thumbgate 1.28.0 → 1.28.2

package/adapters/mcp/server-stdio.js

@@ -187,6 +187,24 @@ const PRIVATE_MCP_MODULES = Object.freeze({
   lessonSearch: path.resolve(__dirname, '../../scripts/lesson-search.js'),
 });
 
+const PRIVATE_MCP_TOOL_REQUIREMENTS = Object.freeze({
+  search_lessons: ['lessonSearch'],
+  reflect_on_feedback: ['reflectorAgent'],
+  list_intents: ['intentRouter'],
+  plan_intent: ['intentRouter'],
+  start_handoff: ['intentRouter', 'delegationRuntime'],
+  complete_handoff: ['delegationRuntime'],
+  distribute_context_to_agents: ['swarmCoordinator'],
+  session_report: ['sessionReport'],
+  generate_operator_artifact: ['operatorArtifacts'],
+  org_dashboard: ['orgDashboard'],
+  get_business_metrics: ['semanticLayer'],
+  describe_semantic_entity: ['semanticLayer'],
+  run_managed_lesson_agent: ['managedLessonAgent'],
+  managed_agent_status: ['managedLessonAgent'],
+  context_stuff_lessons: ['lessonInference'],
+});
+
 function loadPrivateMcpModule(key) {
   const modulePath = PRIVATE_MCP_MODULES[key];
   if (!modulePath) {
@@ -204,6 +222,20 @@ function loadPrivateMcpModule(key) {
   }
 }
 
+function isToolAvailable(toolName) {
+  const requirements = PRIVATE_MCP_TOOL_REQUIREMENTS[toolName] || [];
+  try {
+    return requirements.every((key) => Boolean(loadPrivateMcpModule(key)));
+  } catch {
+    return false;
+  }
+}
+
+function listAvailableTools(profileName = getActiveMcpProfile()) {
+  const allowedTools = new Set(getAllowedTools(profileName));
+  return TOOLS.filter((tool) => allowedTools.has(tool.name) && isToolAvailable(tool.name));
+}
+
 function unavailablePrivateMcpFeature(toolName) {
   return toTextResult({
     ok: false,
@@ -231,7 +263,7 @@ const {
   finalizeSession: finalizeFeedbackSession,
 } = require('../../scripts/feedback-session');
 
-const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.28.0' };
+const SERVER_INFO = { name: 'thumbgate-mcp', version: '1.28.2' };
 const COMMERCE_CATEGORIES = [
   'product_recommendation',
   'brand_compliance',
@@ -1357,7 +1389,7 @@ async function handleRequest(message) {
     };
   }
   if (message.method === 'ping') return {};
-  if (message.method === 'tools/list') return { tools: TOOLS };
+  if (message.method === 'tools/list') return { tools: listAvailableTools() };
   if (message.method === 'tools/call') return callTool(message.params.name, message.params.arguments);
   throw new Error(`Unsupported method: ${message.method}`);
 }
@@ -1430,22 +1462,14 @@ function writeNdjsonResponse(id, payload, error = null) {
   process.stdout.write(`${body}\n`);
 }
 
-/**
- * Default staleness threshold: if a lock is older than this (ms), the holder
- * is considered orphaned even if its PID is still alive — it likely belongs
- * to a defunct Claude Code session whose process was never reaped.
- */
-const LOCK_STALE_MS = Number(process.env.THUMBGATE_LOCK_STALE_MS) || 2 * 60 * 60 * 1000; // 2 hours
-
 /**
  * Acquire a file-system lock to prevent duplicate MCP server instances.
- * Returns { lockFile, cleanupLock } on success, or calls process.exit(1)
- * if another live server holds the lock.
+ * Returns { lockFile, cleanupLock } on success.
  *
- * Staleness reaping: if the lock-holding process is alive but the lock is
- * older than LOCK_STALE_MS, the holder is killed (SIGTERM) and the lock is
- * reclaimed. This prevents orphaned `thumbgate serve` processes from permanently
- * blocking new sessions.
+ * Every live stdio client needs its own MCP process, and those sessions can
+ * legitimately run for many hours. A lock's age is therefore not evidence that
+ * its owner is orphaned. Live owners coexist through per-session locks; only a
+ * lock whose PID is no longer running is reclaimed.
  */
 function acquireLock() {
   const feedbackDir = getFeedbackPaths().FEEDBACK_DIR;
@@ -1458,26 +1482,19 @@ function acquireLock() {
       try { process.kill(lockData.pid, 0); isRunning = true; } catch { /* process is dead */ }
 
       if (isRunning) {
-        const lockAge = Date.now() - new Date(lockData.startedAt).getTime();
-        if (lockAge > LOCK_STALE_MS) {
-          // Orphaned process — kill it and take over
-          process.stderr.write(`[thumbgate] Lock held by PID ${lockData.pid} is ${Math.round(lockAge / 60000)}m old (threshold: ${Math.round(LOCK_STALE_MS / 60000)}m). Reaping orphaned process.\n`);
-          try { process.kill(lockData.pid, 'SIGTERM'); } catch { /* already gone */ }
-        } else {
-          // Another session's MCP server is running — coexist via per-session lock.
-          // Each Claude session communicates via its own stdio pipe and needs its own server.
-          // SQLite WAL mode handles concurrent access safely.
-          process.stderr.write(`[thumbgate] Another MCP server (PID ${lockData.pid}) is running for ${feedbackDir}. Starting concurrent session.\n`);
-          const sessionLockFile = path.join(feedbackDir, `.mcp-server-${process.pid}.lock`);
-          fs.writeFileSync(sessionLockFile, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
-          const cleanupSessionLock = () => { try { fs.unlinkSync(sessionLockFile); } catch { /* already removed */ } };
-          process.on('exit', cleanupSessionLock);
-          process.on('SIGTERM', () => { cleanupSessionLock(); process.exit(0); });
-          process.on('SIGINT', () => { cleanupSessionLock(); process.exit(0); });
-          return { lockFile: sessionLockFile, cleanupLock: cleanupSessionLock };
-        }
+        // Another session's MCP server is running — coexist via per-session lock.
+        // Each client communicates via its own stdio pipe and needs its own server.
+        // SQLite WAL mode handles concurrent access safely.
+        process.stderr.write(`[thumbgate] Another MCP server (PID ${lockData.pid}) is running for ${feedbackDir}. Starting concurrent session.\n`);
+        const sessionLockFile = path.join(feedbackDir, `.mcp-server-${process.pid}.lock`);
+        fs.writeFileSync(sessionLockFile, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() }));
+        const cleanupSessionLock = () => { try { fs.unlinkSync(sessionLockFile); } catch { /* already removed */ } };
+        process.on('exit', cleanupSessionLock);
+        process.on('SIGTERM', () => { cleanupSessionLock(); process.exit(0); });
+        process.on('SIGINT', () => { cleanupSessionLock(); process.exit(0); });
+        return { lockFile: sessionLockFile, cleanupLock: cleanupSessionLock };
       }
-      // Stale lock from a dead or reaped process — remove it
+      // Stale lock from a dead process — remove it.
       try { fs.unlinkSync(lockFile); } catch { /* already gone */ }
       process.stderr.write(`[thumbgate] Removed stale lock (PID ${lockData.pid} is no longer running).\n`);
     }
@@ -1574,7 +1591,10 @@ module.exports = {
   buildSuggestFixResponse,
   __test__: {
     PRIVATE_MCP_MODULES,
+    PRIVATE_MCP_TOOL_REQUIREMENTS,
     loadPrivateMcpModule,
+    isToolAvailable,
+    listAvailableTools,
     unavailablePrivateMcpFeature,
     callToolInner,
   },

package/adapters/opencode/opencode.json

@@ -7,7 +7,7 @@
         "npx",
         "--yes",
         "--package",
-        "thumbgate@1.28.0",
+        "thumbgate@1.28.2",
         "thumbgate",
         "serve"
       ],

package/bin/cli.js

@@ -444,6 +444,11 @@ function codexPreToolHookSectionBlock() {
   return `[hooks.pre_tool_use]\ncommand = "${entry.command}"\nargs = ${formatTomlStringArray(entry.args)}\n`;
 }
 
+function codexUserPromptHookSectionBlock() {
+  const entry = canonicalCodexCliEntry(['hook-auto-capture']);
+  return `[hooks.user_prompt_submit]\ncommand = "${entry.command}"\nargs = ${formatTomlStringArray(entry.args)}\n`;
+}
+
 function mcpSectionRegex(name) {
   return new RegExp(
     `^\\[mcp_servers\\.${escapeRegExp(name)}\\]\\n(?:^(?!\\[).*(?:\\n|$))*`,
@@ -461,6 +466,7 @@ function tomlSectionRegex(name) {
 function upsertCodexServerConfig(content) {
   const canonicalBlock = codexMcpSectionBlock(MCP_SERVER_NAME);
   const canonicalHookBlock = codexPreToolHookSectionBlock();
+  const canonicalUserPromptHookBlock = codexUserPromptHookSectionBlock();
   const sections = MCP_SERVER_NAMES.map((name) => ({
     name,
     regex: mcpSectionRegex(name),
@@ -473,7 +479,7 @@ function upsertCodexServerConfig(content) {
     const prefix = content.trimEnd();
     return {
       changed: true,
-      content: `${prefix}${prefix ? '\n\n' : ''}${canonicalBlock}\n${canonicalHookBlock}`,
+      content: `${prefix}${prefix ? '\n\n' : ''}${canonicalBlock}\n${canonicalHookBlock}\n${canonicalUserPromptHookBlock}`,
     };
   }
 
@@ -517,6 +523,19 @@ function upsertCodexServerConfig(content) {
     changed = true;
   }
 
+  const userPromptHookRegex = tomlSectionRegex('hooks.user_prompt_submit');
+  if (userPromptHookRegex.test(nextContent)) {
+    const current = nextContent.match(userPromptHookRegex)[0];
+    if (current !== canonicalUserPromptHookBlock) {
+      nextContent = nextContent.replace(userPromptHookRegex, canonicalUserPromptHookBlock);
+      changed = true;
+    }
+  } else {
+    const prefix = nextContent.trimEnd();
+    nextContent = `${prefix}${prefix ? '\n\n' : ''}${canonicalUserPromptHookBlock}`;
+    changed = true;
+  }
+
   return {
     changed,
     content: nextContent.endsWith('\n') ? nextContent : `${nextContent}\n`,
@@ -2695,23 +2714,27 @@ function install() {
 }
 
 async function gateCheck() {
-  // Explicit emergency escape hatch ONLY. The 2026-06-03 hotfix made this
-  // bypass-by-default, which silently disabled ThumbGate's enforcement entirely
-  // (the firewall approved everything). Restored 2026-06-04: enforcement runs by
-  // default in warn-by-default posture (see gates-engine applyEnforcementPosture);
-  // set THUMBGATE_HOTFIX_BYPASS=1 to disable all checks if a gate ever misfires.
-  if (process.env.THUMBGATE_HOTFIX_BYPASS === '1') {
-    process.stdout.write(JSON.stringify({
-      decision: 'approve',
-      reason: 'hotfix-bypass-opt-in',
-      hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: '' }
-    }) + '\n');
-    return;
-  }
   try {
     const payload = readStdinText();
     const input = payload ? JSON.parse(payload) : {};
     const gatesEngine = require(path.join(PKG_ROOT, 'scripts', 'gates-engine'));
+
+    // The operator bypass only skips advisory and strict-mode gates. Security and
+    // self-protection floors are evaluated before the early approval path.
+    if (process.env.THUMBGATE_HOTFIX_BYPASS === '1') {
+      const hardFloorOutput = gatesEngine.runHardFloor(input);
+      if (hardFloorOutput) {
+        process.stdout.write(hardFloorOutput + '\n');
+        return;
+      }
+      process.stdout.write(JSON.stringify({
+        decision: 'approve',
+        reason: 'operator-bypass-opt-in',
+        hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: '' }
+      }) + '\n');
+      return;
+    }
+
     const output = await gatesEngine.runAsync(input);
     process.stdout.write(output + '\n');
   } catch (err) {
@@ -2749,14 +2772,21 @@ function statuslineRender() {
 
 function hookAutoCapture() {
   syncActiveProjectContext();
+  const { extractPromptEnvelope } = require(path.join(PKG_ROOT, 'scripts', 'feedback-sanitizer'));
+  const rawStdin = readStdinText();
+  const promptEnvelope = extractPromptEnvelope(rawStdin);
+  // stdin on a UserPromptSubmit hook is the JSON payload
+  // {session_id, transcript_path, cwd, prompt, ...}. Persist ONLY the human
+  // `.prompt` field — never the whole stdin object — so session metadata blobs
+  // can't be promoted as lessons.
   const prompt = process.env.CLAUDE_USER_PROMPT
     || process.env.THUMBGATE_USER_PROMPT
     || process.env.CODEX_USER_PROMPT
     || process.env.USER_PROMPT
-    || readStdinText().trim();
+    || promptEnvelope.prompt;
   const { evaluatePromptGuard } = require(path.join(PKG_ROOT, 'scripts', 'prompt-guard'));
   const { processInlineFeedback, formatCliOutput } = require(path.join(PKG_ROOT, 'scripts', 'cli-feedback'));
-  const { detectFeedbackSignal } = require(path.join(PKG_ROOT, 'scripts', 'feedback-quality'));
+  const { detectFeedbackSignal, isGenericFeedbackText } = require(path.join(PKG_ROOT, 'scripts', 'feedback-quality'));
   const { loadOptionalModule } = require(path.join(PKG_ROOT, 'scripts', 'private-core-boundary'));
   const { recordConversationEntry, readRecentConversationWindow } = loadOptionalModule(
     path.join(PKG_ROOT, 'scripts', 'feedback-history-distiller'),
@@ -2766,34 +2796,60 @@ function hookAutoCapture() {
     })
   );
 
-  recordConversationEntry({
-    author: 'user',
-    text: prompt,
-    source: 'claude_user_prompt',
-  });
-
   const guardResult = evaluatePromptGuard(prompt);
   if (guardResult) {
+    recordConversationEntry({
+      author: 'user',
+      text: prompt,
+      source: 'claude_user_prompt',
+    });
     process.stdout.write(`${JSON.stringify(guardResult)}\n`);
     return;
   }
 
   const detected = detectFeedbackSignal(prompt);
   if (!detected) {
+    recordConversationEntry({
+      author: 'user',
+      text: prompt,
+      source: 'claude_user_prompt',
+    });
     return;
   }
 
   const signal = detected.signal;
   const conversationWindow = readRecentConversationWindow({ limit: 8 });
+  const chatHistory = conversationWindow.map((entry) => ({
+    role: entry.author === 'assistant' ? 'assistant' : 'user',
+    content: entry.text || '',
+  }));
+  const normalizedSignal = signal === 'down' ? 'negative' : 'positive';
+  const genericFeedback = isGenericFeedbackText(prompt, normalizedSignal);
+  const { buildFeedbackSourceIdentity } = require(path.join(PKG_ROOT, 'scripts', 'feedback-loop'));
+  const sourceEvent = buildFeedbackSourceIdentity({
+    signal,
+    promptText: prompt,
+    sessionId: promptEnvelope.sessionId || process.env.CLAUDE_SESSION_ID,
+    promptId: promptEnvelope.promptId,
+    projectDir: promptEnvelope.projectDir || CWD,
+    timestamp: promptEnvelope.timestamp,
+    source: 'claude-user-prompt',
+  });
   const result = processInlineFeedback({
     signal,
     context: prompt,
-    chatHistory: signal === 'down'
-      ? conversationWindow.map((entry) => ({ role: entry.author === 'assistant' ? 'assistant' : 'user', content: entry.text || '' }))
-      : undefined,
-    whatWentWrong: signal === 'down' ? prompt : undefined,
-    whatWorked: signal === 'up' ? prompt : undefined,
+    chatHistory,
+    whatWentWrong: signal === 'down' && !genericFeedback ? prompt : undefined,
+    whatWorked: signal === 'up' && !genericFeedback ? prompt : undefined,
+    sourceEvent,
   });
+  if (!result.feedbackResult || !result.feedbackResult.duplicate) {
+    recordConversationEntry({
+      author: 'user',
+      text: prompt,
+      source: 'claude_user_prompt',
+    });
+  }
   process.stdout.write(formatCliOutput(result) + '\n');
 }
 
@@ -3947,53 +4003,6 @@ switch (COMMAND) {
   case 'dispatch-brief':
     dispatchBrief();
     break;
-  case 'gate-check': {
-    // PreToolUse hook interface: reads tool call JSON from stdin, outputs gate verdict
-    // Used by: generate-pretool-hook.sh → npx thumbgate gate-check
-    const { run: gateRun, runAsync: gateRunAsync } = require(path.join(PKG_ROOT, 'scripts', 'gates-engine'));
-    const { evaluateSelfProtection } = require(path.join(PKG_ROOT, 'scripts', 'self-protection'));
-    let stdinData = '';
-    process.stdin.setEncoding('utf8');
-    process.stdin.on('data', (chunk) => { stdinData += chunk; });
-    process.stdin.on('end', async () => {
-      try {
-        const input = JSON.parse(stdinData);
-        const output = await gateRunAsync(input);
-        // Self-protection overlay (2026-07-08): the gate engine only denies edits
-        // to ThumbGate's own governance files under strict enforcement; by default
-        // such edits pass as a clean ALLOW. Surface them (or block in strict) so an
-        // agent can't silently disable the firewall. Only overlays when the engine
-        // did not already produce a hard deny.
-        let verdict = output;
-        try {
-          const parsed = JSON.parse(output || '{}');
-          const alreadyDeny = (parsed.hookSpecificOutput && parsed.hookSpecificOutput.permissionDecision === 'deny')
-            || parsed.decision === 'block';
-          if (!alreadyDeny) {
-            const sp = evaluateSelfProtection(input.tool_name, input.tool_input);
-            if (sp && sp.action === 'block') {
-              verdict = JSON.stringify({
-                decision: 'block',
-                reason: sp.message,
-                hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: sp.message },
-              });
-            } else if (sp && sp.action === 'warn') {
-              verdict = JSON.stringify({
-                hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: sp.message },
-              });
-            }
-          }
-        } catch (_e) { /* non-JSON engine output: pass through unchanged */ }
-        process.stdout.write(verdict + '\n');
-        process.exit(0);
-      } catch (err) {
-        process.stderr.write(`gate-check error: ${err.message}\n`);
-        process.stdout.write(JSON.stringify({}) + '\n');
-        process.exit(0);
-      }
-    });
-    break;
-  }
   case 'hermes-gate': {
     // Nous Research Hermes Agent `pre_tool_call` shell hook.
     // Hermes pipes each pending tool call as JSON to stdin and reads a decision from stdout;
@@ -4004,7 +4013,7 @@ switch (COMMAND) {
     // Hermes `pre_tool_call` is binary (block or allow) with no warn channel, and the whole point
     // of wiring it is to gate, so we run STRICT enforcement by default — otherwise ThumbGate's
     // warn-by-default posture would pass every deny through and the hook would block nothing.
-    // Opt out with THUMBGATE_HERMES_WARN_ONLY=1; THUMBGATE_HOTFIX_BYPASS=1 still disables checks.
+    // Opt out with THUMBGATE_HERMES_WARN_ONLY=1; the operator bypass also leaves ordinary gates advisory.
     // Wire it in ~/.hermes/config.yaml — see adapters/hermes/config.yaml.
     if (process.env.THUMBGATE_HERMES_WARN_ONLY !== '1' && process.env.THUMBGATE_HOTFIX_BYPASS !== '1') {
       process.env.THUMBGATE_STRICT_ENFORCEMENT = '1';
@@ -4016,8 +4025,22 @@ switch (COMMAND) {
     process.stdin.on('end', async () => {
       try {
         const payload = JSON.parse(hermesStdin);
-        // Hermes sends snake_case tool_name/tool_input — gates-engine reads these directly.
-        const verdict = await hermesGateRun({ tool_name: payload.tool_name, tool_input: payload.tool_input });
+        const hermesToolName = String(payload.tool_name || '');
+        const canonicalToolNames = {
+          terminal: 'Bash',
+          process: 'Bash',
+          execute_code: 'Bash',
+          patch: 'Edit',
+          write_file: 'Write',
+          read_file: 'Read',
+        };
+        const verdict = await hermesGateRun({
+          tool_name: canonicalToolNames[hermesToolName] || hermesToolName,
+          tool_input: {
+            ...(payload.tool_input || {}),
+            hermes_tool_name: hermesToolName,
+          },
+        });
         let parsed = {};
         try { parsed = JSON.parse(verdict); } catch (_e) { parsed = {}; }
         const hso = parsed.hookSpecificOutput || {};

package/config/gates/default.json

@@ -342,7 +342,7 @@
       "id": "self-protect-config",
       "layer": "Execution",
       "toolNames": ["Edit", "Write", "MultiEdit"],
-      "pattern": "(?:config/gates/|config/budget\\.json|\\.thumbgate/|thumbgate\\.json)",
+      "pattern": "(?:config/gates/|config/(?:budget|enforcement|mcp-allowlists)\\.json|\\.thumbgate/config\\.json|thumbgate\\.json)",
       "action": "block",
       "message": "Self-protection: agent cannot modify ThumbGate configuration, gate rules, or budget settings.",
       "severity": "critical",
@@ -372,7 +372,7 @@
       "id": "self-protect-hooks-disable",
       "layer": "Execution",
       "toolNames": ["Edit", "Write", "Bash"],
-      "pattern": "(?:settings\\.json|settings\\.local\\.json).*(?:hooks|PreToolUse|PostToolUse)",
+      "pattern": "(?:\\.claude/settings(?:\\.local)?\\.json|\\.codex/config\\.toml|scripts/hook-[^/]+\\.(?:js|sh))",
       "action": "block",
       "message": "Self-protection: agent cannot modify hook registrations.",
       "severity": "critical",

package/config/github-about.json

@@ -2,14 +2,11 @@
   "repo": "IgorGanapolsky/ThumbGate",
   "repositoryUrl": "https://github.com/IgorGanapolsky/ThumbGate",
   "homepageUrl": "https://thumbgate.ai",
-  "githubDescription": "Agent governance: thumbs become Pre-Action Checks that flag repeat mistakes and hard-block catastrophic classes before code or systems change.",
-  "metaDescription": "ThumbGate is the pre-action governance runtime for AI coding agents (Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode): 👍 thumbs up and 👎 thumbs down feedback become history-aware lessons stored locally; Enterprise adds shared lessons and org visibility. PreToolUse checks flag and log risky tool calls — hard-blocking catastrophic classes by default and warning on the rest, with strict mode to hard-block every rule.",
+  "githubDescription": "ThumbGate Pre-Action Checks derive rules from repeated failures, flag risky tool calls, hard-block detected secret leaks, and block matches in strict mode.",
+  "metaDescription": "ThumbGate is the local pre-action governance runtime for AI coding agents (Claude Code, Cursor, Codex, Gemini CLI, Amp, Cline, OpenCode): accepted 👍 thumbs-up and 👎 thumbs-down feedback becomes history-aware local lessons; repeated failures can become prevention rules. PreToolUse checks flag and log risky tool calls, hard-block detected secret leaks, and block matching actions in strict mode. Pro is for individual operators; Enterprise rollout is scoped after intake.",
   "topics": [
     "thumbgate",
     "pre-action-checks",
-    "save-llm-tokens",
-    "reduce-llm-cost",
-    "ai-cost-optimization",
     "mcp",
     "mcp-server",
     "ai-agents",

package/config/mcp-allowlists.json

@@ -68,6 +68,11 @@
       "distribute_context_to_agents",
       "session_report",
       "generate_operator_artifact",
+      "run_managed_lesson_agent",
+      "managed_agent_status",
+      "run_self_distill",
+      "self_distill_status",
+      "context_stuff_lessons",
       "perplexity_search",
       "perplexity_ask",
       "perplexity_research",

package/config/post-deploy-marketing-pages.json

@@ -4,7 +4,7 @@
   "pages": [
     {
       "route": "/",
-      "sentinel": "Stop paying for the same AI mistake twice",
+      "sentinel": "Catch AI agents before they spend money",
       "description": "Home page hero (lifeblood — never regress)"
     },
     {

package/hooks/hooks.json

@@ -0,0 +1,38 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${CLAUDE_PLUGIN_ROOT}/scripts/hook-pre-tool-use.js"]
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${CLAUDE_PLUGIN_ROOT}/bin/cli.js", "hook-auto-capture"]
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": ["${CLAUDE_PLUGIN_ROOT}/bin/cli.js", "session-start"]
+          }
+        ]
+      }
+    ]
+  }
+}