Quality Gate

Automated quality enforcement with two hooks:

Stop Hook — Code Quality

Fires on every session stop. Runs JavaScript/TypeScript checks on changed files:

Behavior:

• Missing required tools (tsc, eslint, prettier, jest) = FAIL with install command
• Missing optional tools (knip, type-coverage, madge) = WARN with install suggestion
• Retry limiter: allows stop after 3 consecutive failures

PreToolUse Hook — Security Scan

Intercepts git push commands. Runs 4 scanners in sequence:

1. semgrep — SAST scan on changed files with --config=auto
   • Critical/High findings = BLOCK push
   • Medium findings = WARN
   • Claude should auto-fix findings before retrying
2. gitleaks — scans commits being pushed for leaked secrets
   • Any secret found = BLOCK push
3. trivy — filesystem vulnerability, secret, and misconfig scan
   • Critical vulns = BLOCK push
   • High vulns = WARN
4. SonarQube (optional) — checks quality gate status if configured
   • Requires SONARQUBE_URL and SONARQUBE_TOKEN env vars, plus sonar-project.properties
   • Skipped silently if SONARQUBE_TOKEN is not set
   • Failed quality gate = BLOCK push

Configuration

Commands

• /quality run — Run checks manually
• /quality status — View gate status and recent results
• /quality config — See active checks and tool availability