From 7fe1351dd891c437fadefd69c55e3be1e4696c06 Mon Sep 17 00:00:00 2001
From: Kelvin Steiner <me@steinerkelvin.dev>
Date: Wed, 25 Feb 2026 14:57:03 -0300
Subject: [PATCH] Add disable_plugin_hooks config toggle to vaultguard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Plugin hooks and project-local hooks conflict — there is no way to
disable plugin hooks for vaults that want full control via their own
.claude/settings.json. Set disable_plugin_hooks: true in .arscontexta
to make vaultguard exit 1, skipping all plugin hooks while leaving
project-local hooks unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 hooks/scripts/read_config.sh |  2 ++
 hooks/scripts/vaultguard.sh  | 10 ++++++++++
 skills/setup/SKILL.md        |  3 ++-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/hooks/scripts/read_config.sh b/hooks/scripts/read_config.sh
index c4130cd..5c2cbd6 100755
--- a/hooks/scripts/read_config.sh
+++ b/hooks/scripts/read_config.sh
@@ -5,6 +5,8 @@
 # Returns: value for key, or default if key/file missing.
 # Default default: "true" (preserves existing behaviour when no config exists).
 #
+# Supported keys: git, session_capture, disable_plugin_hooks
+#
 # Migration: old marker files (cat face text) have no YAML keys,
 # so grep returns nothing → defaults apply → behaviour unchanged.
 
diff --git a/hooks/scripts/vaultguard.sh b/hooks/scripts/vaultguard.sh
index ab5e58c..ec20e9d 100755
--- a/hooks/scripts/vaultguard.sh
+++ b/hooks/scripts/vaultguard.sh
@@ -21,6 +21,11 @@ git: true
 session_capture: true
 EOF
   fi
+  # Check if plugin hooks are disabled
+  DISABLE_PLUGIN_HOOKS=$("$(dirname "$0")/read_config.sh" disable_plugin_hooks false)
+  if [ "$DISABLE_PLUGIN_HOOKS" = "true" ]; then
+    exit 1
+  fi
   exit 0
 fi
 
@@ -34,6 +39,11 @@ if [ -f ops/config.yaml ] || [ -f .claude/hooks/session-orient.sh ]; then
 git: true
 session_capture: true
 EOF
+  # Check if plugin hooks are disabled
+  DISABLE_PLUGIN_HOOKS=$("$(dirname "$0")/read_config.sh" disable_plugin_hooks false)
+  if [ "$DISABLE_PLUGIN_HOOKS" = "true" ]; then
+    exit 1
+  fi
   exit 0
 fi
 
diff --git a/skills/setup/SKILL.md b/skills/setup/SKILL.md
index 70104de..b33ddfd 100644
--- a/skills/setup/SKILL.md
+++ b/skills/setup/SKILL.md
@@ -1531,8 +1531,9 @@ session_capture: true
 Keys and defaults:
 - `git: true` — auto-commit on writes (auto-commit.sh)
 - `session_capture: true` — session JSON capture on start (session-orient.sh)
+- `disable_plugin_hooks: false` — set to `true` to disable all plugin hooks (use when project-local hooks cover everything)
 
-Omitted keys default to `true`, so a minimal marker file (or even an empty file) preserves full default behaviour.
+Omitted keys default to `false` for `disable_plugin_hooks` and `true` for all others, so a minimal marker file (or even an empty file) preserves full default behaviour.
 
 ---