oh-my-customcodex 0.1.0

package/templates/.claude/hooks/scripts/agent-teams-advisor.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+set -euo pipefail
+
+# Dependency check: exit silently if jq not available
+command -v jq >/dev/null 2>&1 || exit 0
+
+# Agent Teams Advisor Hook
+# Trigger: PreToolUse, tool == "Task" || tool == "Agent"
+# Purpose: Track Agent/Task tool usage count per session and warn when Agent Teams may be more appropriate
+# Protocol: stdin JSON -> process -> stdout pass-through, exit 0 always (advisory only)
+
+input=$(cat)
+
+# Skip if Agent Teams is not available
+ENV_STATUS="/tmp/.codex-env-status-${PPID}"
+if [ -f "$ENV_STATUS" ]; then
+  teams_status=$(grep "agent_teams=" "$ENV_STATUS" 2>/dev/null | cut -d= -f2 || echo "unknown")
+  if [ "$teams_status" != "enabled" ]; then
+    echo "$input"
+    exit 0
+  fi
+fi
+
+# Batch context detection: check for workflow or release-plan state
+BATCH_ISSUES=0
+# Use wildcard to match any workflow name: /tmp/.codex-workflow-*-${PPID}.json
+WORKFLOW_FILE=$(ls /tmp/.codex-workflow-*-"${PPID}".json 2>/dev/null | head -1 || true)
+if [ -n "$WORKFLOW_FILE" ] && [ -f "$WORKFLOW_FILE" ]; then
+  BATCH_ISSUES=$(jq -r '.issue_count // 0' "$WORKFLOW_FILE" 2>/dev/null || echo 0)
+fi
+
+# Also check release-plan context (existence only — if file exists, treat as batch)
+RELEASE_PLAN="/tmp/.codex-release-plan-${PPID}"
+if [ -f "$RELEASE_PLAN" ]; then
+  if [ "$BATCH_ISSUES" -lt 3 ]; then
+    BATCH_ISSUES=3
+  fi
+fi
+
+# Extract task info from input
+agent_type=$(echo "$input" | jq -r '.tool_input.subagent_type // "unknown"')
+prompt_preview=$(echo "$input" | jq -r '.tool_input.description // ""' | head -c 60)
+
+# Session-scoped counter using parent PID as session identifier
+COUNTER_FILE="/tmp/.codex-task-count-${PPID}"
+
+# Read and increment counter
+if [ -f "$COUNTER_FILE" ]; then
+  COUNT=$(cat "$COUNTER_FILE")
+  COUNT=$((COUNT + 1))
+else
+  COUNT=1
+fi
+echo "$COUNT" > "$COUNTER_FILE"
+
+# Warn when batch context detected (even on first call) or from 2nd call onward
+if [ "$BATCH_ISSUES" -ge 3 ] && [ "$COUNT" -eq 1 ]; then
+  echo "" >&2
+  echo "--- [R018 Advisor] Batch context detected (${BATCH_ISSUES} issues) ---" >&2
+  echo "  RECOMMENDATION: Use Agent Teams (TeamCreate) for this batch." >&2
+  echo "  Current: Agent(${agent_type}) -- ${prompt_preview}" >&2
+  echo "-----------------------------------------------------------" >&2
+elif [ "$COUNT" -ge 2 ]; then
+  echo "" >&2
+  echo "--- [R018 Advisor] Agent/Task tool call #${COUNT} in this session ---" >&2
+  echo "  WARNING: Multiple Task calls detected. Consider Agent Teams if:" >&2
+  echo "    * 3+ agents needed for this work" >&2
+  echo "    * Review -> fix -> re-review cycle exists" >&2
+  echo "    * Agents need shared state or coordination" >&2
+  echo "  Current: Agent(${agent_type}) -- ${prompt_preview}" >&2
+  echo "-----------------------------------------------------------" >&2
+fi
+
+# Always pass through -- advisory only, never blocks
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/audit-log.sh

@@ -0,0 +1,64 @@
+#!/bin/bash
+# Audit Log Hook — Append-only JSONL persistence
+# Trigger: PostToolUse on Edit, Write, Bash, Agent
+# Purpose: Persistent audit trail for security and compliance
+# Protocol: stdin JSON -> log entry -> stdout pass-through
+# Always exits 0 (advisory only)
+
+set -euo pipefail
+HOOK_START=$(date +%s%N 2>/dev/null || echo 0)
+
+# Dependency check: exit silently if jq not available
+command -v jq >/dev/null 2>&1 || exit 0
+
+input=$(cat)
+
+# Extract fields from hook input
+tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
+file_path=$(echo "$input" | jq -r '.tool_input.file_path // .tool_input.command // ""' | head -c 200)
+agent_type=$(echo "$input" | jq -r '.agent_type // "unknown"')
+model=$(echo "$input" | jq -r '.model // "unknown"')
+is_error=$(echo "$input" | jq -r '.tool_output.is_error // false')
+timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Determine outcome
+if [ "$is_error" = "true" ]; then
+  outcome="error"
+else
+  outcome="success"
+fi
+
+# Audit log location
+AUDIT_LOG="${HOME}/.codex/audit.jsonl"
+
+# Ensure directory exists
+mkdir -p "$(dirname "$AUDIT_LOG")"
+
+# Write audit entry (append-only JSONL)
+jq -cn \
+  --arg ts "$timestamp" \
+  --arg tool "$tool_name" \
+  --arg path "$file_path" \
+  --arg agent "$agent_type" \
+  --arg model "$model" \
+  --arg outcome "$outcome" \
+  --arg ppid "${PPID}" \
+  '{timestamp: $ts, tool: $tool, path: $path, agent_type: $agent, model: $model, outcome: $outcome, session_ppid: $ppid}' \
+  >> "$AUDIT_LOG" 2>/dev/null || true
+
+# Daily rotation check (rotate if > 10MB)
+if [ -f "$AUDIT_LOG" ]; then
+  file_size=$(stat -f%z "$AUDIT_LOG" 2>/dev/null || stat -c%s "$AUDIT_LOG" 2>/dev/null || echo "0")
+  if [ "$file_size" -gt 10485760 ]; then
+    mv "$AUDIT_LOG" "${AUDIT_LOG}.$(date -u +%Y%m%d%H%M%S)" 2>/dev/null || true
+  fi
+fi
+
+# Pass through
+echo "$input"
+HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
+if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
+  HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))
+  echo "[Hook Perf] $(basename "$0"): ${HOOK_MS}ms" >> "/tmp/.codex-hook-perf-${PPID}.log"
+fi
+exit 0

package/templates/.claude/hooks/scripts/auto-continue-guard.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -euo pipefail
+
+# Auto-Continue Guard
+# Trigger: SubagentStop
+# Purpose: Count consecutive subagent completions and warn when auto-continue limit reached
+# Protocol: stdin JSON -> count check -> stdout pass-through, exit 0 always (R021)
+
+input=$(cat)
+
+count_file="/tmp/.codex-loop-count-${PPID}"
+
+# Reset counter if stale (>60s since last update)
+if [ -f "$count_file" ]; then
+  last_mod=$(stat -c%Y "$count_file" 2>/dev/null || stat -f%m "$count_file" 2>/dev/null || echo 0)
+  now=$(date +%s)
+  if [ $((now - last_mod)) -gt 60 ]; then
+    echo 0 > "$count_file"
+  fi
+fi
+
+# Increment counter
+count=$(cat "$count_file" 2>/dev/null || echo 0)
+count=$((count + 1))
+echo "$count" > "$count_file"
+
+# Warn if limit reached
+if [ "$count" -ge 4 ]; then
+  echo '[AutoContinue] SAFETY: auto-continue limit (3) reached. Pausing.' >&2
+fi
+
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/content-hash-validator.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# Content-Hash Validator — Detect stale file state for Edit operations
+# Trigger: PostToolUse on Read (stores hashes), PreToolUse on Edit (validates)
+# Purpose: Advisory warning when file content changed between Read and Edit
+# Protocol: stdin JSON -> validate -> stdout pass-through
+# Always exits 0 (advisory only, never blocks)
+
+set -euo pipefail
+
+# Dependency check: exit silently if jq not available
+command -v jq >/dev/null 2>&1 || exit 0
+
+input=$(cat)
+
+# Hash store (PPID-scoped, session-only)
+HASH_STORE="/tmp/.codex-content-hashes-${PPID}"
+
+tool_name=$(echo "$input" | jq -r '.tool_name // "unknown"')
+
+case "$tool_name" in
+  "Read")
+    # Store content hash for the file that was just read
+    file_path=$(echo "$input" | jq -r '.tool_input.file_path // ""')
+
+    if [ -n "$file_path" ] && [ -f "$file_path" ]; then
+      content_hash=$(md5 -q "$file_path" 2>/dev/null || md5sum "$file_path" 2>/dev/null | cut -d' ' -f1 || echo "unknown")
+      timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+      # Store hash entry (overwrite previous for same file)
+      if [ -f "$HASH_STORE" ]; then
+        # Remove old entry for this file
+        grep -v "\"path\":\"${file_path}\"" "$HASH_STORE" > "${HASH_STORE}.tmp" 2>/dev/null || true
+        mv "${HASH_STORE}.tmp" "$HASH_STORE" 2>/dev/null || true
+      fi
+
+      jq -cn \
+        --arg path "$file_path" \
+        --arg hash "$content_hash" \
+        --arg ts "$timestamp" \
+        '{path: $path, hash: $hash, stored_at: $ts}' >> "$HASH_STORE" 2>/dev/null || true
+    fi
+    ;;
+
+  "Edit")
+    # Validate that file hasn't changed since last Read
+    file_path=$(echo "$input" | jq -r '.tool_input.file_path // ""')
+
+    if [ -n "$file_path" ] && [ -f "$HASH_STORE" ] && [ -f "$file_path" ]; then
+      stored_hash=$(grep "\"path\":\"${file_path}\"" "$HASH_STORE" 2>/dev/null | tail -1 | jq -r '.hash // ""' 2>/dev/null || echo "")
+
+      if [ -n "$stored_hash" ] && [ "$stored_hash" != "unknown" ]; then
+        current_hash=$(md5 -q "$file_path" 2>/dev/null || md5sum "$file_path" 2>/dev/null | cut -d' ' -f1 || echo "unknown")
+
+        if [ "$current_hash" != "unknown" ] && [ "$stored_hash" != "$current_hash" ]; then
+          echo "[Content-Hash] WARNING: $(basename "$file_path") may have changed since last Read" >&2
+          echo "[Content-Hash] Stored hash: ${stored_hash:0:8}... Current: ${current_hash:0:8}..." >&2
+          echo "[Content-Hash] Advisory: re-read the file before editing if unsure" >&2
+        fi
+      fi
+    fi
+    ;;
+esac
+
+# Ring buffer: keep last 200 entries
+if [ -f "$HASH_STORE" ]; then
+  line_count=$(wc -l < "$HASH_STORE" 2>/dev/null || echo "0")
+  if [ "$line_count" -gt 200 ]; then
+    tail -200 "$HASH_STORE" > "${HASH_STORE}.tmp"
+    mv "${HASH_STORE}.tmp" "$HASH_STORE"
+  fi
+fi
+
+# Always pass through
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/context-budget-advisor.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+set -euo pipefail
+HOOK_START=$(date +%s%N 2>/dev/null || echo 0)
+
+# Dependency check: exit silently if jq not available
+command -v jq >/dev/null 2>&1 || exit 0
+
+# Context Budget Advisor Hook
+# Trigger: PostToolUse (Edit/Write/Agent/Task/Read/Glob/Grep/Bash)
+# Purpose: Monitor context usage and advise ecomode activation based on task type
+# Protocol: stdin JSON -> stdout pass-through, exit 0 always
+
+input=$(cat)
+
+# Read context info from status file if available
+STATUS_FILE="/tmp/.codex-env-status-${PPID}"
+BUDGET_FILE="/tmp/.codex-context-budget-${PPID}"
+
+# Initialize budget tracking file
+if [ ! -f "$BUDGET_FILE" ]; then
+  echo "task_type=general" > "$BUDGET_FILE"
+  echo "tool_count=0" >> "$BUDGET_FILE"
+  echo "write_count=0" >> "$BUDGET_FILE"
+  echo "read_count=0" >> "$BUDGET_FILE"
+  echo "agent_count=0" >> "$BUDGET_FILE"
+fi
+
+# Read current counts
+source "$BUDGET_FILE" 2>/dev/null || true
+tool_count=${tool_count:-0}
+write_count=${write_count:-0}
+read_count=${read_count:-0}
+agent_count=${agent_count:-0}
+
+# Determine tool type from input
+TOOL=$(echo "$input" | jq -r '.tool_name // ""' 2>/dev/null || echo "")
+tool_count=$((tool_count + 1))
+
+case "$TOOL" in
+  Write|Edit)
+    write_count=$((write_count + 1))
+    ;;
+  Read|Glob|Grep)
+    read_count=$((read_count + 1))
+    ;;
+  Task|Agent)
+    agent_count=$((agent_count + 1))
+    ;;
+esac
+
+# Infer task type based on tool usage pattern
+if [ "$agent_count" -ge 4 ]; then
+  task_type="research"
+elif [ "$write_count" -gt "$read_count" ] && [ "$write_count" -ge 5 ]; then
+  task_type="implementation"
+elif [ "$read_count" -gt "$write_count" ] && [ "$read_count" -ge 10 ]; then
+  task_type="review"
+else
+  task_type="general"
+fi
+
+# Update budget file
+cat > "$BUDGET_FILE" << EOF
+task_type=${task_type}
+tool_count=${tool_count}
+write_count=${write_count}
+read_count=${read_count}
+agent_count=${agent_count}
+EOF
+
+# Determine threshold for current task type
+case "$task_type" in
+  research)      THRESHOLD=40 ;;
+  implementation) THRESHOLD=50 ;;
+  review)        THRESHOLD=60 ;;
+  management)    THRESHOLD=70 ;;
+  *)             THRESHOLD=80 ;;
+esac
+
+# Emit advisory at milestones (every 25 tool calls)
+if [ "$tool_count" -gt 0 ] && [ $((tool_count % 25)) -eq 0 ]; then
+  echo "[Context Budget] Task: ${task_type} | Threshold: ${THRESHOLD}% | Tools used: ${tool_count}" >&2
+  if [ "$tool_count" -ge 75 ]; then
+    echo "[Context Budget] ⚠ High tool usage — consider /compact or ecomode" >&2
+  fi
+fi
+
+# R010 compliance heartbeat (every 50 tool calls)
+if [ "$tool_count" -gt 0 ] && [ $((tool_count % 50)) -eq 0 ]; then
+  echo "[Compliance] R007: Agent ID required | R008: Tool ID required | R010: Delegate writes" >&2
+  VIOLATION_FILE="/tmp/.codex-r010-violations-${PPID}"
+  if [ -f "$VIOLATION_FILE" ]; then
+    v_count=$(wc -l < "$VIOLATION_FILE" | tr -d ' ')
+    if [ "$v_count" -gt 0 ]; then
+      echo "[Compliance] R010 violations this session: ${v_count}" >&2
+    fi
+  fi
+fi
+
+# Pass through
+echo "$input"
+HOOK_END=$(date +%s%N 2>/dev/null || echo 0)
+if [ "$HOOK_START" != "0" ] && [ "$HOOK_END" != "0" ]; then
+  HOOK_MS=$(( (HOOK_END - HOOK_START) / 1000000 ))
+  echo "[Hook Perf] $(basename "$0"): ${HOOK_MS}ms" >> "/tmp/.codex-hook-perf-${PPID}.log"
+fi
+exit 0

package/templates/.claude/hooks/scripts/cost-cap-advisor.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# cost-cap-advisor.sh — Advisory hook for session cost monitoring
+# Trigger: PostToolUse (Agent/Task)
+# Purpose: Warn when session cost approaches configurable cap
+# Protocol: stdin JSON -> stdout pass-through, exit 0 always (advisory only, R010)
+
+input=$(cat)
+
+# Cost bridge file written by statusline.sh
+COST_FILE="/tmp/.codex-cost-${PPID}"
+ADVISORY_FILE="/tmp/.codex-cost-advisory-${PPID}"
+
+# Configurable cap (default $5.00, override via CLAUDE_COST_CAP env var)
+COST_CAP="${CLAUDE_COST_CAP:-5.00}"
+
+# Check if cost data is available
+if [ ! -f "$COST_FILE" ]; then
+  echo "$input"
+  exit 0
+fi
+
+# TSV: cost_usd, ctx_pct, timestamp, rl_5h_pct, rl_7d_pct, rl_5h_resets, rl_7d_resets
+IFS=$'\t' read -r cost_usd ctx_pct timestamp _rl_5h _rl_7d _rl_5h_resets _rl_7d_resets < "$COST_FILE" 2>/dev/null || {
+  echo "$input"
+  exit 0
+}
+
+# Validate cost_usd is a number
+if ! printf '%f' "$cost_usd" >/dev/null 2>&1; then
+  echo "$input"
+  exit 0
+fi
+
+# Calculate percentage of cap used
+# Use bc for float arithmetic
+cost_pct=$(echo "scale=0; $cost_usd * 100 / $COST_CAP" | bc 2>/dev/null || echo "0")
+
+# Staleness check — skip if data is older than 60 seconds
+now=$(date +%s)
+age=$((now - ${timestamp:-0}))
+if [ "$age" -gt 60 ]; then
+  echo "$input"
+  exit 0
+fi
+
+# Read last advisory level to avoid repeating the same warning
+last_level=""
+if [ -f "$ADVISORY_FILE" ]; then
+  last_level=$(cat "$ADVISORY_FILE" 2>/dev/null || echo "")
+fi
+
+# Determine advisory level and emit warning (only once per level)
+if [ "$cost_pct" -ge 100 ] && [ "$last_level" != "100" ]; then
+  echo "[Cost Cap] Session cost \$${cost_usd} has reached cap \$${COST_CAP} (${cost_pct}%)" >&2
+  echo "[Cost Cap] Consider wrapping up or increasing CLAUDE_COST_CAP" >&2
+  echo "100" > "$ADVISORY_FILE"
+elif [ "$cost_pct" -ge 90 ] && [ "$last_level" != "90" ] && [ "$last_level" != "100" ]; then
+  echo "[Cost Cap] Session cost \$${cost_usd} at 90% of cap \$${COST_CAP}" >&2
+  echo "[Cost Cap] Ecomode recommended — consider /compact" >&2
+  echo "90" > "$ADVISORY_FILE"
+elif [ "$cost_pct" -ge 75 ] && [ "$last_level" != "75" ] && [ "$last_level" != "90" ] && [ "$last_level" != "100" ]; then
+  echo "[Cost Cap] Session cost \$${cost_usd} at 75% of cap \$${COST_CAP}" >&2
+  echo "75" > "$ADVISORY_FILE"
+elif [ "$cost_pct" -ge 50 ] && [ -z "$last_level" ]; then
+  echo "[Cost Cap] Session cost \$${cost_usd} at 50% of cap \$${COST_CAP}" >&2
+  echo "50" > "$ADVISORY_FILE"
+fi
+
+# Pass through — advisory only
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/cwd-change-detector.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# CwdChanged hook — detect project type on directory change
+# Advisory only — provides context hints when cwd changes
+
+input=$(cat)
+new_cwd=$(echo "$input" | jq -r '.new_cwd // ""' 2>/dev/null)
+
+if [ -z "$new_cwd" ] || [ ! -d "$new_cwd" ]; then
+  echo "$input"
+  exit 0
+fi
+
+hints=""
+
+# Detect project type indicators
+if [ -f "$new_cwd/package.json" ]; then
+  hints="${hints}[Hook] Node.js project detected\n"
+fi
+if [ -f "$new_cwd/go.mod" ]; then
+  hints="${hints}[Hook] Go project detected\n"
+fi
+if [ -f "$new_cwd/Cargo.toml" ]; then
+  hints="${hints}[Hook] Rust project detected\n"
+fi
+if [ -f "$new_cwd/pyproject.toml" ] || [ -f "$new_cwd/requirements.txt" ]; then
+  hints="${hints}[Hook] Python project detected\n"
+fi
+if [ -f "$new_cwd/AGENTS.md" ]; then
+  hints="${hints}[Hook] oh-my-customcodex project detected\n"
+fi
+
+if [ -n "$hints" ]; then
+  printf "%b" "$hints" >&2
+fi
+
+echo "$input"

package/templates/.claude/hooks/scripts/eval-core-batch-save.sh

@@ -0,0 +1,46 @@
+#!/bin/bash
+set -euo pipefail
+
+# Eval-Core Batch Save on Session End (Advisory Only)
+# Trigger: Stop hook
+# Purpose: Auto-collect eval metrics on session end via eval-core CLI
+# Protocol: stdin JSON -> process -> stdout pass-through, exit 0 always
+#
+# This hook is advisory-only and never blocks session termination.
+# If eval-core is unavailable or collection fails, the session continues normally.
+
+input=$(cat)
+PPID_FILE="/tmp/.codex-task-outcomes-${PPID}"
+
+# Only attempt collection if outcome file exists
+if [ ! -f "$PPID_FILE" ]; then
+  echo "$input"
+  exit 0
+fi
+
+# Discover eval-core CLI using multiple strategies
+EVAL_CORE=""
+
+# Strategy 1: Global CLI installation
+if command -v eval-core >/dev/null 2>&1; then
+  EVAL_CORE="eval-core"
+fi
+
+# Strategy 2: Workspace package (oh-my-customcode development)
+if [ -z "$EVAL_CORE" ]; then
+  SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+  PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+  WORKSPACE_CLI="$PROJECT_ROOT/packages/eval-core/src/cli/index.ts"
+  if [ -f "$WORKSPACE_CLI" ] && command -v bun >/dev/null 2>&1; then
+    EVAL_CORE="bun run $WORKSPACE_CLI"
+  fi
+fi
+
+if [ -n "$EVAL_CORE" ]; then
+  echo "[Hook] Collecting eval metrics via eval-core..." >&2
+  $EVAL_CORE collect --ppid "$PPID" 2>/dev/null || true
+fi
+
+# Always pass through input and exit 0 (advisory only)
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/feedback-collector.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# feedback-collector.sh — Auto-extract failure patterns from session outcomes
+# Advisory-only: always exits 0, never blocks session end
+
+set -euo pipefail
+
+# Pass through stdin (Stop hook protocol)
+input=$(cat)
+
+# Dependencies check
+command -v jq >/dev/null 2>&1 || { echo "$input"; exit 0; }
+command -v sqlite3 >/dev/null 2>&1 || { echo "$input"; exit 0; }
+
+# PID scoping
+OUTCOMES_FILE="/tmp/.codex-task-outcomes-${PPID}"
+[ -f "$OUTCOMES_FILE" ] || { echo "$input"; exit 0; }
+
+# DB path
+DB_PATH="${HOME}/.config/oh-my-customcode/eval-core.sqlite"
+[ -f "$DB_PATH" ] || { echo "$input"; exit 0; }
+
+# Log file for error diagnostics
+LOG_FILE="/tmp/.codex-feedback-collector-${PPID}.log"
+
+# SQL injection safety: escape single quotes
+_sql_escape() { printf '%s' "${1//\'/\'\'}"; }
+
+# Count failures per agent type
+declare -A FAILURE_COUNTS
+declare -A TOTAL_COUNTS
+
+while IFS= read -r line; do
+  agent_type=$(echo "$line" | jq -r '.agent_type // empty' 2>/dev/null) || continue
+  outcome=$(echo "$line" | jq -r '.outcome // empty' 2>/dev/null) || continue
+  [ -z "$agent_type" ] && continue
+
+  TOTAL_COUNTS[$agent_type]=$(( ${TOTAL_COUNTS[$agent_type]:-0} + 1 ))
+  if [ "$outcome" = "failure" ]; then
+    FAILURE_COUNTS[$agent_type]=$(( ${FAILURE_COUNTS[$agent_type]:-0} + 1 ))
+  fi
+done < "$OUTCOMES_FILE"
+
+# Detect repeated failure agents (3+ failures)
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+INSERTED=0
+
+for agent_type in "${!FAILURE_COUNTS[@]}"; do
+  count=${FAILURE_COUNTS[$agent_type]}
+  total=${TOTAL_COUNTS[$agent_type]:-0}
+  [ "$count" -lt 3 ] && continue
+
+  # Determine confidence
+  if [ "$count" -ge 5 ]; then
+    confidence="high"
+  elif [ "$count" -ge 3 ]; then
+    confidence="medium"
+  else
+    confidence="low"
+  fi
+
+  # Determine action type
+  if [ "$count" -ge 5 ]; then
+    action_type="escalate"
+  else
+    action_type="augment"
+  fi
+
+  failure_rate=$(awk "BEGIN {printf \"%.2f\", $count/$total}")
+  description="Agent '${agent_type}' failed ${count}/${total} times (${failure_rate} failure rate) in session"
+
+  escaped_agent_type=$(_sql_escape "$agent_type")
+  escaped_action_type=$(_sql_escape "$action_type")
+  escaped_description=$(_sql_escape "$description")
+  escaped_confidence=$(_sql_escape "$confidence")
+  escaped_timestamp=$(_sql_escape "$TIMESTAMP")
+
+  sqlite3 "$DB_PATH" "INSERT INTO improvement_actions (target_type, target_name, action_type, description, confidence, feedback_source, status, created_at) VALUES ('agent', '${escaped_agent_type}', '${escaped_action_type}', '${escaped_description}', '${escaped_confidence}', 'outcome_derived', 'proposed', '${escaped_timestamp}');" \
+  2>>"$LOG_FILE" || {
+    echo "[feedback-collector] INSERT failed for ${agent_type}" >> "$LOG_FILE"
+  }
+
+  INSERTED=$((INSERTED + 1))
+done
+
+if [ "$INSERTED" -gt 0 ]; then
+  echo "[feedback-collector] Extracted ${INSERTED} failure pattern(s) from session outcomes" >&2
+fi
+
+# CRITICAL: Always pass through input and exit 0
+# This hook MUST NEVER block session termination
+echo "$input"
+exit 0

package/templates/.claude/hooks/scripts/file-change-validator.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# FileChanged hook — detect external file modifications
+# Advisory warning when files are modified outside Claude Code
+
+input=$(cat)
+file_path=$(echo "$input" | jq -r '.file_path // ""' 2>/dev/null)
+change_type=$(echo "$input" | jq -r '.change_type // "modified"' 2>/dev/null)
+
+if [ -z "$file_path" ]; then
+  echo "$input"
+  exit 0
+fi
+
+echo "[Hook] External file change detected: ${change_type} ${file_path}" >&2
+
+# Warn about important files
+case "$file_path" in
+  */AGENTS.md|*/hooks.json|*/settings*.json)
+    echo "[Hook] WARNING: Configuration file changed externally — re-read recommended" >&2
+    ;;
+  *.lock|*lockfile*)
+    echo "[Hook] Lock file changed — dependency state may have shifted" >&2
+    ;;
+esac
+
+echo "$input"