specweave 2.0.0 → 2.0.3

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "specweave",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "SpecWeave - Spec-Driven Development Framework. PM-led planning, intelligent model selection, living documentation, multi-tool support.",
   "owner": {
     "name": "Anton Abyzov",
@@ -12,7 +12,7 @@
       "description": "SpecWeave unified plugin — increment lifecycle (plan, work the ledger, verify, review, complete), cross-tool handoff, GitHub/Jira/ADO sync",
       "source": "./plugins/specweave",
       "category": "development",
-      "version": "2.0.0",
+      "version": "2.0.3",
       "author": {
         "name": "Anton Abyzov",
         "email": "anton.abyzov@gmail.com"

package/dist/src/core/doctor/checkers/hooks-checker.d.ts

@@ -14,7 +14,7 @@ export declare function packageRoot(): string;
 export declare class HooksChecker implements HealthChecker {
     category: string;
     check(projectRoot: string, options: DoctorOptions): Promise<CategoryResult>;
-    /** hooks.json must be exec-form (command + args), node-based, with sane timeouts. */
+    /** hooks.json uses a quoted node command string (Codex ignores separate args). */
     private checkHooksJson;
     private dryRun;
 }

package/dist/src/core/doctor/checkers/hooks-checker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks-checker.d.ts","sourceRoot":"","sources":["../../../../../src/core/doctor/checkers/hooks-checker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAe,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7F,OAAO,EAAE,WAAW,EAAsB,MAAM,+BAA+B,CAAC;AAEhF,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS3F,CAAC;AAEF,kGAAkG;AAClG,wBAAgB,WAAW,IAAI,MAAM,CAcpC;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,SAAW;IAEb,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IA+BjF,qFAAqF;IACrF,OAAO,CAAC,cAAc;YAsBR,MAAM;CAoDrB"}
+{"version":3,"file":"hooks-checker.d.ts","sourceRoot":"","sources":["../../../../../src/core/doctor/checkers/hooks-checker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAe,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7F,OAAO,EAAE,WAAW,EAAsB,MAAM,+BAA+B,CAAC;AAEhF,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAS3F,CAAC;AAEF,kGAAkG;AAClG,wBAAgB,WAAW,IAAI,MAAM,CAcpC;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,SAAW;IAEb,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IA+BjF,kFAAkF;IAClF,OAAO,CAAC,cAAc;YAwBR,MAAM;CAoDrB"}

package/dist/src/core/doctor/checkers/hooks-checker.js

@@ -72,7 +72,7 @@ export class HooksChecker {
         }
         return { category: this.category, status: calculateOverallStatus(checks), checks };
     }
-    /** hooks.json must be exec-form (command + args), node-based, with sane timeouts. */
+    /** hooks.json uses a quoted node command string (Codex ignores separate args). */
     checkHooksJson(hooksJson) {
         try {
             const data = JSON.parse(fs.readFileSync(hooksJson, 'utf8'));
@@ -80,15 +80,16 @@ export class HooksChecker {
             for (const [event, groups] of Object.entries(data.hooks ?? {})) {
                 for (const group of groups) {
                     for (const h of group.hooks ?? []) {
-                        if (h.command !== 'node' || !Array.isArray(h.args))
-                            problems.push(`${event}: not exec-form node`);
+                        if (!/^node \"\$\{CLAUDE_PLUGIN_ROOT\}\/hooks\/run\.mjs\" [a-z-]+$/.test(h.command ?? '') || h.args !== undefined) {
+                            problems.push(`${event}: expected quoted node hook command without separate args`);
+                        }
                         if (typeof h.timeout === 'number' && h.timeout > 60)
                             problems.push(`${event}: timeout ${h.timeout}s > 60s`);
                     }
                 }
             }
             return problems.length === 0
-                ? { name: 'hooks.json', status: 'pass', message: 'exec-form node launcher, timeouts <= 60s' }
+                ? { name: 'hooks.json', status: 'pass', message: 'portable node launcher, timeouts <= 60s' }
                 : { name: 'hooks.json', status: 'fail', message: problems.join('; ') };
         }
         catch (err) {

package/dist/src/core/doctor/checkers/hooks-checker.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks-checker.js","sourceRoot":"","sources":["../../../../../src/core/doctor/checkers/hooks-checker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEhF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAExC,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAkE;IAC9F,eAAe,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE;IACvE,cAAc,EAAE;QACd,eAAe,EAAE,YAAY;QAC7B,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,EAAE,SAAS,EAAE,yDAAyD,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE;KACvH;IACD,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC5D,aAAa,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE;CAClE,CAAC;AAEF,kGAAkG;AAClG,MAAM,UAAU,WAAW;IACzB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAsB,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,GAAG,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,OAAO,YAAY;IAAzB;QACE,aAAQ,GAAG,OAAO,CAAC;IA4GrB,CAAC;IA1GC,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,OAAsB;QACrD,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,OAAO,UAAU,EAAE;gBAC7F,aAAa,EAAE,4DAA4D;aAC5E,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uCAAuC;YACvC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IACrF,CAAC;IAED,qFAAqF;IAC7E,cAAc,CAAC,SAAiB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAEzD,CAAC;YACF,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;wBAClC,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;wBAClG,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC;oBAC9G,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0CAA0C,EAAE;gBAC7F,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5H,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,MAAc,EACd,KAAmC,EACnC,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,KAAK,UAAU,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,MAAM,EAAE,KAAK,CAAC,EACf;gBACE,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;aACpF,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACjD,CAAC;YACF,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAElF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACtC,IAAI,MAAM,YAAY,KAAK,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,oBAAoB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,UAAU;gBACV,aAAa,EAAE,0DAA0D,KAAK,EAAE;aACjF,CAAC;QACJ,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;QACzG,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI,KAAK,KAAK,eAAe,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnF,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,6CAA6C;gBACtD,UAAU;gBACV,aAAa,EAAE,4CAA4C;aAC5D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;IACvG,CAAC;CACF"}
+{"version":3,"file":"hooks-checker.js","sourceRoot":"","sources":["../../../../../src/core/doctor/checkers/hooks-checker.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEhF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAExC,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAkE;IAC9F,eAAe,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE;IACvE,cAAc,EAAE;QACd,eAAe,EAAE,YAAY;QAC7B,SAAS,EAAE,MAAM;QACjB,UAAU,EAAE,EAAE,SAAS,EAAE,yDAAyD,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE;KACvH;IACD,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE;IAC5D,aAAa,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE;CAClE,CAAC;AAEF,kGAAkG;AAClG,MAAM,UAAU,WAAW;IACzB,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAsB,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,GAAG,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,OAAO,YAAY;IAAzB;QACE,aAAQ,GAAG,OAAO,CAAC;IA8GrB,CAAC;IA5GC,KAAK,CAAC,KAAK,CAAC,WAAmB,EAAE,OAAsB;QACrD,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QAE/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,OAAO,UAAU,EAAE;gBAC7F,aAAa,EAAE,4DAA4D;aAC5E,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,wEAAwE;YACxE,uCAAuC;YACvC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IACrF,CAAC;IAED,kFAAkF;IAC1E,cAAc,CAAC,SAAiB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAEzD,CAAC;YACF,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;wBAClC,IAAI,CAAC,8DAA8D,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BAClH,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;wBACrF,CAAC;wBACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;4BAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC;oBAC9G,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAC1B,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,yCAAyC,EAAE;gBAC5F,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5H,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,MAAc,EACd,KAAmC,EACnC,WAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,GAAG,KAAK,UAAU,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3D,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,MAAM,EAAE,KAAK,CAAC,EACf;gBACE,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;aACpF,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACjD,CAAC;YACF,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAElF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACtC,IAAI,MAAM,YAAY,KAAK,EAAE,CAAC;YAC5B,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,oBAAoB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC5D,UAAU;gBACV,aAAa,EAAE,0DAA0D,KAAK,EAAE;aACjF,CAAC;QACJ,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;QACzG,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;QAC3E,IAAI,KAAK,KAAK,eAAe,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnF,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,6CAA6C;gBACtD,UAAU;gBACV,aAAa,EAAE,4CAA4C;aAC5D,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC;IACvG,CAAC;CACF"}

package/dist/src/core/session/handoff-git-state.d.ts

@@ -31,19 +31,8 @@ export interface GitState {
     /** True when there are working-tree or staged changes. */
     hasUncommittedChanges: boolean;
 }
-/**
- * Capture git state for `repoRoot` and dump the full uncommitted diff to
- * `diffOutputPath`.
- *
- * The diff file always contains `git diff HEAD` (working-tree vs last commit)
- * concatenated with `git diff --cached` (staged vs HEAD). When the repo is
- * clean — or before the first commit — the file is written empty so callers can
- * unconditionally link to it.
- *
- * @param repoRoot - Absolute path to the candidate repository root.
- * @param diffOutputPath - Absolute path where the full diff is written.
- * @returns The captured {@link GitState}; all-empty + `isGitRepo:false` when
- *          `repoRoot` is not a git work tree (no throw).
- */
+/** Total Git budget leaves headroom below PreCompact's five-second budget. */
+export declare const GIT_CAPTURE_BUDGET_MS = 3500;
+/** Capture through a private index; an interrupted hook never stages user files. */
 export declare function captureGitState(repoRoot: string, diffOutputPath: string): GitState;
 //# sourceMappingURL=handoff-git-state.d.ts.map

package/dist/src/core/session/handoff-git-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handoff-git-state.d.ts","sourceRoot":"","sources":["../../../../src/core/session/handoff-git-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAqBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,CA6DlF"}
+{"version":3,"file":"handoff-git-state.d.ts","sourceRoot":"","sources":["../../../../src/core/session/handoff-git-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,2DAA2D;IAC3D,SAAS,EAAE,OAAO,CAAC;IACnB,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,eAAe,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,QAAQ,CAyDlF"}

package/dist/src/core/session/handoff-git-state.js

@@ -17,136 +17,80 @@
 import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
-/**
- * Run a git command, returning trimmed stdout or `null` on any failure.
- *
- * Uses execFileSync with an argument array (no shell) so paths and refs are
- * never re-interpreted by a shell.
- */
-function git(repoRoot, args) {
-    try {
-        return execFileSync('git', args, {
-            cwd: repoRoot,
-            encoding: 'utf-8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            maxBuffer: 64 * 1024 * 1024, // diffs can be large
-        }).trim();
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Capture git state for `repoRoot` and dump the full uncommitted diff to
- * `diffOutputPath`.
- *
- * The diff file always contains `git diff HEAD` (working-tree vs last commit)
- * concatenated with `git diff --cached` (staged vs HEAD). When the repo is
- * clean — or before the first commit — the file is written empty so callers can
- * unconditionally link to it.
- *
- * @param repoRoot - Absolute path to the candidate repository root.
- * @param diffOutputPath - Absolute path where the full diff is written.
- * @returns The captured {@link GitState}; all-empty + `isGitRepo:false` when
- *          `repoRoot` is not a git work tree (no throw).
- */
+import * as os from 'os';
+/** Total Git budget leaves headroom below PreCompact's five-second budget. */
+export const GIT_CAPTURE_BUDGET_MS = 3500;
+/** Capture through a private index; an interrupted hook never stages user files. */
 export function captureGitState(repoRoot, diffOutputPath) {
     const empty = {
-        isGitRepo: false,
-        branch: '',
-        shortSha: '',
-        statusPorcelain: '',
-        diffStat: '',
-        hasUncommittedChanges: false,
+        isGitRepo: false, branch: '', shortSha: '', statusPorcelain: '',
+        diffStat: '', hasUncommittedChanges: false,
     };
-    const insideWorkTree = git(repoRoot, ['rev-parse', '--is-inside-work-tree']);
-    if (insideWorkTree !== 'true') {
-        // Still write an empty diff file so the doc's link target exists.
+    const deadline = Date.now() + GIT_CAPTURE_BUDGET_MS;
+    const env = { ...process.env, GIT_OPTIONAL_LOCKS: '0' };
+    function git(args, trim = true) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            return null;
+        try {
+            const result = execFileSync('git', args, {
+                cwd: repoRoot, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+                maxBuffer: 64 * 1024 * 1024, timeout: remaining, killSignal: 'SIGKILL',
+            });
+            return trim ? result.trim() : result;
+        }
+        catch {
+            return null;
+        }
+    }
+    let temporary;
+    try {
+        if (git(['rev-parse', '--is-inside-work-tree']) !== 'true') {
+            safeWriteDiff(diffOutputPath, '');
+            return empty;
+        }
+        const indexPath = git(['rev-parse', '--path-format=absolute', '--git-path', 'index']);
+        if (!indexPath) {
+            safeWriteDiff(diffOutputPath, '');
+            return empty;
+        }
+        temporary = fs.mkdtempSync(path.join(os.tmpdir(), 'specweave-handoff-index-'));
+        const privateIndex = path.join(temporary, 'index');
+        if (fs.existsSync(indexPath))
+            fs.copyFileSync(indexPath, privateIndex);
+        Object.assign(env, { GIT_INDEX_FILE: privateIndex });
+        const branch = git(['rev-parse', '--abbrev-ref', 'HEAD']) ?? '';
+        const shortSha = git(['rev-parse', '--short', 'HEAD']) ?? '';
+        const statusPorcelain = git(['status', '--porcelain']) ?? '';
+        // NUL-delimited paths handle spaces, quotes, Unicode and embedded newlines.
+        const untracked = (git(['ls-files', '--others', '--exclude-standard', '-z'], false) ?? '')
+            .split('\0').filter(Boolean);
+        if (untracked.length)
+            git(['add', '-N', '--', ...untracked]);
+        const hasHead = shortSha !== '';
+        const working = ['diff', '--no-ext-diff', '--no-textconv', ...(hasHead ? ['HEAD'] : [])];
+        const staged = ['diff', '--no-ext-diff', '--no-textconv', '--cached'];
+        const workingDiff = git(working) ?? '';
+        const stagedDiff = (hasHead ? git(staged) : '') ?? '';
+        const workingStat = git([...working, '--stat']) ?? '';
+        const stagedStat = (hasHead ? git([...staged, '--stat']) : '') ?? '';
+        safeWriteDiff(diffOutputPath, [workingDiff, stagedDiff].filter(Boolean).join('\n'));
+        return {
+            isGitRepo: true, branch, shortSha, statusPorcelain,
+            diffStat: [workingStat, stagedStat].filter(Boolean).join('\n'),
+            hasUncommittedChanges: statusPorcelain.length > 0,
+        };
+    }
+    catch {
         safeWriteDiff(diffOutputPath, '');
         return empty;
     }
-    const branch = git(repoRoot, ['rev-parse', '--abbrev-ref', 'HEAD']) ?? '';
-    const shortSha = git(repoRoot, ['rev-parse', '--short', 'HEAD']) ?? '';
-    const statusPorcelain = git(repoRoot, ['status', '--porcelain']) ?? '';
-    // Intent-to-add every untracked file so `git diff` includes its FULL body,
-    // not just a `??` porcelain line. Without this, brand-new uncommitted files —
-    // the most common in-flight-work case — would be captured as a filename only,
-    // breaking the spec's "exact uncommitted edits" promise (AC-US4-01/02).
-    // `add -N` records intent only (no content staged) but it DOES add an index
-    // entry, so we MUST revert it afterward to leave the user's real index exactly
-    // as we found it — a handoff is a read-only capture and must not silently
-    // change `git status`, `git stash`, or `git commit -a` behavior.
-    const intentAdded = stageIntentToAddUntracked(repoRoot, statusPorcelain);
-    // `git diff HEAD` covers working-tree vs HEAD; if there is no HEAD yet
-    // (no commits), fall back to plain `git diff` so brand-new repos still work.
-    const hasHead = shortSha !== '';
-    const workingDiff = (hasHead ? git(repoRoot, ['diff', 'HEAD']) : git(repoRoot, ['diff'])) ?? '';
-    const stagedDiff = (hasHead ? git(repoRoot, ['diff', '--cached']) : '') ?? '';
-    const workingStat = (hasHead ? git(repoRoot, ['diff', '--stat', 'HEAD']) : git(repoRoot, ['diff', '--stat'])) ?? '';
-    const stagedStat = (hasHead ? git(repoRoot, ['diff', '--cached', '--stat']) : '') ?? '';
-    // Restore the index: drop the intent-to-add entries we created so the user's
-    // staging area is byte-identical to its pre-handoff state.
-    unstageIntentToAdd(repoRoot, hasHead, intentAdded);
-    const diffStat = [workingStat, stagedStat].filter(Boolean).join('\n');
-    const fullDiff = [workingDiff, stagedDiff].filter(Boolean).join('\n');
-    safeWriteDiff(diffOutputPath, fullDiff);
-    const hasUncommittedChanges = statusPorcelain.length > 0;
-    return {
-        isGitRepo: true,
-        branch,
-        shortSha,
-        statusPorcelain,
-        diffStat,
-        hasUncommittedChanges,
-    };
-}
-/**
- * Intent-to-add every untracked file from a porcelain status so its content
- * shows up in `git diff`. Parses `??`-prefixed porcelain lines and runs a
- * single `git add -N -- <paths...>`. Never throws — a failure here only means
- * untracked bodies are omitted, which must not abort the handoff.
- *
- * `add -N` (intent-to-add) records that a path will be tracked but stages NO
- * content. It DOES create an index entry, so the caller MUST pass the returned
- * paths to {@link unstageIntentToAdd} once the diff has been captured to leave
- * the user's real index untouched.
- *
- * @returns The untracked paths that were intent-to-added (empty if none).
- */
-function stageIntentToAddUntracked(repoRoot, statusPorcelain) {
-    if (!statusPorcelain)
-        return [];
-    const untracked = statusPorcelain
-        .split('\n')
-        .filter((line) => line.startsWith('??'))
-        // Porcelain format is `XY <path>`; for untracked the path starts at col 3.
-        .map((line) => line.slice(3).trim())
-        .filter(Boolean);
-    if (untracked.length === 0)
-        return [];
-    // `--` guards against any path that looks like a flag.
-    git(repoRoot, ['add', '-N', '--', ...untracked]);
-    return untracked;
-}
-/**
- * Revert the intent-to-add entries created by {@link stageIntentToAddUntracked}
- * so the user's index is restored to its pre-handoff state. After this the
- * affected files are untracked (`??`) again, exactly as before the capture.
- *
- * `git reset -- <paths>` clears the index entries when a HEAD exists. Before the
- * first commit there is no HEAD, so `git reset` would fail; `git rm --cached
- * --force -- <paths>` removes the intent entries in that case. Never throws — a
- * failed revert must not abort the handoff (worst case: the index keeps the
- * intent entries, which is the pre-fix behavior).
- */
-function unstageIntentToAdd(repoRoot, hasHead, paths) {
-    if (paths.length === 0)
-        return;
-    if (hasHead) {
-        git(repoRoot, ['reset', '--quiet', '--', ...paths]);
-    }
-    else {
-        git(repoRoot, ['rm', '--cached', '--force', '--quiet', '--', ...paths]);
+    finally {
+        if (temporary)
+            try {
+                fs.rmSync(temporary, { recursive: true, force: true });
+            }
+            catch { /* best effort */ }
     }
 }
 /**

package/dist/src/core/session/handoff-git-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"handoff-git-state.js","sourceRoot":"","sources":["../../../../src/core/session/handoff-git-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAoB7B;;;;;GAKG;AACH,SAAS,GAAG,CAAC,QAAgB,EAAE,IAAc;IAC3C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,qBAAqB;SACnD,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,cAAsB;IACtE,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,eAAe,EAAE,EAAE;QACnB,QAAQ,EAAE,EAAE;QACZ,qBAAqB,EAAE,KAAK;KAC7B,CAAC;IAEF,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC7E,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC9B,kEAAkE;QAClE,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,+EAA+E;IAC/E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,WAAW,GAAG,yBAAyB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAEzE,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,QAAQ,KAAK,EAAE,CAAC;IAChC,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAE9E,MAAM,WAAW,GACf,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAExF,6EAA6E;IAC7E,2DAA2D;IAC3D,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAExC,MAAM,qBAAqB,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEzD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM;QACN,QAAQ;QACR,eAAe;QACf,QAAQ;QACR,qBAAqB;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,yBAAyB,CAAC,QAAgB,EAAE,eAAuB;IAC1E,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,eAAe;SAC9B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACxC,2EAA2E;SAC1E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACnC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,uDAAuD;IACvD,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,OAAgB,EAAE,KAAe;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IACtD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,cAAsB,EAAE,OAAe;IAC5D,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC"}
+{"version":3,"file":"handoff-git-state.js","sourceRoot":"","sources":["../../../../src/core/session/handoff-git-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAoBzB,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,cAAsB;IACtE,MAAM,KAAK,GAAa;QACtB,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE;QAC/D,QAAQ,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,CAAC;IACpD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;IACxD,SAAS,GAAG,CAAC,IAAc,EAAE,IAAI,GAAG,IAAI;QACtC,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;gBACvC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACzE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS;aACvE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC1B,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3D,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,wBAAwB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACpE,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,eAAe,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,4EAA4E;QAC5E,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;aACvF,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,SAAS,CAAC,MAAM;YAAE,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,KAAK,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACrE,aAAa,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO;YACL,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe;YAClD,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9D,qBAAqB,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC;SAClD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,SAAS;YAAE,IAAI,CAAC;gBAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,cAAsB,EAAE,OAAe;IAC5D,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specweave",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "100+ domain-expert AI skills — PM, Architect, Frontend, QA, Security and more. Skills learn your team's patterns permanently. Spec-first planning, autonomous execution, multi-agent teams, synced to GitHub/JIRA. Claude Code, Cursor, Copilot & more.",
   "type": "module",
   "bin": {

package/plugins/specweave/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "sw",
   "description": "SpecWeave: increment lifecycle for any AI tool. 10 skills (increment, do, done, review, team, handoff, sync, auto, brainstorm, qa), 4 exec-form hooks, and the specweave CLI for everything deterministic.",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "author": {
     "name": "SpecWeave Team",
     "url": "https://spec-weave.com"

package/plugins/specweave/hooks/hooks.json

@@ -1,13 +1,12 @@
 {
-  "description": "SpecWeave 2.0 hooks: session context, status-completion guard, auto-loop driver, compaction handoff. Exec-form node launcher (no shell), Windows-safe.",
+  "description": "SpecWeave hooks: portable command strings and bounded worker execution.",
   "hooks": {
     "SessionStart": [
       {
         "hooks": [
           {
             "type": "command",
-            "command": "node",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs", "session-start"],
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs\" session-start",
             "timeout": 10
           }
         ]
@@ -19,8 +18,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs", "pre-tool-use"],
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs\" pre-tool-use",
             "timeout": 10
           }
         ]
@@ -31,8 +29,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs", "stop"],
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs\" stop",
             "timeout": 30
           }
         ]
@@ -43,8 +40,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "node",
-            "args": ["${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs", "pre-compact"],
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs\" pre-compact",
             "timeout": 10
           }
         ]

package/plugins/specweave/hooks/run-worker.mjs

@@ -0,0 +1,229 @@
+#!/usr/bin/env node
+/**
+ * SpecWeave hook launcher (zero-dependency, cross-platform).
+ *
+ * Invoked by Claude Code in exec form (no shell):
+ *   node ${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs <event>
+ *
+ * Contract:
+ *   - reads the hook JSON from stdin (5 s cap), normalizes backslashes in
+ *     tool_input.file_path, locates the installed `specweave` CLI, imports its
+ *     built hook router and prints exactly ONE JSON object;
+ *   - always exits 0; on ANY failure prints `{}` (pass) — except SessionStart,
+ *     which prints an additionalContext line telling the user the CLI is missing.
+ *
+ * CLI root resolution order:
+ *   1. $SPECWEAVE_HOME
+ *   2. <plugin root>/../..  (plugin shipped inside the npm package / repo checkout)
+ *   3. require.resolve('specweave/package.json') from $CLAUDE_PROJECT_DIR / cwd
+ *   4. `npm root -g` (result cached in a per-user private file under ~/.specweave)
+ *
+ * Fast path: PreToolUse for a file outside `.specweave/increments/` prints `{}`
+ * without loading the CLI at all (the guards only concern increment files).
+ */
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const EVENTS = new Set(['session-start', 'pre-tool-use', 'stop', 'pre-compact']);
+const STDIN_CAP_MS = 5000;
+const ROUTER_REL = path.join('dist', 'src', 'core', 'hooks', 'handlers', 'hook-router.js');
+/**
+ * Per-user cache path. NEVER the shared OS temp dir: run.mjs `import()`s the
+ * path it reads back, so a world-writable cache is arbitrary code execution on
+ * every SessionStart/Stop/PreCompact of every session on the machine.
+ */
+const CACHE_DIR = safeHomeDir() ? path.join(safeHomeDir(), '.specweave') : null;
+const CACHE_FILE = CACHE_DIR ? path.join(CACHE_DIR, 'hook-cli-root') : null;
+
+function safeHomeDir() {
+  try {
+    const home = homedir();
+    return home && path.isAbsolute(home) ? home : null;
+  } catch {
+    return null;
+  }
+}
+
+/** True only for a regular file (not a symlink) owned by the current user. */
+function isPrivateOwnedFile(file) {
+  try {
+    const st = lstatSync(file);
+    if (!st.isFile()) return false;
+    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+    return uid === null || st.uid === uid;
+  } catch {
+    return false;
+  }
+}
+
+const event = process.argv[2] ?? '';
+
+function inactiveOutput() {
+  if (event === 'session-start') {
+    return {
+      hookSpecificOutput: {
+        hookEventName: 'SessionStart',
+        additionalContext:
+          'SpecWeave hooks inactive: specweave CLI not found (npm i -g specweave)',
+      },
+    };
+  }
+  return {};
+}
+
+let printed = false;
+function emit(obj) {
+  if (printed) return;
+  printed = true;
+  let text = '{}';
+  try {
+    text = JSON.stringify(obj && typeof obj === 'object' ? obj : {});
+  } catch {
+    text = '{}';
+  }
+  process.stdout.write(text + '\n', () => process.exit(0));
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    const chunks = [];
+    let done = false;
+    const finish = () => {
+      if (done) return;
+      done = true;
+      resolve(Buffer.concat(chunks).toString('utf8'));
+    };
+    const timer = setTimeout(finish, STDIN_CAP_MS);
+    if (timer.unref) timer.unref();
+    try {
+      process.stdin.on('data', (c) => chunks.push(c));
+      process.stdin.on('end', finish);
+      process.stdin.on('error', finish);
+      process.stdin.on('close', finish);
+      if (process.stdin.readableEnded) finish();
+    } catch {
+      finish();
+    }
+  });
+}
+
+/** Returns { raw, skip } — `skip` when the event cannot possibly need the CLI. */
+function normalizeInput(raw) {
+  try {
+    const input = JSON.parse(raw);
+    if (input && typeof input === 'object') {
+      const ti = input.tool_input;
+      let filePath = '';
+      if (ti && typeof ti === 'object' && typeof ti.file_path === 'string') {
+        ti.file_path = ti.file_path.replace(/\\/g, '/');
+        filePath = ti.file_path;
+      }
+      if (typeof input.cwd === 'string') input.cwd = input.cwd.replace(/\\/g, '/');
+      const skip = event === 'pre-tool-use' && !filePath.includes('.specweave/increments/');
+      return { raw: JSON.stringify(input), skip };
+    }
+  } catch {
+    // fall through — the router tolerates a non-JSON payload
+  }
+  return { raw, skip: false };
+}
+
+function isCliRoot(dir) {
+  if (!dir) return false;
+  try {
+    const pkg = path.join(dir, 'package.json');
+    if (!existsSync(pkg) || !existsSync(path.join(dir, ROUTER_REL))) return false;
+    return JSON.parse(readFileSync(pkg, 'utf8')).name === 'specweave';
+  } catch {
+    return false;
+  }
+}
+
+function pluginRoot() {
+  if (process.env.CLAUDE_PLUGIN_ROOT) return path.resolve(process.env.CLAUDE_PLUGIN_ROOT);
+  return path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+}
+
+function fromCache() {
+  if (!CACHE_FILE || !isPrivateOwnedFile(CACHE_FILE)) return null;
+  try {
+    const cached = readFileSync(CACHE_FILE, 'utf8').trim();
+    return isCliRoot(cached) ? cached : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeCache(dir) {
+  if (!CACHE_DIR || !CACHE_FILE) return;
+  try {
+    mkdirSync(CACHE_DIR, { recursive: true, mode: 0o700 });
+    // Drop whatever is there (possibly a planted symlink) before writing.
+    rmSync(CACHE_FILE, { force: true });
+    writeFileSync(CACHE_FILE, dir, { flag: 'wx', mode: 0o600 });
+  } catch {
+    // cache is best-effort
+  }
+}
+
+function fromNpmGlobal() {
+  try {
+    const res = spawnSync('npm root -g', { shell: true, encoding: 'utf8', timeout: 4000 });
+    const root = (res.stdout || '').trim().split(/\r?\n/).pop();
+    if (!root) return null;
+    const dir = path.join(root, 'specweave');
+    if (!isCliRoot(dir)) return null;
+    writeCache(dir);
+    return dir;
+  } catch {
+    return null;
+  }
+}
+
+function resolveCliRoot() {
+  const candidates = [
+    () => process.env.SPECWEAVE_HOME,
+    () => path.resolve(pluginRoot(), '..', '..'),
+    ...[process.env.CLAUDE_PROJECT_DIR, process.cwd()].filter(Boolean).flatMap((dir) => [
+      () => path.dirname(createRequire(path.join(dir, 'package.json')).resolve('specweave/package.json')),
+      () => path.join(dir, 'node_modules', 'specweave'),
+    ]),
+    fromCache,
+    fromNpmGlobal,
+  ];
+  for (const candidate of candidates) {
+    try {
+      const dir = candidate();
+      if (isCliRoot(dir)) return dir;
+    } catch {
+      // try the next strategy
+    }
+  }
+  return null;
+}
+
+async function main() {
+  if (!EVENTS.has(event)) {
+    await readStdin();
+    return emit({});
+  }
+  const { raw, skip } = normalizeInput(await readStdin());
+  if (skip) return emit({});
+  const cliRoot = resolveCliRoot();
+  if (!cliRoot) return emit(inactiveOutput());
+  try {
+    const mod = await import(pathToFileURL(path.join(cliRoot, ROUTER_REL)).href);
+    const result = await mod.hookRouter(event, raw);
+    return emit(result);
+  } catch {
+    return emit(inactiveOutput());
+  }
+}
+
+process.on('uncaughtException', () => emit(inactiveOutput()));
+process.on('unhandledRejection', () => emit(inactiveOutput()));
+main().catch(() => emit(inactiveOutput()));

package/plugins/specweave/hooks/run.mjs

@@ -1,229 +1,72 @@
 #!/usr/bin/env node
-/**
- * SpecWeave hook launcher (zero-dependency, cross-platform).
- *
- * Invoked by Claude Code in exec form (no shell):
- *   node ${CLAUDE_PLUGIN_ROOT}/hooks/run.mjs <event>
- *
- * Contract:
- *   - reads the hook JSON from stdin (5 s cap), normalizes backslashes in
- *     tool_input.file_path, locates the installed `specweave` CLI, imports its
- *     built hook router and prints exactly ONE JSON object;
- *   - always exits 0; on ANY failure prints `{}` (pass) — except SessionStart,
- *     which prints an additionalContext line telling the user the CLI is missing.
- *
- * CLI root resolution order:
- *   1. $SPECWEAVE_HOME
- *   2. <plugin root>/../..  (plugin shipped inside the npm package / repo checkout)
- *   3. require.resolve('specweave/package.json') from $CLAUDE_PROJECT_DIR / cwd
- *   4. `npm root -g` (result cached in a per-user private file under ~/.specweave)
- *
- * Fast path: PreToolUse for a file outside `.specweave/increments/` prints `{}`
- * without loading the CLI at all (the guards only concern increment files).
- */
-import { createRequire } from 'node:module';
-import { spawnSync } from 'node:child_process';
-import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+// SpecWeave hook supervisor: parent deadline remains live while the worker blocks in Git.
+import { spawn, spawnSync } from 'node:child_process';
+import { appendFileSync, mkdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-
-const EVENTS = new Set(['session-start', 'pre-tool-use', 'stop', 'pre-compact']);
-const STDIN_CAP_MS = 5000;
-const ROUTER_REL = path.join('dist', 'src', 'core', 'hooks', 'handlers', 'hook-router.js');
-/**
- * Per-user cache path. NEVER the shared OS temp dir: run.mjs `import()`s the
- * path it reads back, so a world-writable cache is arbitrary code execution on
- * every SessionStart/Stop/PreCompact of every session on the machine.
- */
-const CACHE_DIR = safeHomeDir() ? path.join(safeHomeDir(), '.specweave') : null;
-const CACHE_FILE = CACHE_DIR ? path.join(CACHE_DIR, 'hook-cli-root') : null;
-
-function safeHomeDir() {
+import { fileURLToPath } from 'node:url';
+const event = process.argv[2];
+const worker = path.join(path.dirname(fileURLToPath(import.meta.url)), 'run-worker.mjs');
+const budget = event === 'stop' ? 25000 : 7500;
+let child, finished = false, input = '', output = '', size = 0;
+const started = Date.now();
+function record(reason) {
   try {
-    const home = homedir();
-    return home && path.isAbsolute(home) ? home : null;
-  } catch {
-    return null;
-  }
-}
-
-/** True only for a regular file (not a symlink) owned by the current user. */
-function isPrivateOwnedFile(file) {
-  try {
-    const st = lstatSync(file);
-    if (!st.isFile()) return false;
-    const uid = typeof process.getuid === 'function' ? process.getuid() : null;
-    return uid === null || st.uid === uid;
-  } catch {
-    return false;
-  }
+    const dir = path.join(homedir(), '.specweave', 'logs');
+    mkdirSync(dir, {recursive:true, mode:0o700});
+    appendFileSync(path.join(dir, 'hook-health.jsonl'), JSON.stringify({at:new Date().toISOString(),event,reason,elapsedMs:Date.now()-started})+'\n', {mode:0o600});
+  } catch {}
 }
-
-const event = process.argv[2] ?? '';
-
-function inactiveOutput() {
-  if (event === 'session-start') {
-    return {
-      hookSpecificOutput: {
-        hookEventName: 'SessionStart',
-        additionalContext:
-          'SpecWeave hooks inactive: specweave CLI not found (npm i -g specweave)',
-      },
-    };
+function killWorker() {
+  if (!child?.pid) return;
+  if (process.platform === 'win32') {
+    spawnSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], {timeout:1000, windowsHide:true, stdio:'ignore'});
+  } else {
+    try { process.kill(-child.pid, 'SIGKILL'); } catch { try {child.kill('SIGKILL');} catch {} }
   }
-  return {};
 }
-
-let printed = false;
-function emit(obj) {
-  if (printed) return;
-  printed = true;
-  let text = '{}';
-  try {
-    text = JSON.stringify(obj && typeof obj === 'object' ? obj : {});
-  } catch {
-    text = '{}';
-  }
-  process.stdout.write(text + '\n', () => process.exit(0));
+function finish(result = {}, reason) {
+  if (finished) return;
+  finished = true;
+  clearTimeout(deadline);
+  killWorker();
+  if (reason) record(reason);
+  process.stdout.write(JSON.stringify(result)+'\n',()=>process.exit(0));
 }
-
-function readStdin() {
-  return new Promise((resolve) => {
-    const chunks = [];
-    let done = false;
-    const finish = () => {
-      if (done) return;
-      done = true;
-      resolve(Buffer.concat(chunks).toString('utf8'));
-    };
-    const timer = setTimeout(finish, STDIN_CAP_MS);
-    if (timer.unref) timer.unref();
-    try {
-      process.stdin.on('data', (c) => chunks.push(c));
-      process.stdin.on('end', finish);
-      process.stdin.on('error', finish);
-      process.stdin.on('close', finish);
-      if (process.stdin.readableEnded) finish();
-    } catch {
-      finish();
-    }
+const deadline = setTimeout(()=>finish({},'deadline_exceeded'),budget);
+process.on('SIGTERM',()=>finish({},'terminated'));
+process.on('SIGINT',()=>finish({},'interrupted'));
+process.on('uncaughtException',()=>finish({},'adapter_error'));
+process.stdin.setEncoding('utf8');
+process.stdin.on('data',chunk=>{
+  size += Buffer.byteLength(chunk, 'utf8');
+  if(size>1024*1024) return finish({},'input_limit');
+  input+=chunk;
+});
+process.stdin.on('error',()=>finish({},'stdin_error'));
+process.stdin.on('end',()=>{
+  let data;
+  try {data=JSON.parse(input);if(!data || typeof data!=='object'||Array.isArray(data))throw Error();}
+  catch {return finish({},'invalid_input');}
+  if(!['session-start','pre-tool-use','pre-compact','stop'].includes(event))return finish({});
+  const env={...process.env};
+  child=spawn(process.execPath,[worker,event],{env,detached:process.platform !== 'win32',stdio:['pipe','pipe','pipe']});
+  child.stdout.setEncoding('utf8');
+  child.stdout.on('data',chunk=>{
+    output+=chunk;
+    if(output.length>1024*1024)finish({},'output_limit');
   });
-}
-
-/** Returns { raw, skip } — `skip` when the event cannot possibly need the CLI. */
-function normalizeInput(raw) {
-  try {
-    const input = JSON.parse(raw);
-    if (input && typeof input === 'object') {
-      const ti = input.tool_input;
-      let filePath = '';
-      if (ti && typeof ti === 'object' && typeof ti.file_path === 'string') {
-        ti.file_path = ti.file_path.replace(/\\/g, '/');
-        filePath = ti.file_path;
-      }
-      if (typeof input.cwd === 'string') input.cwd = input.cwd.replace(/\\/g, '/');
-      const skip = event === 'pre-tool-use' && !filePath.includes('.specweave/increments/');
-      return { raw: JSON.stringify(input), skip };
-    }
-  } catch {
-    // fall through — the router tolerates a non-JSON payload
-  }
-  return { raw, skip: false };
-}
-
-function isCliRoot(dir) {
-  if (!dir) return false;
-  try {
-    const pkg = path.join(dir, 'package.json');
-    if (!existsSync(pkg) || !existsSync(path.join(dir, ROUTER_REL))) return false;
-    return JSON.parse(readFileSync(pkg, 'utf8')).name === 'specweave';
-  } catch {
-    return false;
-  }
-}
-
-function pluginRoot() {
-  if (process.env.CLAUDE_PLUGIN_ROOT) return path.resolve(process.env.CLAUDE_PLUGIN_ROOT);
-  return path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-}
-
-function fromCache() {
-  if (!CACHE_FILE || !isPrivateOwnedFile(CACHE_FILE)) return null;
-  try {
-    const cached = readFileSync(CACHE_FILE, 'utf8').trim();
-    return isCliRoot(cached) ? cached : null;
-  } catch {
-    return null;
-  }
-}
-
-function writeCache(dir) {
-  if (!CACHE_DIR || !CACHE_FILE) return;
-  try {
-    mkdirSync(CACHE_DIR, { recursive: true, mode: 0o700 });
-    // Drop whatever is there (possibly a planted symlink) before writing.
-    rmSync(CACHE_FILE, { force: true });
-    writeFileSync(CACHE_FILE, dir, { flag: 'wx', mode: 0o600 });
-  } catch {
-    // cache is best-effort
-  }
-}
-
-function fromNpmGlobal() {
-  try {
-    const res = spawnSync('npm root -g', { shell: true, encoding: 'utf8', timeout: 4000 });
-    const root = (res.stdout || '').trim().split(/\r?\n/).pop();
-    if (!root) return null;
-    const dir = path.join(root, 'specweave');
-    if (!isCliRoot(dir)) return null;
-    writeCache(dir);
-    return dir;
-  } catch {
-    return null;
-  }
-}
-
-function resolveCliRoot() {
-  const candidates = [
-    () => process.env.SPECWEAVE_HOME,
-    () => path.resolve(pluginRoot(), '..', '..'),
-    ...[process.env.CLAUDE_PROJECT_DIR, process.cwd()].filter(Boolean).flatMap((dir) => [
-      () => path.dirname(createRequire(path.join(dir, 'package.json')).resolve('specweave/package.json')),
-      () => path.join(dir, 'node_modules', 'specweave'),
-    ]),
-    fromCache,
-    fromNpmGlobal,
-  ];
-  for (const candidate of candidates) {
+  child.stderr.resume();
+  child.stdin.on('error',()=>{});
+  child.on('error',()=>finish({},'worker_spawn_failed'));
+  child.on('close',code=>{
+    if(finished)return;
+    if(code!==0)return finish({},'worker_failed');
     try {
-      const dir = candidate();
-      if (isCliRoot(dir)) return dir;
-    } catch {
-      // try the next strategy
-    }
-  }
-  return null;
-}
-
-async function main() {
-  if (!EVENTS.has(event)) {
-    await readStdin();
-    return emit({});
-  }
-  const { raw, skip } = normalizeInput(await readStdin());
-  if (skip) return emit({});
-  const cliRoot = resolveCliRoot();
-  if (!cliRoot) return emit(inactiveOutput());
-  try {
-    const mod = await import(pathToFileURL(path.join(cliRoot, ROUTER_REL)).href);
-    const result = await mod.hookRouter(event, raw);
-    return emit(result);
-  } catch {
-    return emit(inactiveOutput());
-  }
-}
-
-process.on('uncaughtException', () => emit(inactiveOutput()));
-process.on('unhandledRejection', () => emit(inactiveOutput()));
-main().catch(() => emit(inactiveOutput()));
+      const result=JSON.parse(output);
+      if(!result||typeof result!=='object'||Array.isArray(result))throw Error();
+      finish(result);
+    } catch {finish({},'invalid_worker_output');}
+  });
+  child.stdin.end(input);
+});