---
name: eck:enable-protections
version: "0.7.4"
description: Flip the protectionsEnabled flag in global-state.json to activate safety hooks
disable-model-invocation: true
---

# Enable Protections

Activate safety hooks (protect-files, detect-secrets, hitl-approval, security-gate) by setting `protectionsEnabled: true` in `$ECK_HOME/global-state.json`. Hooks are permanently registered in `settings.json` and check this flag at runtime — when `false`, they NOOP silently.

> **Architecture:** Safety hooks are always registered in `settings.json` (installed once). This skill only flips the `protectionsEnabled` flag in `global-state.json`. No hook injection or removal occurs. See CLAUDE.md D5 for the canonical description.

---

## Visual Framework

Follow these conventions for all terminal output displayed to the user via the Bash tool.

### Output Mode Awareness

Before producing output, read the user's preferred output mode:

```bash
cat $ECK_HOME/user-preferences.json 2>/dev/null
```

Extract the `outputMode` field and adapt verbosity:

- **guided** — Add explanatory prose after key steps. Describe what is happening and why.
- **standard** (default) — Balanced. Show steps with brief context for non-obvious decisions.
- **concise** — Steps and summary box only. No prose, no explanations.

If the file is missing or `outputMode` is absent, use **standard**.

### ANSI Colors

Declare these variables at the top of **every** Bash tool call (shell state does not persist between calls):

```bash
source $ECK_HOME/colors.sh
```

Every color sequence **must** end with `${RESET}`. No exceptions.

### Stage Banners

Mark major stage transitions with a clean bold header. One blank line before and after.

```bash
echo ""
printf '%b\n' "${ORANGE}${BOLD}Stage Name${RESET}"
echo ""
```

### Status Symbols

| Symbol | Meaning          | Color       |
| ------ | ---------------- | ----------- |
| `[*]`  | Active / running | `${CYAN}`   |
| `[x]`  | Completed        | `${GREEN}`  |
| `[!]`  | Error            | `${RED}`    |
| `[-]`  | Skipped          | `${DIM}`    |
| `[>]`  | In progress      | `${YELLOW}` |
| `[ ]`  | Pending          | `${DIM}`    |

```bash
printf '%b\n' "${GREEN}[x]${RESET} Step completed"
printf '%b\n' "${RED}[!]${RESET} Something failed"
```

No emoji in output. Use only these bracket symbols for status.

### Summary Blocks

Display at checkpoints and at the end of the skill. One blank line before and after.

```bash
echo ""
printf '%b\n' "${ORANGE}${BOLD}Title${RESET}"
echo ""
printf '%b\n' "Label: Value"
echo ""
```

### Error Format

```bash
printf '%b\n' "${RED}[!]${RESET} Error message here"
printf '%b\n' "    ${DIM}Recovery guidance here.${RESET}"
```

### Spacing Rules

- One blank line before and after stage banners and summary boxes.
- No blank lines within step lists.
- Maximum output line width: 70 characters.

### Statusline Stage Updates

At the **start** of each stage, update the statusline:

```bash
bash $ECK_HOME/update-stage.sh "{Statusline text from table}"
```

At **skill completion** (success or error), reset:

```bash
bash $ECK_HOME/update-stage.sh
```

---

## Task Registration

| Stage | Subject                         | Active Form               | Statusline    |
| ----- | ------------------------------- | ------------------------- | ------------- |
| 1     | Stage 1: Verify Project Context | Verifying project context | Verify (1/4)  |
| 2     | Stage 2: Parse Configuration    | Parsing configuration     | Parse (2/4)   |
| 3     | Stage 3: Enable Protections     | Enabling protections      | Enable (3/4)  |
| 4     | Stage 4: Confirm Results        | Confirming results        | Confirm (4/4) |

## Usage

```bash
/eck:enable-protections                           # Enable all 4 hooks (session-scoped)
/eck:enable-protections --always-on               # Enable all 4 hooks permanently
/eck:enable-protections --protect-files            # Enable only protect-files
/eck:enable-protections --detect-secrets --hitl-approval  # Enable specific hooks
/eck:enable-protections --dry-run                  # Preview without changes
```

---

## Stage 1: Verify Project Context

### Inputs

- Current working directory
- `.claude/settings.json` (must exist)

### Activities

Confirm we are in a project directory with `.claude/settings.json`:

```bash
ls .claude/settings.json
```

**If not found:**

```bash
source $ECK_HOME/colors.sh

printf '%b\n' "${RED}[!]${RESET} Settings file not found: .claude/settings.json"
printf '%b\n' "    ${DIM}This command only works in project directories with Claude Code infrastructure.${RESET}"
```

### Outputs

- Confirmation that `.claude/settings.json` exists

### Exit Criteria

- `.claude/settings.json` is found, or error is displayed and skill stops

## Stage 2: Parse Configuration

### Inputs

- `$ECK_HOME/global-state.json`

### Activities

Read the current protection state:

```bash
cat $ECK_HOME/global-state.json 2>/dev/null
```

Check if `protectionsEnabled` is already `true`. If so, inform the user and exit early.

### Outputs

- Current value of `protectionsEnabled` flag

### Exit Criteria

- Protection state is read; if already enabled, user is informed and skill exits

## Stage 3: Enable Protections

### Inputs

- `$ECK_HOME/global-state.json`
- `protectionsEnabled` value from Stage 2

### Activities

Set the `protectionsEnabled` flag to `true` in `global-state.json`:

```bash
# Read current state, set protectionsEnabled: true, write back atomically
node -e "
  const fs = require('fs');
  const p = require('path').join(require('os').homedir(), '.claude/evolv-coder-kit/global-state.json');
  const s = JSON.parse(fs.readFileSync(p, 'utf-8'));
  s.protectionsEnabled = true;
  const tmp = p + '.tmp';
  fs.writeFileSync(tmp, JSON.stringify(s, null, 2) + '\n');
  fs.renameSync(tmp, p);
  console.log('protectionsEnabled set to true');
"
```

### Outputs

- `global-state.json` updated with `protectionsEnabled: true`

### Exit Criteria

- Atomic write to `global-state.json` completes without error

## Stage 4: Confirm Results

### Inputs

- Updated `global-state.json` from Stage 3
- Invocation flags (e.g., `--always-on`, specific hook names)

### Activities

Report to the user:

- Protection state is now enabled
- Which hooks are active (protect-files, detect-secrets, hitl-approval, security-gate)
- Hooks are permanently registered — this only flips the runtime flag
- They can disable with `/eck:disable-protections`

### Outputs

Derive the active-hook count from the project `settings.json` rather than
hardcoding it — only safety hooks actually wired in `settings.json` fire when
the flag is on (see issue #89). Count distinct safety hooks present:

```bash
source $ECK_HOME/colors.sh

# Count safety hooks actually wired in the project settings (not hardcoded).
N=$(grep -oE '(protect-files|detect-secrets|hitl-approval|security-gate)\.sh' \
  .claude/settings.json 2>/dev/null | sort -u | wc -l | tr -d ' ')

echo ""
printf '%b\n' "${ORANGE}${BOLD}Enable Protections${RESET}"
echo ""
printf '%b\n' "${GREEN}[x]${RESET} Settings verified"
printf '%b\n' "${GREEN}[x]${RESET} Safety hooks registered (${N} hooks)"
echo ""
printf '%b\n' "State: ${GREEN}Enabled${RESET}"
printf '%b\n' "Scope: {session-scoped/permanent}"
printf '%b\n' "Hooks: ${N} active"
printf '%b\n' "Disable: /eck:disable-protections"
echo ""
```

### Exit Criteria

- Confirmation summary displayed to user
- Statusline reset

---

## Error Handling

Follow the `output:error-handler` primitive for error classification, formatting, and recovery guidance.

---

## Safety Notes

- **Idempotent**: If `protectionsEnabled` is already `true`, no changes are made
- **Flag model**: Hooks are always registered in `settings.json`; this skill only flips the flag in `global-state.json`
- **Atomic writes**: Uses write-to-tmp + rename pattern to prevent corruption
- **Safety hooks**: `protect-files.sh`, `detect-secrets.sh`, `hitl-approval.sh`, `security-gate.sh`
