specweave 0.30.19 → 0.32.2

package/plugins/specweave/hooks/universal/fail-fast-wrapper.sh

@@ -0,0 +1,183 @@
+#!/bin/bash
+# fail-fast-wrapper.sh - HARD TIMEOUT wrapper for all hooks
+# If ANY hook takes longer than HOOK_TIMEOUT, it gets KILLED.
+#
+# Usage: bash fail-fast-wrapper.sh <hook-script> [args...]
+#
+# Environment:
+#   HOOK_TIMEOUT - max seconds (default: 5)
+#   HOOK_DEBUG   - set to 1 for verbose logging
+#
+# Exit behavior:
+#   - Returns hook output on success
+#   - Returns safe JSON on timeout ({"continue":true} or {"decision":"approve"})
+#   - NEVER hangs - timeout is enforced with SIGKILL
+#
+# CRASH PREVENTION:
+#   - Integrates with crash-prevention.sh for process storm detection
+#   - Auto-kills zombie processes on timeout
+#   - Records failures for circuit breaker
+#
+# v0.33.0 - Enhanced with crash prevention integration
+
+set -o pipefail
+
+# === Configuration ===
+HOOK_TIMEOUT="${HOOK_TIMEOUT:-5}"  # 5 seconds - more than enough for any hook
+HOOK_DEBUG="${HOOK_DEBUG:-0}"
+LOG_FILE="${HOME}/.claude/hook-failures.log"
+
+# === Crash Prevention Integration ===
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CRASH_PREVENTION="${SCRIPT_DIR}/../lib/crash-prevention.sh"
+
+# Source crash prevention if available (non-blocking)
+if [[ -f "$CRASH_PREVENTION" ]]; then
+  source "$CRASH_PREVENTION" 2>/dev/null || true
+fi
+
+# === Helper functions ===
+log_debug() {
+  [[ "$HOOK_DEBUG" == "1" ]] && echo "[DEBUG $(date +%H:%M:%S)] $*" >&2
+}
+
+log_failure() {
+  local msg="$1"
+  mkdir -p "$(dirname "$LOG_FILE")"
+  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] HOOK TIMEOUT: $msg" >> "$LOG_FILE"
+}
+
+# === Safe JSON output based on hook type ===
+get_safe_output() {
+  local script="$1"
+  # PreToolUse hooks need "decision" format
+  if [[ "$script" == *"guard"* ]] || [[ "$script" == *"validator"* ]] || [[ "$script" == *"PreToolUse"* ]]; then
+    echo '{"decision":"allow"}'
+  else
+    echo '{"continue":true}'
+  fi
+}
+
+# === Read stdin with timeout ===
+# Critical: stdin can block forever if not handled properly
+read_stdin_with_timeout() {
+  local stdin_content=""
+
+  # Use read with timeout (integer seconds for bash compatibility)
+  if read -t 1 -r line; then
+    stdin_content="$line"
+    # Continue reading remaining lines (no timeout - stdin should be closed)
+    while IFS= read -r line; do
+      stdin_content="${stdin_content}"$'\n'"${line}"
+    done
+  fi
+
+  echo "$stdin_content"
+}
+
+# === Main execution ===
+main() {
+  local script="$1"
+  shift
+  local args=("$@")
+
+  if [[ -z "$script" ]]; then
+    echo '{"continue":true}'
+    exit 0
+  fi
+
+  if [[ ! -f "$script" ]]; then
+    log_debug "Script not found: $script"
+    echo '{"continue":true}'
+    exit 0
+  fi
+
+  # === CRASH PREVENTION: Process Storm Detection ===
+  # If too many hooks are running, skip this one to prevent cascade
+  if type detect_process_storm &>/dev/null; then
+    local storm_status
+    storm_status=$(detect_process_storm 25)
+    if [[ "$storm_status" == STORM* ]]; then
+      log_failure "$script - BLOCKED due to process storm: $storm_status"
+      get_safe_output "$script"
+      exit 0
+    fi
+  fi
+
+  log_debug "Executing: $script (timeout: ${HOOK_TIMEOUT}s)"
+
+  # Read stdin first (with its own timeout)
+  local stdin_content
+  stdin_content=$(read_stdin_with_timeout)
+
+  # Execute the hook with hard timeout
+  # Using timeout with --kill-after to ensure SIGKILL if SIGTERM doesn't work
+  local output
+  local exit_code
+
+  # Create temp file for output (avoid subshell issues)
+  local tmp_out
+  tmp_out=$(mktemp)
+
+  # Run with timeout - kill entire process group on timeout
+  if command -v gtimeout >/dev/null 2>&1; then
+    # macOS with coreutils
+    echo "$stdin_content" | gtimeout --kill-after=2 "$HOOK_TIMEOUT" bash "$script" "${args[@]}" > "$tmp_out" 2>/dev/null
+    exit_code=$?
+  elif command -v timeout >/dev/null 2>&1; then
+    # Linux
+    echo "$stdin_content" | timeout --kill-after=2 "$HOOK_TIMEOUT" bash "$script" "${args[@]}" > "$tmp_out" 2>/dev/null
+    exit_code=$?
+  else
+    # Fallback: manual timeout using background process
+    (
+      echo "$stdin_content" | bash "$script" "${args[@]}" > "$tmp_out" 2>/dev/null
+    ) &
+    local pid=$!
+
+    # Wait with timeout
+    local count=0
+    while kill -0 "$pid" 2>/dev/null && [[ $count -lt $((HOOK_TIMEOUT * 10)) ]]; do
+      sleep 0.1
+      count=$((count + 1))
+    done
+
+    if kill -0 "$pid" 2>/dev/null; then
+      # Still running - kill it!
+      kill -9 "$pid" 2>/dev/null
+      wait "$pid" 2>/dev/null
+      exit_code=124  # timeout exit code
+    else
+      wait "$pid"
+      exit_code=$?
+    fi
+  fi
+
+  output=$(cat "$tmp_out" 2>/dev/null)
+  rm -f "$tmp_out"
+
+  # Handle timeout (exit code 124 or 137)
+  if [[ $exit_code -eq 124 ]] || [[ $exit_code -eq 137 ]]; then
+    log_failure "$script - killed after ${HOOK_TIMEOUT}s"
+    log_debug "TIMEOUT: $script killed after ${HOOK_TIMEOUT}s"
+
+    # === CRASH PREVENTION: Clean up potential zombie processes ===
+    if type kill_zombie_heredocs &>/dev/null; then
+      kill_zombie_heredocs 2>/dev/null || true
+    fi
+
+    get_safe_output "$script"
+    exit 0
+  fi
+
+  # Return output or safe default
+  if [[ -n "$output" ]]; then
+    echo "$output"
+  else
+    get_safe_output "$script"
+  fi
+
+  exit 0
+}
+
+main "$@"

package/plugins/specweave/hooks/universal/hook-wrapper.cmd

@@ -1,26 +1,26 @@
-@echo off
-REM hook-wrapper.cmd - Windows resilient hook launcher
-REM Prevents crashes when dispatcher.mjs is temporarily unavailable
-
-setlocal enabledelayedexpansion
-
-set "HOOK_TYPE=%~1"
-if "%HOOK_TYPE%"=="" set "HOOK_TYPE=unknown"
-
-set "SCRIPT_DIR=%~dp0"
-set "DISPATCHER=%SCRIPT_DIR%dispatcher.mjs"
-
-REM Check if dispatcher exists
-if not exist "%DISPATCHER%" (
-    echo {"continue":true,"systemMessage":"Hook skipped: dispatcher.mjs not found"}
-    exit /b 0
-)
-
-REM Run dispatcher with error suppression
-node "%DISPATCHER%" "%HOOK_TYPE%" 2>nul
-if errorlevel 1 (
-    echo {"continue":true,"systemMessage":"Hook error, continuing"}
-    exit /b 0
-)
-
-exit /b 0
+@echo off
+REM hook-wrapper.cmd - Windows resilient hook launcher
+REM Prevents crashes when dispatcher.mjs is temporarily unavailable
+
+setlocal enabledelayedexpansion
+
+set "HOOK_TYPE=%~1"
+if "%HOOK_TYPE%"=="" set "HOOK_TYPE=unknown"
+
+set "SCRIPT_DIR=%~dp0"
+set "DISPATCHER=%SCRIPT_DIR%dispatcher.mjs"
+
+REM Check if dispatcher exists
+if not exist "%DISPATCHER%" (
+    echo {"continue":true,"systemMessage":"Hook skipped: dispatcher.mjs not found"}
+    exit /b 0
+)
+
+REM Run dispatcher with error suppression
+node "%DISPATCHER%" "%HOOK_TYPE%" 2>nul
+if errorlevel 1 (
+    echo {"continue":true,"systemMessage":"Hook error, continuing"}
+    exit /b 0
+)
+
+exit /b 0

package/plugins/specweave/hooks/universal/session-start.cmd

@@ -1,16 +1,16 @@
-@echo off
-:: Universal Session Start Hook for Windows
-:: Calls the Node.js dispatcher
-
-:: Find node.exe
-where node >nul 2>&1
-if %ERRORLEVEL% neq 0 (
-    echo {"continue": true, "error": "Node.js not found"}
-    exit /b 0
-)
-
-:: Get the directory of this script
-set "SCRIPT_DIR=%~dp0"
-
-:: Run the dispatcher
-node "%SCRIPT_DIR%dispatcher.mjs" session-start
+@echo off
+:: Universal Session Start Hook for Windows
+:: Calls the Node.js dispatcher
+
+:: Find node.exe
+where node >nul 2>&1
+if %ERRORLEVEL% neq 0 (
+    echo {"continue": true, "error": "Node.js not found"}
+    exit /b 0
+)
+
+:: Get the directory of this script
+set "SCRIPT_DIR=%~dp0"
+
+:: Run the dispatcher
+node "%SCRIPT_DIR%dispatcher.mjs" session-start

package/plugins/specweave/hooks/universal/session-start.ps1

@@ -1,16 +1,16 @@
-# Universal Session Start Hook for Windows PowerShell
-# Calls the Node.js dispatcher for cross-platform compatibility
-
-# Find node.exe
-$nodePath = Get-Command node -ErrorAction SilentlyContinue
-
-if (-not $nodePath) {
-    Write-Host '{"continue": true, "error": "Node.js not found"}'
-    exit 0
-}
-
-# Get script directory
-$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
-
-# Run the dispatcher
-& node "$scriptDir\dispatcher.mjs" session-start
+# Universal Session Start Hook for Windows PowerShell
+# Calls the Node.js dispatcher for cross-platform compatibility
+
+# Find node.exe
+$nodePath = Get-Command node -ErrorAction SilentlyContinue
+
+if (-not $nodePath) {
+    Write-Host '{"continue": true, "error": "Node.js not found"}'
+    exit 0
+}
+
+# Get script directory
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+
+# Run the dispatcher
+& node "$scriptDir\dispatcher.mjs" session-start

package/plugins/specweave/hooks/user-prompt-submit.sh

@@ -1,17 +1,17 @@
 #!/bin/bash
 
-# SpecWeave UserPromptSubmit Hook (v0.26.13 - ULTRA-OPTIMIZED)
+# SpecWeave UserPromptSubmit Hook (v0.33.0 - SCRIPT DELEGATION)
 # Fires BEFORE user's command executes (prompt-based hook)
 # Purpose: Discipline validation, context injection, command suggestions
 #
-# OPTIMIZATIONS (v0.26.13):
-# 1. jq for JSON parsing (10x faster than node -e)
-# 2. Single active increment detection (cached, not 4x!)
-# 3. Removed redundant find | while loops
-# 4. Deferred heavy checks (SpecSyncManager only when needed)
-# 5. Ultra-fast early exits
+# FEATURES:
+# - v0.33.0: Script delegation - status commands bypass LLM entirely (<1s)
+# - v0.26.13: jq for JSON parsing (10x faster than node -e)
+# - Single active increment detection (cached, not 4x!)
+# - Deferred heavy checks (SpecSyncManager only when needed)
+# - Ultra-fast early exits
 #
-# Performance: <10ms (most prompts) vs 200-500ms (before)
+# Performance: Status commands <1s (was 3+ min), other prompts <10ms
 
 set +e
 
@@ -45,6 +45,131 @@ if [[ ! -d "$SPECWEAVE_DIR" ]]; then
   exit 0
 fi
 
+# ==============================================================================
+# INSTANT SCRIPT EXECUTION: Status commands bypass LLM entirely (v0.33.0)
+# ==============================================================================
+# These commands need NO LLM reasoning - execute scripts directly for <1s response
+# Pattern: Detect command → Execute script → Return output via "block" → Exit
+
+PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCRIPTS_DIR="$PLUGIN_ROOT/scripts"
+
+# Helper: Escape output for JSON (handles newlines, quotes, backslashes)
+escape_json() {
+  local input="$1"
+  # Escape backslashes, then quotes, then newlines
+  echo "$input" | sed 's/\\/\\\\/g; s/"/\\"/g' | awk '{printf "%s\\n", $0}' | sed 's/\\n$//'
+}
+
+# /specweave:jobs → Execute read-jobs.sh (pure bash, ~2ms)
+if echo "$PROMPT" | grep -qE "^/specweave:jobs($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:jobs\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-jobs.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-jobs.sh" $ARGS 2>&1)
+  elif [[ -f "$SCRIPTS_DIR/jobs.js" ]] && command -v node >/dev/null 2>&1; then
+    OUTPUT=$(cd "$(pwd)" && node "$SCRIPTS_DIR/jobs.js" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No jobs script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:progress → Execute read-progress.sh (pure bash, ~30ms)
+if echo "$PROMPT" | grep -qE "^/specweave:progress($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:progress\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-progress.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-progress.sh" $ARGS 2>&1)
+  elif [[ -f "$SCRIPTS_DIR/progress.js" ]] && command -v node >/dev/null 2>&1; then
+    OUTPUT=$(cd "$(pwd)" && node "$SCRIPTS_DIR/progress.js" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No progress script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:status → Execute read-status.sh (pure bash, ~150ms)
+if echo "$PROMPT" | grep -qE "^/specweave:status($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:status\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-status.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-status.sh" $ARGS 2>&1)
+  elif [[ -f "$SCRIPTS_DIR/status.js" ]] && command -v node >/dev/null 2>&1; then
+    OUTPUT=$(cd "$(pwd)" && node "$SCRIPTS_DIR/status.js" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No status script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:workflow → Execute read-workflow.sh (pure bash, ~100ms)
+if echo "$PROMPT" | grep -qE "^/specweave:workflow($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:workflow\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-workflow.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-workflow.sh" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No workflow script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:costs → Execute read-costs.sh (pure bash, ~50ms)
+if echo "$PROMPT" | grep -qE "^/specweave:costs($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:costs\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-costs.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-costs.sh" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No costs script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# ==============================================================================
+# TASK COUNT GUARD: Block /specweave:do for oversized increments (v0.32.2+)
+# ==============================================================================
+# >8 tasks = context explosion = CRASH (per CLAUDE.md)
+MAX_TASKS=8
+
+if echo "$PROMPT" | grep -qE "^/specweave:do($| )"; then
+  # Extract increment ID from prompt
+  DO_INCREMENT_ID=$(echo "$PROMPT" | grep -oE "[0-9]{4}[a-zA-Z0-9-]*" | head -1)
+
+  # If no ID provided, find active increment
+  if [[ -z "$DO_INCREMENT_ID" ]]; then
+    for meta in "$SPECWEAVE_DIR/increments"/*/metadata.json; do
+      [[ -f "$meta" ]] || continue
+      if command -v jq >/dev/null 2>&1; then
+        status=$(jq -r '.status // "unknown"' "$meta" 2>/dev/null)
+      else
+        status=$(grep -oP '"status"\s*:\s*"\K[^"]*' "$meta" 2>/dev/null || echo "unknown")
+      fi
+      if [[ "$status" == "active" || "$status" == "in-progress" ]]; then
+        DO_INCREMENT_ID=$(basename "$(dirname "$meta")")
+        break
+      fi
+    done
+  fi
+
+  if [[ -n "$DO_INCREMENT_ID" ]]; then
+    TASKS_FILE="$SPECWEAVE_DIR/increments/$DO_INCREMENT_ID/tasks.md"
+    if [[ -f "$TASKS_FILE" ]]; then
+      TASK_COUNT=$(grep -c "^### T-" "$TASKS_FILE" 2>/dev/null || echo "0")
+      if [[ "$TASK_COUNT" -gt "$MAX_TASKS" ]]; then
+        printf '{"decision":"block","reason":"❌ TASK COUNT EXCEEDS LIMIT\\n\\nIncrement %s has %s tasks (maximum: %s)\\n\\n>8 tasks = context explosion = CRASH\\n\\n💡 REQUIRED: Split into smaller increments:\\n\\n  Pattern: %s/ → Split into:\\n    • %s-part1/ (T-001 to T-004)\\n    • Next increment (T-005 to T-008)\\n    • Next increment (T-009+)\\n\\n⚠️ DO NOT PROCEED until tasks.md has ≤8 tasks!"}\n' "$DO_INCREMENT_ID" "$TASK_COUNT" "$MAX_TASKS" "$DO_INCREMENT_ID" "$DO_INCREMENT_ID"
+        exit 0
+      fi
+    fi
+  fi
+fi
+
 # ==============================================================================
 # CACHED ACTIVE INCREMENT DETECTION (ONCE - reused throughout!)
 # ==============================================================================
@@ -101,23 +226,13 @@ if echo "$PROMPT" | grep -q "/specweave:increment"; then
 
   # Above hard cap: strong warning but NOT a block (user decides!)
   if [[ "$ACTIVE_COUNT" -ge "$HARD_CAP" ]]; then
-    cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "⚠️  WIP LIMIT EXCEEDED (${ACTIVE_COUNT}/${HARD_CAP})\n\nYou have $ACTIVE_COUNT active increments (configured maximum: $HARD_CAP)\n\nActive increments:\n$ACTIVE_LIST\n\n🧠 Research shows 3+ concurrent tasks = 40% slower + more bugs\n\n💡 Options:\n  1️⃣  Complete an increment: /specweave:done <id>\n  2️⃣  Pause an increment: /specweave:pause <id>\n  3️⃣  Increase limit: Edit .specweave/config.json limits.hardCap\n  4️⃣  Continue anyway (not recommended)\n\n📝 To proceed anyway, just confirm your intent."
-}
-EOF
+    printf '{"decision":"approve","systemMessage":"⚠️  WIP LIMIT EXCEEDED (%s/%s)\\n\\nYou have %s active increments (configured maximum: %s)\\n\\nActive increments:\\n%s\\n\\n🧠 Research shows 3+ concurrent tasks = 40%% slower + more bugs\\n\\n💡 Options:\\n  1️⃣  Complete an increment: /specweave:done <id>\\n  2️⃣  Pause an increment: /specweave:pause <id>\\n  3️⃣  Increase limit: Edit .specweave/config.json limits.hardCap\\n  4️⃣  Continue anyway (not recommended)\\n\\n📝 To proceed anyway, just confirm your intent."}\n' "$ACTIVE_COUNT" "$HARD_CAP" "$ACTIVE_COUNT" "$HARD_CAP" "$ACTIVE_LIST"
     exit 0
   fi
 
   # At soft limit: mild warning, approve
   if [[ "$ACTIVE_COUNT" -ge "$SOFT_LIMIT" ]]; then
-    cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "⚠️  WIP LIMIT REACHED (${ACTIVE_COUNT}/${SOFT_LIMIT})\n\nYou have $ACTIVE_COUNT active increment(s) (recommended limit: $SOFT_LIMIT)\n\nActive increments:\n$ACTIVE_LIST\n\n🧠 Focus Principle: Fewer active increments = maximum productivity\n\n💡 Consider:\n  1️⃣  Complete current work (recommended)\n  2️⃣  Pause current work (/specweave:pause)\n  3️⃣  Continue anyway\n\n⚠️  Emergency hotfix/bug? Use --type=hotfix or --type=bug"
-}
-EOF
+    printf '{"decision":"approve","systemMessage":"⚠️  WIP LIMIT REACHED (%s/%s)\\n\\nYou have %s active increment(s) (recommended limit: %s)\\n\\nActive increments:\\n%s\\n\\n🧠 Focus Principle: Fewer active increments = maximum productivity\\n\\n💡 Consider:\\n  1️⃣  Complete current work (recommended)\\n  2️⃣  Pause current work (/specweave:pause)\\n  3️⃣  Continue anyway\\n\\n⚠️  Emergency hotfix/bug? Use --type=hotfix or --type=bug"}\n' "$ACTIVE_COUNT" "$SOFT_LIMIT" "$ACTIVE_COUNT" "$SOFT_LIMIT" "$ACTIVE_LIST"
     exit 0
   fi
 fi
@@ -163,12 +278,7 @@ if [[ -n "$ACTIVE_INCREMENT" ]] && echo "$PROMPT" | grep -qE "/(specweave:)?(syn
   if [[ -f "$SPEC_FILE" ]] && [[ -f "$PLAN_FILE" ]]; then
     # Check if spec is newer than plan (indicates spec changes need sync)
     if [[ -n $(find "$SPEC_FILE" -newer "$PLAN_FILE" 2>/dev/null) ]]; then
-      cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "⚠️ Spec changes detected in $ACTIVE_INCREMENT\n\nspec.md has been modified after plan.md.\nConsider running /specweave:sync-docs to update living documentation."
-}
-EOF
+      printf '{"decision":"approve","systemMessage":"⚠️ Spec changes detected in %s\\n\\nspec.md has been modified after plan.md.\\nConsider running /specweave:sync-docs to update living documentation."}\n' "$ACTIVE_INCREMENT"
       exit 0
     fi
   fi
@@ -253,19 +363,11 @@ fi
 # ==============================================================================
 
 if [[ -n "$CONTEXT" ]]; then
-  cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "$CONTEXT"
-}
-EOF
+  # Escape context for JSON (newlines, quotes)
+  CONTEXT_ESCAPED=$(echo "$CONTEXT" | sed 's/\\/\\\\/g; s/"/\\"/g' | awk '{printf "%s\\n", $0}' | sed 's/\\n$//')
+  printf '{"decision":"approve","systemMessage":"%s"}\n' "$CONTEXT_ESCAPED"
 else
-  # Just approve, no extra context
-  cat <<EOF
-{
-  "decision": "approve"
-}
-EOF
+  echo '{"decision":"approve"}'
 fi
 
 exit 0