continuous-improvement 3.20.0 → 3.20.4

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.20.0",
+      "version": "3.20.4",
       "source": "./plugins/continuous-improvement",
       "author": {
         "name": "naimkatiman"

package/QUICKSTART.md

@@ -139,7 +139,7 @@ npx continuous-improvement install --mode expert
 npx continuous-improvement install --pack react   # optional: react | python | go | meta
 ```
 
-Preconditions: Node 18 / 20 / 22, plus bash on Windows (Git Bash or WSL — `hooks/observe.sh` is a bash script). See [README.md § Expert](README.md#expert--adds-mcp-server-observation-hooks-and-instinct-packs) for the full preconditions and troubleshooting matrix.
+Preconditions: Node 18 / 20 / 22, plus Git Bash on Windows (`hooks/observe.sh` is a Bash script). WSL Bash launched from native Windows cannot resolve the `C:/...` hook paths written by the installer. See [README.md § Expert](README.md#expert--adds-mcp-server-observation-hooks-and-instinct-packs) for the full preconditions and troubleshooting matrix.
 
 Verify with `/dashboard` — you should see instinct health and observation count.
 

package/README.md

@@ -137,7 +137,7 @@ V1 honest limitations: the runtime gate is honor-system once the agent flips `_g
 
 Pick this if you want the MCP tools (19 of them, including `ci_plan_init` / `ci_plan_status` for `task_plan.md`-style planning), the session hooks that feed Mulahazah, and starter packs.
 
-Preconditions: Node 18 / 20 / 22, plus bash on Windows (Git Bash or WSL — `hooks/observe.sh` is a bash script and silently no-ops without it). **`jq` is no longer required**: as of v3.6.0, `observe.sh` prefers the Node observer (`bin/observe.mjs`) which writes the rich event schema natively without external dependencies. The bash thin-schema path is kept as a two-phase shim, so legacy installs that have not re-run `npx continuous-improvement install` since v3.5.x will still degrade silently without `jq` (`winget install jqlang.jq` on Windows, `brew install jq` on macOS, `apt install jq` on Debian/Ubuntu) — re-running the installer is the cleaner fix and removes the dependency entirely. See [CHANGELOG.md](CHANGELOG.md) `[3.6.0]` for the migration details.
+Preconditions: Node 18 / 20 / 22, plus Git Bash on Windows (`hooks/observe.sh` is a Bash script). WSL Bash launched from native Windows cannot resolve the `C:/...` hook paths written by the installer. **`jq` is no longer required**: as of v3.6.0, `observe.sh` prefers the Node observer (`bin/observe.mjs`) which writes the rich event schema natively without external dependencies. The bash thin-schema path is kept as a two-phase shim, so legacy installs that have not re-run `npx continuous-improvement install` since v3.5.x will still degrade silently without `jq` (`winget install jqlang.jq` on Windows, `brew install jq` on macOS, `apt install jq` on Debian/Ubuntu) — re-running the installer is the cleaner fix and removes the dependency entirely. See [CHANGELOG.md](CHANGELOG.md) `[3.6.0]` for the migration details.
 
 ```bash
 npx continuous-improvement install --mode expert
@@ -158,7 +158,7 @@ Three failures account for nearly every install support thread. Try them in orde
 | Symptom | Real cause | Fix |
 |---|---|---|
 | `/discipline` says "command not recognized" right after `/plugin install` | Slash commands load on session start; the marketplace did pick the plugin up | Quit and reopen Claude Code, then run `/discipline` again |
-| Expert mode hooks never fire on Windows | `observe.sh` is bash; PowerShell silently no-ops on it | Install Git Bash (or WSL) and re-run `npx continuous-improvement install --mode expert` |
+| Expert mode hooks never fire on Windows | WSL Bash cannot resolve the native `C:/...` hook paths | Install Git Bash, ensure its `bin` directory precedes `C:\Windows\System32` on PATH, then re-run `npx continuous-improvement install --mode expert` |
 | `/plugin marketplace add ...` returned nothing visible | Marketplace add was silent; the plugin is not yet selected | Run `/plugin install continuous-improvement@continuous-improvement` to select and activate it |
 
 If none of those apply, paste the output of `npx continuous-improvement install` into a GitHub issue — that surface logs every step.

package/bin/check-landing-version.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { argv, cwd } from "node:process";
+import { fileURLToPath } from "node:url";
+const VERSION_RE = "([0-9]+\\.[0-9]+\\.[0-9]+)";
+function firstMatch(content, pattern) {
+    return pattern.exec(content)?.[1] ?? null;
+}
+export function checkLandingVersion(repoRoot) {
+    const packagePath = resolve(repoRoot, "package.json");
+    const landingPath = resolve(repoRoot, "docs", "landing", "index.html");
+    const packageJson = JSON.parse(readFileSync(packagePath, "utf8"));
+    const packageVersion = typeof packageJson.version === "string" ? packageJson.version : "";
+    const landing = readFileSync(landingPath, "utf8");
+    const markers = {
+        badge: firstMatch(landing, new RegExp(`<span\\b[^>]*class=["'][^"']*\\bver\\b[^"']*["'][^>]*>\\s*v${VERSION_RE}\\s*</span>`, "i")),
+        hero: firstMatch(landing, new RegExp(`<span\\b[^>]*class=["'][^"']*\\bkicker\\b[^"']*["'][^>]*>[\\s\\S]*?\\bREV\\s+${VERSION_RE}[\\s\\S]*?</span>`, "i")),
+        current: firstMatch(landing, new RegExp(`<span\\b[^>]*class=["'][^"']*\\bv\\b[^"']*["'][^>]*>\\s*v${VERSION_RE}\\s*</span>\\s*<span\\b[^>]*class=["'][^"']*\\bk\\b[^"']*["'][^>]*>\\s*Current rev\\s*</span>`, "i")),
+        footer: firstMatch(landing, new RegExp(`<span\\b[^>]*class=["'][^"']*\\bfoot-doc\\b[^"']*["'][^>]*>[\\s\\S]*?\\bREV\\s+${VERSION_RE}[\\s\\S]*?</span>`, "i")),
+    };
+    const errors = [];
+    if (!/^[0-9]+\.[0-9]+\.[0-9]+$/.test(packageVersion)) {
+        errors.push(`package.json has an invalid version: ${packageVersion || "<missing>"}`);
+    }
+    const missing = Object.entries(markers)
+        .filter(([, version]) => version === null)
+        .map(([name]) => name);
+    if (missing.length > 0) {
+        errors.push(`landing release marker(s) missing: ${missing.join(", ")}`);
+    }
+    const landingVersions = [...new Set(Object.values(markers).filter((value) => value !== null))];
+    if (landingVersions.length > 1) {
+        errors.push(`landing release markers are mixed: ${landingVersions.join(", ")}`);
+    }
+    for (const [name, version] of Object.entries(markers)) {
+        if (version !== null && version !== packageVersion) {
+            errors.push(`${name} marker is ${version}; package.json is ${packageVersion}`);
+        }
+    }
+    return { ok: errors.length === 0, packageVersion, markers, errors };
+}
+function main() {
+    const repoRoot = argv[2] ?? cwd();
+    try {
+        const result = checkLandingVersion(repoRoot);
+        if (result.ok) {
+            console.log(`OK landing-version: all 4 markers match package.json ${result.packageVersion}.`);
+            return;
+        }
+        console.error(`FAIL landing-version: ${result.errors.join("; ")}`);
+        process.exitCode = 1;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        console.error(`FAIL landing-version: ${message}`);
+        process.exitCode = 1;
+    }
+}
+const entryPath = argv[1] ? resolve(argv[1]) : "";
+if (entryPath === fileURLToPath(import.meta.url)) {
+    main();
+}

package/bin/check-scripts-citation-drift.mjs

@@ -11,7 +11,7 @@
  * Three sides of the contract are enforced as one invariant:
  *
  *   Side A — every file in scripts/ (excluding README.md) must appear in the
- *            Inventory table's Script column.
+ *            Inventory table, and every inventoried helper must exist on disk.
  *   Side B — for every Inventory row, every `skills/<name>.md` token in the
  *            Cited by cell must reference a file whose body contains the
  *            literal substring `scripts/<script-filename>` for at least one
@@ -85,30 +85,67 @@ function listSkillFiles(repoRoot) {
     const dir = join(repoRoot, SKILLS_DIR);
     if (!existsSync(dir) || !statSync(dir).isDirectory())
         return [];
-    return readdirSync(dir)
-        .filter((entry) => entry.endsWith(".md"))
-        .map((entry) => `${SKILLS_DIR}/${entry}`)
-        .sort();
+    const skills = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isFile() && entry.name.endsWith(".md")) {
+            skills.push(`${SKILLS_DIR}/${entry.name}`);
+            continue;
+        }
+        if (entry.isDirectory() &&
+            existsSync(join(dir, entry.name, "SKILL.md"))) {
+            skills.push(`${SKILLS_DIR}/${entry.name}.md`);
+        }
+    }
+    return skills.sort();
+}
+function resolveSkillFile(repoRoot, skillPath) {
+    const flatPath = join(repoRoot, skillPath);
+    if (existsSync(flatPath))
+        return flatPath;
+    const bundledSkill = /^skills\/([^/]+)\.md$/.exec(skillPath);
+    if (bundledSkill?.[1]) {
+        return join(repoRoot, SKILLS_DIR, bundledSkill[1], "SKILL.md");
+    }
+    return flatPath;
 }
 function toPosix(relPath) {
     return relPath.split(sep).join(posix.sep);
 }
 export function checkRepo(repoRoot) {
+    const structure = [];
     const sideA = [];
     const sideB = [];
     const sideC = [];
-    const scriptFiles = listScriptFiles(repoRoot);
+    const scriptsPath = join(repoRoot, SCRIPTS_DIR);
     const readmePath = join(repoRoot, SCRIPTS_README);
-    const readmeContent = existsSync(readmePath) ? readFileSync(readmePath, "utf8") : "";
+    const scriptsDirectoryExists = existsSync(scriptsPath) && statSync(scriptsPath).isDirectory();
+    const readmeExists = scriptsDirectoryExists && existsSync(readmePath);
+    const readmeContent = readmeExists ? readFileSync(readmePath, "utf8") : "";
     const rows = parseInventoryTable(readmeContent);
+    if (!scriptsDirectoryExists) {
+        structure.push("scripts/ directory is missing");
+    }
+    else if (!readmeExists) {
+        structure.push("scripts/README.md inventory is missing");
+    }
+    else if (rows.length === 0) {
+        structure.push("scripts/README.md inventory has no rows");
+    }
+    const scriptFiles = listScriptFiles(repoRoot);
     const inventoryScripts = new Set();
     for (const row of rows) {
         for (const s of row.scripts)
             inventoryScripts.add(s);
     }
+    const scriptFileSet = new Set(scriptFiles);
     for (const file of scriptFiles) {
         if (!inventoryScripts.has(file)) {
-            sideA.push(file);
+            sideA.push(`${file} — file is missing from the inventory`);
+        }
+    }
+    for (const inventoryScript of inventoryScripts) {
+        if (!scriptFileSet.has(inventoryScript)) {
+            sideA.push(`${inventoryScript} — inventoried helper file is missing`);
         }
     }
     let citationCount = 0;
@@ -122,7 +159,7 @@ export function checkRepo(repoRoot) {
     for (const row of rows) {
         for (const skillPath of row.skills) {
             citationCount += 1;
-            const fullSkill = join(repoRoot, skillPath);
+            const fullSkill = resolveSkillFile(repoRoot, skillPath);
             let skillBody = "";
             try {
                 skillBody = readFileSync(fullSkill, "utf8");
@@ -142,7 +179,7 @@ export function checkRepo(repoRoot) {
     for (const skillPath of skillFiles) {
         let body = "";
         try {
-            body = readFileSync(join(repoRoot, skillPath), "utf8");
+            body = readFileSync(resolveSkillFile(repoRoot, skillPath), "utf8");
         }
         catch {
             continue;
@@ -160,6 +197,7 @@ export function checkRepo(repoRoot) {
         }
     }
     return {
+        structure,
         sideA,
         sideB,
         sideC,
@@ -170,15 +208,25 @@ export function checkRepo(repoRoot) {
 function main() {
     const repoRoot = argv[2] ?? cwd();
     const result = checkRepo(repoRoot);
-    const totalViolations = result.sideA.length + result.sideB.length + result.sideC.length;
+    const totalViolations = result.structure.length +
+        result.sideA.length +
+        result.sideB.length +
+        result.sideC.length;
     if (totalViolations === 0) {
         console.log(`OK scripts-citation-drift: ${result.scriptCount} script(s), ${result.citationCount} skill citation(s), all three sides reconciled.`);
         exit(0);
     }
     console.error(`FAIL scripts-citation-drift: ${totalViolations} drift(s) across the inventory-citation contract.`);
+    if (result.structure.length > 0) {
+        console.error("");
+        console.error("Contract structure:");
+        for (const v of result.structure) {
+            console.error(`  ${toPosix(v)}`);
+        }
+    }
     if (result.sideA.length > 0) {
         console.error("");
-        console.error("Side A — script files missing from scripts/README.md inventory table:");
+        console.error("Side A — scripts/ files and inventory rows do not match:");
         for (const v of result.sideA) {
             console.error(`  ${toPosix(v)}`);
         }
@@ -198,7 +246,7 @@ function main() {
         }
     }
     console.error("");
-    console.error("Fix: update scripts/README.md inventory (Side A/C) or correct the skill citation (Side B).");
+    console.error("Fix: restore scripts/ and its inventory, update Side A/C, or correct the Side B skill citation.");
     exit(1);
 }
 const scriptPathFromArgv = argv[1];

package/bin/generate-plugin-manifests.mjs

@@ -82,6 +82,7 @@ async function writePluginBundleReadme() {
         "- `commands/`",
         "- `agents/` — `code-reviewer`, `security-auditor`, `test-engineer` personas (auto-discovered Claude Code subagents; pattern from addy/agent-skills)",
         "- `hooks/`",
+        "- `scripts/`",
         "- `bin/mcp-server.mjs`",
         "- `bin/observe.mjs`",
         "- `bin/backfill.mjs`",
@@ -140,6 +141,7 @@ async function writePluginBundle() {
         copyDirectory(join(REPO_ROOT, "commands"), join(PLUGIN_BUNDLE_DIR, "commands")),
         copyDirectory(join(REPO_ROOT, "agents"), join(PLUGIN_BUNDLE_DIR, "agents")),
         copyDirectory(join(REPO_ROOT, "hooks"), join(PLUGIN_BUNDLE_DIR, "hooks")),
+        copyDirectory(join(REPO_ROOT, "scripts"), join(PLUGIN_BUNDLE_DIR, "scripts")),
         copyDirectory(join(REPO_ROOT, "instinct-packs"), join(PLUGIN_BUNDLE_DIR, "instinct-packs")),
         copyDirectory(join(REPO_ROOT, "templates", "planning-with-files"), join(PLUGIN_BUNDLE_DIR, "templates", "planning-with-files")),
         copyFileTo(join(REPO_ROOT, "bin", "mcp-server.mjs"), join(PLUGIN_BUNDLE_DIR, "bin", "mcp-server.mjs")),

package/bin/install.mjs

@@ -10,7 +10,7 @@
  *   npx continuous-improvement install --uninstall    # remove everything
  */
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { execSync } from "node:child_process";
+import { execFileSync as runFileSync, execSync } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -84,20 +84,25 @@ function readJsonFile(filePath) {
         return null;
     }
 }
-// The observation hooks (hooks/observe.sh, hooks/session.sh) are bash scripts.
-// On Windows without Git Bash / WSL the hook commands written into settings.json
-// silently no-op, so the user finishes install thinking observation capture is
-// live when it never fires. Refuse the install with one actionable line instead.
-function assertBashAvailableOnWindows() {
+// The observation hooks are Bash scripts, and the native Windows settings use
+// forward-slash drive paths such as C:/Users/... . Git Bash resolves that form;
+// WSL's C:\Windows\System32\bash.exe does not. Probe the real packaged hook path
+// instead of accepting any executable that happens to answer `bash --version`.
+function assertBashCanReadHookOnWindows() {
     if (process.platform !== "win32")
         return;
+    const hookSource = toBashPath(join(REPO_ROOT, "hooks", "observe.sh"));
     try {
-        execSync("bash --version", { stdio: "ignore" });
+        runFileSync("bash", ["-c", 'test -r "$CONTINUOUS_IMPROVEMENT_HOOK_SOURCE"'], {
+            env: { ...process.env, CONTINUOUS_IMPROVEMENT_HOOK_SOURCE: hookSource },
+            stdio: "ignore",
+        });
     }
     catch {
-        console.error("  ✗ Install refused: the observation hooks (hooks/observe.sh, hooks/session.sh) " +
-            "are bash scripts, but `bash --version` is not on PATH. Install Git Bash or WSL, " +
-            "reopen your shell, and re-run — see README → Troubleshooting install.");
+        console.error(`  ✗ Install refused: Bash on PATH cannot read the Windows hook path ${hookSource}. ` +
+            "Install Git Bash and ensure its bin directory comes before " +
+            "C:\\Windows\\System32 on PATH, then reopen your shell and re-run. " +
+            "See README > Troubleshooting install.");
         process.exit(1);
     }
 }
@@ -612,6 +617,10 @@ function installNonClaudeTargets(targetIds) {
     for (const note of notes)
         console.log(`  ℹ ${note}`);
 }
+// A mixed target install can write non-Claude rule files below. Validate the
+// Claude hook runtime first so an incompatible Bash cannot leave a partial install.
+if (requestedTargets.includes("claude"))
+    assertBashCanReadHookOnWindows();
 const nonClaudeTargets = requestedTargets.filter((targetId) => targetId !== "claude");
 if (nonClaudeTargets.length > 0) {
     console.log("\ncontinuous-improvement multi-platform install\n");
@@ -625,7 +634,6 @@ console.log(`
 continuous-improvement (mode: ${INSTALL_MODE})
 Research → Plan → Execute → Verify → Reflect → Learn → Iterate
 `);
-assertBashAvailableOnWindows();
 warnOnMarketplaceCollision();
 console.log("Installing to Claude Code...\n");
 const installed = installSkill() ? 1 : 0;

package/commands/verify-install.md

@@ -41,7 +41,7 @@ The observation hook appends one row per tool call to
 
 - If it exists and has at least one row — capture is recording. Record `observe: ✓`.
 - If it is missing or empty — record `observe: ✗ (observation hook not recording —
-  on Windows confirm Git Bash / WSL is installed, then re-run the installer)`.
+  on Windows confirm Git Bash is installed before WSL Bash on PATH, then re-run the installer)`.
 
 ## Report
 

package/hooks/gateguard.mjs

@@ -210,6 +210,16 @@ function buildMutatingFileReason(toolName, filePaths, stateFilePath) {
         "  `_gateguard_facts_presented: true`; Claude Code's strict schema rejects that, so use A or B.)",
     ].join("\n");
 }
+function isGitBraceSelector(value) {
+    const selector = value.trim();
+    if (/^(?:u|upstream|push|-?\d+)$/i.test(selector))
+        return true;
+    if (/^(?:now|today|yesterday|tomorrow|noon|midnight|tea)$/i.test(selector))
+        return true;
+    if (/^\d{4}-\d{1,2}-\d{1,2}(?:[ T].*)?$/.test(selector))
+        return true;
+    return !selector.startsWith("#") && /(?:^|[.\s])ago$/i.test(selector);
+}
 function findUnquotedBraceRef(command) {
     let quote = null;
     for (let i = 0; i < command.length; i++) {
@@ -224,17 +234,26 @@ function findUnquotedBraceRef(command) {
             continue;
         }
         if (ch === "@" && command[i + 1] === "{") {
+            const braceEnd = command.indexOf("}", i + 2);
+            if (braceEnd === -1)
+                continue;
+            const selector = command.slice(i + 2, braceEnd);
+            // Deny only recognized Git selector grammar. PowerShell hashtables can
+            // contain comments, quoted braces, or arbitrary key expressions.
+            if (!isGitBraceSelector(selector)) {
+                i = braceEnd;
+                continue;
+            }
             // Expand to the whitespace-delimited word that carries this @{ ref, then
             // single-quote that whole word in the suggested fix.
             let wordStart = i;
             while (wordStart > 0 && !/\s/.test(command[wordStart - 1]))
                 wordStart--;
-            let wordEnd = i;
+            let wordEnd = braceEnd + 1;
             while (wordEnd < command.length && !/\s/.test(command[wordEnd]))
                 wordEnd++;
             const word = command.slice(wordStart, wordEnd);
-            const braceEnd = command.indexOf("}", i);
-            const ref = braceEnd === -1 ? command.slice(i, wordEnd) : command.slice(i, braceEnd + 1);
+            const ref = command.slice(i, braceEnd + 1);
             const fixed = `${command.slice(0, wordStart)}'${word}'${command.slice(wordEnd)}`;
             return { ref, fixed };
         }

package/hooks/query-cost-nudge.mjs

@@ -61,6 +61,7 @@ function collectChangedFiles(root) {
     return [
         ...parseChangedFiles(run(["diff", "--name-only", "--diff-filter=ACMR"])),
         ...parseChangedFiles(run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"])),
+        ...parseChangedFiles(run(["ls-files", "--others", "--exclude-standard"])),
     ];
 }
 // Marker key: the sanitized session_id when present (the normal case), else a

package/hooks/typecheck-stop.mjs

@@ -51,7 +51,8 @@ function collectChangedFiles(root) {
     };
     const unstaged = run(["diff", "--name-only", "--diff-filter=ACMR"]);
     const staged = run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"]);
-    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged)];
+    const untracked = run(["ls-files", "--others", "--exclude-standard"]);
+    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged), ...parseChangedFiles(untracked)];
 }
 function hasNpmTypecheckScript(root) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.0",
+  "version": "3.20.4",
   "description": "Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
   "keywords": [
     "claude-code",
@@ -56,10 +56,11 @@
     "verify:routing-targets": "node bin/check-routing-targets.mjs",
     "verify:doc-runtime-claims": "node bin/check-doc-runtime-claims.mjs",
     "verify:test-imports-only": "node bin/check-test-imports-only.mjs",
-    "verify:scripts-citation-drift": "node bin/check-scripts-citation-drift.mjs",
+    "verify:landing-version": "node bin/check-landing-version.mjs",
+    "verify:scripts-citation-drift": "node bin/check-scripts-citation-drift.mjs && node bin/check-scripts-citation-drift.mjs plugins/continuous-improvement",
     "verify:third-party-shape": "node bin/check-third-party-shape.mjs",
     "verify:tool-count": "node bin/check-tool-count.mjs",
-    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
+    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:landing-version && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
   },
   "files": [
     ".claude-plugin/",
@@ -74,6 +75,7 @@
     "hooks/",
     "commands/",
     "skills/",
+    "scripts/",
     "templates/",
     "plugins/",
     "instinct-packs/"

package/plugins/beginner.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.0",
+  "version": "3.20.4",
   "mode": "beginner",
   "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles three grounding skills (gateguard, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
   "tools": [

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "continuous-improvement",
       "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.20.0",
+      "version": "3.20.4",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.0",
+  "version": "3.20.4",
   "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",

package/plugins/continuous-improvement/README.md

@@ -10,6 +10,7 @@ Included surfaces:
 - `commands/`
 - `agents/` — `code-reviewer`, `security-auditor`, `test-engineer` personas (auto-discovered Claude Code subagents; pattern from addy/agent-skills)
 - `hooks/`
+- `scripts/`
 - `bin/mcp-server.mjs`
 - `bin/observe.mjs`
 - `bin/backfill.mjs`

package/plugins/continuous-improvement/commands/verify-install.md

@@ -41,7 +41,7 @@ The observation hook appends one row per tool call to
 
 - If it exists and has at least one row — capture is recording. Record `observe: ✓`.
 - If it is missing or empty — record `observe: ✗ (observation hook not recording —
-  on Windows confirm Git Bash / WSL is installed, then re-run the installer)`.
+  on Windows confirm Git Bash is installed before WSL Bash on PATH, then re-run the installer)`.
 
 ## Report
 

package/plugins/continuous-improvement/hooks/gateguard.mjs

@@ -210,6 +210,16 @@ function buildMutatingFileReason(toolName, filePaths, stateFilePath) {
         "  `_gateguard_facts_presented: true`; Claude Code's strict schema rejects that, so use A or B.)",
     ].join("\n");
 }
+function isGitBraceSelector(value) {
+    const selector = value.trim();
+    if (/^(?:u|upstream|push|-?\d+)$/i.test(selector))
+        return true;
+    if (/^(?:now|today|yesterday|tomorrow|noon|midnight|tea)$/i.test(selector))
+        return true;
+    if (/^\d{4}-\d{1,2}-\d{1,2}(?:[ T].*)?$/.test(selector))
+        return true;
+    return !selector.startsWith("#") && /(?:^|[.\s])ago$/i.test(selector);
+}
 function findUnquotedBraceRef(command) {
     let quote = null;
     for (let i = 0; i < command.length; i++) {
@@ -224,17 +234,26 @@ function findUnquotedBraceRef(command) {
             continue;
         }
         if (ch === "@" && command[i + 1] === "{") {
+            const braceEnd = command.indexOf("}", i + 2);
+            if (braceEnd === -1)
+                continue;
+            const selector = command.slice(i + 2, braceEnd);
+            // Deny only recognized Git selector grammar. PowerShell hashtables can
+            // contain comments, quoted braces, or arbitrary key expressions.
+            if (!isGitBraceSelector(selector)) {
+                i = braceEnd;
+                continue;
+            }
             // Expand to the whitespace-delimited word that carries this @{ ref, then
             // single-quote that whole word in the suggested fix.
             let wordStart = i;
             while (wordStart > 0 && !/\s/.test(command[wordStart - 1]))
                 wordStart--;
-            let wordEnd = i;
+            let wordEnd = braceEnd + 1;
             while (wordEnd < command.length && !/\s/.test(command[wordEnd]))
                 wordEnd++;
             const word = command.slice(wordStart, wordEnd);
-            const braceEnd = command.indexOf("}", i);
-            const ref = braceEnd === -1 ? command.slice(i, wordEnd) : command.slice(i, braceEnd + 1);
+            const ref = command.slice(i, braceEnd + 1);
             const fixed = `${command.slice(0, wordStart)}'${word}'${command.slice(wordEnd)}`;
             return { ref, fixed };
         }

package/plugins/continuous-improvement/hooks/query-cost-nudge.mjs

@@ -61,6 +61,7 @@ function collectChangedFiles(root) {
     return [
         ...parseChangedFiles(run(["diff", "--name-only", "--diff-filter=ACMR"])),
         ...parseChangedFiles(run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"])),
+        ...parseChangedFiles(run(["ls-files", "--others", "--exclude-standard"])),
     ];
 }
 // Marker key: the sanitized session_id when present (the normal case), else a

package/plugins/continuous-improvement/hooks/typecheck-stop.mjs

@@ -51,7 +51,8 @@ function collectChangedFiles(root) {
     };
     const unstaged = run(["diff", "--name-only", "--diff-filter=ACMR"]);
     const staged = run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"]);
-    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged)];
+    const untracked = run(["ls-files", "--others", "--exclude-standard"]);
+    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged), ...parseChangedFiles(untracked)];
 }
 function hasNpmTypecheckScript(root) {
     try {

package/plugins/continuous-improvement/scripts/README.md

@@ -0,0 +1,33 @@
+# `scripts/` — deterministic primitives skills cite
+
+This directory holds small, hand-authored scripts that skills (and hooks) cite instead of restating fixed operations inline. The motivation is the skills audit's "deterministic vs non-deterministic" axis: when a step inside a skill is the same operation every time (a fixed git command, a regex parse, a path lookup), it does not belong in the LLM-driven part of the skill — it belongs here, where the script runs the same way every invocation, costs no tokens, and stays in one place so multiple skills can share it.
+
+## Conventions
+
+- **Hand-authored, no `.mts` source.** Files in `scripts/` are not part of the `tsc` build pipeline (see [`CLAUDE.md`](../CLAUDE.md) → "Build pipeline"). The pipeline owns `bin/`, `lib/`, `test/`. `scripts/` is the bare-metal home for shell scripts and one-off Node utilities skills cite directly.
+- **One concern per script.** Each script does one thing and prints either machine-readable output (JSON envelope, single value) or a stable fenced block. Skills consume the output; they do not re-derive it.
+- **Cross-platform shape.** Bash scripts run via Git Bash on Windows, native bash on macOS/Linux. Tests for bash scripts skip when bash is not on PATH (see `src/test/hook.test.mts` for the established skip pattern).
+- **Cite from skills.** When a skill needs a primitive, the skill body cites the script path (`scripts/<name>.<ext>`) and quotes the expected output shape once. The skill does not restate the script's inner mechanics.
+
+## Inventory
+
+| Script | Purpose | Cited by |
+|---|---|---|
+| `git-state-snapshot.sh` | JSON envelope `{head, upstream, dirty, root, branch}` for the current git working tree | `skills/gateguard.md` (Parallel-Actor Gate), `skills/worktree-safety.md` (Root + branch), `skills/workspace-surface-audit.md` (Environment Grain — parallel-actor row), `skills/reconcile.md` (Detect a Concurrent Writer) |
+| `detect-deploy-target.sh` | Detect the auto-deploy provider for the repo at the current working directory (or first arg). Prints one of `railway`/`cloudflare`/`vercel`/`netlify`/`fly`/`appengine`/`apprunner`/`gha-deploy`/`none`. Always exits 0. | `skills/verification-loop.md` (Phase 8 deploy-receipt handoff), `skills/deploy-receipt.md` (When to Activate gate) |
+| `get-deployed-sha.sh` | Per-provider deployed-SHA extraction. Default mode runs the CLI; `--show-command <provider>` prints the pipeline shape without executing (useful for citation, dry-run, tests). | `skills/verification-loop.md` (Phase 8), `skills/deploy-receipt.md` (Route A — provider CLI extraction) |
+| `resolve-verify-ladder.mjs` | Resolve the per-project verification ladder for Phase 0 of `verification-loop`. Encodes the four-step priority — manifest > package.json sniff > per-language toolchain > ask-operator. Default mode prints the fenced block the skill displays; `--json` mode emits a JSON object for machine consumption. | `skills/verification-loop.md` (Phase 0) |
+| `scan-past-mistakes.mjs` | Scan the three Past-Mistake Acknowledgment Gate surfaces — `~/.claude/instincts/<hash>/observations.jsonl` (last N failure/correction rows), `~/.claude/projects/<hash>/memory/feedback_*.md`, and `<root>/CLAUDE.md` "## Past Mistakes" table. Active-in-scope judgment is the LLM's job; the script provides quotes + citations only. | `skills/proceed-with-the-recommendation.md` (Phase 0 Rule 1) |
+| `route-recommendation.mjs` + `route-recommendation.routes.json` | Match a recommendation item to its preferred-skill chain + inline fallback from the Phase 3 routing table (29 rows). Data file is the programmatic source of truth; the skill's table is documentation that mirrors it. Default mode prints a match block; `--json` for machine consumption; `--list` enumerates all rows. | `skills/proceed-with-the-recommendation.md` (Phase 3 routing table) |
+| `run-synthetic.mjs` | Phase 9 runner: invoke every `*.synthetic.{sh,mjs,ts,py}` in `synthetic-checks/`, inject `BASE_URL`/`BASELINE_URL`/`EXPECTED_SHA`/`DEPLOY_BRANCH`/`RECEIPT_TIMESTAMP` (unset vars pass through as `""`), capture stdout/stderr/exit per check, aggregate. Default mode prints the report block; `--json` for machine consumption; `--fail-fast` halts on first drift or timeout; `--timeout <sec>` per-check wall-clock cap; `--show-command` dry-run. Exit 0 all-pass, 1 drift, 2 config error, 3 usage. | `skills/verification-loop.md` (Phase 9 — production-vs-baseline diff) |
+
+When a new script lands here, add a row to this table in the same PR and cite the script from at least one skill — otherwise the script is dead code on arrival.
+
+## Relationship to other locations
+
+- `bin/` — generated CLI entrypoints (`.mjs` from `src/bin/*.mts`). Do not hand-edit; see [`CLAUDE.md`](../CLAUDE.md) → "Build pipeline".
+- `lib/` — generated library code (`.mjs` from `src/lib/*.mts`). Same rule.
+- `hooks/` — generated PreToolUse / PostToolUse / Stop hooks (`.mjs` from `src/hooks/*.mts`). Wired in `plugins/continuous-improvement/hooks/hooks.json`.
+- `scripts/` — this directory. Hand-authored primitives skills cite.
+
+When deciding where a new piece of code belongs: if it implements a runtime hook the harness will call, it goes in `src/hooks/`. If it's a verification or CLI entrypoint the plugin or `npm run` invokes, it goes in `src/bin/`. If it's reusable logic shared between those, it goes in `src/lib/`. If it's a small primitive a skill body cites by path (and the operator or harness runs ad hoc), it goes here.