Add Claude Code plugin for Overwatch

[abhisheksoamj]

Summary

• Two-plugin marketplace (overwatch-mac, overwatch-windows) routing Claude Code hook events to Cerberus (/v1/hooks/evaluate?format=ide).
• Wires PreToolUse (matcher .*), PostToolUse (matcher .*), UserPromptSubmit, SessionStart, Stop, Notification.
• Fail-open on missing HIGHFLAME_API_KEY or network failure.

Test plan

• /plugin marketplace add file:///absolute/path/to/overwatch-claude-code + /plugin install overwatch-mac in Claude Code
• Set HIGHFLAME_API_KEY (and HIGHFLAME_URL for local Cerberus); trigger a tool call; confirm PreToolUse + PostToolUse POSTs land on the backend
• Unset HIGHFLAME_API_KEY; confirm hook exits 0 silently (fail-open)
• Windows: install overwatch-windows, verify .ps1 executes and posts to Cerberus

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces the Highflame Overwatch plugin for Claude Code, providing hook adapters for macOS, Linux, and Windows to route security events to the Cerberus backend. Feedback suggests handling empty stdin in the shell script to prevent invalid JSON and reducing network timeouts in both the shell and PowerShell scripts to improve CLI responsiveness.

[gemini-code-assist]

If stdin is empty, the payload variable will be empty, which results in invalid JSON being constructed on line 33 (e.g., ...,"payload":}). While Claude Code hooks typically provide a payload, it's safer to handle the empty case explicitly to ensure the request to Cerberus is always valid JSON, as is done in the PowerShell version.

Suggested change

	payload=$(cat)
	payload=$(cat)
	[ -z "$payload" ] && payload="{}"

[gemini-code-assist]

Similar to the shell script, a 10-second timeout for a blocking IDE hook can negatively impact the user experience during network latency. Reducing -TimeoutSec to 2 or 3 seconds is recommended for a more responsive feel.

    $resp = Invoke-WebRequest `
        -Uri "$BaseUrl/v1/hooks/evaluate?format=ide" `
        -Method Post `
        -TimeoutSec 2 `
        -Headers @{ "Authorization" = "Bearer $ApiKey" } `
        -ContentType "application/json" `
        -Body $body `
        -UseBasicParsing

[abhisheksoamj]

Addressed the review feedback in 0a1afe2:

• highflame-hook.sh: default empty stdin payload to {} (matches .ps1 behavior)
• highflame-hook.sh and highflame-hook.ps1: reduced HTTP timeout from 10s to 3s. Picked 3s over the suggested 2s to give legitimate Cerberus evaluations some headroom while still staying well under a noticeable UI stall.