round-sync.sh"; then
+    test_result "cbp-mcp-round-sync.sh has @scope: org-shared" "passed" "passed"
+  else
+    test_result "cbp-mcp-round-sync.sh has @scope: org-shared" "passed" "missing"
+  fi
+
+  FIXTURES_DIR="$HOOKS_DIR/__test-fixtures__/cbp-mcp-round-sync"
+  if [ -d "$FIXTURES_DIR" ]; then
+    # stale-file.json — DB has a.ts but git has nothing → expect removed_from_diff: true
+    DRY_OUTPUT=$(bash "$HOOKS_DIR/cbp-mcp-round-sync.sh" --dry-run < "$FIXTURES_DIR/stale-file.json" 2>/dev/null)
+    if echo "$DRY_OUTPUT" | jq -e '[.[] | select(.path == "a.ts" and .removed_from_diff == true)] | length > 0' >/dev/null 2>&1; then
+      test_result "cbp-mcp-round-sync.sh stale-file marks removed_from_diff=true" "passed" "passed"
+    else
+      test_result "cbp-mcp-round-sync.sh stale-file marks removed_from_diff=true" "passed" "failed"
+    fi
+
+    # reactivated-file.json — DB has a.ts with removed_from_diff=true.
+    # If a.ts is in the current git working tree, expect removed_from_diff=false.
+    # If a.ts is NOT in git (normal test env), it will remain removed_from_diff=true —
+    # this is expected behaviour; the real reactivation path requires a live working tree.
+    # Test: verify the hook runs without error and produces a valid JSON array.
+    DRY_OUTPUT=$(bash "$HOOKS_DIR/cbp-mcp-round-sync.sh" --dry-run < "$FIXTURES_DIR/reactivated-file.json" 2>/dev/null)
+    if echo "$DRY_OUTPUT" | jq -e 'type == "array"' >/dev/null 2>&1; then
+      test_result "cbp-mcp-round-sync.sh reactivated-file produces valid JSON array" "passed" "passed"
+    else
+      test_result "cbp-mcp-round-sync.sh reactivated-file produces valid JSON array" "passed" "failed"
+    fi
+
+    # new-file.json — --dry-run mode produces a valid JSON array (no API call)
+    DRY_OUTPUT=$(bash "$HOOKS_DIR/cbp-mcp-round-sync.sh" --dry-run < "$FIXTURES_DIR/new-file.json" 2>/dev/null)
+    if echo "$DRY_OUTPUT" | jq -e 'type == "array"' >/dev/null 2>&1; then
+      test_result "cbp-mcp-round-sync.sh --dry-run on new-file produces valid JSON array" "passed" "passed"
+    else
+      test_result "cbp-mcp-round-sync.sh --dry-run on new-file produces valid JSON array" "passed" "failed"
+    fi
+  else
+    test_result "cbp-mcp-round-sync.sh fixtures dir present" "passed" "missing"
+  fi
+fi
+
+echo ""
+
+# ===== SUMMARY =====
+echo "=== TEST SUMMARY ==="
+echo -e "Passed: ${GREEN}$PASSED${NC}"
+echo -e "Failed: ${RED}$FAILED${NC}"
+echo ""
+
+if [ "$FAILED" -gt 0 ]; then
+  echo -e "${RED}TESTS FAILED${NC}"
+  exit 1
+else
+  echo -e "${GREEN}ALL TESTS PASSED${NC}"
+  exit 0
+fi

package/templates/hooks/hooks.json

@@ -0,0 +1,85 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-maestro-yaml-validate.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/validate-git-stash-deny.sh"
+          },
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-test-coverage-gate.sh"
+          },
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-pre-commit-quality-gate.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__codebyplan__(update_task|complete_task|update_checkpoint|create_checkpoint|create_task)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-mcp-migration-guard.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__codebyplan__(update_task|complete_task|complete_round|update_checkpoint)",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-mcp-worktree-inject.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-auto-test-hooks.sh"
+          },
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-lint-format-on-edit.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "mcp__codebyplan__complete_round",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-mcp-round-sync.sh"
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/cbp-notify.sh"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/hooks/validate-context-usage.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# @scope: org-shared
+# Hook Helper: Context file usage validation for validate-structure.sh
+# Purpose: Ensure context files are referenced by at least one agent or skill
+# Sourced by validate-structure.sh - not run directly
+#
+# Expects: $REL_PATH, $FILE_PATH, $REPO_ROOT, warn()
+
+# Only check .claude/context/ files
+if ! echo "$REL_PATH" | grep -qE '^/\.claude/context/.*\.md$'; then
+  return 0 2>/dev/null || true
+fi
+
+# Get the relative path without leading slash for grep
+CONTEXT_REL="${REL_PATH#/}"
+
+# Also build shorter path variants for matching
+# e.g., ".claude/context/testing/unit.md" and "context/testing/unit.md"
+CONTEXT_SHORT="${CONTEXT_REL#.claude/}"
+
+# Search agents and skills for any reference to this context file
+AGENTS_DIR="$REPO_ROOT/.claude/agents"
+SKILLS_DIR="$REPO_ROOT/.claude/skills"
+
+FOUND=0
+
+# Check agents
+if [ -d "$AGENTS_DIR" ]; then
+  if grep -rqF -e "$CONTEXT_REL" -e "$CONTEXT_SHORT" "$AGENTS_DIR" 2>/dev/null; then
+    FOUND=1
+  fi
+fi
+
+# Check skills
+if [ "$FOUND" -eq 0 ] && [ -d "$SKILLS_DIR" ]; then
+  if grep -rqF -e "$CONTEXT_REL" -e "$CONTEXT_SHORT" "$SKILLS_DIR" 2>/dev/null; then
+    FOUND=1
+  fi
+fi
+
+# Check authoring skills (scope:org-shared content shipped via the codebyplan npm package's claude subcommand)
+PLUGIN_SKILLS_DIR="$REPO_ROOT/packages/codebyplan-package/templates/skills"
+if [ "$FOUND" -eq 0 ] && [ -d "$PLUGIN_SKILLS_DIR" ]; then
+  if grep -rqF -e "$CONTEXT_REL" -e "$CONTEXT_SHORT" "$PLUGIN_SKILLS_DIR" 2>/dev/null; then
+    FOUND=1
+  fi
+fi
+
+# Check authoring agents
+PLUGIN_AGENTS_DIR="$REPO_ROOT/packages/codebyplan-package/templates/agents"
+if [ "$FOUND" -eq 0 ] && [ -d "$PLUGIN_AGENTS_DIR" ]; then
+  if grep -rqF -e "$CONTEXT_REL" -e "$CONTEXT_SHORT" "$PLUGIN_AGENTS_DIR" 2>/dev/null; then
+    FOUND=1
+  fi
+fi
+
+if [ "$FOUND" -eq 0 ]; then
+  warn "Context file not referenced by any agent or skill. Context files must be used by agents/skills — move informational docs to .claude/docs/ instead."
+fi

package/templates/hooks/validate-git-commit.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# @scope: org-shared
+# @hook: PreToolUse Bash
+# Hook: PreToolUse for Bash (git commit commands)
+# Purpose: Prevent Claude attribution in git commits
+# Exit 0 = allow, Exit 2 = block (stderr sent to Claude)
+
+set -e
+
+echo "[HOOK START] validate-git-commit"
+
+# Read JSON input from stdin
+INPUT=$(cat)
+
+# Extract command from tool input
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+if [ -z "$COMMAND" ]; then
+  echo "[HOOK END] validate-git-commit (no command)"
+  exit 0  # No command, allow
+fi
+
+# Only check git commit commands
+if ! echo "$COMMAND" | grep -qE 'git\s+commit'; then
+  echo "[HOOK END] validate-git-commit (not git commit)"
+  exit 0  # Not a git commit, allow
+fi
+
+# Function to block with message
+block() {
+  echo "[HOOK END] validate-git-commit (BLOCKED)"
+  echo "$1" >&2
+  exit 2
+}
+
+# Check for Claude attribution patterns
+# Case-insensitive check for various patterns
+
+# Check for "Claude" mentions (but allow CLAUDE.md files and .claude/ folder paths)
+# First, remove CLAUDE.md filenames and .claude(/path|word-end) — BSD-compatible word-boundary via [[:>:]]
+# Word-boundary allows ".claude folder" / ".claude rules" / ".claude/" all as legit folder references
+COMMAND_WITHOUT_FILES=$(echo "$COMMAND" \
+  | sed -E 's/CLAUDE(\.[a-z]+)?\.md//gi' \
+  | sed -E 's/\.claude(\/[a-zA-Z0-9_./-]*|[[:>:]])//gi' \
+  | sed -E 's/\$\{CLAUDE[A-Z_]*\}//g' \
+  | sed -E 's/claude-plugin[a-zA-Z0-9_./-]*//gi' \
+  | sed -E 's/codebyplan-claude[a-zA-Z0-9_./-]*//gi' \
+  | sed -E 's/@codebyplan\/claude[a-zA-Z0-9_./-]*//gi')
+if echo "$COMMAND_WITHOUT_FILES" | grep -qiE 'claude|anthropic'; then
+  block "BLOCKED: Git commit contains Claude/Anthropic attribution. Remove any mention of Claude from the commit message. Author should only be: midevyou <midevyosauhing@gmail.com>"
+fi
+
+# Check for "Generated with" patterns
+if echo "$COMMAND" | grep -qiE 'generated\s+(with|by)|auto-?generated'; then
+  block "BLOCKED: Git commit contains 'generated with/by' text. Remove this attribution from the commit message."
+fi
+
+# Check for co-author patterns
+if echo "$COMMAND" | grep -qiE 'co-?authored-?by'; then
+  block "BLOCKED: Git commit contains Co-Authored-By. Do not add co-author lines. Only author: midevyou <midevyosauhing@gmail.com>"
+fi
+
+# Check for AI/bot emoji markers
+if echo "$COMMAND" | grep -qE '🤖|🧠|✨|🔮'; then
+  block "BLOCKED: Git commit contains emoji markers (🤖, 🧠, ✨, 🔮). Remove these from the commit message."
+fi
+
+# Check for --author flag overriding
+if echo "$COMMAND" | grep -qE '\-\-author'; then
+  # Allow only if it's the correct author
+  if ! echo "$COMMAND" | grep -qE '\-\-author.*midevyou'; then
+    block "BLOCKED: Git commit has custom --author. Only allowed author: midevyou <midevyosauhing@gmail.com>"
+  fi
+fi
+
+# All checks passed
+echo "[HOOK END] validate-git-commit (passed)"
+exit 0

package/templates/hooks/validate-git-stash-deny.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+# @scope: org-shared
+# Hook: PreToolUse Bash
+# Purpose: Deny any `git stash` command. Git stash is banned per the
+#          feedback_no-git-stash auto-memory entry. Alternatives:
+#            - View uncommitted changes:  git diff <ref>
+#            - View a file at a commit:   git show <ref>:<path>
+#            - Isolate work:              git worktree add <path> <branch>
+# Exit 0 = allow, Exit 2 = block (stderr message returned to Claude)
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+
+# Only intercept Bash tool calls
+[ "$TOOL_NAME" = "Bash" ] || exit 0
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+[ -z "$COMMAND" ] && exit 0
+
+# Block any `git stash` invocation (stash, stash pop, stash apply, stash list, etc.)
+# Regex permits zero or more -X <arg> global option groups between `git` and `stash`
+# (e.g. git -C <path> stash, git -c key=val stash).
+if echo "$COMMAND" | grep -qE '(^|[[:space:]])git(\s+-[A-Za-z]\s+\S+)*\s+stash([[:space:]]|$)'; then
+  echo "BLOCKED: git stash is banned. See auto-memory: feedback_no-git-stash. Use alternatives instead:
+  - View uncommitted changes:  git diff <ref>
+  - View a file at a commit:   git show <ref>:<path>
+  - Isolate work safely:       git worktree add <path> <branch>" >&2
+  exit 2
+fi
+
+exit 0

package/templates/hooks/validate-structure-lengths.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# @scope: org-shared
+# Hook Helper: File-length enforcement for validate-structure.sh
+# Two-tier policy: warn at recommended → stderr notice; block at hard cap (~2× warn) → exit 2
+# Sourced by validate-structure.sh — not run directly.
+#
+# Expects: $REL_PATH, $FILE_PATH, $INPUT, block(), warn(),
+#          read_input_content(), count_lines() (from validate-structure-lib.sh)
+
+# Returns "WARN BLOCK" pair, or empty if the file has no limit.
+_get_limit() {
+  case "$1" in
+    # Documented exceptions — higher budget
+    /docs/templates/*/task.md)                          echo "450 900"; return;;
+    /.claude/docs/architecture/development.md)          echo "1200 2000"; return;;
+    /.claude/skills/cbp-round-start/SKILL.md)           echo "600 1000"; return;;
+    /.claude/rules/development-workflow.md)             echo "250 400"; return;;
+    # Unlimited files
+    /CHANGELOG.md|*/CHANGELOG.md|*/user-input.md|/.claude/docs/research/*) echo ""; return;;
+    # Managed .claude/ files
+    /.claude/rules/*.md)                                echo "100 200"; return;;
+    /.claude/context/*.md|/.claude/context/*/*.md)      echo "200 400"; return;;
+    /.claude/skills/*/SKILL.md)                         echo "300 600"; return;;
+    /.claude/skills/*/reference/*.md)                   echo "200 400"; return;;
+    /.claude/skills/*/examples/*.md|/.claude/skills/*/templates/*) echo "100 200"; return;;
+    /.claude/agents/*/AGENT.md)                         echo "400 800"; return;;
+    /.claude/agents/*/*.md)                             echo "200 400"; return;;
+    /.claude/hooks/*.sh)                                echo "150 300"; return;;
+    /.claude/docs/architecture/*.md|/.claude/docs/server/*.md) echo "200 400"; return;;
+    /.claude/docs/stack/*/index.md|/.claude/docs/stack/*/guide.md) echo "150 300"; return;;
+    /.claude/docs/stack/*/usage.md|/.claude/docs/stack/*/updates.md) echo "100 200"; return;;
+    /.claude/CLAUDE.md|/CLAUDE.md)                      echo "200 400"; return;;
+    # Repo work-tracking markdown
+    */checkpoint.md|*/idea.md|*/launch.md)              echo "200 400"; return;;
+    */TASK-*.md|*/handoff*.md)                          echo "150 300"; return;;
+    */prompt.md)                                        echo "100 200"; return;;
+    # Docs templates
+    /docs/templates/*)                                  echo "150 300"; return;;
+  esac
+  echo ""
+}
+
+PAIR="$(_get_limit "$REL_PATH")"
+[ -z "$PAIR" ] && return 0
+
+WARN_AT="${PAIR% *}"
+BLOCK_AT="${PAIR#* }"
+
+LINES=$(count_lines "$(read_input_content)" "$FILE_PATH")
+
+if [ "$LINES" -gt "$BLOCK_AT" ]; then
+  block "File exceeds hard limit: $LINES > $BLOCK_AT lines" "Pattern: $REL_PATH (warn $WARN_AT / block $BLOCK_AT). Split by concern, extract reference material, or add a documented exception in validate-structure-lengths.sh"
+fi
+
+if [ "$LINES" -gt "$WARN_AT" ]; then
+  warn "File over recommended length: $LINES > $WARN_AT lines (hard limit $BLOCK_AT). Consider splitting."
+fi