continuous-improvement 3.20.0 → 3.21.0

package/hooks/gateguard.mjs

@@ -210,6 +210,16 @@ function buildMutatingFileReason(toolName, filePaths, stateFilePath) {
         "  `_gateguard_facts_presented: true`; Claude Code's strict schema rejects that, so use A or B.)",
     ].join("\n");
 }
+function isGitBraceSelector(value) {
+    const selector = value.trim();
+    if (/^(?:u|upstream|push|-?\d+)$/i.test(selector))
+        return true;
+    if (/^(?:now|today|yesterday|tomorrow|noon|midnight|tea)$/i.test(selector))
+        return true;
+    if (/^\d{4}-\d{1,2}-\d{1,2}(?:[ T].*)?$/.test(selector))
+        return true;
+    return !selector.startsWith("#") && /(?:^|[.\s])ago$/i.test(selector);
+}
 function findUnquotedBraceRef(command) {
     let quote = null;
     for (let i = 0; i < command.length; i++) {
@@ -224,17 +234,26 @@ function findUnquotedBraceRef(command) {
             continue;
         }
         if (ch === "@" && command[i + 1] === "{") {
+            const braceEnd = command.indexOf("}", i + 2);
+            if (braceEnd === -1)
+                continue;
+            const selector = command.slice(i + 2, braceEnd);
+            // Deny only recognized Git selector grammar. PowerShell hashtables can
+            // contain comments, quoted braces, or arbitrary key expressions.
+            if (!isGitBraceSelector(selector)) {
+                i = braceEnd;
+                continue;
+            }
             // Expand to the whitespace-delimited word that carries this @{ ref, then
             // single-quote that whole word in the suggested fix.
             let wordStart = i;
             while (wordStart > 0 && !/\s/.test(command[wordStart - 1]))
                 wordStart--;
-            let wordEnd = i;
+            let wordEnd = braceEnd + 1;
             while (wordEnd < command.length && !/\s/.test(command[wordEnd]))
                 wordEnd++;
             const word = command.slice(wordStart, wordEnd);
-            const braceEnd = command.indexOf("}", i);
-            const ref = braceEnd === -1 ? command.slice(i, wordEnd) : command.slice(i, braceEnd + 1);
+            const ref = command.slice(i, braceEnd + 1);
             const fixed = `${command.slice(0, wordStart)}'${word}'${command.slice(wordEnd)}`;
             return { ref, fixed };
         }

package/hooks/query-cost-nudge.mjs

@@ -61,6 +61,7 @@ function collectChangedFiles(root) {
     return [
         ...parseChangedFiles(run(["diff", "--name-only", "--diff-filter=ACMR"])),
         ...parseChangedFiles(run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"])),
+        ...parseChangedFiles(run(["ls-files", "--others", "--exclude-standard"])),
     ];
 }
 // Marker key: the sanitized session_id when present (the normal case), else a

package/hooks/session.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { resolveHomeDir } from "../lib/resolve-home-dir.mjs";
+function read(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}
+function eventFromStdin() {
+    const raw = read(0);
+    if (!raw)
+        return null;
+    try {
+        const payload = JSON.parse(raw);
+        if (!payload || typeof payload !== "object" || Array.isArray(payload))
+            return null;
+        const event = payload.hook_event_name ?? payload.hook_type ?? payload.event_type;
+        return event === "SessionStart" || event === "SessionEnd" ? event : "unknown";
+    }
+    catch {
+        return null;
+    }
+}
+function projectRoot() {
+    if (process.env.CLAUDE_PROJECT_DIR)
+        return process.env.CLAUDE_PROJECT_DIR;
+    try {
+        return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim() || "global";
+    }
+    catch {
+        return "global";
+    }
+}
+function yamlFiles(dir) {
+    try {
+        return readdirSync(dir)
+            .filter((name) => name.endsWith(".yaml"))
+            .map((name) => join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
+function main() {
+    const event = eventFromStdin();
+    if (event === null)
+        return;
+    if (event === "SessionEnd") {
+        process.stderr.write("[continuous-improvement] Session ending. Run /continuous-improvement to reflect and capture learnings.\n");
+        return;
+    }
+    const home = resolveHomeDir();
+    if (!home)
+        return;
+    const instinctsRoot = join(home, ".claude", "instincts");
+    const hash = createHash("sha256").update(projectRoot()).digest("hex").slice(0, 12);
+    const projectDir = join(instinctsRoot, hash);
+    const files = [...yamlFiles(projectDir), ...yamlFiles(join(instinctsRoot, "global"))];
+    const observations = read(join(projectDir, "observations.jsonl")).split(/\r?\n/).filter(Boolean).length;
+    let level = observations >= 20 || files.length > 0 ? "ANALYZE" : "CAPTURE";
+    for (const file of files) {
+        const value = Number(read(file).match(/^confidence:\s*([0-9]*\.?[0-9]+)/m)?.[1]);
+        if (Number.isFinite(value) && value >= 0.7) {
+            level = "AUTO-APPLY";
+            break;
+        }
+        if (Number.isFinite(value) && value >= 0.5)
+            level = "SUGGEST";
+    }
+    process.stderr.write(`[continuous-improvement] Level: ${level} | Observations: ${observations} | Instincts: ${files.length}\n`);
+}
+try {
+    main();
+}
+catch {
+}

package/hooks/typecheck-stop.mjs

@@ -51,7 +51,8 @@ function collectChangedFiles(root) {
     };
     const unstaged = run(["diff", "--name-only", "--diff-filter=ACMR"]);
     const staged = run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"]);
-    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged)];
+    const untracked = run(["ls-files", "--others", "--exclude-standard"]);
+    return [...parseChangedFiles(unstaged), ...parseChangedFiles(staged), ...parseChangedFiles(untracked)];
 }
 function hasNpmTypecheckScript(root) {
     try {

package/lib/plugin-metadata.mjs

@@ -26,7 +26,7 @@ const KEYWORDS = [
     "transcript-linter",
 ];
 const CLAUDE_PLUGIN_CATEGORY = "productivity";
-const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
+const SHARED_PLUGIN_DESCRIPTION = "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.";
 // Four vendored upstream companions registered alongside the CI plugin.
 // Each entry points at a pinned-SHA snapshot under third-party/<name>/.
 // See third-party/MANIFEST.md for refresh recipes and per-snapshot
@@ -457,76 +457,74 @@ export function getClaudePluginManifest() {
     };
 }
 export function getPluginHooksConfig() {
+    // Cold Node startup on loaded Windows hosts has exceeded five seconds.
+    const hookTimeoutSeconds = 30;
     const gateguardCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gateguard.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const companionPreferenceCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/companion-preference.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const hookPackCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const observeCommand = {
         type: "command",
-        command: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/observe.sh\"",
-        timeout: 5,
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/bin/observe.mjs\"",
+        timeout: hookTimeoutSeconds,
     };
     const sessionCommand = {
         type: "command",
-        command: "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session.sh\"",
-        timeout: 5,
+        command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\"",
+        timeout: hookTimeoutSeconds,
     };
     const threeSectionCloseCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/three-section-close.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const goalDriftStopCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/goal-drift-stop.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const workflowDistillCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const typecheckStopCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/typecheck-stop.mjs\"",
-        // Longer than the 5s hooks: tsc is slower. Opt-in via CLAUDE_TYPECHECK_GATE
-        // (off by default) and near-zero cost when off / no TS file changed; on an
-        // internal timeout it fails open (allow) rather than blocking.
-        timeout: 30,
+        timeout: hookTimeoutSeconds,
     };
     const queryCostNudgeCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/query-cost-nudge.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const routePromptCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     const recallBriefingCommand = {
         type: "command",
         command: "node \"${CLAUDE_PLUGIN_ROOT}/hooks/recall-briefing.mjs\"",
-        timeout: 5,
+        timeout: hookTimeoutSeconds,
     };
     return {
-        description: "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, opt-in query-cost Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
         hooks: {
             // gateguard runs FIRST on PreToolUse so its block decision short-circuits
             // before companion-preference sees the call. companion-preference runs
             // second on Skill tool calls; it is a no-op under ci-first (the default)
-            // and never blocks under companions-first. observe.sh only runs on
+            // and never blocks under companions-first. The observer only runs on
             // PostToolUse: gateguard-blocked calls are intentionally not observed so
             // PreToolUse stays at two subprocesses on the hot path. route-prompt
             // fires on UserPromptSubmit and emits a system-reminder when a prompt

package/llms.txt

@@ -1,6 +1,6 @@
 # continuous-improvement
 
-> The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.
+> The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.
 
 ## What This Is
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.0",
-  "description": "Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
+  "version": "3.21.0",
+  "description": "Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts. Beginner: one /plugin install command. Expert: adds MCP tools and session hooks.",
   "keywords": [
     "claude-code",
     "claude-code-plugin",
@@ -56,10 +56,11 @@
     "verify:routing-targets": "node bin/check-routing-targets.mjs",
     "verify:doc-runtime-claims": "node bin/check-doc-runtime-claims.mjs",
     "verify:test-imports-only": "node bin/check-test-imports-only.mjs",
-    "verify:scripts-citation-drift": "node bin/check-scripts-citation-drift.mjs",
+    "verify:landing-version": "node bin/check-landing-version.mjs",
+    "verify:scripts-citation-drift": "node bin/check-scripts-citation-drift.mjs && node bin/check-scripts-citation-drift.mjs plugins/continuous-improvement",
     "verify:third-party-shape": "node bin/check-third-party-shape.mjs",
     "verify:tool-count": "node bin/check-tool-count.mjs",
-    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
+    "verify:all": "npm run verify:skill-mirror && npm run verify:skill-tiers && npm run verify:skill-law-tag && npm run verify:skill-count && npm run verify:skill-count-prose && npm run verify:command-count && npm run verify:docs-substrings && npm run verify:everything-mirror && npm run verify:routing-targets && npm run verify:doc-runtime-claims && npm run verify:test-imports-only && npm run verify:landing-version && npm run verify:scripts-citation-drift && npm run verify:third-party-shape && npm run verify:tool-count && npm run typecheck"
   },
   "files": [
     ".claude-plugin/",
@@ -74,6 +75,7 @@
     "hooks/",
     "commands/",
     "skills/",
+    "scripts/",
     "templates/",
     "plugins/",
     "instinct-packs/"

package/plugins/beginner.json

@@ -1,6 +1,6 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.0",
+  "version": "3.21.0",
   "mode": "beginner",
   "description": "Beginner mode: see what your agent learned, list its instincts, and request a session reflection. Bundles three grounding skills (gateguard, tdd-workflow, verification-loop) so research, memory, tests, and verification happen by default — every edit starts from facts, not guesses.",
   "tools": [

package/plugins/continuous-improvement/.claude-plugin/marketplace.json

@@ -7,8 +7,8 @@
   "plugins": [
     {
       "name": "continuous-improvement",
-      "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
-      "version": "3.20.0",
+      "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
+      "version": "3.21.0",
       "source": "./",
       "author": {
         "name": "naimkatiman"

package/plugins/continuous-improvement/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "continuous-improvement",
-  "version": "3.20.0",
-  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 27 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
+  "version": "3.21.0",
+  "description": "The persistent-memory and runtime-discipline layer for Claude Code. It remembers the corrections you already gave, grounds every edit in real facts before it lands, and — through the Mulahazah engine — turns each fix into a reusable instinct, so a lesson learned once is applied automatically next time with no re-teaching. Built on the 7 Laws of AI Agent Discipline (research, plan, verify, reflect, learn) and shipped as 28 bundled skills, instinct-aware hooks, an MCP toolset for recall and reflection, and a GitHub Action transcript linter that feeds real work history back into sharper instincts.",
   "author": {
     "name": "naimkatiman",
     "url": "https://github.com/naimkatiman"

package/plugins/continuous-improvement/README.md

@@ -10,6 +10,7 @@ Included surfaces:
 - `commands/`
 - `agents/` — `code-reviewer`, `security-auditor`, `test-engineer` personas (auto-discovered Claude Code subagents; pattern from addy/agent-skills)
 - `hooks/`
+- `scripts/`
 - `bin/mcp-server.mjs`
 - `bin/observe.mjs`
 - `bin/backfill.mjs`

package/plugins/continuous-improvement/commands/production-readiness-review.md

@@ -1,6 +1,6 @@
 ---
 name: production-readiness-review
-description: "Parallel multi-agent readiness gate — fan blind reviewers across performance, security, UI/UX, and test coverage, each grounding findings in real code/logs/live data, then reconcile into one deduplicated, severity-ranked punch-list. Reports only; never fixes, merges, or deploys."
+description: "Parallel multi-agent readiness gate — fan blind reviewers across performance, security, UI/UX, test coverage, and simplicity, each grounding findings in real code/logs/live data, then reconcile into one deduplicated, severity-ranked punch-list. Reports only; never fixes, merges, or deploys."
 ---
 
 # /production-readiness-review
@@ -20,11 +20,12 @@ Pure routing over existing skills and agents. Adds no new code.
 ## Behavior
 
 1. **Scope** — establish ground truth: the diff under review and which changes are recent (`git diff`; `reconcile` fallback for branch/base state). Recent changes get extra scrutiny because they are the likeliest source of self-inflicted defects.
-2. **Fan out** — `superpowers:dispatching-parallel-agents` launches four reviewers, each blind to the others. Every reviewer is instructed to ground each finding in real code, logs, or live queries, and never to assume or fabricate state:
+2. **Fan out** — `superpowers:dispatching-parallel-agents` launches five reviewers, each blind to the others. Every reviewer is instructed to ground each finding in real code, logs, or live queries, and never to assume or fabricate state:
    - **Performance & bundle-size** — hot paths, N+1 queries, unbounded work, regressions.
    - **Security & data-access** (`security-auditor`) — authn/authz, input handling, injection, secret exposure, unsafe data access.
    - **UI/UX correctness** — verified live with Playwright when the MCP is available, else static review of the changed surface.
    - **Test coverage & flaky/stale mocks** (`test-engineer`) — uncovered branches, stale mocks, timing-flaky tests.
+   - **Simplicity & over-engineering** (`simplicity-review`) — code that could reuse an existing file, a stdlib or native feature, or fewer lines; reports trim opportunities via the reuse ladder and never flags input validation, data-loss handling, security, or accessibility.
 3. **Reconcile** — a final pass dedupes findings across reviewers, ranks each CRITICAL / HIGH / MEDIUM / LOW by severity and confidence, and explicitly flags any defect introduced by the changes under review.
 4. **Present** — emit the consolidated punch-list, severity-ranked, with file references. **Stop.**
 
@@ -42,7 +43,7 @@ Pure routing over existing skills and agents. Adds no new code.
 
 ## Composition
 
-Routes through: `reconcile` (scope/ground truth) → `superpowers:dispatching-parallel-agents` (fan-out) → the `security-auditor` and `test-engineer` agents (two of the four dimensions) → a reconciliation pass that ranks and dedupes. Each step falls back to its inline behavior when the preferred skill or agent is not installed.
+Routes through: `reconcile` (scope/ground truth) → `superpowers:dispatching-parallel-agents` (fan-out) → the `security-auditor` and `test-engineer` agents and the `simplicity-review` skill (three of the five dimensions) → a reconciliation pass that ranks and dedupes. Each step falls back to its inline behavior when the preferred skill or agent is not installed.
 
 ## Example
 
@@ -50,4 +51,4 @@ Routes through: `reconcile` (scope/ground truth) → `superpowers:dispatching-pa
 /production-readiness-review #246
 ```
 
-Scopes PR #246's diff, fans four blind reviewers across performance, security, UI/UX, and test coverage, then returns one deduplicated severity-ranked punch-list — flagging anything the PR's own changes introduced — and stops for you to prioritize.
+Scopes PR #246's diff, fans five blind reviewers across performance, security, UI/UX, test coverage, and simplicity, then returns one deduplicated severity-ranked punch-list — flagging anything the PR's own changes introduced — and stops for you to prioritize.

package/plugins/continuous-improvement/commands/simplicity-review.md

@@ -0,0 +1,35 @@
+---
+name: simplicity-review
+description: Review the current diff for over-engineering — flag code that could reuse an existing file, a stdlib or native feature, or fewer lines — and report GO/TRIM findings without touching code. Enforces Law 4 (Verify Before Reporting).
+---
+
+# /simplicity-review — Judge the Diff Before You Ship It
+
+Read the current change like the laziest senior dev in the room: could this have been smaller? Passing tests prove correctness, not minimality. Backed by the `simplicity-review` skill.
+
+## What it does
+
+Takes the working-tree diff (vs HEAD by default; accepts an optional commit range or file list), reads each changed block, and walks a fixed reuse ladder:
+
+```
+1. Does this need to exist?   -> skip it (YAGNI)
+2. Already in this codebase?  -> reuse it
+3. Stdlib does it?            -> use it
+4. Native platform feature?   -> use it
+5. Installed dependency?      -> use it
+6. One line?                  -> one line
+7. Only then:                    the minimum that works
+```
+
+It reports `file:line`, what is over-built, the specific simpler path, and closes with `GO` (already minimal) or `TRIM` (findings to apply). It does not edit code.
+
+## Default skeptical
+
+A finding is a hypothesis. Read the surrounding code and prove the simpler path exists and preserves behavior before asserting it; a wrong trim is worse than the over-build. Never flag input validation, data-loss-preventing error handling, security, or accessibility — lazy, not negligent.
+
+## Pairs with
+
+- **`simplicity-review`** skill — the discipline this command runs.
+- **`proceed-with-the-recommendation`** — apply the trims under the 7 Laws.
+- **`verification-loop`** — the ladder to re-run on whatever you trim.
+- **`production-readiness-review`** — the sibling diff review for performance, security, UI, and test coverage.

package/plugins/continuous-improvement/commands/verify-install.md

@@ -40,8 +40,8 @@ The observation hook appends one row per tool call to
 `<project-hash>` from the current repo, or check `~/.claude/instincts/global/`).
 
 - If it exists and has at least one row — capture is recording. Record `observe: ✓`.
-- If it is missing or empty — record `observe: ✗ (observation hook not recording —
-  on Windows confirm Git Bash / WSL is installed, then re-run the installer)`.
+- If it is missing or empty, record `observe: ✗ (observation hook not recording; re-run
+  the installer to migrate legacy Bash hook rows to the Node observer)`.
 
 ## Report
 

package/plugins/continuous-improvement/hooks/gateguard.mjs

@@ -210,6 +210,16 @@ function buildMutatingFileReason(toolName, filePaths, stateFilePath) {
         "  `_gateguard_facts_presented: true`; Claude Code's strict schema rejects that, so use A or B.)",
     ].join("\n");
 }
+function isGitBraceSelector(value) {
+    const selector = value.trim();
+    if (/^(?:u|upstream|push|-?\d+)$/i.test(selector))
+        return true;
+    if (/^(?:now|today|yesterday|tomorrow|noon|midnight|tea)$/i.test(selector))
+        return true;
+    if (/^\d{4}-\d{1,2}-\d{1,2}(?:[ T].*)?$/.test(selector))
+        return true;
+    return !selector.startsWith("#") && /(?:^|[.\s])ago$/i.test(selector);
+}
 function findUnquotedBraceRef(command) {
     let quote = null;
     for (let i = 0; i < command.length; i++) {
@@ -224,17 +234,26 @@ function findUnquotedBraceRef(command) {
             continue;
         }
         if (ch === "@" && command[i + 1] === "{") {
+            const braceEnd = command.indexOf("}", i + 2);
+            if (braceEnd === -1)
+                continue;
+            const selector = command.slice(i + 2, braceEnd);
+            // Deny only recognized Git selector grammar. PowerShell hashtables can
+            // contain comments, quoted braces, or arbitrary key expressions.
+            if (!isGitBraceSelector(selector)) {
+                i = braceEnd;
+                continue;
+            }
             // Expand to the whitespace-delimited word that carries this @{ ref, then
             // single-quote that whole word in the suggested fix.
             let wordStart = i;
             while (wordStart > 0 && !/\s/.test(command[wordStart - 1]))
                 wordStart--;
-            let wordEnd = i;
+            let wordEnd = braceEnd + 1;
             while (wordEnd < command.length && !/\s/.test(command[wordEnd]))
                 wordEnd++;
             const word = command.slice(wordStart, wordEnd);
-            const braceEnd = command.indexOf("}", i);
-            const ref = braceEnd === -1 ? command.slice(i, wordEnd) : command.slice(i, braceEnd + 1);
+            const ref = command.slice(i, braceEnd + 1);
             const fixed = `${command.slice(0, wordStart)}'${word}'${command.slice(wordEnd)}`;
             return { ref, fixed };
         }

package/plugins/continuous-improvement/hooks/hooks.json

@@ -1,5 +1,4 @@
 {
-  "description": "Gateguard fact-forcing PreToolUse, companion-preference enforcement, observation, session lifecycle, 3-section-close discipline, goal-drift Stop gate, opt-in workflow-distill Stop nudge, opt-in typecheck Stop gate, opt-in query-cost Stop nudge, and UserPromptSubmit lazy-routing plus opt-in proactive recall-briefing hooks for continuous-improvement.",
   "hooks": {
     "PreToolUse": [
       {
@@ -7,12 +6,12 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gateguard.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/companion-preference.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       },
@@ -22,7 +21,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/hook-pack.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       }
@@ -32,8 +31,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/observe.sh\"",
-            "timeout": 5
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/bin/observe.mjs\"",
+            "timeout": 30
           }
         ]
       }
@@ -44,12 +43,12 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/route-prompt.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/recall-briefing.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       }
@@ -59,8 +58,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session.sh\"",
-            "timeout": 5
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\"",
+            "timeout": 30
           }
         ]
       }
@@ -70,8 +69,8 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/session.sh\"",
-            "timeout": 5
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\"",
+            "timeout": 30
           }
         ]
       }
@@ -82,17 +81,17 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/three-section-close.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/goal-drift-stop.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/workflow-distill.mjs\"",
-            "timeout": 5
+            "timeout": 30
           },
           {
             "type": "command",
@@ -102,7 +101,7 @@
           {
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/query-cost-nudge.mjs\"",
-            "timeout": 5
+            "timeout": 30
           }
         ]
       }

package/plugins/continuous-improvement/hooks/query-cost-nudge.mjs

@@ -61,6 +61,7 @@ function collectChangedFiles(root) {
     return [
         ...parseChangedFiles(run(["diff", "--name-only", "--diff-filter=ACMR"])),
         ...parseChangedFiles(run(["diff", "--cached", "--name-only", "--diff-filter=ACMR"])),
+        ...parseChangedFiles(run(["ls-files", "--others", "--exclude-standard"])),
     ];
 }
 // Marker key: the sanitized session_id when present (the normal case), else a