feat: port SDLC enhancements from aegis-daemon — --bare, Stop hook, --add-dir

- Add --bare flag to build_claude_cmd() for faster Claude startup (skips
  CLAUDE.md discovery, MCP init, auto-memory); hooks still load via --settings
- Add --add-dir support: work_dir always passed first (required by --bare for
  CLAUDE.md re-discovery), plus dynamically detected cross-repo dirs
- Add detect_cross_repo_dirs() that scans REPOS_DIR for repos referenced in
  the task prompt and passes them as additional --add-dir flags
- Create hooks/stop-checkpoint.sh Stop hook: captures checkpoint on every
  stop, re-engages Claude if TypeScript errors detected, allows stop on
  second fire (stop_hook_active=true) to prevent infinite loops
- Register Stop hook in ensure_hooks_settings() JSON template
- Wire CC_CHECKPOINT_FILE env var into execute_task() around claude invocation
- Warn when ANTHROPIC_API_KEY is unset (required by --bare mode)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: stackbilt-admin

hooks/stop-checkpoint.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# stop-checkpoint.sh — Stop hook for autonomous taskrunner sessions
+#
+# On natural stop: re-engage Claude if TypeScript errors are found.
+# On second fire (stop_hook_active=true): allows stop to prevent infinite loops.
+#
+# Writes checkpoint to $CC_CHECKPOINT_FILE (set by taskrunner) so the
+# taskrunner can include it in retry prompts.
+#
+# Copyright 2026 Stackbilt LLC — Apache 2.0
+
+INPUT=$(cat)
+STOP_HOOK_ACTIVE=$(printf '%s' "$INPUT" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("stop_hook_active", False))' 2>/dev/null || echo "False")
+LAST_MSG=$(printf '%s' "$INPUT" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("last_assistant_message","")[:500])' 2>/dev/null || echo "")
+CWD=$(printf '%s' "$INPUT" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("cwd",""))' 2>/dev/null || echo "")
+
+CHECKPOINT_FILE="${CC_CHECKPOINT_FILE:-}"
+
+# ─── Always capture checkpoint ────────────────────────────────
+
+capture_checkpoint() {
+  [[ -n "$CHECKPOINT_FILE" ]] || return 0
+
+  local changed_files=""
+
+  if [[ -n "$CWD" ]] && git -C "$CWD" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    changed_files=$(git -C "$CWD" diff --name-only 2>/dev/null | head -20)
+  fi
+
+  CC_LAST_MSG="$LAST_MSG" CC_CHANGED="$changed_files" CC_CWD="$CWD" python3 - > "$CHECKPOINT_FILE" <<'PY'
+import json, os
+print(json.dumps({
+    "last_message": os.environ.get("CC_LAST_MSG", "")[:500],
+    "changed_files": [f for f in os.environ.get("CC_CHANGED", "").split("\n") if f],
+    "cwd": os.environ.get("CC_CWD", ""),
+}))
+PY
+}
+
+capture_checkpoint
+
+# ─── If already re-engaged once, let it stop ─────────────────
+
+if [[ "$STOP_HOOK_ACTIVE" == "True" ]]; then
+  exit 0
+fi
+
+# ─── On natural stop: check if TypeScript errors exist ────────
+
+if [[ -z "$CWD" ]]; then
+  exit 0
+fi
+
+# Quick typecheck (most common failure mode)
+TC_EXIT=0
+TC_OUTPUT=""
+if [[ -f "$CWD/web/tsconfig.json" ]]; then
+  TC_OUTPUT=$(cd "$CWD/web" && npx tsc --noEmit 2>&1 | tail -5)
+  TC_EXIT=$?
+elif [[ -f "$CWD/tsconfig.json" ]]; then
+  TC_OUTPUT=$(cd "$CWD" && npx tsc --noEmit 2>&1 | tail -5)
+  TC_EXIT=$?
+fi
+
+if [[ $TC_EXIT -ne 0 ]]; then
+  # Re-engage: tell Claude to fix type errors before stopping
+  TC_SNIPPET=$(echo "$TC_OUTPUT" | head -10 | tr '\n' ' ' | cut -c1-300)
+  printf '{"decision":"block","reason":"TypeScript errors detected. Fix before completing:\\n%s"}' "$TC_SNIPPET"
+  exit 0
+fi
+
+# TypeScript clean — allow stop
+exit 0

taskrunner.sh

@@ -246,26 +246,66 @@ ensure_hooks_settings() {
           }
         ]
       }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${HOOKS_DIR}/stop-checkpoint.sh"
+          }
+        ]
+      }
     ]
   }
 }
 SETTINGS
   fi
 }
 
+# ─── Cross-repo dir detection ────────────────────────────────
+
+detect_cross_repo_dirs() {
+  # Scan task prompt for references to other repos under REPOS_DIR.
+  # Returns newline-separated list of repo paths (excluding the primary repo).
+  local prompt="$1" primary_repo="$2"
+
+  [[ -z "$REPOS_DIR" ]] && return 0
+
+  local dir dirname
+  for dir in "$REPOS_DIR"/*/; do
+    [[ -d "$dir" ]] || continue
+    dirname=$(basename "$dir")
+    [[ "$dirname" == "$primary_repo" ]] && continue
+    if echo "$prompt" | grep -qi "$dirname" && git -C "$dir" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+      echo "$dir"
+    fi
+  done
+}
+
 # ─── Build Claude command ────────────────────────────────────
 
 build_claude_cmd() {
-  local prompt="$1" max_turns="$2"
+  local prompt="$1" max_turns="$2" add_dirs="${3:-}"
 
   local cmd=(
     claude
     -p "$prompt"
+    --bare
     --dangerously-skip-permissions
     --output-format json
     --max-turns "$max_turns"
     --settings "$HOOKS_SETTINGS"
   )
+  # --bare: skip CLAUDE.md discovery, MCP init, auto-memory for faster startup.
+  # Hooks still load via explicit --settings. Work dir passed via --add-dir below.
+
+  # Cross-repo access and CLAUDE.md discovery via --add-dir
+  if [[ -n "$add_dirs" ]]; then
+    while IFS= read -r dir; do
+      [[ -n "$dir" && -d "$dir" ]] && cmd+=(--add-dir "$dir")
+    done <<< "$add_dirs"
+  fi
 
   printf '%q ' "${cmd[@]}"
 }
@@ -418,16 +458,40 @@ MISSION
   timeout 30 git ls-files --others --exclude-standard 2>/dev/null >> "$pre_snapshot"
 
   # Execute
-  local output_file exit_code=0
+  local output_file checkpoint_file exit_code=0
   output_file=$(mktemp /tmp/cc-task-XXXXXX.json)
-  trap "rm -f ${output_file} ${pre_snapshot}" RETURN
+  checkpoint_file=$(mktemp /tmp/cc-task-checkpoint-XXXXXX.json)
+  trap "rm -f ${output_file} ${pre_snapshot} ${checkpoint_file}" RETURN
+
+  # Detect cross-repo dirs for --add-dir (prompt may reference other repos)
+  local cross_repo_dirs=""
+  if [[ -n "$REPOS_DIR" ]]; then
+    cross_repo_dirs=$(detect_cross_repo_dirs "$prompt $title" "$(basename "$repo_path")" 2>/dev/null || echo "")
+    if [[ -n "$cross_repo_dirs" ]]; then
+      log "│  Cross-repo access: $(echo "$cross_repo_dirs" | tr '\n' ',' | sed 's/,$//')"
+    fi
+  fi
+
+  # --bare requires explicit ANTHROPIC_API_KEY (OAuth/keychain disabled)
+  if [[ -z "${ANTHROPIC_API_KEY:-}" ]]; then
+    log "│  WARNING: ANTHROPIC_API_KEY not set — --bare mode requires explicit API key"
+  fi
+
+  # --bare skips CLAUDE.md auto-discovery; always pass repo_path as first --add-dir
+  local all_dirs="$repo_path"
+  if [[ -n "$cross_repo_dirs" ]]; then
+    all_dirs="${all_dirs}
+${cross_repo_dirs}"
+  fi
 
   log "│  Starting Claude Code session..."
 
   cd "$repo_path"
   unset CLAUDECODE CLAUDE_CODE_ENTRYPOINT 2>/dev/null || true
-  eval "$(build_claude_cmd "$mission_prompt" "$max_turns")" \
+  export CC_CHECKPOINT_FILE="$checkpoint_file"
+  eval "$(build_claude_cmd "$mission_prompt" "$max_turns" "$all_dirs")" \
     < /dev/null > "$output_file" 2>&1 || exit_code=$?
+  unset CC_CHECKPOINT_FILE
 
   # Detect max_turns exceeded from JSON output (#15)
   local max_turns_exceeded=false