@cratis/pi 7.99.0 → 7.101.0

package/package/corpus/agents/backend-developer.md

@@ -12,6 +12,7 @@ tools:
   - Bash
   - Edit
   - Write
+modelTier: scoped
 ---
 
 # Backend Developer

package/package/corpus/agents/browser-operator.md

@@ -0,0 +1,44 @@
+---
+name: Browser Operator
+description: >
+  Read-only browser agent. The only agent type given browser tools. Runs a
+  scoped UI check or production smoke against a named URL and returns an
+  evidence record. Never edits source.
+tools:
+  - Read
+  - Grep
+  - Glob
+  - Bash
+readonly: true
+modelTier: scoped
+---
+
+# Browser Operator
+
+You operate a browser for one scoped check and report evidence. Read `browser.md` and `capability-is-not-authority.md` in `.cratis/ai/rules/` before the first browser call.
+
+Browser tools are granted by the harness (for example an MCP server), not by this file. Frontmatter cannot grant them. If none are available, say so and stop.
+
+## Before you start
+
+- Confirm you were given the URL, scope, permit and artifact directory. If any is missing, return one specific question.
+- Treat production as read-only. Do an action that changes production state only when the permit names that exact action.
+- Prefer a staging or local copy for interactive and visual runs.
+- Check for stale tabs and idle browsers first. Use one production tab.
+
+## Allowed paths
+
+- Write only under `.ai-work/<task>/browser/`, using Bash. Stage uploads there.
+- Never edit repository files. Never copy secrets or tokens into artifacts.
+- If a path guard blocks you, stop and report. Never monkey-patch DOM or file APIs to bypass it.
+
+## Human handoff
+
+On sign-in, 2FA or CAPTCHA, stop. Return `UI UNVERIFIED — needs human sign-in` and what a human must do. Do not guess credentials.
+
+## Report
+
+- URL, build or version, environment, timestamp
+- Screenshot path under `.ai-work/`
+- Correlation id
+- What you checked, what you did not, and any blocker

package/package/corpus/agents/code-reviewer.md

@@ -10,10 +10,14 @@ tools:
   - Glob
   - Bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 
 # Code Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 ## Scope before checklists
 
 Identify the repository profile and changed lane before selecting rules or running a checklist. Read the repository's `AGENTS.md` and applicable universal rules in `.cratis/ai/rules/`. For framework contributions, load `.cratis/ai/rules/framework.md` and relevant universal rules only; skip application architecture, vertical-slice, scenario-helper, and consuming-frontend checklists. Application examples below apply only to applications with the corresponding capabilities, not to every Cratis library.

package/package/corpus/agents/coordinator.md

@@ -14,6 +14,7 @@ tools:
   - Glob
   - Bash
   - Agent
+modelTier: scoped
 ---
 
 # Coordinator

package/package/corpus/agents/frontend-developer.md

@@ -11,6 +11,7 @@ tools:
   - Bash
   - Edit
   - Write
+modelTier: scoped
 ---
 
 # Frontend Developer

package/package/corpus/agents/orchestrator.md

@@ -14,6 +14,7 @@ tools:
   - Glob
   - Bash
   - Agent
+modelTier: scoped
 ---
 
 # Orchestrator

package/package/corpus/agents/performance-reviewer.md

@@ -10,10 +10,14 @@ tools:
   - Glob
   - Bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 
 # Performance Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 ## Scope before checklists
 
 Identify the repository profile and changed lane before selecting rules or running a checklist. Read the repository's `AGENTS.md` and applicable universal rules in `.cratis/ai/rules/`. For framework contributions, load `.cratis/ai/rules/framework.md` and relevant universal rules only; skip application architecture, vertical-slice, scenario-helper, and consuming-frontend checklists. Application examples below apply only to applications with the corresponding capabilities, not to every Cratis library.

package/package/corpus/agents/planner.md

@@ -11,6 +11,7 @@ tools:
   - Glob
   - Bash
   - Agent
+modelTier: scoped
 ---
 
 # Vertical Slice Planner

package/package/corpus/agents/repository-investigation-reviewer.md

@@ -9,10 +9,14 @@ tools:
   - Grep
   - Glob
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 
 # Repository Investigation Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 You independently review a completed Cratis repository investigation. Your result is consumed by humans and deterministic gates, so structured conclusions and evidence references are authoritative; prose is only a projection.
 
 ## Authority and independence

package/package/corpus/agents/repository-investigator.md

@@ -10,6 +10,7 @@ tools:
   - Glob
   - Bash
 readonly: true
+modelTier: scoped
 ---
 
 # Repository Investigator

package/package/corpus/agents/screenplay-modeler.md

@@ -14,6 +14,7 @@ tools:
   - Edit
   - Write
 readonly: false
+modelTier: scoped
 ---
 
 # Screenplay Modeler

package/package/corpus/agents/screenplay-renderer.md

@@ -12,6 +12,7 @@ tools:
   - Glob
   - Bash
 readonly: false
+modelTier: scoped
 ---
 
 # Screenplay Renderer

package/package/corpus/agents/screenplay-reviewer.md

@@ -12,10 +12,14 @@ tools:
   - Glob
   - Bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 
 # Screenplay Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 You are an independent reviewer of the `.play` model. You never write.
 
 ## Capability guard

package/package/corpus/agents/security-reviewer.md

@@ -11,10 +11,14 @@ tools:
   - Glob
   - Bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 
 # Security Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 ## Scope before checklists
 
 Identify the repository profile and changed lane before selecting rules or running a checklist. Read the repository's `AGENTS.md` and applicable universal rules in `.cratis/ai/rules/`. For framework contributions, load `.cratis/ai/rules/framework.md` and relevant universal rules only; skip application architecture, vertical-slice, scenario-helper, and consuming-frontend checklists. Application examples below apply only to applications with the corresponding capabilities, not to every Cratis library.

package/package/corpus/agents/slice-implementer.md

@@ -11,6 +11,7 @@ tools:
   - Bash
   - Edit
   - Write
+modelTier: scoped
 ---
 
 # Slice Implementer

package/package/corpus/agents/spec-writer.md

@@ -11,6 +11,7 @@ tools:
   - Bash
   - Edit
   - Write
+modelTier: scoped
 ---
 
 # Spec Writer

package/package/corpus/harnesses/copilot/instructions/browser.instructions.md

@@ -0,0 +1,46 @@
+---
+applyTo: "**/*"
+---
+<!-- cratis-ai: generated Copilot instructions. Do not edit; rules/ is the source. -->
+
+# Browser use
+
+Browser access is a capability, not authority (see
+[`capability-is-not-authority.md`](./capability-is-not-authority.instructions.md)). Every line is tagged
+**[contract]** (binding) or **[convention]** (the house default) per the Three Levels of
+Authority in [`general.md`](../../../rules/general.md). Read this before any browser call.
+
+## Permit and handoff
+
+- **[contract] Production is read-only.** Write to a production site only when the user's
+  request or an applicable policy names that exact action. A configured browser tool is not
+  a permit.
+- **[contract] One production tab per session.** No parallel polling or parallel findings on
+  production. Run the health check first, close idle browsers, and look for stale tabs from
+  other sessions before opening one.
+- **[convention] Prefer staging or a local copy** for interactive and visual smoke runs.
+- **[contract] Only the `browser-operator` agent receives browser tools.** Hand it the URL,
+  scope, permit and artifact directory. The main session does not do browser work itself
+  unless no such agent is available. No other agent gets browser tools.
+- **[contract] Stop for a human on sign-in, 2FA or CAPTCHA.** Record
+  `UI UNVERIFIED — needs human sign-in` and continue the other lanes. Do not block on it.
+
+## Artifacts and uploads
+
+- **[contract] Write artifacts and stage uploads only under `.ai-work/<task>/browser/`**
+  (see [`local-work-artifacts.md`](./local-work-artifacts.instructions.md)). If a path guard blocks you,
+  stop and report. Never monkey-patch DOM or file APIs to get around it.
+- **[contract] No secrets or tokens in artifacts, URLs or logs.**
+
+## Evidence
+
+- **[contract] A UI verification records:** URL, build or version, screenshot path under
+  `.ai-work/`, correlation id, timestamp and environment. Without these it is unverified.
+
+## Headless production-smoke checklist
+
+- **[convention]** Port-forward to the service.
+- **[convention]** Front it with a GET-only proxy that injects the required headers.
+- **[convention]** Drive it from a fresh headless browser with no persistent profile.
+- **[convention]** Give any signed-in profile a single owner.
+- **[convention]** Tear down the browser, proxy and port-forward when done.

package/package/corpus/harnesses/copilot/instructions/local-work-artifacts.instructions.md

@@ -54,6 +54,9 @@ dumps, and similar coordination files. These are **work records, not documentati
   worktree and branch behind, which is why the script exists. If the branch must outlive the
   task unmerged, leave the worktree and say so in the handoff. Never `--force` a removal; a
   refusal means look, not push harder.
+- **Scan for secrets before archiving or sharing.** Before anything from `.ai-work/` is archived,
+  attached or shared, run `gitleaks detect --no-git --source <dir>` (or the repository's equivalent)
+  and redact every finding. See [`secrets.md`](./secrets.instructions.md).
 - **A decision log is not a work record.** A decision — a durable choice with a
   decider and a date — is documentation: it lives in **`decisions/`** (or the
   repository's documented decisions folder, such as `.cratis/ai.json` `process.decisions.path`) and is reviewed like any other

package/package/corpus/harnesses/copilot/instructions/review-reports.instructions.md

@@ -66,3 +66,14 @@ scope limits when combining reports.
 When a workflow requires a typed review envelope, preserve its schema and express
 these sections, verdict meanings, and scope limits through its existing fields.
 Do not append a competing Markdown report or invent envelope fields.
+
+## Reviewer independence
+
+- **[contract]** Run a reviewer on a different provider family than the author's model
+  where the harness can select one. The reviewer agents declare
+  `reviewIndependence: different-provider` and the `reviewer` model tier.
+- **[contract]** Where the harness cannot select a provider, state `single-provider` in the
+  report header and on the Not examined line.
+- **[contract]** A provider or tool error makes the review **Incomplete**. Fall back once
+  to the other family. Never report a failed verdict, or Approved, because the reviewer
+  could not run.

package/package/corpus/harnesses/copilot/instructions/secrets.instructions.md

@@ -0,0 +1,35 @@
+---
+applyTo: "**/*"
+---
+<!-- cratis-ai: generated Copilot instructions. Do not edit; rules/ is the source. -->
+
+# Secrets never enter agent transcripts
+
+A transcript is saved, summarized and shared, so a credential that is printed once is leaked.
+Every line is tagged **[contract]** (binding) per the Three Levels of Authority in
+[`general.md`](../../../rules/general.md). The `cratis-guard-secrets` hook blocks the commands below
+(see [`.cratis/ai/hooks/README.md`](../../../hooks/README.md)); the rule holds where no hook runs.
+
+## Commands
+
+- **[contract] Never run a command whose output contains credentials:** `kubectl get … -o json|yaml`
+  or `kubectl describe` on pods, deployments, statefulsets, daemonsets, jobs, configmaps or
+  secrets; `kubectl get secret`; `kubectl config view --raw`; `env`, `printenv`, `export -p`
+  (including `env | …`); `docker inspect`; `gh secret`, `gh api …/secrets`, `gh auth token`;
+  `vault read`, `vault kv get`; cloud secret-manager reads; `pulumi … --show-secrets`;
+  reading kubeconfigs, `.env*` files, private keys or token files.
+- **[contract] Project the field you need and say which one:** `-o jsonpath='{.spec.containers[*].image}'`,
+  `-o custom-columns=…`, `kubectl get … -o name`, status fields, `kubectl logs`, `docker inspect --format`.
+  Read a `.env.example`, never the `.env`.
+
+## Values
+
+- **[contract] Never paste, echo or log a credential**, and never put one in a brief, handoff,
+  issue, PR, message or commit. Reference a secret by name only (secret/key, environment variable).
+- **[contract] When a value appears in output, stop.** Do not copy it onward. Report
+  **SECURITY INCIDENT** with the file or tool-call location and the credential kind, and ask for
+  rotation. Do not retry the command in another form.
+- **[contract] Redact before archiving.** Scan and redact a work record before it is archived or
+  shared (see [`local-work-artifacts.md`](./local-work-artifacts.instructions.md)).
+- **[contract] The escape hatch is a human's.** `CRATIS_HOOKS_ALLOW_SECRET_READS=1` is set by the
+  person who authorized the read, in the harness environment, never by an agent.

package/package/corpus/harnesses/pi/agents/backend-developer.md

@@ -6,6 +6,7 @@ description: >
   commands, events, validators, constraints, read models, projections,
   and reactors — all in strict compliance with the vertical slice architecture.
 tools: read, grep, find, bash, edit, write
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/backend-developer.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/browser-operator.md

@@ -0,0 +1,41 @@
+---
+name: Browser Operator
+description: >
+  Read-only browser agent. The only agent type given browser tools. Runs a
+  scoped UI check or production smoke against a named URL and returns an
+  evidence record. Never edits source.
+tools: read, grep, find, bash
+readonly: true
+modelTier: scoped
+---
+<!-- cratis-ai: generated Pi adapter of agents/browser-operator.md. Do not edit; the canonical agent is the source. -->
+
+# Browser Operator
+
+You operate a browser for one scoped check and report evidence. Read `browser.md` and `capability-is-not-authority.md` in `.cratis/ai/rules/` before the first browser call.
+
+Browser tools are granted by the harness (for example an MCP server), not by this file. Frontmatter cannot grant them. If none are available, say so and stop.
+
+## Before you start
+
+- Confirm you were given the URL, scope, permit and artifact directory. If any is missing, return one specific question.
+- Treat production as read-only. Do an action that changes production state only when the permit names that exact action.
+- Prefer a staging or local copy for interactive and visual runs.
+- Check for stale tabs and idle browsers first. Use one production tab.
+
+## Allowed paths
+
+- Write only under `.ai-work/<task>/browser/`, using Bash. Stage uploads there.
+- Never edit repository files. Never copy secrets or tokens into artifacts.
+- If a path guard blocks you, stop and report. Never monkey-patch DOM or file APIs to bypass it.
+
+## Human handoff
+
+On sign-in, 2FA or CAPTCHA, stop. Return `UI UNVERIFIED — needs human sign-in` and what a human must do. Do not guess credentials.
+
+## Report
+
+- URL, build or version, environment, timestamp
+- Screenshot path under `.ai-work/`
+- Correlation id
+- What you checked, what you did not, and any blocker

package/package/corpus/harnesses/pi/agents/code-reviewer.md

@@ -6,11 +6,15 @@ description: >
   TypeScript conventions, and vertical slice correctness before merge.
 tools: read, grep, find, bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 <!-- cratis-ai: generated Pi adapter of agents/code-reviewer.md. Do not edit; the canonical agent is the source. -->
 
 # Code Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 ## Scope before checklists
 
 Identify the repository profile and changed lane before selecting rules or running a checklist. Read the repository's `AGENTS.md` and applicable universal rules in `.cratis/ai/rules/`. For framework contributions, load `.cratis/ai/rules/framework.md` and relevant universal rules only; skip application architecture, vertical-slice, scenario-helper, and consuming-frontend checklists. Application examples below apply only to applications with the corresponding capabilities, not to every Cratis library.

package/package/corpus/harnesses/pi/agents/coordinator.md

@@ -9,6 +9,7 @@ description: >
   multiple slices, mixed C#/TypeScript work, or requires both implementation
   and review).
 tools: read, grep, find, bash
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/coordinator.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/frontend-developer.md

@@ -5,6 +5,7 @@ description: >
   Implements React components that consume auto-generated command and query
   proxies, following the project's component and styling conventions.
 tools: read, grep, find, bash, edit, write
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/frontend-developer.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/orchestrator.md

@@ -9,6 +9,7 @@ description: >
   as a team: mixed implementation + documentation + review, multi-feature work,
   large refactors, or any goal that spans more than one concern.
 tools: read, grep, find, bash
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/orchestrator.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/performance-reviewer.md

@@ -6,11 +6,15 @@ description: >
   React render overhead, and Chronicle anti-patterns before merge.
 tools: read, grep, find, bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 <!-- cratis-ai: generated Pi adapter of agents/performance-reviewer.md. Do not edit; the canonical agent is the source. -->
 
 # Performance Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 ## Scope before checklists
 
 Identify the repository profile and changed lane before selecting rules or running a checklist. Read the repository's `AGENTS.md` and applicable universal rules in `.cratis/ai/rules/`. For framework contributions, load `.cratis/ai/rules/framework.md` and relevant universal rules only; skip application architecture, vertical-slice, scenario-helper, and consuming-frontend checklists. Application examples below apply only to applications with the corresponding capabilities, not to every Cratis library.

package/package/corpus/harnesses/pi/agents/planner.md

@@ -6,6 +6,7 @@ description: >
   to the right specialist agent, and ensures quality gates are met before
   the work is considered done.
 tools: read, grep, find, bash
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/planner.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/repository-investigation-reviewer.md

@@ -6,11 +6,15 @@ description: >
   conventions to framework or client-library repositories.
 tools: read, grep, find
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 <!-- cratis-ai: generated Pi adapter of agents/repository-investigation-reviewer.md. Do not edit; the canonical agent is the source. -->
 
 # Repository Investigation Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 You independently review a completed Cratis repository investigation. Your result is consumed by humans and deterministic gates, so structured conclusions and evidence references are authoritative; prose is only a projection.
 
 ## Authority and independence

package/package/corpus/harnesses/pi/agents/repository-investigator.md

@@ -6,6 +6,7 @@ description: >
   mutating Chronicle operations, or assuming an application architecture.
 tools: read, grep, find, bash
 readonly: true
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/repository-investigator.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/screenplay-modeler.md

@@ -8,6 +8,7 @@ description: >
   legacy extraction. Does not write application code.
 tools: read, grep, find, bash, edit, write
 readonly: false
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/screenplay-modeler.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/screenplay-renderer.md

@@ -8,6 +8,7 @@ description: >
   Stage-managed files; routes non-renderable scope to slice-implementer.
 tools: read, grep, find, bash
 readonly: false
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/screenplay-renderer.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/screenplay-reviewer.md

@@ -8,11 +8,15 @@ description: >
   Returns defects separately from business questions and cannot edit files.
 tools: read, grep, find, bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 <!-- cratis-ai: generated Pi adapter of agents/screenplay-reviewer.md. Do not edit; the canonical agent is the source. -->
 
 # Screenplay Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 You are an independent reviewer of the `.play` model. You never write.
 
 ## Capability guard

package/package/corpus/harnesses/pi/agents/security-reviewer.md

@@ -7,11 +7,15 @@ description: >
   attack surface.
 tools: read, grep, find, bash
 readonly: true
+modelTier: reviewer
+reviewIndependence: different-provider
 ---
 <!-- cratis-ai: generated Pi adapter of agents/security-reviewer.md. Do not edit; the canonical agent is the source. -->
 
 # Security Reviewer
 
+Run on a different provider than the author where the harness can select one; see "Reviewer independence" in `review-reports.md`.
+
 ## Scope before checklists
 
 Identify the repository profile and changed lane before selecting rules or running a checklist. Read the repository's `AGENTS.md` and applicable universal rules in `.cratis/ai/rules/`. For framework contributions, load `.cratis/ai/rules/framework.md` and relevant universal rules only; skip application architecture, vertical-slice, scenario-helper, and consuming-frontend checklists. Application examples below apply only to applications with the corresponding capabilities, not to every Cratis library.

package/package/corpus/harnesses/pi/agents/slice-implementer.md

@@ -5,6 +5,7 @@ description: >
   in when_*/ folders, and the React surface (page and/or command dialog). Use for new slices and for
   non-trivial slice changes spanning backend and frontend.
 tools: read, grep, find, bash, edit, write
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/slice-implementer.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/agents/spec-writer.md

@@ -5,6 +5,7 @@ description: >
   TypeScript/React specs for vertical slices. Ensures every slice has
   comprehensive behavior coverage following the project's BDD conventions.
 tools: read, grep, find, bash, edit, write
+modelTier: scoped
 ---
 <!-- cratis-ai: generated Pi adapter of agents/spec-writer.md. Do not edit; the canonical agent is the source. -->
 

package/package/corpus/harnesses/pi/extensions/cratis-hooks/index.ts

@@ -8,6 +8,7 @@
  *
  *   Claude PreToolUse  (Write|Edit)  →  Pi `tool_call`      →  cratis-guard-writes.sh  (exit 2 = block)
  *   Claude PreToolUse  (Bash)        →  Pi `tool_call`      →  cratis-guard-store-mutations.sh  (exit 2 = block)
+ *   Claude PreToolUse  (Bash)        →  Pi `tool_call`      →  cratis-guard-secrets.sh  (exit 2 = block)
  *   Claude PreToolUse  (Bash)        →  Pi `tool_call`      →  cratis-guard-pr-body.sh  (exit 2 = block)
  *   Claude PostToolUse (Write|Edit)  →  Pi `tool_result`    →  cratis-pattern-scan.sh  (advisory context)
  *   Claude PostToolUse (Bash)        →  Pi `tool_result`    →  cratis-cleanup-worktrees.sh --hook  (removes delivered worktrees/branches)
@@ -26,11 +27,11 @@
  *
  * Nothing here duplicates corpus content: it is adapter machinery, the Pi peer of the Claude
  * `hooks` block in `.claude/settings.json`. Every environment escape hatch the scripts honor
- * (CRATIS_HOOKS_ALLOW_PROTECTED_WRITES, CRATIS_HOOKS_ALLOW_STORE_MUTATIONS, CRATIS_HOOKS_SKIP_SCAN,
+ * (CRATIS_HOOKS_ALLOW_PROTECTED_WRITES, CRATIS_HOOKS_ALLOW_STORE_MUTATIONS, CRATIS_HOOKS_ALLOW_SECRET_READS, CRATIS_HOOKS_SKIP_SCAN,
  * CRATIS_HOOKS_SKIP_GATE, …) still works because the scripts are executed unchanged, in the environment
  * Pi was started from.
  *
- * Only Pi's `bash` tool is bridged to the store-mutation guard. A command the user types directly (`!cmd`,
+ * Only Pi's `bash` tool is bridged to the store-mutation and secrets guards. A command the user types directly (`!cmd`,
  * the `user_bash` event) is the person's own action and is deliberately not guarded.
  */
 
@@ -161,6 +162,19 @@ async function runBlockingGuard(
 	return undefined;
 }
 
+/** Runs the installed blocking Bash guards in order; the first refusal wins. */
+async function runCommandGuards(
+	guards: Array<[script: string, name: string]>,
+	payload: object,
+	ctx: ToolCallContext,
+): Promise<{ block: true; reason: string } | undefined> {
+	for (const [script, name] of guards.filter(([guard]) => isInstalled(guard))) {
+		const blocked = await runBlockingGuard(script, name, "command", payload, ctx);
+		if (blocked) return blocked;
+	}
+	return undefined;
+}
+
 /**
  * Whether a hook script is installed at all.
  *
@@ -186,6 +200,7 @@ export default function (pi: ExtensionAPI) {
 	const scriptsDir = fs.existsSync(managedScriptsDir) ? managedScriptsDir : path.join(bundledCorpusRoot, "hooks", "scripts");
 	const guardWrites = path.join(scriptsDir, "cratis-guard-writes.sh");
 	const guardStoreMutations = path.join(scriptsDir, "cratis-guard-store-mutations.sh");
+	const guardSecrets = path.join(scriptsDir, "cratis-guard-secrets.sh");
 	const guardPrBody = path.join(scriptsDir, "cratis-guard-pr-body.sh");
 	const patternScan = path.join(scriptsDir, "cratis-pattern-scan.sh");
 	const qualityGate = path.join(scriptsDir, "cratis-quality-gate.sh");
@@ -214,10 +229,8 @@ export default function (pi: ExtensionAPI) {
 			const command = (event as any).input?.command;
 			if (typeof command !== "string" || !command.trim()) return;
 			const payload = { cwd: ctx.cwd, tool_name: "Bash", tool_input: { command } };
-			if (isInstalled(guardStoreMutations)) {
-				const blocked = await runBlockingGuard(guardStoreMutations, "cratis-guard-store-mutations", "command", payload, ctx);
-				if (blocked) return blocked;
-			}
+			const blocked = await runCommandGuards([[guardStoreMutations, "cratis-guard-store-mutations"], [guardSecrets, "cratis-guard-secrets"]], payload, ctx);
+			if (blocked) return blocked;
 			if (isInstalled(guardPrBody)) {
 				const run = await runScript(guardPrBody, JSON.stringify(payload), ctx.cwd, ctx.signal);
 				if (run.failed || run.code !== 0) return { block: true, reason: run.stderr.trim() || "cratis-guard-pr-body could not check this command." };

package/package/corpus/harnesses/pi/extensions/cratis-hooks/quality-gate.ts

@@ -285,6 +285,15 @@ export function tailLines(file: string, lines: number): string {
 
 export type Fingerprint = { kind: "ok"; value: string; root: string } | { kind: "not-repository" } | { kind: "unknown"; reason?: string };
 
+/**
+ * Git's discovery failure, in both wordings: "(or any of the parent directories)" and, when discovery stops at a
+ * filesystem boundary, "(or any parent up to mount point /tmp)". A broken GIT_DIR ("not a git repository: '<path>'")
+ * is not a non-repository, so it stays unknown.
+ */
+export function isNotRepositoryError(stderr: string): boolean {
+	return stderr.includes("not a git repository (or any ");
+}
+
 /** Digest the working tree; a Git failure or deadline is unknown, never proof that no gate applies. */
 export async function workingTreeFingerprint(cwd: string, timeoutMs = FINGERPRINT_TIMEOUT_MS, signal?: AbortSignal): Promise<Fingerprint> {
 	const hash = createHash("sha256");
@@ -297,7 +306,7 @@ export async function workingTreeFingerprint(cwd: string, timeoutMs = FINGERPRIN
 	};
 	const root = await git(["rev-parse", "--show-toplevel"]);
 	if (!root || root.aborted || root.timedOut || root.failed) return { kind: "unknown" };
-	if (root.code !== 0) return root.stderr.includes("not a git repository (or any of the parent directories)") ? { kind: "not-repository" } : { kind: "unknown" };
+	if (root.code !== 0) return isNotRepositoryError(root.stderr) ? { kind: "not-repository" } : { kind: "unknown" };
 	const status = await git(["status", "--porcelain=v2", "-z", "--untracked-files=all", "--ignore-submodules=none"]);
 	if (!status || status.code !== 0 || status.aborted || status.timedOut || status.failed || status.stdoutTruncated) return { kind: "unknown" };
 	const head = await git(["rev-parse", "--verify", "-q", "HEAD"]);