Mark file:rule pairs as pending for the Stop-hook outcome sweep.

Append a file path to the touched_paths list (deduped, capped at 200). Stop is the consumer and clears under the same lock it reads with; UPS

Save the full state dict to file.

Stop-hook final sweep. Re-read every file in pending_warnings, re-check patterns, and return (fixed, unresolved, unresolved_mask). Clears sta

Initialize rule engine.

Run a higher-level security concerns analysis on files/diffs. Identifies AREAS OF CONCERN that the main model should investigate. Returns

Atomically check if a counter has reached its limit and increment if not. Returns True if the counter is below max_count (should proceed),

Extract file paths from unified diff output (without content). Only includes files with source code extensions. Returns a list of file pa

Medium-included is the validated default; the model's investigate-stage severity is conservative and dropping mediums before self-refute filters

Render findings as the same text block the CC plugin emits to Claude.

Create Condition from dict.

The wrapped <project-security-guidance> block, or empty string.