@dalzoubi/dev-agents-sync 3.0.3 → 3.0.4

package/README.md

@@ -113,7 +113,7 @@ The CLI seeds a blank steering scaffold under `.claude/steering/` — `decisions
 
 ### Hook scripts (managed)
 
-`init` and `update` install the toolkit's hook scripts as marker-managed, lockfile-tracked executable files: `.claude/hooks/` for Claude and `.codex/hooks/` for Codex. Most are **warning** hooks: they print one line to stderr and always exit 0. Three are **blocking** hooks that can deny a tool call outright. Claude registrations are merged into `.claude/settings.json`; Codex registrations ship as managed `.codex/hooks.json` plus `.codex/hook-adapter.mjs`.
+`init` and `update` install the toolkit's hook scripts as marker-managed, lockfile-tracked executable files: `.claude/hooks/` for Claude and `.codex/hooks/` for Codex. Most are **warning** hooks: they print one line to stderr and always exit 0. Four are **blocking** hooks that can deny a tool call outright. Claude registrations are merged into `.claude/settings.json`; Codex registrations ship as managed `.codex/hooks.json` plus `.codex/hook-adapter.mjs`.
 
 | Script | Event | Matcher | Mode | What it does |
 |---|---|---|---|---|
@@ -121,6 +121,7 @@ The CLI seeds a blank steering scaffold under `.claude/steering/` — `decisions
 | `managed-file-guard.sh` | `PostToolUse` | `Edit\|Write` | warning | Guards managed files against unexpected edits. |
 | `uncommitted-check.sh` | `Stop` | `.*` | warning | Flags uncommitted work when a session ends. |
 | `force-push-guard.sh` | `PreToolUse` | `Bash` | **blocking** | Denies `git push` carrying `--force` / `-f` / `--force-with-lease` at `main` or `master` (by explicit refspec, or by the checked-out branch when the push names no ref). Force-pushing a feature branch, and a plain push to `main`, both pass. |
+| `direct-push-guard.sh` | `PreToolUse` | `Bash` | **blocking** | Denies ANY `git push` — force or not — at `main`, `master`, or `develop` (by explicit refspec, or by the checked-out branch when the push names no ref). Pushing a feature branch passes; open a pull request instead. |
 | `spec-approval-gate.sh` | `PreToolUse` | `Edit\|Write` | **blocking** | Denies an edit that sets a spec to `Status: Approved` while an unresolved clarification marker — a bare bracketed `NEEDS CLARIFICATION` token — remains in prose. Occurrences inside code spans or fenced blocks are documentation and never match. |
 | `handoff-state-guard.sh` | `PreToolUse` | `Write` | **blocking** | Denies a write to `.claude/state/*.json` whose `handoff.status`, `from_agent`, or `to_agent` is outside the vocabulary `.claude/rules/handoff.md` defines. |
 | `spec-drift-warn.sh` | `PostToolUse` | `Edit\|Write` | warning | After an edit to `spec.md` / `design.md` / `tasks.md` under `docs/specs/`, warns when that folder's `spec.md` has already moved past `Draft`. Draft folders stay silent. |
@@ -137,6 +138,7 @@ A blocking hook runs on `PreToolUse`, where exiting 2 denies the tool call and t
 | Code | Raised by | Example message |
 |---|---|---|
 | `EHOOK_FORCE_PUSH` | `force-push-guard.sh` | `blocked: EHOOK_FORCE_PUSH — force-push to protected branch 'main' — push without a force flag or open a pull request; to override, set DEV_AGENTS_HOOKS_BYPASS=force-push-guard` |
+| `EHOOK_DIRECT_PUSH` | `direct-push-guard.sh` | `blocked: EHOOK_DIRECT_PUSH — direct push to protected branch 'main' — open a pull request instead; to override, set DEV_AGENTS_HOOKS_BYPASS=direct-push-guard` |
 | `EHOOK_SPEC_APPROVAL` | `spec-approval-gate.sh` | `blocked: EHOOK_SPEC_APPROVAL — <path> sets Status: Approved while an unresolved clarification marker (a bare bracketed NEEDS CLARIFICATION token) remains in prose — resolve it via /define-analyze or /define before approving; to override, set DEV_AGENTS_HOOKS_BYPASS=spec-approval-gate` |
 | `EHOOK_HANDOFF_STATE` | `handoff-state-guard.sh` | `blocked: EHOOK_HANDOFF_STATE — handoff.status "done" is outside the status enum — fix the value in the state file before writing, or re-run with DEV_AGENTS_HOOKS_BYPASS=handoff-state-guard` |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dalzoubi/dev-agents-sync",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "type": "module",
   "description": "CLI that syncs managed dev-agent workflows into Claude Code, Cursor, Copilot, and Codex projects.",
   "license": "UNLICENSED",

package/src/hook-manifest.mjs

@@ -9,6 +9,7 @@ export const HOOK_MANIFEST = Object.freeze([
   { event: 'PostToolUse', matcher: 'Edit|Write', file: 'managed-file-guard.sh' },
   { event: 'Stop', matcher: '.*', file: 'uncommitted-check.sh' },
   { event: 'PreToolUse', matcher: 'Bash', file: 'force-push-guard.sh' },
+  { event: 'PreToolUse', matcher: 'Bash', file: 'direct-push-guard.sh' },
   { event: 'PreToolUse', matcher: 'Edit|Write', file: 'spec-approval-gate.sh' },
   { event: 'PreToolUse', matcher: 'Write', file: 'handoff-state-guard.sh' },
   { event: 'PostToolUse', matcher: 'Edit|Write', file: 'spec-drift-warn.sh' },

package/src/settings.mjs

@@ -496,4 +496,9 @@ export const RETIRED_HOOK_SCRIPTS = [
   // or by a future regression, and pruning it is always correct since that form
   // is never in DEFAULT_HOOK_SCRIPTS.
   { event: 'Stop', matcher: '.*', command: '.claude/hooks/ui-verification-reminder.sh' },
+  // direct-push-guard.sh ships only in the `bash …` form — same reasoning as
+  // ui-verification-reminder.sh above: it never shipped bare, but the
+  // bare-path form is pruned defensively so a hand-edit or regression can't
+  // register it live alongside the real one.
+  { event: 'PreToolUse', matcher: 'Bash', command: '.claude/hooks/direct-push-guard.sh' },
 ];

package/tests/hooks-wave2-registration.test.mjs

@@ -295,10 +295,10 @@ describe('W2 — init and update install and wire every registered hook', () =>
     }
   });
 
-  it('W2d: the two Bash PreToolUse hooks are both wired (a shared event+matcher is not deduped)', async () => {
-    // force-push-guard and pre-pr-preflight share PreToolUse/Bash. Merge
-    // identity is the COMMAND, so both must survive — collapsing on
-    // event+matcher would silently drop one.
+  it('W2d: all three Bash PreToolUse hooks are wired (a shared event+matcher is not deduped)', async () => {
+    // force-push-guard, direct-push-guard, and pre-pr-preflight all share
+    // PreToolUse/Bash. Merge identity is the COMMAND, so all three must
+    // survive — collapsing on event+matcher would silently drop one.
     await runInit(consumerDir, {
       targets: ['claude'],
       fetcher: makeFixtureFetcher(),
@@ -312,10 +312,11 @@ describe('W2 — init and update install and wire every registered hook', () =>
     assert.deepEqual(
       commands,
       [
+        expectedCommand('.claude/hooks/direct-push-guard.sh'),
         expectedCommand('.claude/hooks/force-push-guard.sh'),
         expectedCommand('.claude/hooks/pre-pr-preflight.sh'),
       ],
-      'both PreToolUse/Bash hooks must be wired independently',
+      'all three PreToolUse/Bash hooks must be wired independently',
     );
   });