Address review findings (job 438)

Syntax check passed. All changes are complete.
Changes:
- Replace macOS `read -t` fallback with `head -c 65536 | jq` pipeline to fix silent failure when `timeout` is unavailable (finding 1)
- Move version-change note from header preamble to Tool Discovery section where it's more contextually relevant (finding 4)

Address review findings (job 436)

Script passes syntax check. This is a shell script, not a Rust source file, so the standard `cargo build`/`cargo test` commands aren't relevant here. The change is minimal and self-contained.
Changes:
- Added `-n 65536` to `read` builtin in the macOS fallback branch to enforce the same 64KB size limit as the `timeout` branch, addressing the size guard inconsistency

Address review findings (job 435)

Syntax check passed. This is a shell script only — no Rust build or tests needed for these changes.
Changes:
- Use bash `read -t 5` fallback instead of bare `head` on systems without `timeout` (macOS) to prevent indefinite stdin blocking
- Emit diagnostic `additionalContext` message when `CLAUDE_PLUGIN_ROOT` is unset, aiding troubleshooting
- Replace instruction-to-AI phrasing ("Inform the user...") with neutral factual messages in JSON output

Address review findings (job 433)

Script syntax is valid. All three review findings are addressed.
Changes:
- Add `command -v timeout` check with fallback to plain `head` for macOS compatibility (issues #1/#3)
- Guard against empty/unset `CLAUDE_PLUGIN_ROOT` before `cd` to prevent unexpected `$HOME` resolution (issue #2)

Address review findings (job 432)

Script syntax is valid (no output = no errors).
Changes:
- Add 5-second timeout to stdin read to prevent indefinite blocking if no input is provided
- Guard against deploying CLAUDE.md into the plugin's own directory tree
- Replace hardcoded version "v16.1" with version-agnostic wording in cowork template
- Add `stats` (with extended stats) to the memory-intensive commands list in cowork template

Address review findings (job 430)

Script syntax is valid.
Changes:
- Guard `jq` parse of stdin against truncated JSON: redirect stderr and fall back to empty `CWD` on failure, so `set -e` won't abort on malformed input
- Replace `realpath` with POSIX-portable `cd "$CWD" && pwd -P` for symlink resolution, ensuring compatibility on minimal macOS and CI images without GNU coreutils

Address review findings (job 429)

All changes look correct. Since this is a shell script and markdown file (no Rust code changes), there's no build or test to run.
Changes:
- Limit stdin read to 64KB (`head -c 65536`) to prevent hangs on malformed/endless input
- Resolve CWD with `realpath` to prevent path traversal via symlinks
- Add `QSV_NO_COWORK_SETUP=1` env var opt-out mechanism
- Wrap `cp` in error handling to produce a friendly JSON message instead of failing with `set -e`
- Add version note and opt-out instructions to the cowork-CLAUDE.md template header

Address review findings (job 427)

Script syntax is valid (no output means no errors).
Changes:
- Redirect `jq`-missing diagnostic from stderr to stdout so the hook framework can surface it as `additionalContext` to the agent

Address review findings (job 426)

Both files validate correctly. The diagnostic errors about `qsv_bin` are pre-existing and unrelated to these changes.
Changes:
- Use here-string (`<<<`) instead of `echo | jq` to avoid escape sequence mangling in JSON input
- Add `jq` availability check with friendly message instead of cryptic hook error
- Remove misleading `"matcher": "startup"` from SessionStart hook config
- Use `jq -n` to construct output JSON safely, preventing malformed JSON from paths with special characters
- Remove unverified `QSV_MCP_OPERATION_TIMEOUT_MS` / `qsv_config` references from cowork-CLAUDE.md template

Author: jqnatividad

.claude/skills/.claude-plugin/plugin.json

@@ -25,7 +25,6 @@
   "hooks": {
     "SessionStart": [
       {
-        "matcher": "startup",
         "type": "command",
         "command": "${CLAUDE_PLUGIN_ROOT}/scripts/cowork-setup.sh"
       }

.claude/skills/cowork-CLAUDE.md

@@ -2,6 +2,7 @@
 
 This CLAUDE.md was auto-deployed by the qsv plugin to provide workflow guidance.
 You can edit or replace it — it will NOT be overwritten on future sessions.
+To disable auto-deployment, set `QSV_NO_COWORK_SETUP=1` in your environment.
 
 ---
 
@@ -34,16 +35,16 @@ SQL queries on CSV inputs auto-convert to Parquet before execution.
 
 ## Memory Limits
 
-Commands `dedup`, `sort`, `reverse`, `table`, `transpose`, `pragmastat` load entire files into memory.
+Commands `dedup`, `sort`, `reverse`, `table`, `transpose`, `pragmastat`, and `stats` (with extended stats) load entire files into memory.
 
 For files >1GB, prefer `extdedup`/`extsort` alternatives via **`qsv_command`**.
 
 Check column cardinality with **`qsv_stats`** before running `frequency` or `pivotp` to avoid huge output.
 
 ## Tool Discovery
 
-Use **`qsv_search_tools`** to discover commands beyond the initially loaded core tools. There are 56 qsv commands available covering selection, filtering, transformation, aggregation, joining, validation, formatting, conversion, and more.
+Use **`qsv_search_tools`** to discover commands beyond the initially loaded core tools. There are 56 qsv commands available covering selection, filtering, transformation, aggregation, joining, validation, formatting, conversion, and more. Tool names may change across versions; check `qsv_search_tools` if any are unrecognized.
 
 ## Operation Timeout
 
-qsv operations can take significant time on larger files. The MCP server's default operation timeout is 10 minutes (configurable via `QSV_MCP_OPERATION_TIMEOUT_MS`, max 30 minutes). Allow operations to run to completion. Check the current timeout with **`qsv_config`**.
+qsv operations can take significant time on larger files. Allow operations to run to completion.

.claude/skills/scripts/cowork-setup.sh

@@ -5,16 +5,38 @@
 
 set -euo pipefail
 
-# Read hook input JSON from stdin
-INPUT=$(cat)
+# Allow opting out via environment variable
+if [ "${QSV_NO_COWORK_SETUP:-}" = "1" ]; then
+  exit 0
+fi
+
+# Require jq for JSON parsing
+if ! command -v jq &>/dev/null; then
+  echo '{"additionalContext": "jq is not installed. Skipping qsv CLAUDE.md deployment. Install jq for automatic workflow guidance setup."}'
+  exit 0
+fi
 
-# Extract cwd from the hook input
-CWD=$(echo "$INPUT" | jq -r '.cwd // empty')
+# Extract cwd from hook input JSON (limit to 64KB; timeout after 5s to avoid hangs)
+# Pipe directly through head into jq to avoid platform-specific read/timeout issues
+CWD=$(head -c 65536 | jq -r '.cwd // empty' 2>/dev/null) || CWD=""
 
 if [ -z "$CWD" ]; then
   exit 0
 fi
 
+# Resolve to real path to prevent path traversal via symlinks (POSIX-portable)
+CWD=$(cd "$CWD" 2>/dev/null && pwd -P) || exit 0
+
+# Guard against deploying into the plugin's own directory tree
+if [ -z "${CLAUDE_PLUGIN_ROOT:-}" ]; then
+  echo '{"additionalContext": "CLAUDE_PLUGIN_ROOT is not set. Skipping qsv CLAUDE.md deployment."}'
+  exit 0
+fi
+PLUGIN_ROOT=$(cd "$CLAUDE_PLUGIN_ROOT" 2>/dev/null && pwd -P) || exit 0
+case "$CWD" in
+  "$PLUGIN_ROOT"|"$PLUGIN_ROOT"/*) exit 0 ;;
+esac
+
 TEMPLATE="${CLAUDE_PLUGIN_ROOT}/cowork-CLAUDE.md"
 TARGET="${CWD}/CLAUDE.md"
 
@@ -25,13 +47,15 @@ fi
 
 if [ -f "$TARGET" ]; then
   # Existing CLAUDE.md — don't overwrite
-  cat <<EOF
-{"additionalContext": "An existing CLAUDE.md was found at ${TARGET}. It was NOT overwritten. Inform the user their existing CLAUDE.md is being used."}
-EOF
+  jq -n --arg path "$TARGET" \
+    '{"additionalContext": "An existing CLAUDE.md was found at \($path). It was NOT overwritten. The existing file will be used for workflow guidance."}'
 else
   # Copy the template
-  cp "$TEMPLATE" "$TARGET"
-  cat <<EOF
-{"additionalContext": "A qsv CLAUDE.md was created at ${TARGET}. Inform the user that qsv workflow guidance has been set up in their working folder."}
-EOF
+  if cp "$TEMPLATE" "$TARGET" 2>/dev/null; then
+    jq -n --arg path "$TARGET" \
+      '{"additionalContext": "A qsv CLAUDE.md was created at \($path). qsv workflow guidance has been set up in the working folder."}'
+  else
+    jq -n --arg path "$CWD" \
+      '{"additionalContext": "Could not create CLAUDE.md in \($path) (directory may not be writable). Skipping qsv workflow guidance setup."}'
+  fi
 fi