claude-code-kit 0.22.0__tar.gz → 0.24.0__tar.gz

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.22.0",
+      "version": "0.24.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/CHANGELOG.md

@@ -4,6 +4,81 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.24.0] — 2026-06-24
+
+**PR3 of the phased hardening review: deeper validation, a deterministic pipeline CLI, an MCP
+lockfile, and a CI matrix that brings every distribution channel and quality dimension under test.**
+
+### Added
+
+- **`claude-kit validate --strict`** — beyond the structural checks, strict mode verifies that every
+  `settings.json` hook fires on a known event and runs an **installed, executable** script; that
+  `.mcp.json` has a sane `{mcpServers: {id: {command|url}}}` shape; that the resolved
+  `stack-catalog.snapshot.yaml` agrees with the agents/skills/overlays actually on disk; and that the
+  **bundled catalog is referentially consistent** (`validator.check_catalog`: every profile resolves to
+  existing agents/skills/registered hooks, every stack overlay rule/agent file is present, and the org
+  overlay's new skills/agents/rules/packs exist). `doctor` now runs the strict validate by default.
+- **`claude-kit pipeline` command group** (`src/claude_kit/pipeline.py`) — deterministic,
+  **non-executing** operations on the `/sdlc` state files: `pipeline validate` (snapshot shape +
+  profile/scope/mode/lane/findings coherence, with `last_gate_passed` checked against the installed
+  gate set), `pipeline status` (human-readable run summary), `pipeline close-gate <gate> --evidence
+  <file>` (records a passed gate, requiring the evidence artifact and a gate name the profile defines),
+  and `pipeline abort`. These validate/mutate `.claude/state/pipeline-snapshot.json` — they do **not**
+  run the pipeline.
+- **`.mcp.lock.json`** — when `.mcp.json` is written, a deterministic lockfile captures the resolved
+  package + pinned version (parsed from the `npx -y <pkg>@<ver>` args) or hosted URL per server, so a
+  reviewer can see exactly what would run. It is a kit-owned, derived artifact (refreshed on upgrade,
+  never a user sidecar). **`claude-kit doctor --mcp`** checks each server's command is on PATH, warns on
+  unset `${ENV}` vars, and flags a lockfile that has drifted from `.mcp.json` (warnings only).
+- **Expanded CI** (`.github/workflows/ci.yml`) — new jobs alongside the test matrix: `lint`
+  (`ruff check` + `ruff format --check` + `mypy`), `shell` (`shellcheck -S warning` over all hook + repo
+  scripts), `static` (`gen_hooks.py --check`, the docs-consistency guard, catalog referential
+  integrity, and JSON validity of the plugin manifests + `hooks.json`), and `wheel-smoke` (build → install
+  into a clean venv → `init --defaults` → `validate --strict` → `doctor`). `ruff`/`mypy`/`shellcheck-py`
+  are added to the `dev` extra, with conservative `[tool.ruff.lint]` (no E501) and `[tool.mypy]` config.
+
+### Fixed
+
+- **Latent type/lint bugs surfaced by the new CI** — `upgrader.py` used `ResolvedPlan` in annotations
+  without importing it (harmless under `from __future__ import annotations`, but undefined) and passed
+  `str | Path` to a `Path`-typed `_compare`; `_format_preview` could dereference `None`;
+  `prompts._choose_many` and `__main__` used None-returning calls in value position. All fixed; the
+  codebase is now `ruff` + `mypy --ignore-missing-imports` clean. Two hook scripts had redundant,
+  shellcheck-flagged glob alternatives (`*__tests__*` under `*test*`; `*oauth*`/`*authoriz*` under
+  `*auth*`) — removed with no behavior change.
+
+## [0.23.0] — 2026-06-23
+
+**PR2 of the phased hardening review: structural single-source-of-truth for hooks, and plugin/CLI
+parity that fails loud instead of silently degrading.**
+
+### Changed
+
+- **Hooks are now generated from one registry.** The two previously hand-maintained static hook files —
+  the plugin's `hooks/hooks.json` and the no-pip starter `templates/settings.json` — are now generated
+  from `src/claude_kit/hooks.py` (`HOOK_REGISTRY` + per-channel membership data) via
+  `scripts/gen_hooks.py`. They had already drifted (the starter was missing `load-autonomy`, the PR1
+  `jq`-degradation prefix, and used a slightly different block message). A drift test
+  (`gen_hooks.py --check`, run in the suite) fails the build if either file is hand-edited.
+  - The installed per-profile `.claude/settings.json` (built by `build_settings`) is **byte-identical**
+    to before — pure refactor, verified against `origin/main`.
+  - `hooks/hooks.json` is **semantically identical** to before (reflowed to canonical 2-space JSON; no
+    hook added, removed, or reordered).
+  - `templates/settings.json` changes only by refreshing its two inline Bash guards to the registry
+    versions (gaining the `command -v jq … || exit 0` no-jq degradation + aligned message); same hook
+    membership.
+- **`guard-kubectl-delete` is now declared data.** It moves into a `PLUGIN_ONLY_HOOKS` map (with a
+  `reason`) — the single documented exception to "the registry is the source of truth" — instead of
+  being a silent hand-edit in `hooks.json`.
+
+### Fixed
+
+- **Plugin/CLI parity: `/claude-kit:init` requires the CLI and fails loud.** The command no longer
+  silently falls back to the thin `scripts/init.sh` scaffolder when neither `claude-kit` nor `ckit` is
+  on PATH — it stops and instructs `pipx install claude-code-kit` (or `pip install …`). The shell
+  fallback is now opt-in only (`CLAUDE_KIT_BASIC=1`) and prints a loud "degraded, no-resolution
+  install; upgrade/diff won't work" warning. README onboarding documents the CLI requirement.
+
 ## [0.22.0] — 2026-06-23
 
 **Critical-correctness hardening (PR1 of a phased review): a non-destructive `init` merge that no longer

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/CLAUDE.md

@@ -28,7 +28,7 @@ distributed two ways from one source of truth:
 | `templates/stacks/<kind>/<id>/` | Per-stack **overlay** content: `rules/` (+ `agents/` for DB stacks). **No application code, no Docker** — the only place stack-specific content lives. |
 | `templates/org/` | **Org overlay** content (scope-gated, organization only): `skills/`, `agents/` (personas), `rules/` (policy/vibe), `packs/<pack>/{pack.yaml,README.md}`, `README.md`. Wired via `catalog/org.yaml`. The only place org-specific content lives. |
 | `scripts/init.sh` | Thin no-pip fallback scaffolder (copies the full payload; no catalog resolution) |
-| `src/claude_kit/` | The pip CLI (Typer): `cli.py`, `catalog.py` (resolver), `prompts.py`, `models.py`, `scaffold.py` (installer), `render.py` (Jinja2), `hooks.py`, `validator.py`, `upgrader.py` |
+| `src/claude_kit/` | The pip CLI (Typer): `cli.py`, `catalog.py` (resolver), `prompts.py`, `models.py`, `scaffold.py` (installer), `render.py` (Jinja2), `hooks.py`, `validator.py` (incl. `validate --strict` + `check_catalog`), `upgrader.py`, `pipeline.py` (deterministic `/sdlc` state-file ops) |
 | `tests/` | pytest suite (catalog, render, scaffold, validator, upgrader, CLI; incl. the profile×stack×scope self-test matrix) |
 | `examples/` | Synthetic end-to-end `/sdlc` worked example (repo reference; **not** bundled into the wheel) |
 | `docs/architecture.md` · `docs/agents.md` · `docs/coverage-audit.md` · `docs/eval-harness.md` | Architecture diagrams · agent guide · the GATED-vs-RULE-vs-SKILL enforcement audit · the with/without eval template |

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/CONTRIBUTING.md

@@ -38,11 +38,15 @@ locally, and how to release.
   *when* to use it. Add it to the relevant profile(s) in `catalog/profiles.yaml`.
 - **Rule** → add `rules/<name>.md`; cross-reference siblings as `.claude/rules/<name>.md`.
 - **Hook** → add a script to `hooks/scripts/`, register it in the `HOOK_REGISTRY` in
-  `src/claude_kit/hooks.py`, wire it in `hooks/hooks.json` (plugin), and list its id in the relevant
-  profile's `hooks:`. (Exception: the agent-side capture hooks `capture-learnings[-catchup|-stop]` are
-  **not** profile-listed — they're installed by the init-time `capture_mode` choice via
-  `catalog/capture.yaml` + `catalog._apply_capture_mode`. One script, three triggers, dispatched by an
-  arg.)
+  `src/claude_kit/hooks.py`, and list its id in the relevant profile's `hooks:`. To surface it in the
+  plugin and/or the no-pip starter, add its id to `PLUGIN_HOOK_IDS` / `STARTER_HOOK_IDS` (same module),
+  then **run `python scripts/gen_hooks.py`** to regenerate `hooks/hooks.json` and
+  `templates/settings.json` — **never hand-edit those two files** (a drift test, `gen_hooks.py --check`,
+  fails the build if they diverge from the registry). A plugin-only hook (no CLI scaffold equivalent,
+  e.g. `guard-kubectl-delete`) goes in `PLUGIN_ONLY_HOOKS` with a `reason` instead of the registry.
+  (Exception: the agent-side capture hooks `capture-learnings[-catchup|-stop]` are **not** profile-listed
+  — they're installed by the init-time `capture_mode` choice via `catalog/capture.yaml` +
+  `catalog._apply_capture_mode`. One script, three triggers, dispatched by an arg.)
 - **Stack** (framework / database) → a **data change**: add an entry to `catalog/stacks.yaml`
   (`label`, `overlay_rules`, optional `overlay_agents`, `skills`, `stack_dir`, `commands`) and create
   `templates/stacks/<stack_dir>/rules/<name>.md` (+ `agents/` for a database). Mark not-yet-ready
@@ -67,6 +71,13 @@ claude-kit diff /tmp/ck-demo
 # Tests:
 pytest
 
+# Lint / type / shell / drift checks (all run in CI — keep them green locally):
+ruff check src scripts tests && ruff format --check src scripts tests
+mypy
+shellcheck -S warning hooks/scripts/*.sh scripts/*.sh
+python scripts/gen_hooks.py --check
+python scripts/check_docs_consistency.py
+
 # Build + validate the package:
 python3 -m build
 python3 -m twine check dist/*
@@ -84,8 +95,9 @@ a specific stack — `pytest` enforces the no-Docker invariant on a scaffolded p
 
 ## Releasing
 
-1. Bump the version in **all four** places: `pyproject.toml`, `.claude-plugin/plugin.json`, the
-   `.claude-plugin/marketplace.json` entry, and `src/claude_kit/__init__.py`.
+1. Bump the version in **all five** places: `pyproject.toml`, `.claude-plugin/plugin.json`, the
+   `.claude-plugin/marketplace.json` entry, `src/claude_kit/__init__.py`, and `SECURITY.md`
+   (`check_docs_consistency.py` enforces parity across all of them + the latest `CHANGELOG.md` heading).
 2. Add a `CHANGELOG.md` entry, including a **"Not adopted (deliberately)"** block stating what you
    chose *not* to add and why — this is a marketed feature of the changelog (the README links to it),
    so keep it. If those blocks ever grow unwieldy they may later split into `docs/decision-log.md`,

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.22.0
+Version: 0.24.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -21,7 +21,10 @@ Requires-Dist: pyyaml>=6.0
 Requires-Dist: typer>=0.12
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: shellcheck-py>=0.10; extra == 'dev'
 Requires-Dist: twine>=5.0; extra == 'dev'
 Description-Content-Type: text/markdown
 
@@ -110,6 +113,12 @@ Then, inside any project you want the pipeline to manage:
 /sdlc Add a CSV export button to the reports page
 ```
 
+> **`/claude-kit:init` requires the Python CLI** (`pipx install claude-code-kit`, or `pip install
+> claude-code-kit`) — it's what resolves your stack/profile/MCP catalog and records `init-options.json`
+> for safe `upgrade`/`diff`. If the CLI isn't on PATH the command stops and tells you to install it
+> rather than doing a partial install. (A degraded, no-resolution shell scaffolder is available only by
+> explicitly setting `CLAUDE_KIT_BASIC=1`; `upgrade`/`diff` won't work against it.)
+
 > `/sdlc` is a **project skill** installed by `init`, so it becomes available after the restart. The
 > plugin also exposes `/claude-kit:sdlc <task>`, which works immediately (no restart needed).
 
@@ -607,10 +616,11 @@ everything available.
 | Command | Description |
 |---------|-------------|
 | `init [path] [--defaults] [--config FILE] [--force]` | Scaffold `CLAUDE.md` + `.claude/` (interactive or non-interactive) |
-| `validate [path]` | Structurally validate an installed config |
-| `doctor [path]` | Validate + environment/health checks with fix hints |
+| `validate [path] [--strict]` | Structurally validate an installed config; `--strict` adds hooks→script, `.mcp.json`-shape, snapshot, and catalog-integrity checks |
+| `doctor [path] [--mcp]` | Strict validate + environment/health checks; `--mcp` checks MCP commands, `${ENV}` vars, and lockfile drift |
 | `diff [path]` | Preview what an `upgrade` would change (no writes) |
 | `upgrade [path] [--force]` | Refresh kit/overlay files; protect your edits; prune orphans |
+| `pipeline validate · status · close-gate · abort` | Inspect/mutate the `/sdlc` state files (gate/lane/evidence coherence); **does not run** the pipeline |
 | `list-options` | List available frontend/backend/database/profile/MCP options |
 | `status [path]` | Show what's installed, the selection, and working memory |
 | `version` | Print the version |
@@ -619,6 +629,9 @@ everything available.
 Plugin slash commands: `/claude-kit:init`, `/claude-kit:sdlc <task>`, `/claude-kit:status`; and the
 `/sdlc` skill inside any scaffolded project.
 
+> When MCP servers are selected, `init` also writes a derived **`.mcp.lock.json`** pinning each
+> server's resolved package version — inspect it (or run `doctor --mcp`) to see exactly what would run.
+
 </details>
 
 <details>

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/README.md

@@ -83,6 +83,12 @@ Then, inside any project you want the pipeline to manage:
 /sdlc Add a CSV export button to the reports page
 ```
 
+> **`/claude-kit:init` requires the Python CLI** (`pipx install claude-code-kit`, or `pip install
+> claude-code-kit`) — it's what resolves your stack/profile/MCP catalog and records `init-options.json`
+> for safe `upgrade`/`diff`. If the CLI isn't on PATH the command stops and tells you to install it
+> rather than doing a partial install. (A degraded, no-resolution shell scaffolder is available only by
+> explicitly setting `CLAUDE_KIT_BASIC=1`; `upgrade`/`diff` won't work against it.)
+
 > `/sdlc` is a **project skill** installed by `init`, so it becomes available after the restart. The
 > plugin also exposes `/claude-kit:sdlc <task>`, which works immediately (no restart needed).
 
@@ -580,10 +586,11 @@ everything available.
 | Command | Description |
 |---------|-------------|
 | `init [path] [--defaults] [--config FILE] [--force]` | Scaffold `CLAUDE.md` + `.claude/` (interactive or non-interactive) |
-| `validate [path]` | Structurally validate an installed config |
-| `doctor [path]` | Validate + environment/health checks with fix hints |
+| `validate [path] [--strict]` | Structurally validate an installed config; `--strict` adds hooks→script, `.mcp.json`-shape, snapshot, and catalog-integrity checks |
+| `doctor [path] [--mcp]` | Strict validate + environment/health checks; `--mcp` checks MCP commands, `${ENV}` vars, and lockfile drift |
 | `diff [path]` | Preview what an `upgrade` would change (no writes) |
 | `upgrade [path] [--force]` | Refresh kit/overlay files; protect your edits; prune orphans |
+| `pipeline validate · status · close-gate · abort` | Inspect/mutate the `/sdlc` state files (gate/lane/evidence coherence); **does not run** the pipeline |
 | `list-options` | List available frontend/backend/database/profile/MCP options |
 | `status [path]` | Show what's installed, the selection, and working memory |
 | `version` | Print the version |
@@ -592,6 +599,9 @@ everything available.
 Plugin slash commands: `/claude-kit:init`, `/claude-kit:sdlc <task>`, `/claude-kit:status`; and the
 `/sdlc` skill inside any scaffolded project.
 
+> When MCP servers are selected, `init` also writes a derived **`.mcp.lock.json`** pinning each
+> server's resolved package version — inspect it (or run `doctor --mcp`) to see exactly what would run.
+
 </details>
 
 <details>

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/commands/init.md

@@ -6,21 +6,35 @@ allowed-tools: Bash, Read, Glob
 
 Install the claude-kit autonomous-SDLC configuration into the current project.
 
-**Prefer the full Python CLI** (it runs the ordered prompts, resolves the stack/profile/MCP catalog,
+**The Python CLI is required.** It runs the ordered prompts, resolves the stack/profile/MCP catalog,
 installs overlay rules + agents, assembles `settings.json`, and records `init-options.json` for safe
-upgrades). Check whether it's on PATH and use it, passing through `$ARGUMENTS`:
+upgrades (`claude-kit upgrade` / `diff`). Check whether it's on PATH and use it, passing through
+`$ARGUMENTS`:
 
 ```
 command -v claude-kit >/dev/null 2>&1 && claude-kit init $ARGUMENTS \
-  || { command -v ckit >/dev/null 2>&1 && ckit init $ARGUMENTS; }
+  || { command -v ckit >/dev/null 2>&1 && ckit init $ARGUMENTS \
+  || echo "CKIT_CLI_MISSING"; }
 ```
 
-If neither `claude-kit` nor `ckit` is installed, fall back to the **thin** bundled scaffolder (it
-copies the full payload with no stack/profile resolution — a superset install; suggest the user
-`pip install claude-code-kit` afterwards for the catalog-driven experience):
+**If the output is `CKIT_CLI_MISSING`, STOP — do not scaffold anything.** Neither `claude-kit` nor
+`ckit` is installed. Tell the user the CLI is required and how to install it, then have them re-run
+`/claude-kit:init`. Do **not** silently fall back to a partial install:
+
+- Recommended: `pipx install claude-code-kit`
+- Or: `pip install claude-code-kit`
+
+**Escape hatch (advanced, opt-in only).** A thin shell scaffolder exists for locked-down environments
+where installing the CLI is impossible. It copies the full payload as a **superset** with **no**
+stack/profile/MCP resolution, and `claude-kit upgrade` / `diff` will **not** work against it. Use it
+**only** if the user has explicitly opted in by setting `CLAUDE_KIT_BASIC=1`:
 
 ```
-bash "${CLAUDE_PLUGIN_ROOT}/scripts/init.sh" $ARGUMENTS
+if [ "${CLAUDE_KIT_BASIC:-0}" = "1" ]; then
+  bash "${CLAUDE_PLUGIN_ROOT}/scripts/init.sh" $ARGUMENTS
+else
+  echo "set CLAUDE_KIT_BASIC=1 to use the degraded no-CLI scaffolder (the CLI is the supported path)"
+fi
 ```
 
 If `${CLAUDE_PLUGIN_ROOT}` is not set (running from a source checkout), locate `scripts/init.sh` in

claude_code_kit-0.24.0/hooks/hooks.json

@@ -0,0 +1,106 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-continuity.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-learnings.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-autonomy.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/capture-learnings.sh\" catchup"
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
+          },
+          {
+            "type": "command",
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi"
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-destructive-git.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-secrets.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-kubectl-delete.sh\""
+          }
+        ]
+      },
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-shared-modules.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-llm-io.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-sensitive-files.sh\""
+          }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/validate-settings.sh\""
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/lint-fix.sh\""
+          },
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/type-check.sh\""
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/capture-learnings.sh\" end"
+          }
+        ]
+      }
+    ]
+  }
+}

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/hooks/scripts/warn-missing-tests.sh

@@ -12,7 +12,7 @@ low="$(printf '%s' "$FILE_PATH" | tr '[:upper:]' '[:lower:]')"
 
 # Skip non-source: tests, docs, config, markdown, and the kit's own config.
 case "$low" in
-  *test*|*spec*|*__tests__*|*.md|*.markdown|*.json|*.ya?ml|*.toml|*.ini|*.cfg|*.txt|*.lock|*/.claude/*)
+  *test*|*spec*|*.md|*.markdown|*.json|*.ya?ml|*.toml|*.ini|*.cfg|*.txt|*.lock|*/.claude/*)
     exit 0 ;;
 esac
 

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/hooks/scripts/warn-sensitive-files.sh

@@ -11,7 +11,7 @@ FILE_PATH="$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_response.file
 low="$(printf '%s' "$FILE_PATH" | tr '[:upper:]' '[:lower:]')"
 
 case "$low" in
-  *auth*|*login*|*session*|*oauth*|*jwt*|*password*|*permission*|*rbac*|*authoriz*)
+  *auth*|*login*|*session*|*jwt*|*password*|*permission*|*rbac*)
     echo "WARN: editing an AUTH / authorization surface ($FILE_PATH). High-risk: get review + security check before completion (.claude/rules/risk-classification.md)." >&2 ;;
 esac
 case "$low" in

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.22.0"
+version = "0.24.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -46,6 +46,9 @@ dev = [
   "pytest>=8.0",
   "build>=1.2",
   "twine>=5.0",
+  "ruff>=0.6",
+  "mypy>=1.10",
+  "shellcheck-py>=0.10",
 ]
 
 [project.urls]
@@ -62,6 +65,20 @@ claude-sdlc = "claude_kit.cli:main"
 testpaths = ["tests"]
 pythonpath = ["."]
 
+[tool.ruff]
+target-version = "py39"
+
+[tool.ruff.lint]
+# Deliberately conservative: pyflakes (F) + the actionable pycodestyle subsets (E4/E7/E9, W) +
+# import sorting (I) + bugbear (B). Line length (E501) is intentionally NOT enforced — docstrings and
+# pinned-version comments run long on purpose and `ruff format` owns layout.
+select = ["E4", "E7", "E9", "F", "W", "I", "B"]
+
+[tool.mypy]
+files = ["src/claude_kit"]
+ignore_missing_imports = true
+# typer/yaml ship without type stubs; we check our own code, not third-party signatures.
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/claude_kit"]
 

claude_code_kit-0.24.0/scripts/gen_hooks.py

@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""Generate (or --check) the two *static* hook files from the single ``hooks.py`` registry.
+
+claude-kit ships hooks through three channels, but only one should ever be hand-maintained:
+
+* the **installed** ``.claude/settings.json`` — built per-profile by ``hooks.build_settings`` at init;
+* the auto-discovered **plugin** ``hooks/hooks.json`` (``${CLAUDE_PLUGIN_ROOT}`` paths);
+* the thin no-pip **starter** ``templates/settings.json`` (``$CLAUDE_PROJECT_DIR`` paths).
+
+The latter two used to be edited by hand and silently drifted from the registry (and each other).
+This script regenerates both from ``claude_kit.hooks`` so the registry is the single source of truth.
+
+Usage::
+
+    python scripts/gen_hooks.py            # regenerate the two files in place
+    python scripts/gen_hooks.py --check    # exit 1 if either file is out of sync (CI / tests)
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(
+    0, str(ROOT / "src")
+)  # importable from a bare checkout (no editable install needed)
+
+from claude_kit import hooks  # noqa: E402
+
+#: (path on disk, generator) for each static file derived from the registry.
+TARGETS = [
+    (ROOT / "hooks" / "hooks.json", hooks.generate_plugin_hooks_json),
+    (ROOT / "templates" / "settings.json", hooks.generate_starter_settings),
+]
+
+
+def _render(doc: dict) -> str:
+    """Canonical JSON form (2-space indent, literal Unicode, trailing newline) for both files."""
+    return json.dumps(doc, indent=2, ensure_ascii=False) + "\n"
+
+
+def main(argv: list[str]) -> int:
+    check = "--check" in argv
+    drift: list[Path] = []
+    for path, generate in TARGETS:
+        want = _render(generate())
+        have = path.read_text(encoding="utf-8") if path.is_file() else ""
+        if check:
+            if want != have:
+                drift.append(path)
+        else:
+            path.write_text(want, encoding="utf-8")
+            print(f"wrote {path.relative_to(ROOT)}")
+    if check:
+        if drift:
+            print(
+                "hooks drift: FAIL — run `python scripts/gen_hooks.py` to regenerate:"
+            )
+            for path in drift:
+                print(f"  - {path.relative_to(ROOT)}")
+            return 1
+        print("hooks: in sync with the registry")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/scripts/init.sh

@@ -40,6 +40,16 @@ done
 
 DEST="$TARGET/.claude"
 mkdir -p "$DEST"
+
+# Loud warning: this is the degraded, no-pip path. The full experience is the Python CLI.
+echo "================================================================" >&2
+echo "claude-kit BASIC scaffolder (no Python CLI)" >&2
+echo "  SUPERSET install: NO stack / profile / MCP resolution." >&2
+echo "  'claude-kit upgrade' and 'diff' will NOT work against it." >&2
+echo "  For the full catalog-driven experience + safe upgrades:" >&2
+echo "    pipx install claude-code-kit   (then re-run /claude-kit:init)" >&2
+echo "================================================================" >&2
+
 echo "claude-kit: scaffolding into $TARGET"
 
 copy_root_file() {  # src, dest, label

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.22.0"
+__version__ = "0.24.0"

{claude_code_kit-0.22.0 → claude_code_kit-0.24.0}/src/claude_kit/__main__.py

@@ -1,8 +1,6 @@
 """Enable ``python -m claude_kit`` as an alias for the CLI."""
 
-import sys
-
 from claude_kit.cli import main
 
 if __name__ == "__main__":
-    sys.exit(main())
+    main()  # Typer's app() raises SystemExit with the right code itself.