From 22ad036cb5bf2a4583e3df2076708d6cb4288bd4 Mon Sep 17 00:00:00 2001 From: Affaan Mustafa Date: Fri, 23 Jan 2026 20:47:22 -0800 Subject: [PATCH 01/19] fix: add hooks declaration to plugin.json for proper hook loading Previously hooks were not loaded when the plugin was installed because plugin.json didn't declare the hooks path. This caused errors like: "Stop hook error: .../skills/continuous-learning/evaluate-session.sh: No such file" The hooks are defined in hooks/hooks.json and use JS implementations in scripts/hooks/ directory. --- .claude-plugin/plugin.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 6abaa72f..cf1101c1 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -23,5 +23,6 @@ "best-practices" ], "commands": "./commands", - "skills": "./skills" + "skills": "./skills", + "hooks": "./hooks/hooks.json" } From a7bc5f2a90266b5ebbcdb85f63b10268159bfb17 Mon Sep 17 00:00:00 2001 From: Affaan Mustafa Date: Fri, 23 Jan 2026 22:27:21 -0800 Subject: [PATCH 02/19] revert: remove hooks declaration - auto-loaded by convention Claude Code automatically loads hooks/hooks.json if it exists. Declaring it in plugin.json causes "Duplicate hooks file" error. Fixes #52 --- .claude-plugin/plugin.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index cf1101c1..6abaa72f 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -23,6 +23,5 @@ "best-practices" ], "commands": "./commands", - "skills": "./skills", - "hooks": "./hooks/hooks.json" + "skills": "./skills" } From 660e0d3badd31d5081b0e28206a2f027ba5a08e9 Mon Sep 17 00:00:00 2001 From: Affaan Mustafa Date: Sat, 24 Jan 2026 01:36:02 -0800 Subject: [PATCH 03/19] fix: security and documentation fixes - fix(utils.js): prevent command injection in commandExists() by using spawnSync instead of execSync with string interpolation, and validate input to only allow alphanumeric chars, dash, underscore, dot (#42) - fix(utils.js): add security documentation to runCommand() warning against passing user-controlled input - fix(setup-package-manager.js): replace