continuous-improvement 3.17.0 → 3.19.0

package/lib/gateguard-state.mjs

@@ -59,7 +59,11 @@ function sanitizeSessionId(sessionId) {
         return "";
     return sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
 }
-function resolveProjectRoot() {
+// Exported for the target-lock gate (RISA 2 / G2): the hook compares a mutating
+// call's absolute target against this root to catch wrong-repo / wrong-worktree
+// writes. Returns "global" when no CLAUDE_PROJECT_DIR and no git toplevel — the
+// caller treats that as "no known root, do not guess".
+export function resolveProjectRoot() {
     const fromEnv = process.env.CLAUDE_PROJECT_DIR;
     if (fromEnv)
         return fromEnv;

package/lib/plugin-metadata.mjs

@@ -497,6 +497,14 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
         timeout: 5,
     };
+    const typecheckStopCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/typecheck-stop.mjs\"",
+        // Longer than the 5s hooks: tsc is slower. Opt-in via CLAUDE_TYPECHECK_GATE
+        // (off by default) and near-zero cost when off / no TS file changed; on an
+        // internal timeout it fails open (allow) rather than blocking.
+        timeout: 30,
+    };
     const routePromptCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
@@ -508,7 +516,7 @@ export function getPluginHooksConfig() {
         timeout: 5,
     };
     return {
-        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
+        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
         hooks: {
             // gateguard runs FIRST on PreToolUse so its block decision short-circuits
             // before companion-preference sees the call. companion-preference runs
@@ -532,7 +540,7 @@ export function getPluginHooksConfig() {
             UserPromptSubmit: [{ hooks: [routePromptCommand, recallBriefingCommand] }],
             SessionStart: [{ hooks: [sessionCommand] }],
             SessionEnd: [{ hooks: [sessionCommand] }],
-            Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand, workflowDistillCommand] }],
+            Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand, workflowDistillCommand, typecheckStopCommand] }],
         },
     };
 }

package/lib/typecheck-gate.mjs

@@ -0,0 +1,62 @@
+/**
+ * Pure decision helpers for the typecheck Stop gate (RISA 4 / G4).
+ *
+ * The hook (src/hooks/typecheck-stop.mts) does the I/O — git, spawning the
+ * typecheck, emitting the decision. Everything here is pure and unit-tested so
+ * the mode/selection/formatting logic is provable without spawning a compiler.
+ *
+ * Mode via CLAUDE_TYPECHECK_GATE: "off" (default) | "warn" | "block".
+ *   - off   : no-op. The default. The global ~/.claude typecheck-changed.sh
+ *             already emits an advisory systemMessage; this hook stays silent
+ *             until opted in, so there is no double-advisory and no regression.
+ *   - warn  : print a one-line notice to stderr; never blocks.
+ *   - block : emit {"decision":"block","reason":...} so the failure re-enters
+ *             model context — the fix headless/autonomous -p loops need.
+ */
+export function resolveTypecheckMode(raw) {
+    const value = (raw ?? "").trim().toLowerCase();
+    return value === "block" || value === "warn" ? value : "off";
+}
+// Matches the extensions typecheck-changed.sh screens for. `.d.ts` ends in
+// `.ts` so it counts — a changed ambient declaration can still break the build.
+const TS_FILE_RE = /\.(ts|tsx|mts|cts)$/;
+export function hasChangedTsFile(files) {
+    return files.some((file) => TS_FILE_RE.test(file.trim()));
+}
+// Split a `git diff --name-only` blob into a clean path list (drops blank lines).
+export function parseChangedFiles(gitOutput) {
+    return (gitOutput ?? "")
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+}
+// Prefer the project's own `typecheck` npm script (authoritative — it encodes
+// the project's exact flags), else a local tsc, else null (a TS project with no
+// runnable typecheck stays silent rather than guessing).
+export function pickTypecheckKind(hasNpmTypecheckScript, hasLocalTsc) {
+    if (hasNpmTypecheckScript)
+        return "npm";
+    if (hasLocalTsc)
+        return "tsc";
+    return null;
+}
+export function formatTypecheckReason(output, maxLines = 15) {
+    const tail = (output ?? "")
+        .split(/\r?\n/)
+        .filter((line) => line.length > 0)
+        .slice(-maxLines)
+        .join("\n");
+    return `Typecheck FAILED on changed TS files — fix before ending the turn:\n${tail}`;
+}
+// The single decision point. `ranTypecheck` is false when the gate short-circuited
+// (mode off, no TS project, no changed TS file, no runnable typecheck, or the run
+// timed out) — all of which allow. A conclusive non-zero rc maps to the mode.
+export function decideTypecheckAction(input) {
+    if (input.mode === "off")
+        return "allow";
+    if (!input.ranTypecheck)
+        return "allow";
+    if (input.rc === 0)
+        return "allow";
+    return input.mode;
+}

package/package.json

@@ -1,18 +1,21 @@
 {
   "name": "continuous-improvement",
-  "version": "3.17.0",
-  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
+  "version": "3.19.0",
+  "description": "Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
   "keywords": [
     "claude-code",
+    "claude-code-plugin",
     "claude-code-skill",
+    "claude",
+    "anthropic",
     "ai-agent",
+    "ai-agents",
     "agent-skill",
     "ai-discipline",
     "mulahazah",
-    "instinct",
+    "instinct-learning",
     "hooks",
     "mcp",
-    "mcp-server",
     "github-action",
     "transcript-linter"
   ],
@@ -30,7 +33,9 @@
     "continuous-improvement": "bin/install.mjs",
     "ci-lint-transcript": "bin/lint-transcript.mjs",
     "ci": "bin/unified-cli.mjs",
-    "ci-plan-pack": "bin/plan-pack.mjs"
+    "ci-plan-pack": "bin/plan-pack.mjs",
+    "ci-audit-actions": "bin/audit-actions.mjs",
+    "ci-portfolio-health": "bin/portfolio-health.mjs"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json && node bin/generate-plugin-manifests.mjs && node -e \"const fs=require('node:fs'); for (const f of fs.readdirSync('bin')) { if (f.endsWith('.mjs')) fs.chmodSync('bin/'+f, 0o755); } for (const f of fs.readdirSync('hooks')) { if (f.endsWith('.mjs')) fs.chmodSync('hooks/'+f, 0o755); } for (const f of fs.readdirSync('lib')) { if (f.endsWith('.mjs')) fs.chmodSync('lib/'+f, 0o755); } for (const f of fs.readdirSync('plugins/continuous-improvement/bin')) { if (f.endsWith('.mjs')) fs.chmodSync('plugins/continuous-improvement/bin/'+f, 0o755); } for (const f of fs.readdirSync('plugins/continuous-improvement/lib')) { if (f.endsWith('.mjs')) fs.chmodSync('plugins/continuous-improvement/lib/'+f, 0o755); } for (const f of fs.readdirSync('plugins/continuous-improvement/hooks')) { if (f.endsWith('.mjs')) fs.chmodSync('plugins/continuous-improvement/hooks/'+f, 0o755); } for (const f of fs.readdirSync('scripts')) { if (f.endsWith('.mjs')) fs.chmodSync('scripts/'+f, 0o755); } for (const f of fs.readdirSync('synthetic-checks')) { if (f.endsWith('.mjs')) fs.chmodSync('synthetic-checks/'+f, 0o755); } \"",
@@ -45,6 +50,7 @@
     "verify:skill-law-tag": "node bin/check-skill-law-tag.mjs",
     "verify:skill-count": "node bin/check-skill-count.mjs",
     "verify:skill-count-prose": "node bin/check-skill-count-prose.mjs",
+    "verify:command-count": "node bin/check-command-count.mjs",
     "verify:docs-substrings": "node bin/check-docs-substrings.mjs",
     "verify:everything-mirror": "node bin/check-everything-mirror.mjs",
     "verify:routing-targets": "node bin/check-routing-targets.mjs",
@@ -53,7 +59,7 @@
     "verify:scripts-citation-drift": "node bin/check-scripts-citation-drift.mjs",
     "verify:third-party-shape": "node bin/check-third-party-shape.mjs",
     "verify:tool-count": "node bin/check-tool-count.mjs",
-    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
+    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
   },
   "files": [
     ".claude-plugin/",

package/plugins/beginner.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.17.0",
+  "version": "3.19.0",
   "mode": "beginner",
   "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles three grounding skills (gateguard, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
   "tools": [

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.17.0",
+      "version": "3.19.0",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.17.0",
+  "version": "3.19.0",
   "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",

package/plugins/continuous-improvement/commands/reconcile.md

@@ -1,22 +1,22 @@
 ---
 name: reconcile
-description: Establish git ground truth (branch, status, stashes, worktrees, ahead/behind) before any mutation, halt on protected or destructive operations, and verify a push actually landed. Enforces Law 1 (Research Before Executing).
+description: Establish git ground truth (branch, status, stashes, worktrees, ahead/behind) before any mutation, halt on protected or destructive operations, then carry the known-good state through a single-concern commit, a push, an open PR, and — after the PR merges — a fast-forward of the default branch. Enforces Law 1 (Research Before Executing).
 ---
 
-# /reconcile — Ground-Truth Git State Before You Touch It
+# /reconcile — Ground Truth, Then Commit, Push, and Open the PR
 
-Read the repo's real state before acting on it: a branch that shifted, a push that did not land, or another session mid-merge will burn a whole session if you assume instead of check.
+Read the repo's real state before acting on it: a branch that shifted, a push that did not land, or another session mid-merge will burn a whole session if you assume instead of check. Once the state is known, `/reconcile` carries the work through to an open PR and back to an up-to-date default branch.
 
 ## What it does
 
-Snapshots the full git state in one pass, detects a concurrent writer, classifies the upstream relationship, then acts only on the known state — stopping at every operation that is hard to reverse. Backed by the `reconcile` skill.
+Snapshots the full git state in one pass, detects a concurrent writer, classifies the upstream relationship, then acts only on the known state — stopping at every operation that is hard to reverse. When work is ready, it stages by filename, commits one concern, pushes a feature branch, verifies the push landed, and opens a PR. After a human merges, it fast-forwards the default branch and checks it out. Backed by the `reconcile` skill.
 
 ## Establish ground truth
 
 ```
 git branch --show-current
 git status --porcelain=v1                     # but trust git diff --stat for real drift (autocrlf)
-git rev-list --left-right --count @{u}...HEAD  # behind / ahead
+git rev-list --left-right --count '@{u}...HEAD'  # behind / ahead (quote the ref — bare @{u} trips the Bash parser)
 git stash list
 git worktree list
 ls .git/MERGE_HEAD .git/rebase-merge .git/rebase-apply 2>/dev/null  # in-progress op = another actor; do not race
@@ -31,7 +31,22 @@ behind    -> git pull --ff-only
 diverged  -> rebase/merge deliberately; never blind --force
 ```
 
-STOP for authorization before: pushing to a protected branch (this repo = feature branch + PR, never direct push to main), `--force` / `--force-with-lease`, `reset --hard`, `clean -fd`, or removing a dirty worktree. Never stage with `git add -A` on a Windows autocrlf tree (it commits phantom line-ending-only changes) — stage by explicit filename.
+STOP for authorization before: pushing to a protected branch (this repo = feature branch + PR, never direct push to main), merging the PR you opened, `--force` / `--force-with-lease`, `reset --hard`, `clean -fd`, force-deleting a branch (`branch -D`), or removing a dirty worktree. Never stage with `git add -A` on a Windows autocrlf tree (it commits phantom line-ending-only changes) — stage by explicit filename.
+
+## Commit and open the PR (self-contained)
+
+Reimplements the commit → push → PR tail inline, so it works with no companion plugin installed:
+
+```
+git switch main && git pull --ff-only origin main   # branch from a fresh base
+git switch -c <type>/<slug>                          # only if not already on a feature branch
+git add path/one path/two                            # stage by name, one concern
+git commit -m "feat(scope): <observable outcome>"    # single-line -m; never a multi-line here-doc on Windows
+git push -u origin <type>/<slug>
+gh pr create --fill --base main                      # open one PR, then STOP — the merge is a human decision
+```
+
+`/reconcile` never merges the PR, never uses `--admin` / `--force` / `--no-verify`, never auto-merges on green CI, and never deploys.
 
 ## Verify the push landed
 
@@ -39,9 +54,21 @@ STOP for authorization before: pushing to a protected branch (this repo = featur
 git ls-remote origin refs/heads/<branch>   # remote tip must equal local HEAD, else it did not land
 ```
 
+## Sync the default branch after the PR merges
+
+"Latest work on main" is true only once the PR merges, and on a protected branch that merge is a human action. After it lands:
+
+```
+git switch main                        # or master
+git pull --ff-only origin main         # fast-forward only; if it will not ff, main diverged — re-survey, do not force
+git rev-parse HEAD                     # confirm this equals the squash-merge SHA
+git branch -d <type>/<slug>            # delete the merged feature branch (safe -d, never -D)
+```
+
 ## Pairs with
 
 - **`reconcile`** skill — the discipline this command runs.
 - **`gateguard`** / **`safety-guard`** — runtime + destructive-op guardrails.
 - **`recall`** — recall whether the same git op failed here before.
-- **`audit`** — the loop that often produces the fix `reconcile` then ships.
+- **`audit`** — the loop that often produces the fix `/reconcile` then ships.
+- **`/ship`** — the TDD-gated single-defect variant; `commit-commands:commit-push-pr` is the external-plugin equivalent of the commit → PR tail.

package/plugins/continuous-improvement/hooks/gateguard.mjs

@@ -35,7 +35,7 @@
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { MAX_CLEARED_FILES, canonicalizeFileKey, isCapReached, isFileCleared, loadState, markFileCleared, resolveSessionDir, saveState, } from "../lib/gateguard-state.mjs";
+import { MAX_CLEARED_FILES, canonicalizeFileKey, canonicalizeProjectRoot, isCapReached, isFileCleared, loadState, markFileCleared, resolveProjectRoot, resolveSessionDir, saveState, } from "../lib/gateguard-state.mjs";
 const TOOL_ROUTE = {
     Read: "allow",
     Grep: "allow",
@@ -69,8 +69,20 @@ const DESTRUCTIVE_PATTERNS = [
     "Remove-Item -Recurse",
     "Remove-Item -Force",
 ];
+// Flags whose VALUE is human prose (a commit message, a PR body) or a filename —
+// never a command to execute. Their contents must not trip the destructive scan:
+// `git commit -m "drop the stale format helper"` and `gh pr create --body "…"`
+// were stranding finished work on their own wording. `-c` is deliberately
+// EXCLUDED — `bash -c "rm -rf /"` carries a real command and must still gate.
+const MESSAGE_FLAG_RE = /(^|\s)(-m|--message|-F|--file|--body|--body-file|--title|--notes|-C|--reuse-message)(=|\s+)('[^']*'|"[^"]*"|\S+)/g;
+// Blank the value of every message/body flag so only executable command syntax
+// remains for the destructive-pattern scan. The flag itself is preserved so a
+// flag like `-F` never accidentally merges with its neighbours.
+function stripMessageArgs(command) {
+    return command.replace(MESSAGE_FLAG_RE, (_match, lead, flag) => `${lead}${flag} `);
+}
 function isDestructiveBash(command) {
-    const lower = command.toLowerCase();
+    const lower = stripMessageArgs(command).toLowerCase();
     return DESTRUCTIVE_PATTERNS.some((p) => lower.includes(p.toLowerCase()));
 }
 function classifyTool(toolName, toolInput) {
@@ -95,6 +107,60 @@ function extractFilePaths(toolInput) {
         return [toolInput.command];
     return [];
 }
+// --- Path exclusions -------------------------------------------------------
+// Opt-in: skip the fact-forcing gate for low-risk paths a user edits
+// constantly (an LLM-maintained prose wiki, a generated scratch dir). Set the
+// CI_GATEGUARD_EXCLUDE env var to a comma-separated list of path substrings;
+// each is matched case-insensitively against the forward-slash-normalized file
+// path. Unset/empty (the default) changes nothing — every mutating file call is
+// gated exactly as before. A call whose targets mix excluded and non-excluded
+// paths still gates the non-excluded ones.
+const EXCLUDE_FRAGMENTS = String(process.env.CI_GATEGUARD_EXCLUDE ?? "")
+    .split(",")
+    .map((fragment) => fragment.trim().replace(/\\/g, "/").toLowerCase())
+    .filter((fragment) => fragment !== "");
+function isExcludedPath(filePath) {
+    if (EXCLUDE_FRAGMENTS.length === 0 || typeof filePath !== "string" || filePath === "") {
+        return false;
+    }
+    const normalized = filePath.replace(/\\/g, "/").toLowerCase();
+    return EXCLUDE_FRAGMENTS.some((fragment) => normalized.includes(fragment));
+}
+// --- Target lock (opt-in) --------------------------------------------------
+// A fact-list can't catch a wrong-repo / wrong-worktree write — you can present
+// perfect facts about the wrong file. CI_GATEGUARD_TARGET_LOCK=block denies a
+// mutating call whose ABSOLUTE target canonicalizes outside the session project
+// root. Default (unset) checks nothing, so existing sessions — including
+// legitimate out-of-root edits to ~/.claude or /tmp — are unaffected. This is
+// the warn-first rollout: ship non-enforcing, flip to block per session.
+const TARGET_LOCK_ON = String(process.env.CI_GATEGUARD_TARGET_LOCK ?? "").toLowerCase() === "block";
+// Relative paths resolve under cwd (= the project root) and always pass; only an
+// absolute path into a different tree can be out-of-root. Drive-letter (d:/,
+// D:\), POSIX-absolute (/x), and UNC (\\host) forms all count as absolute.
+function isAbsolutePathString(p) {
+    return /^[A-Za-z]:[\\/]/.test(p) || p.startsWith("/") || p.startsWith("\\\\");
+}
+function isTargetOutsideRoot(filePath, projectRoot) {
+    if (!isAbsolutePathString(filePath))
+        return false;
+    const root = canonicalizeProjectRoot(projectRoot);
+    if (root === "global" || root === "")
+        return false; // no known root — do not guess
+    const target = canonicalizeFileKey(filePath);
+    return target !== root && !target.startsWith(`${root}/`);
+}
+function buildTargetLockReason(strayPath, projectRoot) {
+    return [
+        `Target is outside the session project root — refusing a possible wrong-repo / wrong-worktree write.`,
+        "",
+        `  Target: ${strayPath.replace(/\\/g, "/")}`,
+        `  Session root: ${canonicalizeProjectRoot(projectRoot)}`,
+        "",
+        "If this is intentional, confirm you are in the right worktree (cwd / CLAUDE_PROJECT_DIR),",
+        "or unset CI_GATEGUARD_TARGET_LOCK for this session. Target lock is opt-in; it fires only",
+        "when CI_GATEGUARD_TARGET_LOCK=block.",
+    ].join("\n");
+}
 // The call site only reads this inside the block branch, where at least one
 // path is uncleared; an all-cleared batch returns "" and is never consumed.
 function firstUnclearedFilePath(toolInput, state) {
@@ -144,6 +210,47 @@ function buildMutatingFileReason(toolName, filePaths, stateFilePath) {
         "  `_gateguard_facts_presented: true`; Claude Code's strict schema rejects that, so use A or B.)",
     ].join("\n");
 }
+function findUnquotedBraceRef(command) {
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (quote) {
+            if (ch === quote)
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (ch === "@" && command[i + 1] === "{") {
+            // Expand to the whitespace-delimited word that carries this @{ ref, then
+            // single-quote that whole word in the suggested fix.
+            let wordStart = i;
+            while (wordStart > 0 && !/\s/.test(command[wordStart - 1]))
+                wordStart--;
+            let wordEnd = i;
+            while (wordEnd < command.length && !/\s/.test(command[wordEnd]))
+                wordEnd++;
+            const word = command.slice(wordStart, wordEnd);
+            const braceEnd = command.indexOf("}", i);
+            const ref = braceEnd === -1 ? command.slice(i, wordEnd) : command.slice(i, braceEnd + 1);
+            const fixed = `${command.slice(0, wordStart)}'${word}'${command.slice(wordEnd)}`;
+            return { ref, fixed };
+        }
+    }
+    return null;
+}
+function buildBraceRefReason(hit) {
+    return [
+        `Unquoted git ref ${hit.ref} — Claude Code's Bash parser trips on the braces and blocks this`,
+        "post-hoc, costing a retry. Quote the ref and run the SAME command:",
+        "",
+        `  ${hit.fixed}`,
+        "",
+        "Single quotes stop the shell from touching the braces; git reads the ref as-is.",
+    ].join("\n");
+}
 function buildDestructiveBashReason(command) {
     return [
         `Destructive command requested: ${command}`,
@@ -199,6 +306,16 @@ function main() {
     const toolName = typeof payload.tool_name === "string" ? payload.tool_name : "";
     const toolInput = payload.tool_input ?? {};
     const gate = classifyTool(toolName, toolInput);
+    // Unquoted @{…} refs trip the built-in Bash parser — catch them first, for
+    // both routine and destructive commands, so the quoted fix surfaces before the
+    // opaque post-hoc block (and before the destructive rollback demand).
+    if (toolName === "Bash" && typeof toolInput.command === "string") {
+        const braceHit = findUnquotedBraceRef(toolInput.command);
+        if (braceHit) {
+            emitDeny(buildBraceRefReason(braceHit));
+            return;
+        }
+    }
     if (gate === "allow") {
         emitAllow();
         return;
@@ -215,7 +332,24 @@ function main() {
     const sessionDir = resolveSessionDir(sessionId);
     const stateFilePath = join(sessionDir, "gateguard-session.json");
     const state = loadState(sessionDir);
-    const filePaths = extractFilePaths(toolInput);
+    const allTargetPaths = extractFilePaths(toolInput);
+    const filePaths = allTargetPaths.filter((path) => !isExcludedPath(path));
+    if (allTargetPaths.length > 0 && filePaths.length === 0) {
+        emitAllow(); // every target is under a CI_GATEGUARD_EXCLUDE path; skip the gate
+        return;
+    }
+    // Target lock runs before the fact gate and independent of clearance: a
+    // wrong-repo write is wrong even with perfect facts. Excluded paths were
+    // already filtered out above, so an explicitly-excluded scratch dir outside
+    // the root is never target-locked.
+    if (TARGET_LOCK_ON) {
+        const projectRoot = resolveProjectRoot();
+        const stray = filePaths.find((path) => isTargetOutsideRoot(path, projectRoot));
+        if (stray) {
+            emitDeny(buildTargetLockReason(stray, projectRoot));
+            return;
+        }
+    }
     const filePath = firstUnclearedFilePath(toolInput, state);
     const factsFlagged = toolInput._gateguard_facts_presented === true;
     const alreadyCleared = filePaths.length > 0 && filePaths.every((path) => isFileCleared(state, path));

package/plugins/continuous-improvement/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
+  "description": "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
   "hooks": {
     "PreToolUse": [
       {
@@ -93,6 +93,11 @@
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
             "timeout": 5
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/typecheck-stop.mjs\"",
+            "timeout": 30
           }
         ]
       }

package/plugins/continuous-improvement/hooks/typecheck-stop.mjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/**
+ * typecheck-stop.mts — Stop hook that runs the project typecheck on changed TS
+ * files and, when opted in, returns a block decision so the failure re-enters
+ * model context and the agent fixes it before ending the turn — in all modes,
+ * including headless `-p` runs where Stop still fires (RISA 4 / G4).
+ *
+ * Ports the proven detection logic of ~/.claude/scripts/typecheck-changed.sh
+ * (skip non-TS repos, skip TS repos with no changed TS file, prefer the npm
+ * `typecheck` script) and adds the block mechanism of goal-drift-stop.mts.
+ *
+ * Mode via CLAUDE_TYPECHECK_GATE: "off" (default) | "warn" | "block".
+ *   off   : no-op (the global script's advisory systemMessage stays the default
+ *           layer; this hook is the opt-in enforcement layer — zero regression).
+ *   warn  : one-line stderr notice; never blocks.
+ *   block : {"decision":"block","reason":...} to re-prompt the model.
+ *
+ * Fail-open by construction: any error, missing root, non-TS repo, no changed
+ * TS file, no runnable typecheck, or a run that times out exits 0 (allow). No
+ * network. The wiring gives this hook a longer timeout than the 5s hooks
+ * because `tsc` is slower; on the internal timeout it fails open.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { decideTypecheckAction, formatTypecheckReason, hasChangedTsFile, parseChangedFiles, pickTypecheckKind, resolveTypecheckMode, } from "../lib/typecheck-gate.mjs";
+const SPAWN_TIMEOUT_MS = 25_000;
+function resolveProjectRoot() {
+    const fromEnv = process.env.CLAUDE_PROJECT_DIR;
+    if (fromEnv && fromEnv.trim())
+        return fromEnv.trim();
+    try {
+        const root = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return root || null;
+    }
+    catch {
+        return null;
+    }
+}
+function collectChangedFiles(root) {
+    const run = (args) => {
+        try {
+            return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        }
+        catch {
+            return "";
+        }
+    };
+    const unstaged = run(["diff", "--name-only", "--diff-filter=ACMR"]);
+    const staged = run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"]);
+    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged)];
+}
+function hasNpmTypecheckScript(root) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        return typeof pkg.scripts?.typecheck === "string";
+    }
+    catch {
+        return false;
+    }
+}
+function localTscPath(root) {
+    // node_modules/typescript/bin/tsc is a Node script — invoking it via `node`
+    // is cross-platform, unlike node_modules/.bin/tsc (a shell script / .cmd).
+    const path = join(root, "node_modules", "typescript", "bin", "tsc");
+    return existsSync(path) ? path : null;
+}
+function runTypecheck(root) {
+    const tscPath = localTscPath(root);
+    const kind = pickTypecheckKind(hasNpmTypecheckScript(root), tscPath !== null);
+    if (!kind)
+        return { ran: false, rc: 0, output: "" };
+    const result = kind === "npm"
+        ? spawnSync("npm", ["run", "--silent", "typecheck"], {
+            cwd: root,
+            encoding: "utf8",
+            shell: true,
+            timeout: SPAWN_TIMEOUT_MS,
+        })
+        : spawnSync(process.execPath, [tscPath, "--noEmit"], {
+            cwd: root,
+            encoding: "utf8",
+            timeout: SPAWN_TIMEOUT_MS,
+        });
+    // A timeout or spawn failure leaves error set / status null — inconclusive, so
+    // fail open (do not block on a check that never produced a verdict).
+    if (result.error || typeof result.status !== "number")
+        return { ran: false, rc: 0, output: "" };
+    return { ran: true, rc: result.status, output: `${result.stdout ?? ""}${result.stderr ?? ""}` };
+}
+function main() {
+    const mode = resolveTypecheckMode(process.env.CLAUDE_TYPECHECK_GATE);
+    if (mode === "off")
+        return;
+    const root = resolveProjectRoot();
+    if (!root || !existsSync(join(root, "tsconfig.json")))
+        return; // not a TS project
+    if (!hasChangedTsFile(collectChangedFiles(root)))
+        return; // nothing TS changed — near-zero cost
+    const { ran, rc, output } = runTypecheck(root);
+    const action = decideTypecheckAction({ mode, ranTypecheck: ran, rc });
+    if (action === "block") {
+        process.stdout.write(`${JSON.stringify({ decision: "block", reason: formatTypecheckReason(output) })}\n`);
+    }
+    else if (action === "warn") {
+        process.stderr.write(`[continuous-improvement] typecheck: ${formatTypecheckReason(output)}\n`);
+    }
+}
+try {
+    main();
+}
+catch {
+    // fail open — never trap a turn on a hook bug
+}

package/plugins/continuous-improvement/lib/gateguard-state.mjs

@@ -59,7 +59,11 @@ function sanitizeSessionId(sessionId) {
         return "";
     return sessionId.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
 }
-function resolveProjectRoot() {
+// Exported for the target-lock gate (RISA 2 / G2): the hook compares a mutating
+// call's absolute target against this root to catch wrong-repo / wrong-worktree
+// writes. Returns "global" when no CLAUDE_PROJECT_DIR and no git toplevel — the
+// caller treats that as "no known root, do not guess".
+export function resolveProjectRoot() {
     const fromEnv = process.env.CLAUDE_PROJECT_DIR;
     if (fromEnv)
         return fromEnv;

package/plugins/continuous-improvement/lib/plugin-metadata.mjs

@@ -497,6 +497,14 @@ export function getPluginHooksConfig() {
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
         timeout: 5,
     };
+    const typecheckStopCommand = {
+        type: "command",
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/typecheck-stop.mjs\"",
+        // Longer than the 5s hooks: tsc is slower. Opt-in via CLAUDE_TYPECHECK_GATE
+        // (off by default) and near-zero cost when off / no TS file changed; on an
+        // internal timeout it fails open (allow) rather than blocking.
+        timeout: 30,
+    };
     const routePromptCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
@@ -508,7 +516,7 @@ export function getPluginHooksConfig() {
         timeout: 5,
     };
     return {
-        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
+        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
         hooks: {
             // gateguard runs FIRST on PreToolUse so its block decision short-circuits
             // before companion-preference sees the call. companion-preference runs
@@ -532,7 +540,7 @@ export function getPluginHooksConfig() {
             UserPromptSubmit: [{ hooks: [routePromptCommand, recallBriefingCommand] }],
             SessionStart: [{ hooks: [sessionCommand] }],
             SessionEnd: [{ hooks: [sessionCommand] }],
-            Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand, workflowDistillCommand] }],
+            Stop: [{ hooks: [threeSectionCloseCommand, goalDriftStopCommand, workflowDistillCommand, typecheckStopCommand] }],
         },
     };
 }