Add a scope-guard hook for repo-wide formatters and bare stash pops

Context

The story behind this plan — what prompted the work and why it matters now.

The 2026-08-14 usage report records the two most expensive single incidents in
the period, both from commands whose blast radius exceeded their intent: a
repo-wide npm run fix:all that "reformatted ~190 untouched files, requiring
a guarded revert", and "a bare git stash pop [that] restored an unrelated
stash and created conflicts requiring recovery." It also notes 47
user_rejected_action events clustering on destructive commands — meaning the
enforcement mechanism today is a human at the permission prompt.

The rule exists but is not shipped. Both constraints are already written in
this user's global CLAUDE.md, under Formatting & Scope and Git. That governs
this user and nobody who installs these plugins, and it is advice a model can
weigh rather than a gate it cannot pass. A hook is the difference between a
prompt and a program.

A user-level hook already covers part of this, with three gaps.
~/.claude/hooks/block-repo-wide-format.py was written on 2026-08-14 and
blocks three literal patterns: <runner> run fix:all, prettier|biome --write .,
and eslint|biome --fix .. It is the right idea, and it settles the yarn run
question — its own pattern already spells the runner alternation with an
explicit run. Three gaps remain, and they are why this plan is still worth
landing:

1. No script resolution. It matches the literal string fix:all, so
npm run format where format is prettier --write . passes untouched.
The incident command happened to be named fix:all; the next one will not
be.
2. run is mandatory in its first pattern. yarn fix:all — the bare form
every runner accepts — does not match. Stripping an optional run token
covers both spellings without enumerating either.
3. It fires on non-executing mentions. It inspects the raw command text, so
git commit -m "...fix:all..." is blocked even though nothing runs. This
was observed while authoring this plan: a commit whose message described
the pattern was refused. A guard that blocks talking about a command is a
guard that gets disabled.

It is also user-level, so it does not travel to anyone installing git-agent —
the original reason for shipping it in a plugin stands unchanged.

It belongs in git-agent because the wiring already exists. git-agent
registers a PreToolUse hook on Bash for lint-before-commit.py, and its
manifest carries the explicit "hooks": "./hooks.json" key added in 4.14.0
after a controlled A/B showed the root-level file is otherwise never read. A
second command in the same matcher costs one new file and no new registration.
The alternative — a new plugin for two guards — is a marketplace entry, a
README, a version line, and a CHANGELOG for 80 lines of Python.

A literal-text match would miss the actual incident. The report's own
suggested hook greps the raw command for fix:all. The command that caused the
damage was npm run fix:all, whose expansion lives in package.json — and the
general case, npm run format where the script is prettier --write ., has no
matching text at all. The hook therefore resolves npm/pnpm/yarn/bun
script invocations against the nearest manifest before matching, reusing the
upward walk lint-before-commit.py already implements. Without that step the
guard would pass the exact command it exists to stop.

Resolution strips an optional run token rather than enumerating invocation
spellings. Every runner accepts both — yarn fix:all and yarn run fix:all
are the same command, and lint-before-commit.py already normalizes Yarn to
yarn run at its RUNNERS table — so a list of literal forms leaves a bypass
for whichever spelling it omitted.

Two patterns, not five. Only the two with recorded incidents are blocked:

- a formatter or linter invoked with --write or --fix and no path argument,
or with . as its path, whether typed directly or reached through a package
script;
- git stash pop or git stash apply with no explicit stash reference.

rm, curl, git reset --hard, and git checkout -- . are deliberately
excluded. rm and curl are already denied outright at the permission layer
for this user, and the rest have no measured incident here. A guard that fires
on safe commands gets disabled within a week, which costs more than the two it
was catching.

The desktop app will not run it. Plugin hooks.json files are not
registered in Claude Code desktop sessions — measured across 627 hook
executions, where zero came from any plugin. This guard is therefore CLI-only
enforcement, and the CLAUDE.md rules remain the desktop fallback rather than
being retired when it ships. That belongs in the README next to the hook, so
nobody debugs a hook that was never wired.

The lint gate is already a test gate and nobody knows. Separately,
lint-before-commit.py accepts arbitrary commands through
.claude/lint-gate.json {"commands": [...]}, compares against HEAD so
pre-existing failures never block, and is documented in the README only as a
lint mechanism. The report's "defects caught by CI and review bots instead of
locally" finding — 100 buggy_code frictions against 95 code_review_response
sessions — needs no new machinery to address, only a documented example. It
ships here because it edits the same README section as the new hook.