Merge pull request 'feat: add plugin name prefixes to hooks and improve git-flow sync' (#105) from feat/hook-improvements-and-sync-prune into development

- Add [plugin-name] prefix to all hook messages for better identification
- Make doc-guardian hook notification-only (non-blocking)
- Add stale branch detection to /commit-sync with git fetch --prune
- Enhance /branch-cleanup to handle stale branches separately

Closes improvements for hook UX and git workflow

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -6,12 +6,12 @@
   },
   "metadata": {
     "description": "Project management plugins with Gitea and NetBox integrations",
-    "version": "3.0.1"
+    "version": "3.1.0"
   },
   "plugins": [
     {
       "name": "projman",
-      "version": "3.0.0",
+      "version": "3.1.0",
       "description": "Sprint planning and project management with Gitea integration",
       "source": "./plugins/projman",
       "author": {

CHANGELOG.md

@@ -4,6 +4,64 @@ All notable changes to the Leo Claude Marketplace will be documented in this fil
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [3.1.1] - 2026-01-22
+
+### Added
+- **git-flow:** `/commit-sync` now prunes stale remote-tracking branches with `git fetch --prune`
+- **git-flow:** `/commit-sync` detects and reports local branches with deleted upstreams
+- **git-flow:** `/branch-cleanup` now handles stale branches (upstream gone) separately from merged branches
+- **git-flow:** New `GIT_CLEANUP_STALE` environment variable for stale branch cleanup control
+
+### Changed
+- **All hooks:** Added `[plugin-name]` prefix to all hook messages for better identification
+  - `[projman]`, `[pr-review]`, `[code-sentinel]`, `[doc-guardian]` prefixes
+- **doc-guardian:** Hook now notification-only (no file reads or blocking operations)
+  - Suggests running `/doc-sync` instead of performing inline checks
+  - Significantly reduces workflow interruption
+
+### Fixed
+- doc-guardian hook no longer stalls workflow with deep file analysis
+
+---
+
+## [3.1.0] - 2026-01-21
+
+### Added
+
+#### Debug Workflow Commands (projman)
+- **`/debug-report`** - Run diagnostics in test projects, create structured issues in marketplace
+  - Runs 5 diagnostic MCP tool tests with explicit repo parameter
+  - Captures full project context (git remote, cwd, branch)
+  - Generates structured issue with hypothesis and investigation steps
+  - Creates issue in configured marketplace repository automatically
+
+- **`/debug-review`** - Investigate diagnostic issues with human approval gates
+  - Lists open diagnostic issues for triage
+  - Maps errors to relevant code files using error-to-file mapping
+  - MANDATORY: Reads relevant files before proposing any fix
+  - Three approval gates: investigation summary, fix approach, PR creation
+  - Creates feature branch, commits, and PR with proper linking
+
+#### MCP Server Improvements
+- Dynamic label format detection in `suggest_labels`
+  - Supports slash format (`Type/Bug`) and colon-space format (`Type: Bug`)
+  - Fetches actual labels from repo and matches suggestions to real format
+  - Handles Effort/Efforts singular/plural normalization
+
+### Changed
+- **`/labels-sync`** completely rewritten with explicit execution steps
+  - Step 1 now explicitly requires running `git remote get-url origin` via Bash
+  - All MCP tool calls show required `repo` parameter
+  - Added "DO NOT" section preventing common mistakes
+  - Removed confusing "Label Reference" section that caused file creation prompts
+
+### Fixed
+- MCP tools no longer fail with "Use 'owner/repo' format" error
+  - Root cause: MCP server is sandboxed and cannot auto-detect project directory
+  - Solution: Command documentation now instructs Claude to detect repo via Bash first
+
+---
+
 ## [3.0.1] - 2026-01-21
 
 ### Added

CLAUDE.md

@@ -28,19 +28,23 @@ A plugin marketplace for Claude Code containing:
 # Validate marketplace compliance
 ./scripts/validate-marketplace.sh
 
-# Setup commands (in a target project with plugin installed)
-/initial-setup    # First time: full setup wizard
-/project-init     # New project: quick config
-/project-sync     # After repo move: sync config
-
-# Run projman commands
-/sprint-plan      # Start sprint planning
-/sprint-status    # Check progress
-/review           # Pre-close code quality review
-/test-check       # Verify tests before close
-/sprint-close     # Complete sprint
+# After updates
+./scripts/post-update.sh   # Rebuild venvs, verify symlinks
 ```
 
+### Plugin Commands by Category
+
+| Category | Commands |
+|----------|----------|
+| **Setup** | `/initial-setup`, `/project-init`, `/project-sync` |
+| **Sprint** | `/sprint-plan`, `/sprint-start`, `/sprint-status`, `/sprint-close` |
+| **Quality** | `/review`, `/test-check`, `/test-gen` |
+| **PR Review** | `/pr-review:initial-setup`, `/pr-review:project-init` |
+| **Docs** | `/doc-audit`, `/doc-sync` |
+| **Security** | `/security-scan`, `/refactor`, `/refactor-dry` |
+| **Config** | `/config-analyze`, `/config-optimize` |
+| **Debug** | `/debug-report`, `/debug-review` |
+
 ## Repository Structure
 
 ```
@@ -208,42 +212,47 @@ Stored in Gitea Wiki under `lessons-learned/sprints/`.
 | Document | Purpose |
 |----------|---------|
 | `docs/CANONICAL-PATHS.md` | **Single source of truth** for paths |
-| `docs/COMMANDS-CHEATSHEET.md` | All commands quick reference with workflow examples |
+| `docs/COMMANDS-CHEATSHEET.md` | All commands quick reference |
 | `docs/CONFIGURATION.md` | Centralized setup guide |
+| `docs/DEBUGGING-CHECKLIST.md` | Systematic troubleshooting guide |
 | `docs/UPDATING.md` | Update guide for the marketplace |
-| `plugins/projman/CONFIGURATION.md` | Quick reference (links to central) |
+| `plugins/projman/CONFIGURATION.md` | Projman quick reference (links to central) |
 | `plugins/projman/README.md` | Projman full documentation |
 
-## Versioning and Changelog Rules
+## Installation Paths
 
-### Version Display
-**The marketplace version is displayed ONLY in the main `README.md` title.**
+Understanding where files live is critical for debugging:
 
-- Format: `# Leo Claude Marketplace - vX.Y.Z`
-- Do NOT add version numbers to individual plugin documentation titles
-- Do NOT add version numbers to configuration guides
-- Do NOT add version numbers to CLAUDE.md or other docs
+| Context | Path | Purpose |
+|---------|------|---------|
+| **Source** | `~/claude-plugins-work/` | Development - edit here |
+| **Installed** | `~/.claude/plugins/marketplaces/leo-claude-mktplace/` | Runtime - Claude uses this |
+| **Cache** | `~/.claude/` | Plugin metadata and settings |
 
-### Changelog Maintenance (MANDATORY)
-**`CHANGELOG.md` is the authoritative source for version history.**
+**Key insight:** Edits to source require reinstall/update to take effect at runtime.
 
-When releasing a new version:
-1. Update main `README.md` title with new version
-2. Update `CHANGELOG.md` with:
-   - Version number and date: `## [X.Y.Z] - YYYY-MM-DD`
-   - **Added**: New features, commands, files
-   - **Changed**: Modifications to existing functionality
-   - **Fixed**: Bug fixes
-   - **Removed**: Deleted features, files, deprecated items
-3. Update `marketplace.json` metadata version
-4. Update plugin `plugin.json` versions if plugin-specific changes
+## Debugging & Troubleshooting
 
-### Version Format
-- Follow [Semantic Versioning](https://semver.org/): MAJOR.MINOR.PATCH
-- MAJOR: Breaking changes
-- MINOR: New features, backward compatible
-- PATCH: Bug fixes, minor improvements
+See `docs/DEBUGGING-CHECKLIST.md` for systematic troubleshooting.
+
+**Common Issues:**
+| Symptom | Likely Cause | Fix |
+|---------|--------------|-----|
+| "X MCP servers failed" | Missing venv in installed path | `cd ~/.claude/plugins/marketplaces/leo-claude-mktplace && ./scripts/setup.sh` |
+| MCP tools not available | Symlink broken or venv missing | Run `/debug-report` to diagnose |
+| Changes not taking effect | Editing source, not installed | Reinstall plugin or edit installed path |
+
+**Debug Commands:**
+- `/debug-report` - Run full diagnostics, create issue if needed
+- `/debug-review` - Investigate and propose fixes
+
+## Versioning Rules
+
+- Version displayed ONLY in main `README.md` title: `# Leo Claude Marketplace - vX.Y.Z`
+- `CHANGELOG.md` is authoritative for version history
+- Follow [SemVer](https://semver.org/): MAJOR.MINOR.PATCH
+- On release: Update README title → CHANGELOG → marketplace.json → plugin.json files
 
 ---
 
-**Last Updated:** 2026-01-20
+**Last Updated:** 2026-01-22

README.md

@@ -1,4 +1,4 @@
-# Leo Claude Marketplace - v3.0.1
+# Leo Claude Marketplace - v3.1.1
 
 A collection of Claude Code plugins for project management, infrastructure automation, and development workflows.
 

docs/CANONICAL-PATHS.md

@@ -18,6 +18,7 @@ leo-claude-mktplace/
 │   ├── architecture/           # Draw.io diagrams and specs
 │   ├── CANONICAL-PATHS.md      # This file - single source of truth
 │   ├── CONFIGURATION.md        # Centralized configuration guide
+│   ├── DEBUGGING-CHECKLIST.md  # Systematic troubleshooting guide
 │   ├── UPDATING.md             # Update guide
 │   └── workflows/              # Workflow documentation
 ├── hooks/                      # Shared hooks (if any)
@@ -103,6 +104,10 @@ leo-claude-mktplace/
 │       ├── skills/
 │       └── claude-md-integration.md
 ├── scripts/                    # Setup and maintenance scripts
+│   ├── setup.sh                # Initial setup (create venvs, config templates)
+│   ├── post-update.sh          # Post-update (rebuild venvs, verify symlinks)
+│   ├── check-venv.sh           # Check if venvs exist (for hooks)
+│   └── validate-marketplace.sh # Marketplace compliance validation
 ├── CLAUDE.md
 ├── README.md
 ├── LICENSE
@@ -156,6 +161,7 @@ The symlink target is relative: `../../../mcp-servers/{server}`
 | Update guide | `docs/UPDATING.md` |
 | Configuration guide | `docs/CONFIGURATION.md` |
 | Commands cheat sheet | `docs/COMMANDS-CHEATSHEET.md` |
+| Debugging checklist | `docs/DEBUGGING-CHECKLIST.md` |
 
 ---
 

docs/COMMANDS-CHEATSHEET.md

@@ -20,6 +20,8 @@ Quick reference for all commands in the Leo Claude Marketplace.
 | **projman** | `/project-sync` | | X | Sync config with git remote after repo move/rename |
 | **projman** | *SessionStart hook* | X | | Detects git remote vs .env mismatch, warns to run /project-sync |
 | **projman** | `/test-gen` | | X | Generate comprehensive tests for specified code |
+| **projman** | `/debug-report` | | X | Run diagnostics and create structured issue in marketplace |
+| **projman** | `/debug-review` | | X | Investigate diagnostic issues and propose fixes with approval gates |
 | **git-flow** | `/commit` | | X | Create commit with auto-generated conventional message |
 | **git-flow** | `/commit-push` | | X | Commit and push to remote in one operation |
 | **git-flow** | `/commit-merge` | | X | Commit current changes, then merge into target branch |
@@ -40,7 +42,6 @@ Quick reference for all commands in the Leo Claude Marketplace.
 | **doc-guardian** | `/doc-audit` | | X | Full documentation audit - scans for doc drift |
 | **doc-guardian** | `/doc-sync` | | X | Synchronize pending documentation updates |
 | **doc-guardian** | *PostToolUse hook* | X | | Silently detects doc drift on Write/Edit |
-| **doc-guardian** | *Stop hook* | X | | Offers to sync docs at session end |
 | **code-sentinel** | `/security-scan` | | X | Full security audit (SQL injection, XSS, secrets, etc.) |
 | **code-sentinel** | `/refactor` | | X | Apply refactoring patterns to improve code |
 | **code-sentinel** | `/refactor-dry` | | X | Preview refactoring without applying changes |
@@ -78,7 +79,6 @@ Quick reference for all commands in the Leo Claude Marketplace.
 | **projman** | SessionStart | Checks git remote vs .env; warns if mismatch detected |
 | **pr-review** | SessionStart | Checks git remote vs .env; warns if mismatch detected |
 | **doc-guardian** | PostToolUse (Write/Edit) | Silently tracks documentation drift |
-| **doc-guardian** | Stop | Prompts to sync if drift detected |
 | **code-sentinel** | PreToolUse (Write/Edit) | Scans for security issues; blocks critical vulnerabilities |
 | **project-hygiene** | PostToolUse (Write/Edit) | Cleans temp files, warns about misplaced files |
 
@@ -214,4 +214,4 @@ Ensure credentials are configured in `~/.config/claude/gitea.env` or `~/.config/
 
 ---
 
-*Last Updated: 2026-01-21*
+*Last Updated: 2026-01-22*

docs/DEBUGGING-CHECKLIST.md

@@ -0,0 +1,213 @@
+# Debugging Checklist for Marketplace Troubleshooting
+
+**Purpose:** Systematic approach to diagnose and fix plugin loading issues.
+
+Last Updated: 2026-01-22
+
+---
+
+## Step 1: Identify the Loading Path
+
+Claude Code loads plugins from different locations depending on context:
+
+| Location | Path | When Used |
+|----------|------|-----------|
+| **Source** | `~/claude-plugins-work/` | When developing in this directory |
+| **Installed** | `~/.claude/plugins/marketplaces/leo-claude-mktplace/` | After marketplace install |
+| **Cache** | `~/.claude/` | Plugin metadata, settings |
+
+**Determine which path Claude is using:**
+
+```bash
+# Check if installed marketplace exists
+ls -la ~/.claude/plugins/marketplaces/leo-claude-mktplace/
+
+# Check Claude's current plugin loading
+cat ~/.claude/settings.local.json | grep -A5 "mcpServers"
+```
+
+**Key insight:** If you're editing source but Claude uses installed, your changes won't take effect.
+
+---
+
+## Step 2: Verify Files Exist at Runtime Location
+
+Check the files Claude will actually load:
+
+```bash
+# For installed marketplace
+RUNTIME=~/.claude/plugins/marketplaces/leo-claude-mktplace
+
+# Check MCP server exists
+ls -la $RUNTIME/mcp-servers/gitea/
+ls -la $RUNTIME/mcp-servers/netbox/
+
+# Check plugin manifests
+ls -la $RUNTIME/plugins/projman/.claude-plugin/plugin.json
+ls -la $RUNTIME/plugins/pr-review/.claude-plugin/plugin.json
+
+# Check .mcp.json files
+cat $RUNTIME/plugins/projman/.mcp.json
+```
+
+---
+
+## Step 3: Verify Virtual Environments Exist
+
+**This is the most common failure point after installation.**
+
+MCP servers require Python venvs to exist at the INSTALLED location:
+
+```bash
+RUNTIME=~/.claude/plugins/marketplaces/leo-claude-mktplace
+
+# Check venvs exist
+ls -la $RUNTIME/mcp-servers/gitea/.venv/bin/python
+ls -la $RUNTIME/mcp-servers/netbox/.venv/bin/python
+
+# If missing, create them:
+cd $RUNTIME && ./scripts/setup.sh
+```
+
+**Common error:** "X MCP servers failed to start" = venvs don't exist in installed path.
+
+---
+
+## Step 4: Verify Symlink Resolution
+
+Plugins use symlinks to shared MCP servers. Verify they resolve correctly:
+
+```bash
+RUNTIME=~/.claude/plugins/marketplaces/leo-claude-mktplace
+
+# Check symlinks exist and resolve
+readlink -f $RUNTIME/plugins/projman/mcp-servers/gitea
+readlink -f $RUNTIME/plugins/pr-review/mcp-servers/gitea
+readlink -f $RUNTIME/plugins/cmdb-assistant/mcp-servers/netbox
+
+# Should resolve to:
+# $RUNTIME/mcp-servers/gitea
+# $RUNTIME/mcp-servers/netbox
+```
+
+**If broken:** Symlinks are relative. If directory structure differs, they'll break.
+
+---
+
+## Step 5: Test MCP Server Startup
+
+Manually test if the MCP server can start:
+
+```bash
+RUNTIME=~/.claude/plugins/marketplaces/leo-claude-mktplace
+
+# Test Gitea MCP
+cd $RUNTIME/mcp-servers/gitea
+PYTHONPATH=. .venv/bin/python -c "from mcp_server.server import main; print('OK')"
+
+# Test NetBox MCP
+cd $RUNTIME/mcp-servers/netbox
+PYTHONPATH=. .venv/bin/python -c "from mcp_server.server import main; print('OK')"
+```
+
+**If import fails:** Check requirements.txt installed, check Python version compatibility.
+
+---
+
+## Step 6: Verify Configuration Files
+
+Check environment variables are set:
+
+```bash
+# System-level credentials (should exist)
+cat ~/.config/claude/gitea.env
+# Should contain: GITEA_API_URL, GITEA_API_TOKEN
+
+cat ~/.config/claude/netbox.env
+# Should contain: NETBOX_API_URL, NETBOX_API_TOKEN
+
+# Project-level config (in target project)
+cat /path/to/project/.env
+# Should contain: GITEA_ORG, GITEA_REPO
+```
+
+---
+
+## Step 7: Verify Hooks Configuration
+
+Check hooks are valid:
+
+```bash
+RUNTIME=~/.claude/plugins/marketplaces/leo-claude-mktplace
+
+# List all hooks.json files
+find $RUNTIME/plugins -name "hooks.json" -exec echo "=== {} ===" \; -exec cat {} \;
+
+# Verify hook events are valid
+# Valid: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd,
+#        Notification, Stop, SubagentStop, PreCompact
+# INVALID: task-completed, file-changed, git-commit-msg-needed
+```
+
+---
+
+## Quick Diagnostic Commands
+
+Run these to quickly identify issues:
+
+```bash
+RUNTIME=~/.claude/plugins/marketplaces/leo-claude-mktplace
+
+echo "=== Installation Status ==="
+[ -d "$RUNTIME" ] && echo "Installed: YES" || echo "Installed: NO"
+
+echo -e "\n=== Virtual Environments ==="
+[ -f "$RUNTIME/mcp-servers/gitea/.venv/bin/python" ] && echo "Gitea venv: OK" || echo "Gitea venv: MISSING"
+[ -f "$RUNTIME/mcp-servers/netbox/.venv/bin/python" ] && echo "NetBox venv: OK" || echo "NetBox venv: MISSING"
+
+echo -e "\n=== Symlinks ==="
+[ -L "$RUNTIME/plugins/projman/mcp-servers/gitea" ] && echo "projman->gitea: OK" || echo "projman->gitea: MISSING"
+[ -L "$RUNTIME/plugins/pr-review/mcp-servers/gitea" ] && echo "pr-review->gitea: OK" || echo "pr-review->gitea: MISSING"
+[ -L "$RUNTIME/plugins/cmdb-assistant/mcp-servers/netbox" ] && echo "cmdb-assistant->netbox: OK" || echo "cmdb-assistant->netbox: MISSING"
+
+echo -e "\n=== Config Files ==="
+[ -f ~/.config/claude/gitea.env ] && echo "gitea.env: OK" || echo "gitea.env: MISSING"
+[ -f ~/.config/claude/netbox.env ] && echo "netbox.env: OK" || echo "netbox.env: MISSING"
+```
+
+---
+
+## Common Issues and Fixes
+
+| Issue | Symptom | Fix |
+|-------|---------|-----|
+| Missing venvs | "X MCP servers failed" | `cd ~/.claude/plugins/marketplaces/leo-claude-mktplace && ./scripts/setup.sh` |
+| Broken symlinks | MCP tools not available | Reinstall marketplace or manually recreate symlinks |
+| Wrong path edits | Changes don't take effect | Edit installed path or reinstall after source changes |
+| Missing credentials | MCP connection errors | Create `~/.config/claude/gitea.env` with API credentials |
+| Invalid hook events | Hooks don't fire | Use only valid event names (see Step 7) |
+
+---
+
+## After Fixing Issues
+
+1. **Restart Claude Code** - Plugins are loaded at startup
+2. **Verify fix works** - Run a simple command that uses the MCP
+3. **Document the issue** - If it's a new failure mode, add to this checklist
+
+---
+
+## Automated Diagnostics
+
+Use these commands for automated checking:
+
+- `/debug-report` - Run full diagnostics, create issue if problems found
+- `/debug-review` - Investigate existing diagnostic issues and propose fixes
+
+---
+
+## Related Documentation
+
+- `CLAUDE.md` - Installation Paths and Troubleshooting sections
+- `docs/CONFIGURATION.md` - Setup and configuration guide
+- `docs/UPDATING.md` - Update procedures

docs/UPDATING.md

@@ -4,15 +4,32 @@ This guide covers how to update your local installation when new versions are re
 
 ---
 
-## Quick Update
+## ⚠️ CRITICAL: Run Setup in Installed Location
+
+When Claude Code installs a marketplace, it copies files to `~/.claude/plugins/marketplaces/` but **does NOT create Python virtual environments**. You must run setup manually after installation or update.
+
+**After installing or updating the marketplace:**
 
 ```bash
-# 1. Pull latest changes
+cd ~/.claude/plugins/marketplaces/leo-claude-mktplace && ./scripts/setup.sh
+```
+
+This creates the required `.venv` directories for MCP servers. Without this step, **all MCP servers will fail to start**.
+
+---
+
+## Quick Update (Source Repository)
+
+```bash
+# 1. Pull latest changes to source
 cd /path/to/leo-claude-mktplace
 git pull origin main
 
-# 2. Run post-update script
+# 2. Run post-update script (updates source repo venvs)
 ./scripts/post-update.sh
+
+# 3. CRITICAL: Run setup in installed marketplace location
+cd ~/.claude/plugins/marketplaces/leo-claude-mktplace && ./scripts/setup.sh
 ```
 
 **Then restart your Claude Code session** to load any changes.
@@ -132,10 +149,34 @@ deactivate
 
 ### MCP server won't start after update
 
+**Most common cause:** Virtual environments don't exist in the installed marketplace.
+
+```bash
+# Fix: Run setup in installed location
+cd ~/.claude/plugins/marketplaces/leo-claude-mktplace && ./scripts/setup.sh
+```
+
+If that doesn't work:
+
 1. Check Python version: `python3 --version` (requires 3.10+)
-2. Verify venv exists: `ls mcp-servers/gitea/.venv`
-3. Restart Claude Code session
-4. Check logs for specific errors
+2. Verify venv exists in INSTALLED location:
+   ```bash
+   ls ~/.claude/plugins/marketplaces/leo-claude-mktplace/mcp-servers/gitea/.venv
+   ls ~/.claude/plugins/marketplaces/leo-claude-mktplace/mcp-servers/netbox/.venv
+   ```
+3. If missing, the symlinks won't resolve. Run setup.sh as shown above.
+4. Restart Claude Code session
+5. Check logs for specific errors
+
+### "X MCP servers failed" on startup
+
+This almost always means the venvs don't exist in the installed marketplace:
+
+```bash
+cd ~/.claude/plugins/marketplaces/leo-claude-mktplace && ./scripts/setup.sh
+```
+
+Then restart Claude Code.
 
 ### New commands not available
 

mcp-servers/gitea/mcp_server/server.py

@@ -220,6 +220,10 @@ class GiteaMCPServer:
                             "context": {
                                 "type": "string",
                                 "description": "Issue title + description or sprint context"
+                            },
+                            "repo": {
+                                "type": "string",
+                                "description": "Repository name (owner/repo format)"
                             }
                         },
                         "required": ["context"]

plugins/code-sentinel/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "prompt",
-            "prompt": "SECURITY CHECK - Before writing this code, scan for these patterns:\n\n**Critical (BLOCK if found):**\n- eval(), exec() with user input\n- SQL string concatenation (SQL injection)\n- shell=True with user input (command injection)\n- Hardcoded secrets (API keys, passwords, tokens)\n- Pickle/marshal deserialization of untrusted data\n- innerHTML/dangerouslySetInnerHTML with user content (XSS)\n\n**Warning (WARN but allow):**\n- subprocess without input validation\n- File operations without path sanitization\n- HTTP requests without timeout\n- Broad exception catches (except:)\n- Debug/print statements with sensitive data\n\n**Response:**\n- If CRITICAL found: STOP, explain the issue, suggest safe alternative\n- If WARNING found: Note it briefly, proceed with suggestion\n- If clean: Proceed silently (say nothing)\n\nDo NOT announce clean scans. Only speak if issues found."
+            "prompt": "[code-sentinel] SECURITY CHECK - Before writing this code, scan for these patterns:\n\n**Critical (BLOCK if found):**\n- eval(), exec() with user input\n- SQL string concatenation (SQL injection)\n- shell=True with user input (command injection)\n- Hardcoded secrets (API keys, passwords, tokens)\n- Pickle/marshal deserialization of untrusted data\n- innerHTML/dangerouslySetInnerHTML with user content (XSS)\n\n**Warning (WARN but allow):**\n- subprocess without input validation\n- File operations without path sanitization\n- HTTP requests without timeout\n- Broad exception catches (except:)\n- Debug/print statements with sensitive data\n\n**Response:**\n- If CRITICAL found: STOP with '[code-sentinel] BLOCKED:', explain the issue, suggest safe alternative\n- If WARNING found: Note briefly with '[code-sentinel] WARNING:', proceed with suggestion\n- If clean: Proceed silently (say nothing)\n\nDo NOT announce clean scans. Only speak if issues found."
           }
         ]
       }

plugins/doc-guardian/README.md

@@ -11,10 +11,10 @@ Documentation gets outdated. Functions get renamed, configs change, versions bum
 
 ## Solution
 
-doc-guardian watches your code changes and automatically:
-1. Detects when changes affect documentation
-2. Queues updates silently (doesn't interrupt your flow)
-3. Syncs all doc changes in a single commit when ready
+doc-guardian monitors your code changes via hooks:
+1. Detects when changes might affect documentation
+2. Alerts you to potential drift (doesn't interrupt your flow)
+3. Provides commands to audit and sync docs when ready
 
 ## Commands
 
@@ -25,8 +25,7 @@ doc-guardian watches your code changes and automatically:
 
 ## Hooks
 
-- **PostToolUse (Write\|Edit)**: Silently checks if code changes affect docs
-- **Stop**: Reminds you of pending doc updates before session ends
+- **PostToolUse (Write|Edit)**: Silently checks if code changes affect docs
 
 ## What It Detects
 

plugins/doc-guardian/hooks/hooks.json

@@ -6,18 +6,7 @@
         "hooks": [
           {
             "type": "prompt",
-            "prompt": "A file was just modified. Silently check if this change affects any documentation:\n\n1. If a code file changed: check if README, CLAUDE.md, docstrings, or API docs reference the modified functions/classes/configs\n2. If drift detected: add to internal queue (do NOT interrupt user flow)\n3. At natural breakpoints or when user runs /doc-sync: report pending doc updates\n\nDo NOT announce this check unless drift is found. Work silently."
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "matcher": ".*",
-        "hooks": [
-          {
-            "type": "prompt",
-            "prompt": "Before ending, check if there are pending documentation updates queued by doc-guardian. If yes, ask user: 'I detected documentation drift in X files. Run /doc-sync to update, or skip for now?'"
+            "prompt": "[doc-guardian] QUICK drift check (DO NOT block workflow):\n\n1. ONLY check if the modified file is referenced in README.md, CLAUDE.md, or API docs in the SAME directory\n2. Do NOT read files or perform deep analysis - just note potential drift based on file name/path\n3. If potential drift: output a single line like '[doc-guardian] Note: {filename} changed - may affect {doc}. Run /doc-sync to verify.'\n4. If no obvious drift: say nothing\n\nIMPORTANT: This is notification-only. Do NOT read documentation files, do NOT make changes, do NOT use any tools. Just a quick mental check based on the file path."
           }
         ]
       }

plugins/git-flow/commands/branch-cleanup.md

@@ -1,12 +1,19 @@
-# /branch-cleanup - Clean Merged Branches
+# /branch-cleanup - Clean Merged and Stale Branches
 
 ## Purpose
 
-Remove branches that have been merged, both locally and optionally on remote.
+Remove branches that have been merged OR whose remote tracking branch no longer exists, both locally and optionally on remote.
 
 ## Behavior
 
-### Step 1: Identify Merged Branches
+### Step 1: Prune Remote Refs
+
+```bash
+# Remove stale remote-tracking references
+git fetch --prune
+```
+
+### Step 2: Identify Branches for Cleanup
 
 ```bash
 # Find merged local branches
@@ -14,19 +21,26 @@ git branch --merged <base-branch>
 
 # Find merged remote branches
 git branch -r --merged <base-branch>
+
+# Find local branches with deleted upstreams (stale)
+git branch -vv | grep ': gone]'
 ```
 
-### Step 2: Present Findings
+### Step 3: Present Findings
 
 ```
-Found 5 merged branches:
+Found branches for cleanup:
 
-Local:
+Merged (safe to delete):
   - feat/login-page (merged 3 days ago)
   - fix/typo-header (merged 1 week ago)
   - chore/deps-update (merged 2 weeks ago)
 
-Remote:
+Stale (remote deleted):
+  - feat/old-feature (upstream gone)
+  - fix/already-merged (upstream gone)
+
+Remote (merged into base):
   - origin/feat/login-page
   - origin/fix/typo-header
 
@@ -36,35 +50,40 @@ Protected (won't delete):
   - staging
 
 Delete these branches?
-1. Delete all (local + remote)
-2. Delete local only
-3. Let me pick which ones
-4. Cancel
+1. Delete all (local merged + stale + remote)
+2. Delete merged only (skip stale)
+3. Delete stale only (upstream gone)
+4. Let me pick which ones
+5. Cancel
 ```
 
-### Step 3: Execute Cleanup
+### Step 4: Execute Cleanup
 
 ```bash
-# Delete local
+# Delete merged local branches
 git branch -d <branch-name>
 
-# Delete remote
+# Delete stale local branches (force needed since no upstream)
+git branch -D <stale-branch-name>
+
+# Delete remote branches
 git push origin --delete <branch-name>
 ```
 
-### Step 4: Report
+### Step 5: Report
 
 ```
 Cleanup complete:
 
-Deleted local: 3 branches
+Deleted local (merged): 3 branches
+Deleted local (stale): 2 branches
 Deleted remote: 2 branches
 Skipped: 0 branches
 
 Remaining local branches:
   - main
   - development
-  - feat/current-work (not merged)
+  - feat/current-work (not merged, has upstream)
 ```
 
 ## Environment Variables
@@ -74,20 +93,24 @@ Remaining local branches:
 | `GIT_DEFAULT_BASE` | `development` | Base branch for merge detection |
 | `GIT_PROTECTED_BRANCHES` | `main,master,development,staging,production` | Never delete these |
 | `GIT_AUTO_DELETE_REMOTE` | `false` | Auto-delete remote branches |
+| `GIT_CLEANUP_STALE` | `true` | Include stale branches (upstream gone) in cleanup |
 
 ## Safety
 
 - Never deletes protected branches
-- Warns about unmerged branches
+- Warns about unmerged branches that still have upstreams
 - Confirms before deleting remote branches
-- Uses `-d` (safe delete) not `-D` (force delete)
+- Uses `-d` (safe delete) for merged branches
+- Uses `-D` (force delete) only for stale branches with confirmation
+- Stale branches are highlighted separately for review
 
 ## Output
 
 On success:
 ```
 Cleaned up:
-  Local: 3 branches deleted
+  Local (merged): 3 branches deleted
+  Local (stale): 2 branches deleted
   Remote: 2 branches deleted
 
 Repository is tidy!

plugins/git-flow/commands/commit-sync.md

@@ -2,7 +2,7 @@
 
 ## Purpose
 
-Full sync operation: commit local changes, push to remote, and sync with upstream/base branch.
+Full sync operation: commit local changes, push to remote, sync with upstream/base branch, and clean up stale remote-tracking branches.
 
 ## Behavior
 
@@ -19,8 +19,8 @@ Push committed changes to remote branch.
 Pull latest from base branch and rebase/merge:
 
 ```bash
-# Fetch all
-git fetch --all
+# Fetch all with prune (removes stale remote-tracking refs)
+git fetch --all --prune
 
 # Rebase on base branch
 git rebase origin/<base-branch>
@@ -29,7 +29,26 @@ git rebase origin/<base-branch>
 git push --force-with-lease
 ```
 
-### Step 4: Report Status
+### Step 4: Detect Stale Local Branches
+
+Check for local branches tracking deleted remotes:
+
+```bash
+# Find local branches with gone upstreams
+git branch -vv | grep ': gone]'
+```
+
+If stale branches found, report them:
+
+```
+Stale local branches (remote deleted):
+  - feat/old-feature (was tracking origin/feat/old-feature)
+  - fix/merged-bugfix (was tracking origin/fix/merged-bugfix)
+
+Run /branch-cleanup to remove these branches.
+```
+
+### Step 5: Report Status
 
 ```
 Sync complete:
@@ -40,6 +59,10 @@ Base:   development @ xyz7890 (synced)
 
 Your branch is up-to-date with development.
 No conflicts detected.
+
+Cleanup:
+  Remote refs pruned: 2
+  Stale local branches: 2 (run /branch-cleanup to remove)
 ```
 
 ## Environment Variables
@@ -48,6 +71,7 @@ No conflicts detected.
 |----------|---------|-------------|
 | `GIT_DEFAULT_BASE` | `development` | Branch to sync with |
 | `GIT_SYNC_STRATEGY` | `rebase` | How to incorporate upstream changes |
+| `GIT_AUTO_PRUNE` | `true` | Auto-prune stale remote refs on sync |
 
 ## Conflict Handling
 
@@ -76,4 +100,5 @@ Pushed to: origin/feat/password-reset
 Synced with: development (xyz7890)
 
 Status: Clean, up-to-date
+Stale branches: None (or N found - run /branch-cleanup)
 ```

plugins/pr-review/.mcp.json

@@ -3,7 +3,10 @@
     "gitea": {
       "command": "${CLAUDE_PLUGIN_ROOT}/mcp-servers/gitea/.venv/bin/python",
       "args": ["-m", "mcp_server.server"],
-      "cwd": "${CLAUDE_PLUGIN_ROOT}/mcp-servers/gitea"
+      "cwd": "${CLAUDE_PLUGIN_ROOT}/mcp-servers/gitea",
+      "env": {
+        "PYTHONPATH": "${CLAUDE_PLUGIN_ROOT}/mcp-servers/gitea"
+      }
     }
   }
 }

plugins/pr-review/hooks/hooks.json

@@ -1,14 +1,9 @@
 {
   "hooks": {
     "SessionStart": [
-      {
-        "matcher": ".*",
-        "hooks": [
       {
         "type": "prompt",
-            "prompt": "Silently check if the project's git remote matches the .env configuration:\n\n1. Read .env to get GITEA_ORG and GITEA_REPO values\n2. Run: git remote get-url origin\n3. Extract org and repo from the remote URL\n4. Compare with .env values\n\nIf mismatch detected:\n- Display a brief warning: 'Repository location mismatch detected. Git remote shows <org>/<repo> but .env has <old-org>/<old-repo>. Run /project-sync to update.'\n\nIf match or no .env exists: Stay silent, do not interrupt.\n\nThis check should be quick and non-blocking."
-          }
-        ]
+        "prompt": "[pr-review] Perform silent startup checks:\n\n1. Check if MCP venvs exist at the installed marketplace location. If the marketplace is installed but venvs are missing, warn the user: '[pr-review] MCP venvs missing - run setup.sh from installed marketplace location'.\n\n2. Check if the project git remote matches .env configuration (GITEA_ORG/GITEA_REPO). If mismatch, warn: '[pr-review] Git remote mismatch - run /project-sync'.\n\nStay silent if all checks pass or not applicable. Be quick and non-blocking."
       }
     ]
   }

plugins/projman/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "projman",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "Sprint planning and project management with Gitea integration",
   "author": {
     "name": "Leo Miranda",

plugins/projman/README.md

@@ -178,7 +178,9 @@ Sync configuration with current git remote.
 
 **When to use:** After moving or renaming a repository
 
-**Note:** A SessionStart hook automatically detects mismatches and warns you to run `/project-sync`.
+**Note:** A SessionStart hook automatically checks for:
+1. Missing MCP venvs at the installed marketplace location (warns to run setup.sh)
+2. Repository config mismatches (warns to run `/project-sync`)
 
 ### `/review`
 Pre-sprint-close code quality review.
@@ -232,6 +234,39 @@ Generate tests for specified code.
 
 **When to use:** When adding new code that needs test coverage
 
+## Debug Workflow Commands
+
+These commands enable a cross-repository debugging workflow between your project and the marketplace.
+
+### `/debug-report`
+Run diagnostics and create structured issue in marketplace repository.
+
+**What it does:**
+- Runs MCP tool diagnostics (validate_repo_org, get_labels, list_issues, etc.)
+- Captures error messages and hypothesis
+- Creates a structured issue in the marketplace repository
+- Tags with `Source: Diagnostic` label
+
+**When to use:** When MCP tools fail in your project, run this to report the issue to the marketplace for investigation.
+
+### `/debug-review`
+Investigate diagnostic issues and propose fixes with human approval.
+
+**What it does:**
+- Fetches open diagnostic issues from marketplace
+- Lets you select which issue to investigate
+- Maps errors to relevant source files
+- Reads code and analyzes root cause
+- Proposes fixes with THREE mandatory approval gates
+- Creates PR with fix after approval
+
+**Approval Gates:**
+1. Analysis confirmation - Does the investigation match your understanding?
+2. Fix approach - Proceed with proposed changes?
+3. PR creation - Create pull request?
+
+**When to use:** In the marketplace repo, to investigate and fix issues reported by `/debug-report`.
+
 ## Code Quality Commands
 
 The `/review` and `/test-check` commands complement the Executor agent by catching issues before work is marked complete. Run both commands before `/sprint-close` for a complete quality check.
@@ -447,9 +482,13 @@ projman/
 │   ├── sprint-close.md
 │   ├── labels-sync.md
 │   ├── initial-setup.md
+│   ├── project-init.md
+│   ├── project-sync.md
 │   ├── review.md
 │   ├── test-check.md
-│   └── test-gen.md
+│   ├── test-gen.md
+│   ├── debug-report.md
+│   └── debug-review.md
 ├── agents/                  # Agent prompts
 │   ├── planner.md
 │   ├── orchestrator.md

plugins/projman/commands/debug-report.md

@@ -0,0 +1,342 @@
+---
+description: Run diagnostics and create structured issue in marketplace repository
+---
+
+# Debug Report
+
+Run diagnostic checks on projman MCP tools and create a structured issue in the marketplace repository for investigation.
+
+## Prerequisites
+
+Your project `.env` must have:
+
+```env
+PROJMAN_MARKETPLACE_REPO=personal-projects/leo-claude-mktplace
+```
+
+If not configured, ask the user for the marketplace repository path.
+
+## CRITICAL: Execution Steps
+
+You MUST follow these steps in order. Do NOT skip any step.
+
+### Step 1: Gather Project Context
+
+Run these Bash commands to capture project information:
+
+```bash
+# Get git remote URL
+git remote get-url origin
+
+# Get current branch
+git branch --show-current
+
+# Get working directory
+pwd
+```
+
+Parse the git remote to extract `REPO_NAME` in `owner/repo` format.
+
+Store all values:
+- `PROJECT_REPO`: The detected owner/repo
+- `GIT_REMOTE`: Full git remote URL
+- `CURRENT_BRANCH`: Current branch name
+- `WORKING_DIR`: Current working directory
+
+### Step 2: Read Marketplace Configuration
+
+```bash
+grep PROJMAN_MARKETPLACE_REPO .env
+```
+
+Store as `MARKETPLACE_REPO`. If not found, ask the user.
+
+### Step 3: Run Diagnostic Suite
+
+Run each MCP tool with explicit `repo` parameter. Record success/failure and full response.
+
+**Test 1: validate_repo_org**
+```
+mcp__plugin_projman_gitea__validate_repo_org(repo=PROJECT_REPO)
+```
+Expected: `{is_organization: true/false}`
+
+**Test 2: get_labels**
+```
+mcp__plugin_projman_gitea__get_labels(repo=PROJECT_REPO)
+```
+Expected: `{organization: [...], repository: [...], total_count: N}`
+
+**Test 3: list_issues**
+```
+mcp__plugin_projman_gitea__list_issues(repo=PROJECT_REPO, state="open")
+```
+Expected: Array of issues
+
+**Test 4: list_milestones**
+```
+mcp__plugin_projman_gitea__list_milestones(repo=PROJECT_REPO)
+```
+Expected: Array of milestones
+
+**Test 5: suggest_labels**
+```
+mcp__plugin_projman_gitea__suggest_labels(context="Test bug fix for authentication")
+```
+Expected: Array of label names matching repo's format
+
+For each test, record:
+- Tool name
+- Exact parameters used
+- Status: PASS or FAIL
+- Response or error message
+
+### Step 4: Analyze Results
+
+Count failures and categorize errors:
+
+| Category | Indicators |
+|----------|------------|
+| Parameter Format | "owner/repo format", "missing parameter" |
+| Authentication | "401", "403", "unauthorized" |
+| Not Found | "404", "not found" |
+| Network | "connection", "timeout", "ECONNREFUSED" |
+| Logic | Unexpected response format, wrong data |
+
+For each failure, write a hypothesis about the likely cause.
+
+### Step 5: Generate Issue Content
+
+Use this exact template:
+
+```markdown
+## Diagnostic Report
+
+**Generated**: [ISO timestamp]
+**Command Tested**: [What the user was trying to run, or "general diagnostic"]
+**Reporter**: Claude Code via /debug-report
+
+## Project Context
+
+| Field | Value |
+|-------|-------|
+| Repository | `[PROJECT_REPO]` |
+| Git Remote | `[GIT_REMOTE]` |
+| Working Directory | `[WORKING_DIR]` |
+| Current Branch | `[CURRENT_BRANCH]` |
+
+## Diagnostic Results
+
+### Test 1: validate_repo_org
+
+**Call**: `validate_repo_org(repo="[PROJECT_REPO]")`
+**Status**: [PASS/FAIL]
+**Response**:
+```json
+[full response or error]
+```
+
+### Test 2: get_labels
+
+**Call**: `get_labels(repo="[PROJECT_REPO]")`
+**Status**: [PASS/FAIL]
+**Response**:
+```json
+[full response or error - truncate if very long]
+```
+
+[... repeat for each test ...]
+
+## Summary
+
+- **Total Tests**: 5
+- **Passed**: [N]
+- **Failed**: [N]
+
+### Failed Tools
+
+[List each failed tool with its error]
+
+### Error Category
+
+[Check applicable categories]
+
+### Hypothesis
+
+[Your analysis of what's wrong and why]
+
+### Suggested Investigation
+
+1. [First file/function to check]
+2. [Second file/function to check]
+3. [etc.]
+
+## Reproduction Steps
+
+1. Navigate to `[WORKING_DIR]`
+2. Run `[command that was being tested]`
+3. Observe error at step [X]
+
+---
+
+*Generated by /debug-report - Labels: Type: Bug, Source: Diagnostic, Agent: Claude*
+```
+
+### Step 6: Create Issue in Marketplace
+
+**First, check if MCP tools are available.** Attempt to use an MCP tool. If you receive "tool not found", "not in function list", or similar error, the MCP server is not accessible in this session - use the curl fallback.
+
+#### Option A: MCP Available (preferred)
+
+```
+mcp__plugin_projman_gitea__create_issue(
+  repo=MARKETPLACE_REPO,
+  title="[Diagnostic] [summary of main failure]",
+  body=[generated content from Step 5],
+  labels=["Type: Bug", "Source: Diagnostic", "Agent: Claude"]
+)
+```
+
+If labels don't exist, create issue without labels.
+
+#### Option B: MCP Unavailable - Use curl Fallback
+
+If MCP tools are not available (the very issue you may be diagnosing), use this fallback:
+
+**1. Check for Gitea credentials:**
+
+```bash
+if [[ -f ~/.config/claude/gitea.env ]]; then
+  source ~/.config/claude/gitea.env
+  echo "Credentials found. API URL: $GITEA_API_URL"
+else
+  echo "No credentials at ~/.config/claude/gitea.env"
+fi
+```
+
+**2. If credentials exist, create issue via curl with proper JSON escaping:**
+
+Create secure temp files and save content:
+
+```bash
+# Create temp files with restrictive permissions
+DIAG_TITLE=$(mktemp -p /tmp -m 600 diag-title.XXXXXX)
+DIAG_BODY=$(mktemp -p /tmp -m 600 diag-body.XXXXXX)
+DIAG_PAYLOAD=$(mktemp -p /tmp -m 600 diag-payload.XXXXXX)
+
+# Save title
+echo "[Diagnostic] [summary of main failure]" > "$DIAG_TITLE"
+
+# Save body (paste Step 5 content) - heredoc delimiter prevents shell expansion
+cat > "$DIAG_BODY" << 'DIAGNOSTIC_EOF'
+[Paste the full issue content from Step 5 here]
+DIAGNOSTIC_EOF
+```
+
+Construct JSON safely using jq's --rawfile (avoids command substitution):
+
+```bash
+# Build JSON payload using jq with --rawfile for safe content handling
+jq -n \
+  --rawfile title "$DIAG_TITLE" \
+  --rawfile body "$DIAG_BODY" \
+  '{title: ($title | rtrimstr("\n")), body: $body}' > "$DIAG_PAYLOAD"
+
+# Create issue using the JSON file
+curl -s -X POST "${GITEA_API_URL}/repos/${MARKETPLACE_REPO}/issues" \
+  -H "Authorization: token ${GITEA_API_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -d @"$DIAG_PAYLOAD" | jq '.html_url // .'
+
+# Secure cleanup
+rm -f "$DIAG_TITLE" "$DIAG_BODY" "$DIAG_PAYLOAD"
+```
+
+**3. If no credentials found, save report locally:**
+
+```bash
+REPORT_FILE=$(mktemp -p /tmp -m 600 diagnostic-report-XXXXXX.md)
+cat > "$REPORT_FILE" << 'DIAGNOSTIC_EOF'
+[Paste the full issue content from Step 5 here]
+DIAGNOSTIC_EOF
+echo "Report saved to: $REPORT_FILE"
+```
+
+Then inform the user:
+
+```
+MCP tools are unavailable and no Gitea credentials found at ~/.config/claude/gitea.env.
+
+Diagnostic report saved to: [REPORT_FILE]
+
+To create the issue manually:
+1. Configure credentials: See docs/CONFIGURATION.md
+2. Or create issue directly at: http://gitea.hotserv.cloud/[MARKETPLACE_REPO]/issues/new
+```
+
+### Step 7: Report to User
+
+Display summary:
+
+```
+Debug Report Complete
+=====================
+
+Project: [PROJECT_REPO]
+Tests Run: 5
+Passed: [N]
+Failed: [N]
+
+Failed Tools:
+  - [tool1]: [brief error]
+  - [tool2]: [brief error]
+
+Issue Created: [issue URL]
+
+Next Steps:
+  1. Switch to marketplace repo: cd [marketplace path]
+  2. Run: /debug-review
+  3. Select issue #[N] to investigate
+```
+
+## DO NOT
+
+- **DO NOT** attempt to fix anything - only report
+- **DO NOT** create issues if all tests pass (just report success)
+- **DO NOT** skip any diagnostic test
+- **DO NOT** call MCP tools without the `repo` parameter
+- **DO NOT** ask user questions during execution - run autonomously
+
+## If All Tests Pass
+
+If all 5 tests pass, report success without creating an issue:
+
+```
+Debug Report Complete
+=====================
+
+Project: [PROJECT_REPO]
+Tests Run: 5
+Passed: 5
+Failed: 0
+
+All diagnostics passed. No issues to report.
+
+If you're experiencing a specific problem, please describe it
+and I can create a manual bug report.
+```
+
+## Troubleshooting
+
+**PROJMAN_MARKETPLACE_REPO not configured**
+- Ask user: "What is the marketplace repository? (e.g., personal-projects/leo-claude-mktplace)"
+- Store for this session and remind user to add to .env
+
+**Cannot detect project repository**
+- Check if in a git repository: `git rev-parse --git-dir`
+- If not a git repo, ask user for the repository path
+
+**MCP tools not available**
+- Use the curl fallback in Step 6, Option B
+- Requires Gitea credentials at `~/.config/claude/gitea.env`
+- If no credentials, report will be saved locally for manual submission

plugins/projman/commands/debug-review.md

@@ -0,0 +1,394 @@
+---
+description: Investigate diagnostic issues and propose fixes with human approval
+---
+
+# Debug Review
+
+Investigate diagnostic issues created by `/debug-report`, read relevant code, and propose fixes with human approval at each step.
+
+## CRITICAL: This Command Requires Human Approval
+
+This command has THREE mandatory approval gates. You MUST stop and wait for user confirmation at each gate before proceeding.
+
+## Execution Steps
+
+### Step 1: Detect Repository
+
+Run Bash to get the current repository:
+
+```bash
+git remote get-url origin
+```
+
+Parse to extract `REPO_NAME` in `owner/repo` format.
+
+### Step 2: Fetch Diagnostic Issues
+
+```
+mcp__plugin_projman_gitea__list_issues(
+  repo=REPO_NAME,
+  state="open",
+  labels=["Source: Diagnostic"]
+)
+```
+
+If no issues with that label, try without label filter and look for issues with "[Diagnostic]" in title.
+
+### Step 3: Display Issue List
+
+Show the user available issues:
+
+```
+Debug Review
+============
+
+Open Diagnostic Issues:
+
+  #80 - [Diagnostic] get_labels fails without repo parameter
+        Created: 2026-01-21 | Labels: Type: Bug, Source: Diagnostic
+
+  #77 - [Diagnostic] MCP tools require explicit repo parameter
+        Created: 2026-01-21 | Labels: Type: Bug, Source: Diagnostic
+
+No diagnostic issues? Showing recent bugs:
+
+  #75 - [Bug] Some other issue
+        Created: 2026-01-20
+```
+
+### Step 4: User Selects Issue
+
+Use AskUserQuestion:
+
+```
+Which issue would you like to investigate?
+Options: [List issue numbers]
+```
+
+Wait for user selection.
+
+### Step 5: Fetch Full Issue Details
+
+```
+mcp__plugin_projman_gitea__get_issue(repo=REPO_NAME, issue_number=SELECTED)
+```
+
+### Step 6: Parse Diagnostic Report
+
+Extract from the issue body:
+
+1. **Failed Tools**: Which MCP tools failed
+2. **Error Messages**: Exact error text
+3. **Hypothesis**: Reporter's analysis
+4. **Suggested Investigation**: Files to check
+5. **Project Context**: Repo, branch, cwd where error occurred
+
+If the issue doesn't follow the diagnostic template, extract what information is available.
+
+### Step 7: Map Errors to Code Files
+
+Use this mapping to identify relevant files:
+
+**By Tool Name:**
+| Tool | Primary Files |
+|------|---------------|
+| `validate_repo_org` | `mcp-servers/gitea/mcp_server/gitea_client.py` |
+| `get_labels` | `mcp-servers/gitea/mcp_server/tools/labels.py` |
+| `suggest_labels` | `mcp-servers/gitea/mcp_server/tools/labels.py` |
+| `list_issues` | `mcp-servers/gitea/mcp_server/tools/issues.py` |
+| `create_issue` | `mcp-servers/gitea/mcp_server/tools/issues.py` |
+| `list_milestones` | `mcp-servers/gitea/mcp_server/gitea_client.py` |
+
+**By Error Pattern:**
+| Error Contains | Check Files |
+|----------------|-------------|
+| "owner/repo format" | `config.py`, `gitea_client.py` |
+| "404" + "orgs" | `gitea_client.py` (is_org_repo method) |
+| "401", "403" | `config.py` (token loading) |
+| "No repository" | Command `.md` file (repo detection step) |
+
+**By Command:**
+| Command | Documentation File |
+|---------|-------------------|
+| `/labels-sync` | `plugins/projman/commands/labels-sync.md` |
+| `/sprint-plan` | `plugins/projman/commands/sprint-plan.md` |
+| `/sprint-start` | `plugins/projman/commands/sprint-start.md` |
+| `/debug-report` | `plugins/projman/commands/debug-report.md` |
+
+### Step 8: Read Relevant Files (MANDATORY)
+
+You MUST read the identified files before proposing any fix.
+
+For each relevant file:
+1. Read the file using the Read tool
+2. Find the specific function/method mentioned in the error
+3. Understand the code path that leads to the error
+4. Note any related code that might be affected
+
+Display snippets of relevant code to the user:
+
+```
+Reading relevant files...
+
+┌─ mcp-servers/gitea/mcp_server/tools/labels.py (lines 29-40) ────────┐
+│                                                                      │
+│ async def get_labels(self, repo: Optional[str] = None):              │
+│     target_repo = repo or self.gitea.repo                            │
+│     if not target_repo or '/' not in target_repo:                    │
+│         raise ValueError("Use 'owner/repo' format...")               │
+│                                                                      │
+└──────────────────────────────────────────────────────────────────────┘
+```
+
+### Step 9: Present Investigation Summary
+
+Summarize what you found:
+
+```
+Investigation Summary
+=====================
+
+ISSUE: #80 - get_labels fails without repo parameter
+
+FAILED TOOLS:
+  • get_labels - "Use 'owner/repo' format"
+
+CODE ANALYSIS:
+
+1. labels.py:get_labels() requires repo parameter
+   - Line 30: `target_repo = repo or self.gitea.repo`
+   - Line 31-32: Raises ValueError if no repo
+
+2. labels-sync.md documents Step 1 for repo detection
+   - Lines 13-26: Instructs to run `git remote get-url origin`
+   - This step may not be followed by executing Claude
+
+ROOT CAUSE HYPOTHESIS:
+
+The command documentation (labels-sync.md) correctly instructs
+repo detection, but the executing Claude may be skipping Step 1
+and calling MCP tools directly.
+
+Evidence:
+  • Error indicates repo parameter was not passed
+  • labels-sync.md has correct instructions
+  • MCP server cannot auto-detect (sandboxed environment)
+
+LIKELY FIX:
+
+Option A: Make Step 1 more prominent in labels-sync.md
+Option B: Add validation that repo was detected before proceeding
+Option C: [Other based on analysis]
+```
+
+## APPROVAL GATE 1
+
+```
+Does this analysis match your understanding of the problem?
+
+[Y] Yes, proceed to propose fix
+[N] No, let me clarify
+[R] Read more files first
+```
+
+**STOP HERE AND WAIT FOR USER RESPONSE**
+
+Do NOT proceed until user approves.
+
+### Step 10: Propose Fix Approach
+
+Based on the analysis, propose a specific fix:
+
+```
+Proposed Fix
+============
+
+APPROACH: [A/B/C from above]
+
+CHANGES NEEDED:
+
+1. File: plugins/projman/commands/labels-sync.md
+   Change: Add warning box after Step 1 emphasizing repo must be detected
+
+2. File: [if applicable]
+   Change: [description]
+
+RATIONALE:
+
+[Explain why this fix addresses the root cause]
+
+RISKS:
+
+[Any potential issues with this approach]
+```
+
+## APPROVAL GATE 2
+
+```
+Proceed with this fix approach?
+
+[Y] Yes, implement it
+[N] No, try different approach
+[M] Modify the approach (tell me what to change)
+```
+
+**STOP HERE AND WAIT FOR USER RESPONSE**
+
+Do NOT implement until user approves.
+
+### Step 11: Implement Fix
+
+Only after user approves:
+
+1. Create feature branch:
+```bash
+git checkout -b fix/issue-[NUMBER]-[brief-description]
+```
+
+2. Make the code changes using Edit tool
+
+3. Run relevant tests if they exist:
+```bash
+cd mcp-servers/gitea && .venv/bin/python -m pytest tests/ -v
+```
+
+4. Show the changes to user:
+```bash
+git diff
+```
+
+### Step 12: Present Changes
+
+```
+Changes Implemented
+===================
+
+Branch: fix/issue-80-labels-sync-instructions
+
+Files Modified:
+  • plugins/projman/commands/labels-sync.md (+15, -3)
+
+Diff Summary:
+[Show git diff output]
+
+Test Results:
+  • 23 passed, 0 failed (or N/A if no tests)
+```
+
+## APPROVAL GATE 3
+
+```
+Create PR with these changes?
+
+[Y] Yes, create PR
+[N] No, I want to modify something
+[D] Discard changes
+```
+
+**STOP HERE AND WAIT FOR USER RESPONSE**
+
+Do NOT create PR until user approves.
+
+### Step 13: Create PR
+
+Only after user approves:
+
+1. Commit changes:
+```bash
+git add -A
+git commit -m "fix: [description]
+
+[Longer explanation]
+
+Fixes #[ISSUE_NUMBER]
+
+Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>"
+```
+
+2. Push branch:
+```bash
+git push -u origin fix/issue-[NUMBER]-[brief-description]
+```
+
+3. Create PR via API or MCP tools
+
+4. **Switch back to development branch** (required for MCP issue operations):
+```bash
+git checkout development
+```
+
+5. Add comment to original issue:
+```
+mcp__plugin_projman_gitea__add_comment(
+  repo=REPO_NAME,
+  issue_number=ISSUE_NUMBER,
+  comment="Fix proposed in PR #[PR_NUMBER]\n\nChanges:\n- [summary]\n\nPlease test after merge and report back."
+)
+```
+
+### Step 14: Report Completion
+
+```
+Debug Review Complete
+=====================
+
+Issue: #80 - get_labels fails without repo parameter
+Status: Fix Proposed
+
+PR Created: #81 - fix: improve labels-sync repo detection instructions
+URL: http://gitea.hotserv.cloud/.../pulls/81
+
+Next Steps:
+  1. Review and merge PR #81
+  2. In test project, pull latest plugin version
+  3. Run /debug-report to verify fix
+  4. If passing, close issue #80
+```
+
+## DO NOT
+
+- **DO NOT** skip reading relevant files - this is MANDATORY
+- **DO NOT** proceed past approval gates without user confirmation
+- **DO NOT** guess at fixes without evidence from code
+- **DO NOT** close issues - let user verify fix works first
+- **DO NOT** commit directly to development or main branches
+
+## If Investigation Finds No Bug
+
+Sometimes investigation reveals the issue is:
+- User error (didn't follow documented steps)
+- Configuration issue (missing .env vars)
+- Already fixed in a newer version
+
+In this case:
+
+```
+Investigation Summary
+=====================
+
+FINDING: This does not appear to be a code bug.
+
+ANALYSIS:
+[Explanation of what you found]
+
+RECOMMENDATION:
+[ ] Close issue as "not a bug" - user error
+[ ] Close issue as "duplicate" of #[X]
+[ ] Add documentation to prevent confusion
+[ ] Other: [specify]
+
+Would you like me to add a comment explaining this finding?
+```
+
+## Error-to-File Quick Reference
+
+```
+Error Message                    → File to Check
+─────────────────────────────────────────────────────────────────
+"Use 'owner/repo' format"        → config.py, gitea_client.py
+"404 Client Error.*orgs"         → gitea_client.py (_is_organization)
+"No repository specified"        → Command .md file (Step 1)
+"401 Unauthorized"               → config.py (token loading)
+"labels not found"               → labels.py, gitea_client.py
+"create local.*file"             → Command .md file (DO NOT section)
+```

plugins/projman/hooks/hooks.json

@@ -1,14 +1,9 @@
 {
   "hooks": {
     "SessionStart": [
-      {
-        "matcher": ".*",
-        "hooks": [
       {
         "type": "prompt",
-            "prompt": "Silently check if the project's git remote matches the .env configuration:\n\n1. Read .env to get GITEA_ORG and GITEA_REPO values\n2. Run: git remote get-url origin\n3. Extract org and repo from the remote URL\n4. Compare with .env values\n\nIf mismatch detected:\n- Display a brief warning: 'Repository location mismatch detected. Git remote shows <org>/<repo> but .env has <old-org>/<old-repo>. Run /project-sync to update.'\n\nIf match or no .env exists: Stay silent, do not interrupt.\n\nThis check should be quick and non-blocking."
-          }
-        ]
+        "prompt": "[projman] Perform silent startup checks:\n\n1. Check if MCP venvs exist at the installed marketplace location. If the marketplace is installed but venvs are missing, warn the user: '[projman] MCP venvs missing - run setup.sh from installed marketplace location'.\n\n2. Check if the project git remote matches .env configuration (GITEA_ORG/GITEA_REPO). If mismatch, warn: '[projman] Git remote mismatch - run /project-sync'.\n\nStay silent if all checks pass or not applicable. Be quick and non-blocking."
       }
     ]
   }

scripts/check-venv.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+#
+# check-venv.sh - Check if MCP server venvs exist in installed marketplace
+#
+# Usage: ./scripts/check-venv.sh
+#
+# Exit codes:
+#   0 - All venvs exist (or not installed via marketplace)
+#   1 - Venvs missing, needs setup
+#
+# This script is designed to be called from SessionStart hooks
+# to enable self-healing MCP server setup.
+
+set -euo pipefail
+
+# Installed marketplace location
+MKTPLACE="$HOME/.claude/plugins/marketplaces/leo-claude-mktplace"
+
+# If not installed via marketplace, exit silently
+if [[ ! -d "$MKTPLACE" ]]; then
+    exit 0
+fi
+
+# Check if gitea venv exists
+if [[ ! -f "$MKTPLACE/mcp-servers/gitea/.venv/bin/python" ]]; then
+    echo "SETUP_NEEDED"
+    exit 1
+fi
+
+# Check if netbox venv exists
+if [[ ! -f "$MKTPLACE/mcp-servers/netbox/.venv/bin/python" ]]; then
+    echo "SETUP_NEEDED"
+    exit 1
+fi
+
+# All good
+exit 0