v1.35.0.1 fix: /freeze and /careful enforcement chain (#1459)

Three independent bugs all required for hooks to fire and enforce:
Bug 1 — bin/ not symlinked (hook script unreachable)
Bug 2 — hooks not registered in settings.json (never fires)
Bug 3 — wrong hookSpecificOutput format (fires, deny ignored)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: NikhileshNanduri

CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [1.48.3.0] - 2026-05-28
+
+**`/freeze` and `/careful` now actually block. Three independent bugs — no bin/ symlink, no hook registration, wrong response format — were all required for the hooks to fire and enforce.**
+
+The `/freeze` skill blocks Edit and Write outside a declared directory. `/careful` warns before destructive Bash commands. Both worked during skill invocation but provided zero actual enforcement. An Edit on a blocked file would succeed silently.
+
+| Bug | Symptom | Root cause |
+|-----|---------|-----------|
+| Bug 1 | Hook script not found | `link_claude_skill_dirs` symlinked `SKILL.md` but not `bin/` — hook scripts unreachable |
+| Bug 2 | Hook never fired | SKILL.md frontmatter `hooks:` is documentation only — setup never wrote to `~/.claude/settings.json` |
+| Bug 3 | Hook fired, deny ignored | Scripts returned a flat object; correct format requires `hookSpecificOutput` envelope |
+
+Re-run `./setup` once to activate. After that, `/freeze` actually blocks edits outside the declared directory.
+
+### Itemized changes
+
+#### Fixed
+- **Bug 1** — `setup` and `gstack-relink` now symlink each skill's `bin/` alongside `SKILL.md`
+- **Bug 2** — `setup` registers PreToolUse hook entries in `~/.claude/settings.json` at install time
+- **Bug 3** — `check-freeze.sh` and `check-careful.sh` now output the correct `hookSpecificOutput` envelope
+
+#### For contributors
+- `test/hook-scripts.test.ts`: freeze and careful tests assert `hookSpecificOutput` shape
+
 ## [1.48.0.0] - 2026-05-26
 
 ## **Agents stop dropping AskUserQuestion options when there are 5+.** A new canonical preamble rule + runtime gate makes Conductor's 4-option cap a split-or-batch decision, not a silent trim.

VERSION

@@ -1 +1 @@
-1.48.0.0
+1.48.3.0

freeze/SKILL.md

@@ -80,7 +80,7 @@ The hook reads `file_path` from the Edit/Write tool input JSON, then checks
 whether the path starts with the freeze directory. If not, it returns
 a `hookSpecificOutput` deny decision to block the operation.
 
-The hook is registered globally in `~/.claude/settings.json` by the gstack
+The hook is registered globally in Claude Code's settings by the gstack
 installer. It is a no-op when no freeze state file exists, so it does not
 interfere in sessions where `/freeze` has not been invoked. The freeze
 boundary persists via the state file; `/unfreeze` clears it.

freeze/SKILL.md.tmpl

@@ -75,7 +75,7 @@ The hook reads `file_path` from the Edit/Write tool input JSON, then checks
 whether the path starts with the freeze directory. If not, it returns
 a `hookSpecificOutput` deny decision to block the operation.
 
-The hook is registered globally in `~/.claude/settings.json` by the gstack
+The hook is registered globally in Claude Code's settings by the gstack
 installer. It is a no-op when no freeze state file exists, so it does not
 interfere in sessions where `/freeze` has not been invoked. The freeze
 boundary persists via the state file; `/unfreeze` clears it.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.48.0.0",
+  "version": "1.48.3.0",
   "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.",
   "license": "MIT",
   "type": "module",