Pluginize all 12 standalone hooks and retire hook-scripts/

[karanb192]

Summary

• Converts the 12 standalone scripts under hook-scripts/ into installable plugins, growing the marketplace from 7 to 19 entries; every hook now installs with /plugin install <name>@claude-code-hooks
• Scripts move into plugins/<name>/ as git renames with logic untouched; the one functional addition is a HOOK_SAFETY_LEVEL env override on the six guards that had a hardcoded SAFETY_LEVEL constant (block-dangerous-commands, case-insensitive-guard, config-guard, git-safety, protect-secrets, protect-tests), since plugin updates overwrite edited files
• Deletes hook-scripts/ and rewires everything that referenced it: package.json test glob, bench/run.mjs paths, README, CONTRIBUTING, the OWASP mapping, and the site catalog
• Tests: 1544 pass, 0 fail (up from 1499; the new cases cover the env overrides), claude plugin validate passes

Details

New plugins. Each of the 12 gets .claude-plugin/plugin.json (v1.0.0), hooks/hooks.json, its script, a README documenting real behavior and every env var, and its full test suite under tests/. Registrations follow each script's own header: instructions-audit registers all three arms (InstructionsLoaded + UserPromptSubmit + PreToolUse) in one install, replacing the three manual registrations the root README used to prescribe; session-logger registers SessionStart + async PostToolUse + SessionEnd; the PreToolUse guards stay synchronous so a deny lands before the tool runs.

Script changes. Confined to the same two things per script (plus one analog: session-logger's BASH_TRUNCATE constant became the CC_SESSION_BASH_TRUNCATE env override for the same frozen-file reason): the header's setup section now describes plugin install (with the classic copy path kept as an alternative), and the SAFETY_LEVEL constant became env-overridable with whitelist validation falling back to the original default. Patterns, messages, exit codes, and log paths are byte-identical; an adversarial per-plugin review diffed each against its original to confirm.

Repo rewiring. hook-scripts/tests/meta/test-discovery.test.js moves to tests/ with its shape regexes updated for the new layout; event-logger.py moves to utils/ unchanged; bench/run.mjs points its 7 script paths at the plugin locations; .claude-plugin/marketplace.json gains 12 entries in the existing style.

Docs and site. README is rewritten plugin-first: the per-event hook tables now link to plugin dirs, the install table lists all 19 plugins, the Safety Levels section documents the env override, and the tests badge reflects the real 1544 total. CONTRIBUTING describes the plugin-shaped contribution flow. The OWASP mapping links and the GitHub Pages catalog point at the new paths.

Migration. The README gains a "Migrating from hook-scripts/" section covering the two upgrade hazards: a settings.json entry pointing into a clone's hook-scripts/ dies silently after this merge (a failing hook command is a non-blocking error), and a manual copy plus the plugin runs a hook twice.

Test plan

• npm test: 1544 pass, 0 fail across Node 18/20/22 in CI
• claude plugin validate .: marketplace manifest passes
• grep -rn "hook-scripts" . --exclude-dir=.git: zero hits
• /plugin marketplace add karanb192/claude-code-hooks then /plugin install instructions-audit@claude-code-hooks: all three arms register from one install

Generated with Claude Code