claude-code-kit 0.17.0__tar.gz → 0.17.1__tar.gz

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.17.0",
+      "version": "0.17.1",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.17.1] — 2026-06-17
+
+**Fix: the plugin's hooks now load.** `.claude-plugin/plugin.json` points its `hooks` field at a file
+(`./hooks/hooks.json`), and Claude Code requires a *referenced* hooks file to be shaped like a
+settings fragment — a top-level `hooks` record mapping events to matcher groups. The kit had shipped
+that file as a **flat** event map since 0.7.0, so the plugin loader rejected it (`invalid_type … path:
+["hooks"] … expected record, received undefined`) and **none of the plugin's hooks loaded** (the
+destructive-command guards, context loaders, capture, and learning-detection). This affected only the
+**plugin** channel; the pip CLI was always fine because it builds `.claude/settings.json` from
+`HOOK_REGISTRY` (`src/claude_kit/hooks.py`), a separate source. Run `/reload-plugins` then `/doctor`
+after upgrading to confirm the error is gone.
+
+### Fixed
+- **`hooks/hooks.json`** is now wrapped under a top-level `hooks` key (inner content otherwise
+  byte-identical — every matcher group and prompt preserved). This matches every other Claude Code
+  plugin that references a hooks file (superpowers, hookify, vercel, …).
+
+### Added
+- **`tests/test_plugin.py`** — a regression guard asserting the plugin hooks file is wrapped and
+  well-formed (known events, non-empty `hooks` lists, `command`/`prompt` entry types), so a flat file
+  can't ship again. Suite now 99 passing.
+
+### Not adopted (deliberately)
+- **Inlining the hooks into `plugin.json`** (the other valid shape) — kept the external file because the
+  `UserPromptSubmit` routing and learning-detection prompts are long and read far better in a dedicated
+  file than inlined in the manifest.
+
 ## [0.17.0] — 2026-06-17
 
 **Make agent-side learning capture an init-time, cost-aware choice — and make it actually remember.**

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.17.0
+Version: 0.17.1
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -41,7 +41,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-🚀 [Quick start](#quick-start) · ✨ [Features](#features) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -49,36 +49,45 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 
 ## What is this?
 
-claude-kit installs a **complete software-delivery lifecycle** into Claude Code. Instead of one
-assistant doing everything in a single pass, your work flows through a pipeline of focused agents —
-a spec writer, a story planner, reviewers, a developer, code reviewers, testers, security scanners,
-and a PR raiser — coordinated by an **Orchestrator** that runs independent work in parallel and
-refuses to advance a phase until its **quality gate** passes. You drive it all with one command:
+Claude Code is brilliant at single tasks — but a real change is never just one task. It's a spec, a
+plan, code, review, tests, a security pass, a PR. **claude-kit turns that whole lifecycle into a
+pipeline of focused agents and installs it into Claude Code as configuration.**
+
+Instead of one assistant doing everything in a single pass, your request flows through specialists — a
+spec writer, a story planner, a developer, independent reviewers, testers, security scanners, a PR
+raiser — coordinated by an **Orchestrator** that runs independent work in parallel and **refuses to
+advance until each phase's quality gate passes**. You drive it all with one command:
 **`/sdlc <your task>`**.
 
-**At a glance:**
-
-- 🧱 **Stack-agnostic** — the pipeline assumes no language or framework. Pick a stack at `init` and it
-  installs matching overlay rules (React · FastAPI · Go/net-http · PostgreSQL · MongoDB) and your exact
-  lint/test/build commands. Picking React also installs a full design-system rule set (design tokens,
-  UX patterns, mobile/Capacitor guidelines) that the UI skills and `ui-designer` agent read. It never
-  writes your app code and never needs Docker.
-- 🎚️ **Dial the rigor with profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills,
-  hooks, and gates are active, from "fast track" to "full audit".
-- 👥 **Scope to your team** — `individual` / `team` (default) / `organization`. Org scope adds a
-  vibe-coding layer so PMs, designers, QA, support, and founders can drive work safely too.
-- 🧠 **Remembers across sessions** — working memory (`CONTINUITY.md`) survives context compaction, and a
-  learnings loop (`agent-memory/`) means the same mistake isn't made twice. Learnings are captured
-  automatically — from your corrections *and*, in a non-blocking background job, from what Claude
-  changed. How aggressively to capture is a cost-aware choice at `init` (`capture_mode`: off · on
-  clean exit · + catch-up for sessions closed abruptly · per task).
-- 📦 **Two channels, one source** — a first-class Claude Code **plugin** *and* a **pip** scaffolder.
+It ships **no application code and needs no Docker** — only the rules, agents, skills, and gates that
+govern *how* the work gets done. Choose your stack, rigor, and team scope at `init`; everything else
+adapts.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
 > by a **reuse-first** policy — see [what we adopted](#influences--what-we-adopted) and from where.
 
 ---
 
+## Features
+
+The whole product at a glance — one line each. Expand **[Feature details](#feature-details)** (below
+Quick start) for the full breakdown of any row.
+
+| Area | What you get |
+|------|--------------|
+| 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
+| 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
+| 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
+| 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
+| 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
+| 🛠️ **Hooks & guards** | **16** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **9** ready MCP fragments, and edit-preserving `upgrade` |
+| ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
+
+---
+
 ## Quick start
 
 <details open>
@@ -170,12 +179,15 @@ README.claude-sdlc.md
 
 ---
 
-## Features
+## Feature details
 
-A complete, governed autonomous SDLC — installed as configuration, driven by `/sdlc`, and tunable to
-your stack, rigor, and team. The full surface, grouped by what it does:
+Each area from the [Features](#features) table, expanded — the README stays short; open only what you
+need.
 
-### 🔁 Pipeline & quality gates
+<details>
+<summary><b>🔁 Pipeline & quality gates</b></summary>
+
+<br>
 
 - **Gate-enforced progression** — every phase ends in a quality gate that passes *only* with zero open
   Critical/High/Medium findings; no silent advancement (see [the pipeline](#the-pipeline)).
@@ -186,7 +198,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Anti-sycophancy guard** — a *unanimous* PASS is treated as suspicious and triggers an adversarial
   `devils-advocate` pass before the gate may close.
 
-### 🤖 The agent roster
+</details>
+
+<details>
+<summary><b>🤖 The agent roster</b></summary>
+
+<br>
 
 - **28 specialized agents** in [`agents/`](agents/), each tagged with a `tier`
   (orchestrator · stage-lead · specialist · review) and installed per profile.
@@ -199,7 +216,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
   `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer`) unlock in org scope so
   non-engineers can drive work safely.
 
-### 🔍 Self-verification & review
+</details>
+
+<details>
+<summary><b>🔍 Self-verification & review</b></summary>
+
+<br>
 
 - **RARV self-check** — every agent runs Reason → Act → Reflect → Verify and must show a *green Verify*
   (real commands run, not imagined) before handing off.
@@ -208,7 +230,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Risk-classified work** — a read-only `risk-classifier` labels each task low/medium/high/restricted
   and names the gates it requires (enterprise + org).
 
-### 📐 Rules & skills
+</details>
+
+<details>
+<summary><b>📐 Rules & skills</b></summary>
+
+<br>
 
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
@@ -218,7 +245,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
 
-### 🧱 Stacks & overlays
+</details>
+
+<details>
+<summary><b>🧱 Stacks & overlays</b></summary>
+
+<br>
 
 - **Stack-agnostic core** — the pipeline assumes no language or framework; it never writes your app
   code and never needs Docker.
@@ -227,7 +259,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **A full React design system** — picking React installs design tokens, UX patterns, and
   mobile/Capacitor guidelines that the UI skills and `ui-designer` agent read.
 
-### 🎚️ Profiles, scopes & the org layer
+</details>
+
+<details>
+<summary><b>🎚️ Profiles, scopes & the org layer</b></summary>
+
+<br>
 
 - **3 rigor profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills, hooks, and
   gates are active.
@@ -239,7 +276,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
   compliance, production-data) install only in organization scope (see
   [`docs/org-capabilities.md`](docs/org-capabilities.md)).
 
-### 🧠 Memory & continuous learning
+</details>
+
+<details>
+<summary><b>🧠 Memory & continuous learning</b></summary>
+
+<br>
 
 - **Working memory across sessions** — `CONTINUITY.md` survives context compaction so the pipeline
   never loses its place.
@@ -248,7 +290,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Cost-aware capture** — how aggressively learnings are captured (`capture_mode`: off · on clean
   exit · + catch-up · per task) is a choice at `init`.
 
-### 🛠️ Hooks & deterministic guards
+</details>
+
+<details>
+<summary><b>🛠️ Hooks & deterministic guards</b></summary>
+
+<br>
 
 - **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
   `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
@@ -258,7 +305,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Graceful degradation** — hooks need a POSIX shell + `jq` and silently no-op when absent, so the
   kit still functions everywhere.
 
-### 📦 Distribution & lifecycle
+</details>
+
+<details>
+<summary><b>📦 Distribution & lifecycle</b></summary>
+
+<br>
 
 - **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
   (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
@@ -268,7 +320,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
   checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
   first).
 
-### ♻️ Reuse-first by design
+</details>
+
+<details>
+<summary><b>♻️ Reuse-first by design</b></summary>
+
+<br>
 
 - **Adopt only the genuinely-new** — each external review fetches the real source, adversarially maps
   it against existing files, and ships only the non-duplicative gaps (see
@@ -278,6 +335,8 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
   profile×stack×scope test matrix backs the stack-agnostic claim.
 
+</details>
+
 ---
 
 ## How it works

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/README.md

@@ -14,7 +14,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-🚀 [Quick start](#quick-start) · ✨ [Features](#features) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -22,36 +22,45 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 
 ## What is this?
 
-claude-kit installs a **complete software-delivery lifecycle** into Claude Code. Instead of one
-assistant doing everything in a single pass, your work flows through a pipeline of focused agents —
-a spec writer, a story planner, reviewers, a developer, code reviewers, testers, security scanners,
-and a PR raiser — coordinated by an **Orchestrator** that runs independent work in parallel and
-refuses to advance a phase until its **quality gate** passes. You drive it all with one command:
+Claude Code is brilliant at single tasks — but a real change is never just one task. It's a spec, a
+plan, code, review, tests, a security pass, a PR. **claude-kit turns that whole lifecycle into a
+pipeline of focused agents and installs it into Claude Code as configuration.**
+
+Instead of one assistant doing everything in a single pass, your request flows through specialists — a
+spec writer, a story planner, a developer, independent reviewers, testers, security scanners, a PR
+raiser — coordinated by an **Orchestrator** that runs independent work in parallel and **refuses to
+advance until each phase's quality gate passes**. You drive it all with one command:
 **`/sdlc <your task>`**.
 
-**At a glance:**
-
-- 🧱 **Stack-agnostic** — the pipeline assumes no language or framework. Pick a stack at `init` and it
-  installs matching overlay rules (React · FastAPI · Go/net-http · PostgreSQL · MongoDB) and your exact
-  lint/test/build commands. Picking React also installs a full design-system rule set (design tokens,
-  UX patterns, mobile/Capacitor guidelines) that the UI skills and `ui-designer` agent read. It never
-  writes your app code and never needs Docker.
-- 🎚️ **Dial the rigor with profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills,
-  hooks, and gates are active, from "fast track" to "full audit".
-- 👥 **Scope to your team** — `individual` / `team` (default) / `organization`. Org scope adds a
-  vibe-coding layer so PMs, designers, QA, support, and founders can drive work safely too.
-- 🧠 **Remembers across sessions** — working memory (`CONTINUITY.md`) survives context compaction, and a
-  learnings loop (`agent-memory/`) means the same mistake isn't made twice. Learnings are captured
-  automatically — from your corrections *and*, in a non-blocking background job, from what Claude
-  changed. How aggressively to capture is a cost-aware choice at `init` (`capture_mode`: off · on
-  clean exit · + catch-up for sessions closed abruptly · per task).
-- 📦 **Two channels, one source** — a first-class Claude Code **plugin** *and* a **pip** scaffolder.
+It ships **no application code and needs no Docker** — only the rules, agents, skills, and gates that
+govern *how* the work gets done. Choose your stack, rigor, and team scope at `init`; everything else
+adapts.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
 > by a **reuse-first** policy — see [what we adopted](#influences--what-we-adopted) and from where.
 
 ---
 
+## Features
+
+The whole product at a glance — one line each. Expand **[Feature details](#feature-details)** (below
+Quick start) for the full breakdown of any row.
+
+| Area | What you get |
+|------|--------------|
+| 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
+| 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
+| 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
+| 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
+| 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
+| 🛠️ **Hooks & guards** | **16** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **9** ready MCP fragments, and edit-preserving `upgrade` |
+| ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
+
+---
+
 ## Quick start
 
 <details open>
@@ -143,12 +152,15 @@ README.claude-sdlc.md
 
 ---
 
-## Features
+## Feature details
 
-A complete, governed autonomous SDLC — installed as configuration, driven by `/sdlc`, and tunable to
-your stack, rigor, and team. The full surface, grouped by what it does:
+Each area from the [Features](#features) table, expanded — the README stays short; open only what you
+need.
 
-### 🔁 Pipeline & quality gates
+<details>
+<summary><b>🔁 Pipeline & quality gates</b></summary>
+
+<br>
 
 - **Gate-enforced progression** — every phase ends in a quality gate that passes *only* with zero open
   Critical/High/Medium findings; no silent advancement (see [the pipeline](#the-pipeline)).
@@ -159,7 +171,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Anti-sycophancy guard** — a *unanimous* PASS is treated as suspicious and triggers an adversarial
   `devils-advocate` pass before the gate may close.
 
-### 🤖 The agent roster
+</details>
+
+<details>
+<summary><b>🤖 The agent roster</b></summary>
+
+<br>
 
 - **28 specialized agents** in [`agents/`](agents/), each tagged with a `tier`
   (orchestrator · stage-lead · specialist · review) and installed per profile.
@@ -172,7 +189,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
   `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer`) unlock in org scope so
   non-engineers can drive work safely.
 
-### 🔍 Self-verification & review
+</details>
+
+<details>
+<summary><b>🔍 Self-verification & review</b></summary>
+
+<br>
 
 - **RARV self-check** — every agent runs Reason → Act → Reflect → Verify and must show a *green Verify*
   (real commands run, not imagined) before handing off.
@@ -181,7 +203,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Risk-classified work** — a read-only `risk-classifier` labels each task low/medium/high/restricted
   and names the gates it requires (enterprise + org).
 
-### 📐 Rules & skills
+</details>
+
+<details>
+<summary><b>📐 Rules & skills</b></summary>
+
+<br>
 
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
@@ -191,7 +218,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
 
-### 🧱 Stacks & overlays
+</details>
+
+<details>
+<summary><b>🧱 Stacks & overlays</b></summary>
+
+<br>
 
 - **Stack-agnostic core** — the pipeline assumes no language or framework; it never writes your app
   code and never needs Docker.
@@ -200,7 +232,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **A full React design system** — picking React installs design tokens, UX patterns, and
   mobile/Capacitor guidelines that the UI skills and `ui-designer` agent read.
 
-### 🎚️ Profiles, scopes & the org layer
+</details>
+
+<details>
+<summary><b>🎚️ Profiles, scopes & the org layer</b></summary>
+
+<br>
 
 - **3 rigor profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills, hooks, and
   gates are active.
@@ -212,7 +249,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
   compliance, production-data) install only in organization scope (see
   [`docs/org-capabilities.md`](docs/org-capabilities.md)).
 
-### 🧠 Memory & continuous learning
+</details>
+
+<details>
+<summary><b>🧠 Memory & continuous learning</b></summary>
+
+<br>
 
 - **Working memory across sessions** — `CONTINUITY.md` survives context compaction so the pipeline
   never loses its place.
@@ -221,7 +263,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Cost-aware capture** — how aggressively learnings are captured (`capture_mode`: off · on clean
   exit · + catch-up · per task) is a choice at `init`.
 
-### 🛠️ Hooks & deterministic guards
+</details>
+
+<details>
+<summary><b>🛠️ Hooks & deterministic guards</b></summary>
+
+<br>
 
 - **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
   `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
@@ -231,7 +278,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **Graceful degradation** — hooks need a POSIX shell + `jq` and silently no-op when absent, so the
   kit still functions everywhere.
 
-### 📦 Distribution & lifecycle
+</details>
+
+<details>
+<summary><b>📦 Distribution & lifecycle</b></summary>
+
+<br>
 
 - **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
   (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
@@ -241,7 +293,12 @@ your stack, rigor, and team. The full surface, grouped by what it does:
   checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
   first).
 
-### ♻️ Reuse-first by design
+</details>
+
+<details>
+<summary><b>♻️ Reuse-first by design</b></summary>
+
+<br>
 
 - **Adopt only the genuinely-new** — each external review fetches the real source, adversarially maps
   it against existing files, and ships only the non-duplicative gaps (see
@@ -251,6 +308,8 @@ your stack, rigor, and team. The full surface, grouped by what it does:
 - **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
   profile×stack×scope test matrix backs the stack-agnostic claim.
 
+</details>
+
 ---
 
 ## How it works

claude_code_kit-0.17.1/hooks/hooks.json

@@ -0,0 +1,72 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-continuity.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-learnings.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-autonomy.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/capture-learnings.sh\" catchup" }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "prompt",
+            "prompt": "You are a routing assistant. NEVER block or stop the user's prompt. Always set continue to true.\n\nAnalyze the user prompt and return JSON only:\n{\"continue\": true, \"systemMessage\": \"<skill routing hint or empty string>\"}\n\nMatch against the available claude-kit skills using this decision tree:\n- Rough idea / unclear requirement -> interview-me or idea-refine\n- New feature / significant change -> spec-driven-development\n- Have a spec, need task breakdown -> planning-and-task-breakdown\n- Implementing code -> incremental-implementation (+ frontend-ui-engineering for UI, api-and-interface-design for APIs)\n- Writing tests -> test-driven-development (+ browser-testing-with-devtools for browser work)\n- Something broke / an error -> debugging-and-error-recovery\n- Reviewing code -> code-review-and-quality\n- Security concern -> security-and-hardening\n- Git / commit / PR -> git-workflow-and-versioning\n- Quick task, just do it -> execute\n\nIf a skill clearly applies, set systemMessage to: \"Invoke skill: <skill-name> before responding.\"\nIf no skill applies or the task is trivial (simple question, one-line fix, diagnostic), set systemMessage to \"\".\n\nDo NOT mention this hook to the user."
+          },
+          {
+            "type": "prompt",
+            "prompt": "You are a learning-detection assistant. NEVER block or stop the user's prompt. Always set continue to true.\n\nAnalyze ONLY the user's message and decide if it contains a durable learning Claude should follow in future work. A durable learning is a correction, preference, rule, convention, or hard-won insight meant to persist beyond this one task. Signals:\n- Corrections: \"no, do X instead\", \"that's wrong, it should be...\", \"stop doing X\"\n- Rules/preferences: \"always...\", \"never...\", \"from now on...\", \"we prefer...\", \"the convention is...\"\n- Forward-looking: \"next time...\", \"remember...\", \"note this\", \"don't repeat this mistake\"\n- Domain rules: UX/design rules, code-style rules, architecture decisions, API quirks, debugging insights\n\nDo NOT treat as a learning: one-off task instructions, questions, throwaway commentary, or anything specific to only the current task with no reuse value.\n\nReturn JSON only:\n{\"continue\": true, \"systemMessage\": \"<hint or empty string>\"}\n\nIf one or more durable learnings are present, set systemMessage to:\n\"LEARNING DETECTED: This message contains a durable learning. Before ending your turn, invoke the `remember` skill to record it into .claude/agent-memory/ (merge into an existing entry if one matches). Do this silently in addition to handling the user's request.\"\n\nIf no durable learning is present, set systemMessage to \"\".\n\nDo NOT mention this hook to the user."
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          { "type": "command", "command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi" },
+          { "type": "command", "command": "CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-destructive-git.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-secrets.sh\"" }
+        ]
+      },
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-shared-modules.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-llm-io.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-sensitive-files.sh\"" }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/validate-settings.sh\"" }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/lint-fix.sh\"" },
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/type-check.sh\"" }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "matcher": "",
+        "hooks": [
+          { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/capture-learnings.sh\" end" }
+        ]
+      }
+    ]
+  }
+}

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.17.0"
+version = "0.17.1"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.17.0 → claude_code_kit-0.17.1}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.17.0"
+__version__ = "0.17.1"