@damiangilgonzalez/harness 1.3.16 → 1.3.18

package/targets/danger-guard.mjs

@@ -3,37 +3,43 @@
 // as `node ...` so it runs on every platform including Windows.
 //   argv[2] = absolute project root   stdin = PreToolUse hook JSON
 //
-// For a NON-TECHNICAL user (per docs/wiki/harness/user-profile.md → technical_level),
-// it DENIES irreversible, foot-gun Bash commands and tells the agent to find a safer,
-// scoped alternative. A fully `technical` user is never guarded. Default-safe: if there
-// is no profile yet, the harness convention is "assume non-technical", so the guard is ON.
+// It catches irreversible, foot-gun shell commands and puts a HUMAN in front of them. What it does
+// depends on docs/wiki/harness/user-profile.md -> technical_level:
+//   - technical      -> never guarded.
+//   - mixed          -> not blocked: the command goes through the normal permission flow, with a
+//                       one-line warning that names the risk.
+//   - non-technical  -> `ask`: Claude Code shows the user a confirmation. Their approval IS the
+//     or no profile     explicit order that unblocks it (default-safe: no profile = assume
+//                       non-technical, so the guard is ON).
 //
-// Disable per project with .rsc/.no-danger-guard — but only when the USER explicitly asks
-// for it (the deny message says so). Fail-open on any internal error (never brick a shell).
+// It used to `deny` for everyone below `technical`, with a reason that began "BLOCKED for a
+// non-technical user". In real sessions that denied ~20 `rm -rf` / `git branch -D` the user had
+// just asked for in so many words ("bórrala"): a deny cannot be overridden from the conversation,
+// so the order never reached the shell, and the label sent the agent into over-explaining to
+// someone it had just been told was not technical. `ask` keeps the stop and lets the person
+// decide; the message describes the COMMAND's risk and never the user.
+//
+// Disable per project with .rsc/.no-danger-guard — only when the USER explicitly asks for it.
+// Fail-open on any internal error (never brick a shell).
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 const root = process.argv[2] || process.cwd();
 
 function allow() { process.exit(0); }
-function deny(why) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason:
-        `BLOCKED for a non-technical user — this command ${why}. ` +
-        `Do NOT run it: explain the risk in plain language and propose a safer, scoped alternative ` +
-        `(name exact paths, add a WHERE clause, back up first, etc.). ` +
-        `Only if the USER explicitly insists on allowing dangerous commands here, create .rsc/.no-danger-guard to disable this guard.`,
-    },
-  }));
+// `ask` is the human gate; `mixed` gets a warning and no decision at all, so whatever permission
+// rules the project already has still apply (an explicit `allow` here would bypass them).
+function stop(why) {
+  const reason = `Este comando ${why}. No se puede deshacer: confirma solo si es lo que quieres.`;
+  const out = level === 'mixed'
+    ? { systemMessage: `Aviso: este comando ${why}.` }
+    : { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask', permissionDecisionReason: reason } };
+  process.stdout.write(JSON.stringify(out));
   process.exit(0);
 }
 
 if (existsSync(join(root, '.rsc', '.no-danger-guard'))) allow();
 
-// technical_level === 'technical' → not guarded. non-technical / mixed / missing → guarded.
 function technicalLevel() {
   try {
     const txt = readFileSync(join(root, 'docs', 'wiki', 'harness', 'user-profile.md'), 'utf8');
@@ -41,14 +47,41 @@ function technicalLevel() {
     return m ? m[1].toLowerCase() : null;
   } catch { return null; }
 }
-if (technicalLevel() === 'technical') allow();
+const level = technicalLevel();
+if (level === 'technical') allow();
 
-// Only Bash commands can be dangerous here.
+// Only shell commands can be dangerous here.
 let input = {};
 try { input = JSON.parse(readFileSync(0, 'utf8') || '{}'); } catch { allow(); }
 if (!['Bash', 'PowerShell'].includes(input.tool_name || input.toolName)) allow();
-const cmd = input.tool_input?.command || input.toolInput?.command || '';
-if (typeof cmd !== 'string' || !cmd) allow();
+const raw = input.tool_input?.command || input.toolInput?.command || '';
+if (typeof raw !== 'string' || !raw) allow();
+
+// --- text that is written, not run ------------------------------------------
+// A heredoc body or the value of a message flag is DATA: `cat > doc.md <<'EOF' … rm -rf … EOF`,
+// `git commit -m "… rm -rf …"`, `gh pr create --body "| rm -rf /agent |"`. The guard matched all of
+// them — a markdown table even splits on `|` into a segment that starts with `rm`. They are stripped
+// before any rule looks at the command. A heredoc fed to something that EXECUTES it (a shell, a SQL
+// client, mongosh) keeps its body: `bash <<EOF rm -rf / EOF` really does delete.
+const INTERPRETER = /(^|[\s|;&(])(sudo\s+)?(bash|sh|zsh|dash|ksh|psql|mysql|mariadb|sqlite3|mongosh|mongo|duckdb|clickhouse-client)(?=\s|$)/;
+function stripHeredocs(text) {
+  const lines = text.split('\n');
+  const out = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    out.push(lines[i]);
+    const m = lines[i].match(/(?<!<)<<(?!<)-?\s*(['"]?)([A-Za-z_][\w.-]*)\1/);
+    if (!m) continue;
+    let end = i + 1;
+    while (end < lines.length && lines[end].trim() !== m[2]) end += 1;
+    if (end >= lines.length) continue; // unterminated: leave it, judge what is there
+    if (INTERPRETER.test(lines[i])) out.push(...lines.slice(i + 1, end));
+    out.push(lines[end]);
+    i = end;
+  }
+  return out.join('\n');
+}
+const MESSAGE_FLAG = /(\s(?:-m|--message|-b|--body|-t|--title|--notes|--description)(?:\s+|=))("(?:[^"\\]|\\[\s\S])*"|'[^']*')/g;
+const cmd = stripHeredocs(raw).replace(MESSAGE_FLAG, '$1""');
 
 // --- the dangerous-command list ---------------------------------------------
 // High-signal, low-false-positive. Each rule: what it catches and the plain why.
@@ -84,7 +117,32 @@ const SHELLS = /^(bash|sh|zsh|dash|ksh)$/i;
 // this, `echo "never run rm -rf /"` was denied — the guard blocking the conversation about a
 // command instead of the command, exactly the defect the gitmoji guard had to fix with its own
 // RUNS_GIT check. A guard that argues with you about a sentence is a guard you turn off.
-function runsRm(segment) {
+//
+// Split on shell separators that are OUTSIDE quotes. Splitting the raw string cut `echo "a | rm -rf x"`
+// into a segment that begins with `rm`.
+function splitTopLevel(text) {
+  const parts = [];
+  let cur = '';
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) {
+      if (c === '\\' && quote === '"') { cur += c + (text[i + 1] ?? ''); i += 1; continue; }
+      if (c === quote) quote = null;
+      cur += c;
+      continue;
+    }
+    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (c === '\n' || c === ';' || c === '|' || c === '&') { parts.push(cur); cur = ''; continue; }
+    cur += c;
+  }
+  parts.push(cur);
+  return parts;
+}
+
+// Is this segment a recursive force delete? A shell with -c is walked INTO — `bash -c "cd x && rm -rf y"`
+// really deletes — by judging its quoted script the same way, a few levels deep at most.
+function segmentIsRmRf(segment, depth) {
   const tokens = segment.trim().split(/\s+/).filter(Boolean);
   let i = 0;
   while (i < tokens.length) {
@@ -92,47 +150,51 @@ function runsRm(segment) {
     if (WRAPPERS.test(bare)) { i += 1; continue; }
     if (SHELLS.test(bare)) {
       i += 1;
-      while (i < tokens.length && /^-/.test(tokens[i])) i += 1; // skip -c and friends
+      let script = false;
+      while (i < tokens.length && /^-/.test(tokens[i])) { if (/c/.test(tokens[i])) script = true; i += 1; }
+      if (script && depth < 3) {
+        const body = tokens.slice(i).join(' ').replace(/^(['"])([\s\S]*)\1$/, '$2');
+        return commandIsRmRf(body, depth + 1);
+      }
       continue;
     }
-    return bare === 'rm' || bare.endsWith('/rm');
-  }
-  return false;
-}
-
-function isRmRecursiveForce() {
-  if (!/\brm\b/.test(cmd)) return false;
-  for (const segment of cmd.split(/\|\||&&|[|;&]/)) {
-    if (!runsRm(segment)) continue;
+    if (bare !== 'rm' && !bare.endsWith('/rm')) return false;
     const flags = rmFlagsIn(segment);
     const hasR = flags.some((f) => /^--recursive$/i.test(f) || /^-[A-Za-z]*r/i.test(f));
     const hasF = flags.some((f) => /^--force$/i.test(f) || /^-[A-Za-z]*f/i.test(f));
-    if (hasR && hasF) return true; // -rf / -fr / -Rf / -r -f / --recursive --force
+    return hasR && hasF; // -rf / -fr / -Rf / -r -f / --recursive --force
   }
   return false;
 }
 
+function commandIsRmRf(text, depth = 0) {
+  if (!/\brm\b/.test(text)) return false;
+  return splitTopLevel(text).some((segment) => segmentIsRmRf(segment, depth));
+}
+
+function isRmRecursiveForce() { return commandIsRmRf(cmd); }
+
 const RULES = [
-  { id: 'rm-rf', why: 'deletes whole files/folders irreversibly (rm with -r and -f)', match: isRmRecursiveForce },
-  { id: 'find-delete', why: 'mass-deletes matched files (find … -delete / -exec rm)', match: () => /\bfind\b[^|;&]*(-delete\b|-exec\s+rm\b)/i.test(cmd) },
-  { id: 'dd-disk', why: 'overwrites a raw disk device and can destroy the whole drive (dd of=/dev/…)', match: () => /\bdd\b[^|;&]*\bof=\/dev\//i.test(cmd) },
-  { id: 'mkfs', why: 'formats a filesystem, erasing everything on it (mkfs)', match: () => /\bmkfs(\.\w+)?\b/i.test(cmd) },
-  { id: 'curl-pipe-shell', why: 'pipes a downloaded script straight into a shell (curl|bash) — runs untrusted code', match: () => /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i.test(cmd) },
-
-  { id: 'git-push-force', why: 'force-pushes and can overwrite shared history for everyone (git push --force)', match: () => /\bgit\s+push\b[^|;&]*(--force(?!-with-lease)\b|\s-f\b)/i.test(cmd) },
-  { id: 'git-reset-hard', why: 'throws away all uncommitted work with no undo (git reset --hard)', match: () => /\bgit\s+reset\b[^|;&]*--hard\b/i.test(cmd) },
-  { id: 'git-clean', why: 'permanently deletes untracked files (git clean -f)', match: () => /\bgit\s+clean\b[^|;&]*-[a-z]*f/i.test(cmd) },
-  { id: 'git-branch-D', why: 'force-deletes a branch even if its work was never merged (git branch -D)', match: () => /\bgit\s+branch\b[^|;&]*\s-D\b/.test(cmd) },
-
-  { id: 'sql-drop', why: 'drops an entire database/schema/table (DROP …)', match: () => /\bdrop\s+(database|schema|table)\b/i.test(cmd) },
-  { id: 'sql-truncate', why: 'empties an entire table (TRUNCATE)', match: () => /\btruncate\s+(table\s+)?\S/i.test(cmd) },
-  { id: 'sql-delete-no-where', why: 'deletes EVERY row — a DELETE with no WHERE clause', match: () => noWhere(/\bdelete\s+from\s+\S/i) },
-  { id: 'sql-update-no-where', why: 'rewrites EVERY row — an UPDATE with no WHERE clause', match: () => noWhere(/\bupdate\s+\S+\s+set\b/i) },
-  { id: 'mongo-wipe', why: 'drops a collection/database or deletes all documents (drop()/dropDatabase/deleteMany({}))', match: () => /\.drop\(\s*\)|dropdatabase\s*\(|deletemany\(\s*\{\s*\}\s*\)|\.remove\(\s*\{\s*\}\s*\)/i.test(cmd) },
+  { id: 'rm-rf', why: 'borra archivos o carpetas enteras de forma irreversible (rm con -r y -f)', match: isRmRecursiveForce },
+  { id: 'find-delete', why: 'borra en masa todos los archivos que encuentra (find … -delete / -exec rm)', match: () => /\bfind\b[^|;&]*(-delete\b|-exec\s+rm\b)/i.test(cmd) },
+  { id: 'dd-disk', why: 'sobrescribe un disco entero y puede destruir todo lo que contiene (dd of=/dev/…)', match: () => /\bdd\b[^|;&]*\bof=\/dev\//i.test(cmd) },
+  { id: 'mkfs', why: 'formatea un sistema de archivos y borra todo lo que hay en él (mkfs)', match: () => /\bmkfs(\.\w+)?\b/i.test(cmd) },
+  { id: 'curl-pipe-shell', why: 'ejecuta un script descargado sin revisarlo (curl | bash): código que no conocemos', match: () => /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i.test(cmd) },
+
+  { id: 'git-push-force', why: 'reescribe en el remoto el historial compartido, para todos (git push --force)', match: () => /\bgit\s+push\b[^|;&]*(--force(?!-with-lease)\b|\s-f\b)/i.test(cmd) },
+  { id: 'git-reset-hard', why: 'descarta todo el trabajo sin commitear y no hay forma de recuperarlo (git reset --hard)', match: () => /\bgit\s+reset\b[^|;&]*--hard\b/i.test(cmd) },
+  { id: 'git-clean', why: 'borra para siempre los archivos que git no sigue (git clean -f)', match: () => /\bgit\s+clean\b[^|;&]*-[a-z]*f/i.test(cmd) },
+  { id: 'git-branch-D', why: 'borra una rama aunque su trabajo no esté fusionado (git branch -D)', match: () => /\bgit\s+branch\b[^|;&]*\s-D\b/.test(cmd) },
+
+  { id: 'sql-drop', why: 'elimina una base de datos, esquema o tabla entera (DROP …)', match: () => /\bdrop\s+(database|schema|table)\b/i.test(cmd) },
+  { id: 'sql-truncate', why: 'vacía una tabla entera (TRUNCATE)', match: () => /\btruncate\s+(table\s+)?\S/i.test(cmd) },
+  { id: 'sql-delete-no-where', why: 'borra todas las filas: es un DELETE sin WHERE', match: () => noWhere(/\bdelete\s+from\s+\S/i) },
+  { id: 'sql-update-no-where', why: 'reescribe todas las filas: es un UPDATE sin WHERE', match: () => noWhere(/\bupdate\s+\S+\s+set\b/i) },
+  { id: 'mongo-wipe', why: 'elimina una colección o base de datos, o todos sus documentos (drop()/dropDatabase/deleteMany({}))', match: () => /\.drop\(\s*\)|dropdatabase\s*\(|deletemany\(\s*\{\s*\}\s*\)|\.remove\(\s*\{\s*\}\s*\)/i.test(cmd) },
 ];
 
 for (const rule of RULES) {
-  try { if (rule.match()) deny(rule.why); } catch { /* a rule erroring must never block */ }
+  try { if (rule.match()) stop(rule.why); } catch { /* a rule erroring must never block */ }
 }
 
 allow();

package/targets/hook-once.mjs

@@ -94,25 +94,56 @@ Responde en el idioma en que escribe la persona, no en el de este texto.
 Si el usuario pide construir, anadir o cambiar algo (en cualquier idioma, se juzga la intencion),
 sigue esta cadena ANTES de escribir codigo. Ninguna skill escribe codigo de una feature hasta que
 el que esta claro y el usuario ha dado el visto bueno.
-1. Aclarar el que:
-   - Peticion concreta y acotada -> \`grill-with-docs\`.
-   - Tema amplio, o el usuario no sabe como abordarlo -> recomiendale \`wayfinder\`.
-   - \`superpowers:brainstorming\` vale para lo mismo si el usuario lo prefiere.
-   Cada decision dificil de revertir se registra con \`write-adr\`, en docs/adr/.
-2. Escribir la spec: \`to-spec\`, o \`superpowers:brainstorming\` para cerrarla por secciones.
-   Sin spec escrita no se programa.
-3. Construir: \`superpowers:writing-plans\` -> \`superpowers:executing-plans\`. Spec grande o que
-   salio de \`wayfinder\` -> \`to-tickets\` -> \`implement-spec\` (subagentes en paralelo sobre el
-   grafo de tickets); un solo ticket suelto -> \`implement\`.
-   Si la tarea toca pantalla, invoca ademas \`flujo-interfaz\`: dice que skill de diseno manda.
-4. Antes de fusionar: \`code-review\` (estandares del repo + lo que pedia la spec), y el cuerpo
-   de la PR con \`pr\` (resumen visual, evidencia antes/despues, peligro de fusion).
+Elige la cadena por el tamano y encadena tu mismo cada paso, sin esperar a que el usuario lo pida:
+- Pequeno (cabe en una sesion, un solo ticket):
+  1. Aclarar: \`superpowers:brainstorming\` si la idea aun esta verde; \`grill-with-docs\` si ya
+     hay un plan que endurecer.
+  2. Construir: \`implement\`.
+- Grande (varias sesiones o muchas piezas):
+  1. Aclarar: \`grill-with-docs\`; tema amplio o sin camino claro -> \`wayfinder\`.
+  2. Escribir la spec: \`to-spec\`. Sin spec escrita no se programa.
+  3. Partirla: \`to-tickets\` (grafo de tickets con bloqueos). Sin tickets no hay \`implement-spec\`.
+  4. Construir: \`implement-spec\` (subagentes en paralelo sobre el grafo de tickets).
+En ambas: cada decision dificil de revertir va a \`write-adr\`, en docs/adr/.
+Si la tarea toca pantalla, invoca ademas \`flujo-interfaz\`: dice que skill de diseno manda.
+Antes de fusionar: \`code-review\` (estandares del repo + lo que pedia la spec), y la PR con \`pr\`.
 Siempre: \`superpowers:test-driven-development\` y \`superpowers:verification-before-completion\`
 antes de dar nada por terminado. Los bugs entran por \`superpowers:systematic-debugging\`.
 Cambio de una linea, typo o ajuste de configuracion -> hazlo y di que te saltas la cadena.
 ==========================================================
 `;
 
+// Some skills the gate names carry `disable-model-invocation: true`: the Skill tool refuses them,
+// so telling the agent to "use `to-spec`" sends it into a refusal and the user ends up typing the
+// command anyway. The flag lives in each SKILL.md, so the gate reads it from there at emit time
+// instead of keeping a second, hand-written list that drifts. Each flagged id is rendered as the
+// slash command the user has to type, plus one line saying so. `roots` are searched in order
+// (project, then user scope); the first SKILL.md found decides. Fail-safe: a skill whose file
+// cannot be read keeps the current wording — this runs every turn and must never break the gate.
+const GATE_ID = /`([a-z][a-z0-9-]*)`/g;
+export function renderGate(text, roots = []) {
+  const manual = [];
+  for (const id of new Set([...text.matchAll(GATE_ID)].map((m) => m[1]))) {
+    for (const r of roots) {
+      let md;
+      try { md = readFileSync(join(r, '.claude', 'skills', id, 'SKILL.md'), 'utf8'); } catch { continue; }
+      const fm = md.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      if (fm && /^disable-model-invocation:\s*true\s*$/m.test(fm[1])) manual.push(id);
+      break;
+    }
+  }
+  if (!manual.length) return text;
+  const flagged = new Set(manual);
+  const lines = text.replace(GATE_ID, (m, id) => (flagged.has(id) ? `\`/${id}\`` : m)).split('\n');
+  const note = `Las que van con / (${manual.map((id) => `\`/${id}\``).join(', ')}) no las lances tu: la\n` +
+    `herramienta Skill las rechaza. Pide al usuario que escriba \`/<skill>\` (p. ej. \`/${manual[0]}\`).`;
+  let close = lines.length - 1;
+  while (close > 0 && !lines[close].startsWith('=====')) close -= 1;
+  if (close <= 0) return `${lines.join('\n')}\n${note}\n`;
+  lines.splice(close, 0, note);
+  return lines.join('\n');
+}
+
 /**
  * Parse the hook payload Claude Code writes to stdin.
  * Pass `raw` explicitly in tests; in a hook, call with no argument to read fd 0.

package/targets/memory.js

@@ -76,10 +76,15 @@ function handler(target, event) {
     : target === 'codex'
       ? '"$(git rev-parse --show-toplevel)/.rsc/session-memory-adapter.mjs"'
       : '".rsc/session-memory-adapter.mjs"';
+  // PreCompact gets more room than the per-turn events. It runs once, right before a compaction that
+  // itself takes tens of seconds, so a longer ceiling costs nothing in the normal case; and a
+  // cancelled PreCompact is the one that loses the budget reset. The per-turn events keep 5 s:
+  // they run on every tool call and must stay cheap.
+  const seconds = event === 'compact' ? 15 : event === 'end' && target === 'codex' ? 3 : 5;
   const value = {
     type: 'command',
     command: `node ${unixScript} ${target} ${event}`,
-    timeout: target === 'gemini' ? 5000 : event === 'end' && target === 'codex' ? 3 : 5,
+    timeout: target === 'gemini' ? seconds * 1000 : seconds,
   };
   if (target === 'codex') {
     value.commandWindows = `node \"$((git rev-parse --show-toplevel).Trim())/.rsc/session-memory-adapter.mjs\" ${target} ${event}`;

package/targets/session-memory-adapter.mjs

@@ -108,7 +108,10 @@ export function handleLifecycle({ target, event, native = {}, cwd, settings } =
     const id = sessionId(native, target);
     const eventName = hookEventName(target, event, native);
     if (event === 'start') {
-      const started = capture({ cwd: project, worktreeCwd: here, sessionId: id, target, event: 'start', settings: config });
+      // `source: "compact"` is the SessionStart that follows a compaction. It resets the edit budget
+      // on its own, so the count still restarts when the PreCompact hook itself never finished.
+      const reset = native?.source === 'compact';
+      const started = capture({ cwd: project, worktreeCwd: here, sessionId: id, target, event: 'start', reset, settings: config });
       const resumed = resume({ cwd: project, worktreeCwd: here, target, settings: config });
       return {
         output: nativeOutput(target, eventName, resumed.context),

package/targets/session-memory-core.mjs

@@ -1,5 +1,5 @@
 import {
-  appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync,
+  appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync,
 } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
@@ -167,11 +167,22 @@ function parseStatus(output) {
 // runs on every hook event: a few hundred dirty files were enough to blow the 5 s hook timeout.
 // `--stdin-paths` stops at the first path it cannot read (a deleted file), so on failure each file
 // is hashed on its own, which keeps the old per-file `null` for the unreadable ones.
+//
+// A deleted file is the ordinary case, not the exotic one — any `rm` or `git rm` puts one in the
+// status — and it used to send EVERY file down the per-file path, back over the timeout (400 dirty
+// files and one deletion: ~20 s per event, so PreCompact was cancelled). So paths that are not a
+// readable regular file are settled here, as `null`, before the batch ever sees them.
 function fingerprintFiles(worktree, files) {
   if (!files.length) return {};
-  const batch = git(worktree, ['hash-object', '--no-filters', '--stdin-paths'], `${files.join('\n')}\n`);
+  const readable = files.filter((path) => {
+    try { return statSync(join(worktree, path)).isFile(); } catch { return false; }
+  });
+  const isReadable = new Set(readable);
+  const missing = Object.fromEntries(files.filter((path) => !isReadable.has(path)).map((path) => [path, null]));
+  if (!readable.length) return missing;
+  const batch = git(worktree, ['hash-object', '--no-filters', '--stdin-paths'], `${readable.join('\n')}\n`);
   const hashes = batch.ok ? batch.out.split('\n') : [];
-  if (hashes.length === files.length) return Object.fromEntries(files.map((path, i) => [path, hashes[i]]));
+  if (hashes.length === readable.length) return { ...missing, ...Object.fromEntries(readable.map((path, i) => [path, hashes[i]])) };
   return Object.fromEntries(files.map((path) => {
     const result = git(worktree, ['hash-object', '--no-filters', '--', path]);
     return [path, result.ok ? result.out : null];
@@ -346,13 +357,27 @@ export function capture(input = {}) {
   const observed = Object.entries(repo.fingerprints || {})
     .filter(([path, fingerprint]) => fingerprint && previousFingerprints[path] !== fingerprint).length;
   const editDelta = Math.max(finiteOrNull(input.editDelta, true) || 0, observed);
-  // Compaction closes a context window, so the edit budget starts again from zero.
-  const previousEdits = input.event === 'compact' ? 0 : (existing?.editCount || 0);
+  // Compaction closes a context window, so the edit budget starts again from zero. Two signals say
+  // it happened, and either is enough: PreCompact (`compact`) and the SessionStart that follows it
+  // (`reset`, from `source: "compact"`). Relying on PreCompact alone meant a cancelled PreCompact
+  // hook — which is what the 5 s timeout did on a dirty tree — left the old count standing.
+  const resetsBudget = input.event === 'compact' || input.reset === true;
+  const previousEdits = resetsBudget ? 0 : (existing?.editCount || 0);
   const editCount = Math.max(0, previousEdits + editDelta);
   // Hint once per threshold crossed, and only on the edit that crosses it: re-emitting on
   // every later event (Stop in particular) wakes the model again and loops.
   const crossedThreshold = editCount > previousEdits
     && Math.floor(editCount / config.editThreshold) > Math.floor(previousEdits / config.editThreshold);
+  // And never ON a turn end, even the one that crosses. A Stop hook that speaks is a Stop hook that
+  // can start another turn, and that turn ends in another Stop: the field report is ~150 empty
+  // assistant replies in a row. A crossing seen at a turn end is kept on the anchor and said by the
+  // next event that is not one (the person's next prompt, or the next tool call). Compaction and
+  // start never say it either — "consider compacting" while compacting is noise — and a reset
+  // drops whatever was pending, because the window it was about is gone.
+  const mutedEvents = ['turn', 'stop', 'compact', 'start', 'end', 'sessionEnd'];
+  const hintDue = !resetsBudget && (crossedThreshold || anchor.hintPending === true);
+  const speaks = !mutedEvents.includes(input.event);
+  const hintPending = hintDue && !speaks;
   const baselineFiles = new Set(anchor.baselineFiles || []);
   const newDirtyPath = repo.files.some((path) => !baselineFiles.has(path));
   const baselineFingerprints = anchor.baselineFingerprints || {};
@@ -391,13 +416,20 @@ export function capture(input = {}) {
   if (errors.length) return { record: null, path: null, notice: null, compactionHint: false, errors };
   atomicJson(recordPath, record);
   existing = record;
-  const compactionHint = Boolean(config.compactionHint && crossedThreshold);
+  const compactionHint = Boolean(config.compactionHint && hintDue && speaks);
   // The fingerprints the next event compares against live on the ANCHOR, not on the record: the
   // record's schema is closed and every field of it is required, so a new field there would fail
   // validation on every record already written. Written only when they moved, so a read-only shell
-  // command costs no extra disk.
+  // command costs no extra disk. The pending hint lives there for the same reason.
   const fingerprintsMoved = observed > 0 || !anchor.lastFingerprints;
-  if (fingerprintsMoved) atomicJson(anchorPath, { ...anchor, lastFingerprints: repo.fingerprints || {} });
+  if (fingerprintsMoved || Boolean(anchor.hintPending) !== hintPending) {
+    const { hintPending: _previous, ...rest } = anchor;
+    atomicJson(anchorPath, {
+      ...rest,
+      lastFingerprints: fingerprintsMoved ? (repo.fingerprints || {}) : anchor.lastFingerprints,
+      ...(hintPending ? { hintPending: true } : {}),
+    });
+  }
   return {
     record,
     path: recordPath,

package/targets/session-start.mjs

@@ -274,7 +274,8 @@ ${candidates.map((c) => W.summarize(c, root)).join('\n')}
 ACTION: offer to retire them in ONE line and wait for a yes. On a yes run:
   npx @damiangilgonzalez/harness worktrees reap          (the ones marked safe)
   npx @damiangilgonzalez/harness worktrees reap <path>   (one the user confirmed by name)
-A yes in bulk covers only the safe ones; anything marked \`ask\` is confirmed on its own.
+  npx @damiangilgonzalez/harness worktrees reap --merged --confirm   (safe + "provenance unclear" only, after a fetch; say so when offering)
+A yes in bulk covers only those; any other \`ask\` (uncommitted changes, files in no commit) is confirmed on its own.
 A no holds for this session. Permanent off: .rsc/.no-worktree-cleanup
 ================================
 `;

package/targets/ship-guard.mjs

@@ -5,9 +5,10 @@
 //
 // Enforces the "close the feature before you leave it" rule at the one deterministic
 // moment it matters: when a Bash command tries to switch to the trunk (main/master)
-// or merge into it. If the current feature branch has uncommitted changes or commits
-// that were never pushed, the guard DENIES the command and tells the agent to run
-// `ship` (commit → push → PR). Opening the PR itself is `ship`'s job and the skill's
+// or merge into it. If the current feature branch has commits that were never pushed,
+// the guard DENIES the command and tells the agent to run `ship` (commit → push → PR).
+// Uncommitted changes alone only earn a hint: they may be the user's own work, and git
+// already refuses a switch that would overwrite them. Opening the PR itself is `ship`'s job and the skill's
 // hard rule; this hook guarantees you cannot quietly abandon unsaved/unpushed work.
 //
 // Design: precise (only fires on a trunk switch/merge), local-only (no network, no gh),
@@ -77,10 +78,26 @@ if (!branch || branch === 'HEAD' || branch === 'main' || branch === 'master') al
 
 const tail = '\n(If this is intentional and you accept the risk, create .rsc/.no-ship-guard to disable this guard.)';
 
-// 1) Uncommitted work would be carried off the feature branch.
+// 1) Uncommitted changes are NOT a reason to deny. They may well be the user's own work in the main
+// checkout, not the agent's: in real sessions this denied five branch switches over a diff the agent
+// had no business committing, and "commit them first" pushed it to do exactly that. Git itself
+// refuses a switch that would overwrite local changes, and carries the rest along untouched, so the
+// switch is left to git and the agent gets a hint: leave that diff alone and work in a worktree.
+// The unpushed-commits rule below is the guard's real purpose and still denies.
 const dirty = git('status', '--porcelain');
-if (dirty && dirty.length > 0) {
-  deny(`You're leaving feature branch "${branch}" with uncommitted changes. Commit them first — run the \`ship\` skill (commit → push → PR), don't abandon the diff.${tail}`);
+const worktreeHint = dirty && dirty.length > 0
+  ? `The working tree on "${branch}" has uncommitted changes, and they may be the user's, not yours: ` +
+    `do not commit, stash or discard them to make room. If git refuses the switch, work in a separate ` +
+    `worktree instead: \`git worktree add .claude/worktrees/<name> -b <branch> origin/main\` ` +
+    `(or \`npx @damiangilgonzalez/harness worktrees new <name>\`).`
+  : '';
+function hint() {
+  if (!worktreeHint) allow();
+  process.stdout.write(JSON.stringify({
+    systemMessage: 'ship-guard: hay cambios sin commitear en el árbol; no se tocan.',
+    hookSpecificOutput: { hookEventName: 'PreToolUse', additionalContext: worktreeHint },
+  }));
+  process.exit(0);
 }
 
 // 2) Commits exist but were never pushed.
@@ -88,14 +105,14 @@ const upstream = git('rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}'
 if (upstream) {
   const ahead = git('rev-list', '--count', `${upstream}..HEAD`);
   if (ahead && Number(ahead) > 0) {
-    deny(`Feature branch "${branch}" has ${ahead} commit(s) not pushed to ${upstream}. Push them and open the PR — run the \`ship\` skill — before switching to the trunk.${tail}`);
+    deny(`Feature branch "${branch}" has ${ahead} commit(s) not pushed to ${upstream}. Push them and open the PR — run the \`ship\` skill — before switching to the trunk.${worktreeHint ? `\n${worktreeHint}` : ''}${tail}`);
   }
 } else {
   // No upstream at all: if the branch carries commits beyond the trunk, it was never pushed.
   const aheadOfTrunk = git('rev-list', '--count', 'main..HEAD') ?? git('rev-list', '--count', 'master..HEAD');
   if (aheadOfTrunk && Number(aheadOfTrunk) > 0) {
-    deny(`Feature branch "${branch}" was never pushed (no upstream, ${aheadOfTrunk} commit(s) ahead of the trunk). Push it and open a PR — run the \`ship\` skill — before leaving it.${tail}`);
+    deny(`Feature branch "${branch}" was never pushed (no upstream, ${aheadOfTrunk} commit(s) ahead of the trunk). Push it and open a PR — run the \`ship\` skill — before leaving it.${worktreeHint ? `\n${worktreeHint}` : ''}${tail}`);
   }
 }
 
-allow();
+hint();

package/targets/userprompt-gate.mjs

@@ -14,7 +14,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { claimOnce, readHookInput, WORKFLOW_GATE_TEXT } from './hook-once.mjs';
+import { claimOnce, readHookInput, renderGate, WORKFLOW_GATE_TEXT } from './hook-once.mjs';
 
 const root = process.argv[2] || process.cwd();
 
@@ -33,4 +33,9 @@ if (hook.session_id && turnKey && !claimOnce(`up:${hook.session_id}:${turnKey}`)
 // that is not installed sends the agent looking for something that does not exist, so the line only
 // ships when the skill is present in this project or in the user scope.
 const hasFlujo = [root, homedir()].some((r) => existsSync(join(r, '.claude', 'skills', 'flujo-interfaz', 'SKILL.md')));
-process.stdout.write(hasFlujo ? WORKFLOW_GATE_TEXT : WORKFLOW_GATE_TEXT.split('\n').filter((l) => !l.includes('flujo-interfaz')).join('\n'));
+const gate = hasFlujo ? WORKFLOW_GATE_TEXT : WORKFLOW_GATE_TEXT.split('\n').filter((l) => !l.includes('flujo-interfaz')).join('\n');
+// Skills marked `disable-model-invocation: true` are rendered as the slash command the user types,
+// read from the installed SKILL.md so the gate cannot contradict the skill (see renderGate).
+let out = gate;
+try { out = renderGate(gate, [root, homedir()]); } catch { /* fail-safe: keep the plain gate */ }
+process.stdout.write(out);

package/targets/worklog-checkpoint.mjs

@@ -5,7 +5,7 @@
 // Reminds the agent to run a Worklog Sweep (capture what we did this session into
 // docs/raw/worklog/). The hook only reminds; the agent writes the worklog.
 // Silent when this workspace has no harness wiki yet.
-import { existsSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 
 const root = process.argv[2] || process.cwd();
@@ -13,10 +13,25 @@ const root = process.argv[2] || process.cwd();
 // No harness wiki here → nothing to document into. Stay silent.
 if (!existsSync(join(root, 'docs', 'wiki'))) process.exit(0);
 
+// The sweep used to open with the agent running `ls docs/raw/worklog` to see what was there, and in
+// a wiki scaffolded before that folder existed (or whose .gitkeep never got committed) that printed
+// an error into the session on every compaction. The hook already knows the answer, so it says it:
+// what is there, or that the folder has to be created first. Nothing is left to list blindly.
+// It does not create the folder itself: an untracked docs/raw/worklog/ is where the session memory
+// prefers to keep its journal, and moving that store mid-session would orphan the session's anchor.
+let state;
+try {
+  const entries = readdirSync(join(root, 'docs', 'raw', 'worklog')).filter((name) => name.endsWith('.md'));
+  state = `docs/raw/worklog/ exists with ${entries.length} worklog file(s); no need to list it.`;
+} catch {
+  state = 'docs/raw/worklog/ does not exist yet: create it first (mkdir -p docs/raw/worklog); do not list it.';
+}
+
 process.stdout.write(`
 ===== rsc worklog checkpoint =====
 If this session did meaningful work (files changed, a decision made, a commit),
 run a WORKLOG SWEEP before context is lost:
+  ${state}
   1. Write docs/raw/worklog/<YYYY-MM-DD>-<slug>.md using the harness
      wiki-worklog-template.md (what we did · why · files touched · outcome · next).
   2. Compile it into wiki/ (update existing articles first; wikilinks + Related);