specweave 0.32.0 → 0.32.3

package/plugins/specweave/hooks/universal/dispatcher.mjs

@@ -12,6 +12,7 @@
  *   - session-start
  *   - post-tool-use
  *   - completion-guard
+ *   - bash-file-guard
  *
  * @module hooks/universal/dispatcher
  */
@@ -27,18 +28,82 @@ const __dirname = dirname(__filename);
 // Hook type from arguments
 const hookType = process.argv[2] || 'unknown';
 
+// Global timeout for hook execution (30 seconds max)
+const HOOK_TIMEOUT_MS = 30000;
+
+/**
+ * Detect if we're in a development environment with duplicate hooks
+ *
+ * Problem: When working IN the specweave project AND having the marketplace
+ * plugin installed, Claude Code loads hooks from BOTH sources, causing:
+ * - Duplicate hook execution
+ * - Potential race conditions
+ * - Confusing output
+ *
+ * Solution: If we detect we're running from the marketplace copy while
+ * the CWD is the specweave project itself, skip execution (let local hooks handle it).
+ *
+ * @returns {boolean} true if we should skip this hook execution
+ */
+function shouldSkipDueToDevEnvironment() {
+  const pluginRoot = process.env.CLAUDE_PLUGIN_ROOT || '';
+  const cwd = process.cwd();
+
+  // Check if running from marketplace (installed plugin)
+  const isFromMarketplace = pluginRoot.includes('.claude/plugins/marketplaces/');
+
+  // Check if CWD is the specweave project itself
+  const isInSpecweaveProject = existsSync(join(cwd, 'plugins', 'specweave', 'hooks', 'hooks.json'));
+
+  // Skip marketplace hooks when developing specweave locally
+  if (isFromMarketplace && isInSpecweaveProject) {
+    // Output diagnostic only for session-start (once per session)
+    if (hookType === 'session-start') {
+      console.log(JSON.stringify({
+        continue: true,
+        systemMessage: 'SpecWeave dev environment: Using local hooks (marketplace hooks skipped)'
+      }));
+    } else {
+      console.log(JSON.stringify({ continue: true }));
+    }
+    return true;
+  }
+
+  return false;
+}
+
 /**
- * Find the dist/hooks directory
+ * Wrap a promise with a timeout
+ * @param promise - Promise to wrap
+ * @param timeoutMs - Timeout in milliseconds
+ * @param cleanup - Optional cleanup function (e.g., to kill child process)
+ */
+function withTimeout(promise, timeoutMs, cleanup) {
+  let timeoutId;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutId = setTimeout(() => {
+      if (cleanup) cleanup();
+      reject(new Error(`Hook timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+
+  return Promise.race([promise, timeoutPromise]).finally(() => {
+    clearTimeout(timeoutId);
+  });
+}
+
+/**
+ * Find the dist/src/hooks directory (TypeScript compiled hooks)
  */
 function findHooksDir() {
   // Try multiple locations
   const candidates = [
-    // Production: node_modules/specweave/dist/hooks
-    join(__dirname, '..', '..', '..', '..', 'node_modules', 'specweave', 'dist', 'hooks'),
-    // Development: project root dist/hooks
+    // Production: node_modules/specweave/dist/src/hooks
+    join(__dirname, '..', '..', '..', '..', 'node_modules', 'specweave', 'dist', 'src', 'hooks'),
+    // Development: project root dist/src/hooks
+    join(__dirname, '..', '..', '..', '..', 'dist', 'src', 'hooks'),
+    // Fallback: older path without src/ (backward compatibility)
     join(__dirname, '..', '..', '..', '..', 'dist', 'hooks'),
-    // Relative to this file
-    join(__dirname, '..', '..', '..', '..', 'src', 'hooks'),
   ];
 
   for (const candidate of candidates) {
@@ -52,7 +117,7 @@ function findHooksDir() {
 }
 
 /**
- * Run a hook script
+ * Run a hook script with timeout protection
  */
 async function runHook(scriptName) {
   const hooksDir = findHooksDir();
@@ -74,13 +139,26 @@ async function runHook(scriptName) {
     windowsHide: true,
   });
 
-  return new Promise((resolve) => {
+  const execPromise = new Promise((resolve) => {
     child.on('exit', (code) => resolve(code || 0));
     child.on('error', () => {
       console.log(JSON.stringify({ continue: true }));
       resolve(1);
     });
   });
+
+  try {
+    return await withTimeout(execPromise, HOOK_TIMEOUT_MS, () => {
+      // Kill the child process on timeout
+      try {
+        child.kill('SIGTERM');
+        setTimeout(() => child.kill('SIGKILL'), 1000);
+      } catch { /* ignore */ }
+    });
+  } catch (err) {
+    console.log(JSON.stringify({ continue: true, error: err.message }));
+    return 1;
+  }
 }
 
 /**
@@ -124,7 +202,39 @@ function findGitBash() {
 }
 
 /**
- * Fallback to bash script if TypeScript not built
+ * Helper to spawn a bash script with timeout protection
+ */
+async function spawnBashWithTimeout(bashExe, args, options = {}) {
+  const child = spawn(bashExe, args, {
+    stdio: ['inherit', 'inherit', 'inherit'],
+    windowsHide: true,
+    ...options,
+  });
+
+  const execPromise = new Promise((resolve) => {
+    child.on('exit', (code) => resolve(code || 0));
+    child.on('error', () => {
+      console.log(JSON.stringify({ continue: true }));
+      resolve(1);
+    });
+  });
+
+  try {
+    return await withTimeout(execPromise, HOOK_TIMEOUT_MS, () => {
+      // Kill the child process on timeout
+      try {
+        child.kill('SIGTERM');
+        setTimeout(() => child.kill('SIGKILL'), 1000);
+      } catch { /* ignore */ }
+    });
+  } catch (err) {
+    console.log(JSON.stringify({ continue: true, error: err.message }));
+    return 1;
+  }
+}
+
+/**
+ * Fallback to bash script if TypeScript not built (with timeout protection)
  *
  * @param bashScript - Name of the bash script (e.g., 'post-tool-use.sh')
  * @param subdir - Subdirectory under v2 (e.g., 'dispatchers', 'guards')
@@ -143,17 +253,7 @@ async function fallbackToBash(bashScript, subdir = 'dispatchers') {
     // Strategy 1: Git Bash (preferred - most common)
     const bashExe = findGitBash();
     if (bashExe) {
-      const child = spawn(bashExe, [scriptPath], {
-        stdio: ['inherit', 'inherit', 'inherit'],
-        windowsHide: true,
-      });
-      return new Promise((resolve) => {
-        child.on('exit', (code) => resolve(code || 0));
-        child.on('error', () => {
-          console.log(JSON.stringify({ continue: true }));
-          resolve(1);
-        });
-      });
+      return spawnBashWithTimeout(bashExe, [scriptPath]);
     }
 
     // Strategy 2: WSL (if Git Bash not available) - FALLBACK only
@@ -166,17 +266,7 @@ async function fallbackToBash(bashScript, subdir = 'dispatchers') {
       const wslScriptPath = scriptPath
         .replace(/\\/g, '/')
         .replace(/^([A-Za-z]):/, (_, d) => `/mnt/${d.toLowerCase()}`);
-      const child = spawn('wsl', ['bash', wslScriptPath], {
-        stdio: ['inherit', 'inherit', 'inherit'],
-        windowsHide: true,
-      });
-      return new Promise((resolve) => {
-        child.on('exit', (code) => resolve(code || 0));
-        child.on('error', () => {
-          console.log(JSON.stringify({ continue: true }));
-          resolve(1);
-        });
-      });
+      return spawnBashWithTimeout('wsl', ['bash', wslScriptPath]);
     }
 
     // Strategy 3: No bash available - output warning and continue
@@ -188,21 +278,18 @@ async function fallbackToBash(bashScript, subdir = 'dispatchers') {
     return;
   }
 
-  // POSIX (macOS, Linux) - run directly
-  const child = spawn('bash', [scriptPath], {
-    stdio: ['inherit', 'inherit', 'inherit'],
-  });
-  return new Promise((resolve) => {
-    child.on('exit', (code) => resolve(code || 0));
-    child.on('error', () => {
-      console.log(JSON.stringify({ continue: true }));
-      resolve(1);
-    });
-  });
+  // POSIX (macOS, Linux) - run directly with timeout
+  return spawnBashWithTimeout('bash', [scriptPath]);
 }
 
 // Main routing
 async function main() {
+  // CRITICAL: Skip if we're in dev environment with duplicate hooks
+  // This prevents marketplace hooks from running when local hooks are available
+  if (shouldSkipDueToDevEnvironment()) {
+    return;
+  }
+
   const isWindows = process.platform === 'win32';
 
   try {
@@ -235,6 +322,12 @@ async function main() {
         await fallbackToBash('completion-guard.sh', 'guards');
         break;
 
+      case 'bash-file-guard':
+        // CRITICAL: Prevents infinite hangs from heredoc/echo file creation
+        // See CLAUDE.md Rule 9 for why this is essential
+        await fallbackToBash('bash-file-guard.sh', 'guards');
+        break;
+
       default:
         console.log(JSON.stringify({ continue: true, error: `Unknown hook type: ${hookType}` }));
     }

package/plugins/specweave/hooks/universal/fail-fast-wrapper.sh

@@ -0,0 +1,183 @@
+#!/bin/bash
+# fail-fast-wrapper.sh - HARD TIMEOUT wrapper for all hooks
+# If ANY hook takes longer than HOOK_TIMEOUT, it gets KILLED.
+#
+# Usage: bash fail-fast-wrapper.sh <hook-script> [args...]
+#
+# Environment:
+#   HOOK_TIMEOUT - max seconds (default: 5)
+#   HOOK_DEBUG   - set to 1 for verbose logging
+#
+# Exit behavior:
+#   - Returns hook output on success
+#   - Returns safe JSON on timeout ({"continue":true} or {"decision":"approve"})
+#   - NEVER hangs - timeout is enforced with SIGKILL
+#
+# CRASH PREVENTION:
+#   - Integrates with crash-prevention.sh for process storm detection
+#   - Auto-kills zombie processes on timeout
+#   - Records failures for circuit breaker
+#
+# v0.33.0 - Enhanced with crash prevention integration
+
+set -o pipefail
+
+# === Configuration ===
+HOOK_TIMEOUT="${HOOK_TIMEOUT:-5}"  # 5 seconds - more than enough for any hook
+HOOK_DEBUG="${HOOK_DEBUG:-0}"
+LOG_FILE="${HOME}/.claude/hook-failures.log"
+
+# === Crash Prevention Integration ===
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CRASH_PREVENTION="${SCRIPT_DIR}/../lib/crash-prevention.sh"
+
+# Source crash prevention if available (non-blocking)
+if [[ -f "$CRASH_PREVENTION" ]]; then
+  source "$CRASH_PREVENTION" 2>/dev/null || true
+fi
+
+# === Helper functions ===
+log_debug() {
+  [[ "$HOOK_DEBUG" == "1" ]] && echo "[DEBUG $(date +%H:%M:%S)] $*" >&2
+}
+
+log_failure() {
+  local msg="$1"
+  mkdir -p "$(dirname "$LOG_FILE")"
+  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] HOOK TIMEOUT: $msg" >> "$LOG_FILE"
+}
+
+# === Safe JSON output based on hook type ===
+get_safe_output() {
+  local script="$1"
+  # PreToolUse hooks need "decision" format
+  if [[ "$script" == *"guard"* ]] || [[ "$script" == *"validator"* ]] || [[ "$script" == *"PreToolUse"* ]]; then
+    echo '{"decision":"allow"}'
+  else
+    echo '{"continue":true}'
+  fi
+}
+
+# === Read stdin with timeout ===
+# Critical: stdin can block forever if not handled properly
+read_stdin_with_timeout() {
+  local stdin_content=""
+
+  # Use read with timeout (integer seconds for bash compatibility)
+  if read -t 1 -r line; then
+    stdin_content="$line"
+    # Continue reading remaining lines (no timeout - stdin should be closed)
+    while IFS= read -r line; do
+      stdin_content="${stdin_content}"$'\n'"${line}"
+    done
+  fi
+
+  echo "$stdin_content"
+}
+
+# === Main execution ===
+main() {
+  local script="$1"
+  shift
+  local args=("$@")
+
+  if [[ -z "$script" ]]; then
+    echo '{"continue":true}'
+    exit 0
+  fi
+
+  if [[ ! -f "$script" ]]; then
+    log_debug "Script not found: $script"
+    echo '{"continue":true}'
+    exit 0
+  fi
+
+  # === CRASH PREVENTION: Process Storm Detection ===
+  # If too many hooks are running, skip this one to prevent cascade
+  if type detect_process_storm &>/dev/null; then
+    local storm_status
+    storm_status=$(detect_process_storm 25)
+    if [[ "$storm_status" == STORM* ]]; then
+      log_failure "$script - BLOCKED due to process storm: $storm_status"
+      get_safe_output "$script"
+      exit 0
+    fi
+  fi
+
+  log_debug "Executing: $script (timeout: ${HOOK_TIMEOUT}s)"
+
+  # Read stdin first (with its own timeout)
+  local stdin_content
+  stdin_content=$(read_stdin_with_timeout)
+
+  # Execute the hook with hard timeout
+  # Using timeout with --kill-after to ensure SIGKILL if SIGTERM doesn't work
+  local output
+  local exit_code
+
+  # Create temp file for output (avoid subshell issues)
+  local tmp_out
+  tmp_out=$(mktemp)
+
+  # Run with timeout - kill entire process group on timeout
+  if command -v gtimeout >/dev/null 2>&1; then
+    # macOS with coreutils
+    echo "$stdin_content" | gtimeout --kill-after=2 "$HOOK_TIMEOUT" bash "$script" "${args[@]}" > "$tmp_out" 2>/dev/null
+    exit_code=$?
+  elif command -v timeout >/dev/null 2>&1; then
+    # Linux
+    echo "$stdin_content" | timeout --kill-after=2 "$HOOK_TIMEOUT" bash "$script" "${args[@]}" > "$tmp_out" 2>/dev/null
+    exit_code=$?
+  else
+    # Fallback: manual timeout using background process
+    (
+      echo "$stdin_content" | bash "$script" "${args[@]}" > "$tmp_out" 2>/dev/null
+    ) &
+    local pid=$!
+
+    # Wait with timeout
+    local count=0
+    while kill -0 "$pid" 2>/dev/null && [[ $count -lt $((HOOK_TIMEOUT * 10)) ]]; do
+      sleep 0.1
+      count=$((count + 1))
+    done
+
+    if kill -0 "$pid" 2>/dev/null; then
+      # Still running - kill it!
+      kill -9 "$pid" 2>/dev/null
+      wait "$pid" 2>/dev/null
+      exit_code=124  # timeout exit code
+    else
+      wait "$pid"
+      exit_code=$?
+    fi
+  fi
+
+  output=$(cat "$tmp_out" 2>/dev/null)
+  rm -f "$tmp_out"
+
+  # Handle timeout (exit code 124 or 137)
+  if [[ $exit_code -eq 124 ]] || [[ $exit_code -eq 137 ]]; then
+    log_failure "$script - killed after ${HOOK_TIMEOUT}s"
+    log_debug "TIMEOUT: $script killed after ${HOOK_TIMEOUT}s"
+
+    # === CRASH PREVENTION: Clean up potential zombie processes ===
+    if type kill_zombie_heredocs &>/dev/null; then
+      kill_zombie_heredocs 2>/dev/null || true
+    fi
+
+    get_safe_output "$script"
+    exit 0
+  fi
+
+  # Return output or safe default
+  if [[ -n "$output" ]]; then
+    echo "$output"
+  else
+    get_safe_output "$script"
+  fi
+
+  exit 0
+}
+
+main "$@"

package/plugins/specweave/hooks/user-prompt-submit.sh

@@ -1,17 +1,17 @@
 #!/bin/bash
 
-# SpecWeave UserPromptSubmit Hook (v0.26.13 - ULTRA-OPTIMIZED)
+# SpecWeave UserPromptSubmit Hook (v0.33.0 - SCRIPT DELEGATION)
 # Fires BEFORE user's command executes (prompt-based hook)
 # Purpose: Discipline validation, context injection, command suggestions
 #
-# OPTIMIZATIONS (v0.26.13):
-# 1. jq for JSON parsing (10x faster than node -e)
-# 2. Single active increment detection (cached, not 4x!)
-# 3. Removed redundant find | while loops
-# 4. Deferred heavy checks (SpecSyncManager only when needed)
-# 5. Ultra-fast early exits
+# FEATURES:
+# - v0.33.0: Script delegation - status commands bypass LLM entirely (<1s)
+# - v0.26.13: jq for JSON parsing (10x faster than node -e)
+# - Single active increment detection (cached, not 4x!)
+# - Deferred heavy checks (SpecSyncManager only when needed)
+# - Ultra-fast early exits
 #
-# Performance: <10ms (most prompts) vs 200-500ms (before)
+# Performance: Status commands <1s (was 3+ min), other prompts <10ms
 
 set +e
 
@@ -45,6 +45,131 @@ if [[ ! -d "$SPECWEAVE_DIR" ]]; then
   exit 0
 fi
 
+# ==============================================================================
+# INSTANT SCRIPT EXECUTION: Status commands bypass LLM entirely (v0.33.0)
+# ==============================================================================
+# These commands need NO LLM reasoning - execute scripts directly for <1s response
+# Pattern: Detect command → Execute script → Return output via "block" → Exit
+
+PLUGIN_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SCRIPTS_DIR="$PLUGIN_ROOT/scripts"
+
+# Helper: Escape output for JSON (handles newlines, quotes, backslashes)
+escape_json() {
+  local input="$1"
+  # Escape backslashes, then quotes, then newlines
+  echo "$input" | sed 's/\\/\\\\/g; s/"/\\"/g' | awk '{printf "%s\\n", $0}' | sed 's/\\n$//'
+}
+
+# /specweave:jobs → Execute read-jobs.sh (pure bash, ~2ms)
+if echo "$PROMPT" | grep -qE "^/specweave:jobs($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:jobs\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-jobs.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-jobs.sh" $ARGS 2>&1)
+  elif [[ -f "$SCRIPTS_DIR/jobs.js" ]] && command -v node >/dev/null 2>&1; then
+    OUTPUT=$(cd "$(pwd)" && node "$SCRIPTS_DIR/jobs.js" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No jobs script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:progress → Execute read-progress.sh (pure bash, ~30ms)
+if echo "$PROMPT" | grep -qE "^/specweave:progress($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:progress\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-progress.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-progress.sh" $ARGS 2>&1)
+  elif [[ -f "$SCRIPTS_DIR/progress.js" ]] && command -v node >/dev/null 2>&1; then
+    OUTPUT=$(cd "$(pwd)" && node "$SCRIPTS_DIR/progress.js" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No progress script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:status → Execute read-status.sh (pure bash, ~150ms)
+if echo "$PROMPT" | grep -qE "^/specweave:status($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:status\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-status.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-status.sh" $ARGS 2>&1)
+  elif [[ -f "$SCRIPTS_DIR/status.js" ]] && command -v node >/dev/null 2>&1; then
+    OUTPUT=$(cd "$(pwd)" && node "$SCRIPTS_DIR/status.js" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No status script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:workflow → Execute read-workflow.sh (pure bash, ~100ms)
+if echo "$PROMPT" | grep -qE "^/specweave:workflow($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:workflow\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-workflow.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-workflow.sh" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No workflow script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# /specweave:costs → Execute read-costs.sh (pure bash, ~50ms)
+if echo "$PROMPT" | grep -qE "^/specweave:costs($| )"; then
+  ARGS=$(echo "$PROMPT" | sed 's|^/specweave:costs\s*||')
+  if [[ -f "$SCRIPTS_DIR/read-costs.sh" ]]; then
+    OUTPUT=$(cd "$(pwd)" && bash "$SCRIPTS_DIR/read-costs.sh" $ARGS 2>&1)
+  else
+    OUTPUT="❌ No costs script available"
+  fi
+  OUTPUT_ESCAPED=$(escape_json "$OUTPUT")
+  printf '{"decision":"block","reason":"%s"}\n' "$OUTPUT_ESCAPED"
+  exit 0
+fi
+
+# ==============================================================================
+# TASK COUNT GUARD: Block /specweave:do for oversized increments (v0.32.2+)
+# ==============================================================================
+# >8 tasks = context explosion = CRASH (per CLAUDE.md)
+MAX_TASKS=8
+
+if echo "$PROMPT" | grep -qE "^/specweave:do($| )"; then
+  # Extract increment ID from prompt
+  DO_INCREMENT_ID=$(echo "$PROMPT" | grep -oE "[0-9]{4}[a-zA-Z0-9-]*" | head -1)
+
+  # If no ID provided, find active increment
+  if [[ -z "$DO_INCREMENT_ID" ]]; then
+    for meta in "$SPECWEAVE_DIR/increments"/*/metadata.json; do
+      [[ -f "$meta" ]] || continue
+      if command -v jq >/dev/null 2>&1; then
+        status=$(jq -r '.status // "unknown"' "$meta" 2>/dev/null)
+      else
+        status=$(grep -oP '"status"\s*:\s*"\K[^"]*' "$meta" 2>/dev/null || echo "unknown")
+      fi
+      if [[ "$status" == "active" || "$status" == "in-progress" ]]; then
+        DO_INCREMENT_ID=$(basename "$(dirname "$meta")")
+        break
+      fi
+    done
+  fi
+
+  if [[ -n "$DO_INCREMENT_ID" ]]; then
+    TASKS_FILE="$SPECWEAVE_DIR/increments/$DO_INCREMENT_ID/tasks.md"
+    if [[ -f "$TASKS_FILE" ]]; then
+      TASK_COUNT=$(grep -c "^### T-" "$TASKS_FILE" 2>/dev/null || echo "0")
+      if [[ "$TASK_COUNT" -gt "$MAX_TASKS" ]]; then
+        printf '{"decision":"block","reason":"❌ TASK COUNT EXCEEDS LIMIT\\n\\nIncrement %s has %s tasks (maximum: %s)\\n\\n>8 tasks = context explosion = CRASH\\n\\n💡 REQUIRED: Split into smaller increments:\\n\\n  Pattern: %s/ → Split into:\\n    • %s-part1/ (T-001 to T-004)\\n    • Next increment (T-005 to T-008)\\n    • Next increment (T-009+)\\n\\n⚠️ DO NOT PROCEED until tasks.md has ≤8 tasks!"}\n' "$DO_INCREMENT_ID" "$TASK_COUNT" "$MAX_TASKS" "$DO_INCREMENT_ID" "$DO_INCREMENT_ID"
+        exit 0
+      fi
+    fi
+  fi
+fi
+
 # ==============================================================================
 # CACHED ACTIVE INCREMENT DETECTION (ONCE - reused throughout!)
 # ==============================================================================
@@ -101,23 +226,13 @@ if echo "$PROMPT" | grep -q "/specweave:increment"; then
 
   # Above hard cap: strong warning but NOT a block (user decides!)
   if [[ "$ACTIVE_COUNT" -ge "$HARD_CAP" ]]; then
-    cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "⚠️  WIP LIMIT EXCEEDED (${ACTIVE_COUNT}/${HARD_CAP})\n\nYou have $ACTIVE_COUNT active increments (configured maximum: $HARD_CAP)\n\nActive increments:\n$ACTIVE_LIST\n\n🧠 Research shows 3+ concurrent tasks = 40% slower + more bugs\n\n💡 Options:\n  1️⃣  Complete an increment: /specweave:done <id>\n  2️⃣  Pause an increment: /specweave:pause <id>\n  3️⃣  Increase limit: Edit .specweave/config.json limits.hardCap\n  4️⃣  Continue anyway (not recommended)\n\n📝 To proceed anyway, just confirm your intent."
-}
-EOF
+    printf '{"decision":"approve","systemMessage":"⚠️  WIP LIMIT EXCEEDED (%s/%s)\\n\\nYou have %s active increments (configured maximum: %s)\\n\\nActive increments:\\n%s\\n\\n🧠 Research shows 3+ concurrent tasks = 40%% slower + more bugs\\n\\n💡 Options:\\n  1️⃣  Complete an increment: /specweave:done <id>\\n  2️⃣  Pause an increment: /specweave:pause <id>\\n  3️⃣  Increase limit: Edit .specweave/config.json limits.hardCap\\n  4️⃣  Continue anyway (not recommended)\\n\\n📝 To proceed anyway, just confirm your intent."}\n' "$ACTIVE_COUNT" "$HARD_CAP" "$ACTIVE_COUNT" "$HARD_CAP" "$ACTIVE_LIST"
     exit 0
   fi
 
   # At soft limit: mild warning, approve
   if [[ "$ACTIVE_COUNT" -ge "$SOFT_LIMIT" ]]; then
-    cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "⚠️  WIP LIMIT REACHED (${ACTIVE_COUNT}/${SOFT_LIMIT})\n\nYou have $ACTIVE_COUNT active increment(s) (recommended limit: $SOFT_LIMIT)\n\nActive increments:\n$ACTIVE_LIST\n\n🧠 Focus Principle: Fewer active increments = maximum productivity\n\n💡 Consider:\n  1️⃣  Complete current work (recommended)\n  2️⃣  Pause current work (/specweave:pause)\n  3️⃣  Continue anyway\n\n⚠️  Emergency hotfix/bug? Use --type=hotfix or --type=bug"
-}
-EOF
+    printf '{"decision":"approve","systemMessage":"⚠️  WIP LIMIT REACHED (%s/%s)\\n\\nYou have %s active increment(s) (recommended limit: %s)\\n\\nActive increments:\\n%s\\n\\n🧠 Focus Principle: Fewer active increments = maximum productivity\\n\\n💡 Consider:\\n  1️⃣  Complete current work (recommended)\\n  2️⃣  Pause current work (/specweave:pause)\\n  3️⃣  Continue anyway\\n\\n⚠️  Emergency hotfix/bug? Use --type=hotfix or --type=bug"}\n' "$ACTIVE_COUNT" "$SOFT_LIMIT" "$ACTIVE_COUNT" "$SOFT_LIMIT" "$ACTIVE_LIST"
     exit 0
   fi
 fi
@@ -163,12 +278,7 @@ if [[ -n "$ACTIVE_INCREMENT" ]] && echo "$PROMPT" | grep -qE "/(specweave:)?(syn
   if [[ -f "$SPEC_FILE" ]] && [[ -f "$PLAN_FILE" ]]; then
     # Check if spec is newer than plan (indicates spec changes need sync)
     if [[ -n $(find "$SPEC_FILE" -newer "$PLAN_FILE" 2>/dev/null) ]]; then
-      cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "⚠️ Spec changes detected in $ACTIVE_INCREMENT\n\nspec.md has been modified after plan.md.\nConsider running /specweave:sync-docs to update living documentation."
-}
-EOF
+      printf '{"decision":"approve","systemMessage":"⚠️ Spec changes detected in %s\\n\\nspec.md has been modified after plan.md.\\nConsider running /specweave:sync-docs to update living documentation."}\n' "$ACTIVE_INCREMENT"
       exit 0
     fi
   fi
@@ -253,19 +363,11 @@ fi
 # ==============================================================================
 
 if [[ -n "$CONTEXT" ]]; then
-  cat <<EOF
-{
-  "decision": "approve",
-  "systemMessage": "$CONTEXT"
-}
-EOF
+  # Escape context for JSON (newlines, quotes)
+  CONTEXT_ESCAPED=$(echo "$CONTEXT" | sed 's/\\/\\\\/g; s/"/\\"/g' | awk '{printf "%s\\n", $0}' | sed 's/\\n$//')
+  printf '{"decision":"approve","systemMessage":"%s"}\n' "$CONTEXT_ESCAPED"
 else
-  # Just approve, no extra context
-  cat <<EOF
-{
-  "decision": "approve"
-}
-EOF
+  echo '{"decision":"approve"}'
 fi
 
 exit 0