@damiangilgonzalez/harness 1.3.17 → 1.3.18

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.3.17",
+  "version": "1.3.18",
   "counts": {
     "skills": 294,
     "agents": 34,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@damiangilgonzalez/harness",
-  "version": "1.3.17",
+  "version": "1.3.18",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {

package/scripts/doctor.js

@@ -261,7 +261,7 @@ export function doctor({ target, home, cwd }) {
   // #277 — the three "missing" lists share one shape, { id, path, action }, so whoever builds on top
   // of doctor reads them the same way; and `healthy` is what the exit code says.
   for (const [id, e] of Object.entries(state.skills)) {
-    for (const f of e.files) if (!existsSync(f)) report.missing.push({ id, path: f, action: 'Run `npx @ericrisco/rsc sync` to restore this managed skill.' });
+    for (const f of e.files) if (!existsSync(f)) report.missing.push({ id, path: f, action: 'Run `npx @damiangilgonzalez/harness sync` to restore this managed skill.' });
   }
   report.healthy = report.hookWired && !report.missing.length && !missingAgents.length && !missingCommands.length;
   return report;

package/scripts/rsc.js

@@ -885,11 +885,72 @@ async function main() {
       const root = W.resolveMainRoot(process.cwd());
       const sub = argv[1];
 
+      if (sub === 'new') {
+        // Creating is not cleaning, so the cleanup opt-out does not apply here. Two things a worktree
+        // was measured lacking when it is born: a current base (local main was 400 commits behind
+        // origin) and what git does not track (.env, dependencies). The base is fixed here; the rest
+        // is the project's own hook, because only the project knows what makes it runnable.
+        const branchAt = argv.indexOf('--branch');
+        const branch = branchAt >= 0 ? argv[branchAt + 1] : undefined;
+        if (branchAt >= 0 && (!branch || branch.startsWith('--'))) { say('rsc: --branch needs a branch name.'); process.exitCode = 1; return; }
+        const name = argv.slice(2).find((a, i, all) => !a.startsWith('--') && all[i - 1] !== '--branch');
+        if (!name) { say('Use: npx @damiangilgonzalez/harness worktrees new <nombre> [--branch <rama>]'); process.exitCode = 1; return; }
+        const out = W.createWorktree(root, name, { branch });
+        if (!out.created) { say(`rsc: ${out.reason}`); process.exitCode = 1; return; }
+        if (!out.fetched) say(`⚠️  git fetch origin failed (${out.fetchError || 'no detail'}); starting from the last known ${out.base}, which may be stale.`);
+        say(`✅ worktree ${out.path}`);
+        say(`   branch ${out.branch}, from ${out.base}`);
+        const hook = W.findPrepareHook(out.path, root);
+        if (hook) {
+          say(`   preparing it: ${hook}`);
+          const ran = W.runPrepareHook(hook, out.path, root);
+          if (!ran.ok) { say(`⚠️  the preparation hook failed (${ran.reason}). The worktree exists; finish preparing it by hand.`); process.exitCode = 1; }
+        } else {
+          say(`   No preparation hook (${W.PREPARE_HOOKS.join(' or ')}): .env files and dependencies are NOT copied — create the hook to do it on every new worktree.`);
+        }
+        say(`Next: cd "${out.path}"`);
+        return;
+      }
+
       if (!W.isCleanupEnabled(root)) {
         say(`worktree cleanup is off for this project (.rsc/${W.OPT_OUT}). Delete that file to turn it back on.`);
         return;
       }
 
+      if (sub === 'reap' && argv.includes('--merged')) {
+        // The bulk answer to "delete the worktrees" — asked four times in one project, with up to
+        // fourteen open. Merged is judged against origin's trunk AFTER a fetch, so a branch landed in
+        // the forge an hour ago counts. Without --confirm this only lists: one look, then one yes.
+        const fetched = W.fetchOrigin(root);
+        if (!fetched.ok) say(`⚠️  git fetch origin failed (${fetched.err || 'no detail'}); judging against the last known trunk.`);
+        const all = W.classifyWorktrees(root);
+        const merged = W.mergedCandidates(all);
+        const held = all.filter((c) => c.verdict === 'ask' && !merged.includes(c));
+        if (!merged.length) say('No merged worktree that can be removed in bulk.');
+        if (!argv.includes('--confirm')) {
+          if (merged.length) {
+            say(`${merged.length} merged worktree(s), clean, removable in one go:`);
+            for (const c of merged) say(`  ${c.path}${c.branch ? ` (${c.branch})` : ''}`);
+          }
+          for (const c of held) say(W.describe(c));
+          if (merged.length) say('\nRemove them all:  npx @damiangilgonzalez/harness worktrees reap --merged --confirm');
+          return;
+        }
+        for (const c of merged) {
+          const out = W.reapWorktree(root, c.path, { confirmed: true });
+          if (out.removed) {
+            say(`✅ removed ${out.path}`);
+            if (out.branchKept) say(`   branch ${out.branch} kept — git will not delete it safely, and while it exists the commits are recoverable.`);
+          } else {
+            say(`⏸  kept ${c.path} — ${out.reason}`);
+            process.exitCode = 1;
+          }
+        }
+        // What a bulk yes never covers, said out loud so nobody thinks it was forgotten.
+        for (const c of held) say(`⏸  kept ${c.path} — ${W.refusal(c)}`);
+        return;
+      }
+
       const candidates = W.classifyWorktrees(root).filter((c) => c.verdict !== 'skip');
 
       if (sub === 'reap') {
@@ -920,6 +981,7 @@ async function main() {
       say('');
       say('Remove the safe ones:  npx @damiangilgonzalez/harness worktrees reap');
       say('Remove one by name:    npx @damiangilgonzalez/harness worktrees reap <path> [--confirm]');
+      say('Remove every merged:   npx @damiangilgonzalez/harness worktrees reap --merged [--confirm]');
       return;
     }
     case 'capabilities': {
@@ -1195,7 +1257,7 @@ async function main() {
       return void (await runPurge(argv.includes('--dry-run'), argv.includes('--with-docs')));
     default:
       say(`rsc: unknown command '${cmd}'.`);
-      say('Use: npx @damiangilgonzalez/harness onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | memory <on|off|status|save|resume|learn|metrics> | sello <on|off|status|…> | worktrees [reap [path] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id> | purge');
+      say('Use: npx @damiangilgonzalez/harness onboard | reassess | add <id...> | install --profile <p> | consult "<text>" | list | capabilities [--full|gap-log] | audit | registry refresh | doctor | sync | memory <on|off|status|save|resume|learn|metrics> | sello <on|off|status|…> | worktrees [new <nombre> [--branch <rama>] | reap [path|--merged] [--confirm]] | backups | restore <id|latest> | upgrade | repair | uninstall <id> | purge');
       say('Any command takes --target <claude|codex|cursor|copilot|gemini|…> (comma-separate for several)');
       say('   → without it, rsc uses the assistant already installed here; if two are, it asks instead of guessing.');
       process.exitCode = 1;

package/skills/building-agents/SKILL.md

@@ -14,7 +14,7 @@ A thin provider adapter, a disciplined agent loop, schema-validated tools, provi
 
 > Program against a **capability interface**, never a vendor SDK. Vendor specifics (model id, tool-schema shape, JSON mode, caching, token limits) live behind one adapter resolved from config. Model names and prices rot — if one appears in business logic it's a bug, and re-verify the dated tables before quoting a number.
 
-**Hand off instead when:** a new non-trivial feature has no approved spec + plan under `docs/wiki/sdd/` → stop and write one first (the `to-spec` skill, or `superpowers:writing-plans`), which routes back here once the plan is approved; one-line/low-risk changes go straight through. Anthropic-SDK internals (caching, thinking, batch) in a file that *only* imports `anthropic` → `claude-api` if your environment has it, since this skill stays multi-provider. Workspace scaffolding → [`harness`](../harness/SKILL.md). Choosing *which* coding agent to use → agent-eval territory. Pure prompt-wording tuning with no architecture change → prompt engineering, not this. A one-shot throwaway prompt, or no retrieval/tools/loop/evals at all → you don't need an agent; call the SDK directly and say so.
+**Hand off instead when:** a new non-trivial feature has no approved spec + plan under `docs/wiki/sdd/` → stop and write one first (the `to-spec` skill, then `to-tickets`), which routes back here once the plan is approved; one-line/low-risk changes go straight through. Anthropic-SDK internals (caching, thinking, batch) in a file that *only* imports `anthropic` → `claude-api` if your environment has it, since this skill stays multi-provider. Workspace scaffolding → [`harness`](../harness/SKILL.md). Choosing *which* coding agent to use → agent-eval territory. Pure prompt-wording tuning with no architecture change → prompt engineering, not this. A one-shot throwaway prompt, or no retrieval/tools/loop/evals at all → you don't need an agent; call the SDK directly and say so.
 
 ## Decision rules (read before writing code)
 

package/skills/grill-with-docs/SKILL.md

@@ -2,7 +2,6 @@
 name: grill-with-docs
 description: "A relentless interrogation to sharpen a plan or design, which also builds documentation (ADRs and a glossary) along the way."
 tags: ["planning", "questioning", "documentation", "adr"]
-disable-model-invocation: true
 profiles: [core, ui, full]
 origin: damiangil
 ---

package/skills/harness/references/daily-curation-automation.md

@@ -42,7 +42,8 @@ process inbox/, then scan the workspace (minus .rscignore) for un-ingested docum
 applying Clean-as-you-go (move loose root-level + inbox files into raw/ after a
 verified ingest; copy files nested in user-maintained folders and propose
 consolidation), record them in wiki/.ingested.json, and list ambiguous folders as
-proposals (do not grab them). Then compile pending raw/worklog/ material into wiki/
+proposals (do not grab them). Then compile pending raw/worklog/ material (skip this
+step if raw/worklog/ does not exist; do not list a missing folder) into wiki/
 pages (update existing before creating new), keep frontmatter + relative markdown
 links OKF-consistent, append significant decisions to wiki/harness/decisions.md,
 refresh the .base-backed navigation, recompute scores.json + the score: property,

package/skills/harness/references/wiki-protocol.md

@@ -417,7 +417,9 @@ safety rule the curation pass honors.
 ### Steps
 
 1. **Capture.** Write the worklog to `raw/worklog/YYYY-MM-DD-<slug>.md`
-   (`status: unprocessed`). Infer `topic` from content.
+   (`status: unprocessed`). Infer `topic` from content. If `raw/worklog/` does
+   not exist yet, create it (`mkdir -p`) — never list it blindly: the checkpoint
+   hook already says whether it exists and how many worklogs it holds.
 2. **Compile.** Run the normal Compile (Fetch is a no-op — the worklog is already
    `raw`): distill durable points into `wiki/<topic>/` articles (update existing
    before creating new), add markdown-link cross-refs + `## Related`, cascade.

package/skills/implement/SKILL.md

@@ -2,7 +2,6 @@
 name: implement
 description: "Implements a piece of work from a spec or a set of tickets."
 tags: ["implementation", "spec", "tickets"]
-disable-model-invocation: true
 profiles: [core, ui, full]
 origin: damiangil
 ---

package/skills/implement-spec/SKILL.md

@@ -2,12 +2,11 @@
 name: implement-spec
 description: "Implement the result of /to-spec and /to-tickets in code, orchestrating parallel implementer subagents over the ticket graph."
 tags: ["implementation", "spec", "tickets", "subagents", "orchestration"]
-disable-model-invocation: true
 profiles: [core, ui, full]
 origin: damiangil
 ---
 
-Te han dado una spec. Esa spec debería tener tickets asociados que describen cómo implementarla.
+Te han dado una spec. Esa spec debería tener tickets asociados que describen cómo implementarla. Si no los tiene, **para**: lanza `to-tickets` sobre la spec y vuelve aquí con el grafo ya publicado. Sin tickets no hay frontera que repartir, y esto se convierte en una implementación a ciegas.
 
 El issue tracker debería estar descrito en `docs/agents/issue-tracker.md`. Si falta, pregunta al usuario dónde viven los tickets y cómo se cierra el trabajo (PR, issue, fichero).
 

package/skills/init/SKILL.md

@@ -165,11 +165,13 @@ means the user starts clean.
    machine and flags overlap or skills with no footprint, so the project starts with the right set
    rather than a pile. Summarize at their level.
 4. **Tell them about the danger guard.** A `technical_level` of `non-technical` or `mixed` (and the
-   state before any profile exists) turns on a `PreToolUse` guard that blocks irreversible commands —
-   `rm -rf`, `git push --force`, `git reset --hard`, `DROP`/`TRUNCATE`, `DELETE`/`UPDATE` with no
-   `WHERE`, `dd` to a device, `curl | bash` — and asks for a safer alternative. A fully `technical`
-   user is never guarded. It turns off only if the user explicitly asks: `.rsc/.no-danger-guard`.
-   Mention it when you set a non-technical level, so a later block is not a surprise.
+   state before any profile exists) turns on a `PreToolUse` guard for irreversible commands —
+   `rm -rf`, `git push --force`, `git reset --hard`, `git branch -D`, `DROP`/`TRUNCATE`,
+   `DELETE`/`UPDATE` with no `WHERE`, `dd` to a device, `curl | bash`. For `non-technical` (or no
+   profile) Claude Code asks the user to confirm each one, saying what the command destroys; their
+   yes is the order that runs it. For `mixed` it only warns. A fully `technical` user is never
+   guarded. It turns off only if the user explicitly asks: `.rsc/.no-danger-guard`.
+   Mention it when you set a non-technical level, so a later confirmation is not a surprise.
 
 ### Phase 5 — HANDOFF
 

package/skills/postgresdb/SKILL.md

@@ -13,7 +13,7 @@ fix slow SQL, run zero-downtime migrations, and operate/secure the database. Too
 example is runnable.
 
 New, non-trivial feature with no approved spec + plan under `docs/wiki/sdd/`? Hand off to
-the `to-spec` skill before writing feature code (or `superpowers:writing-plans`); build
+the `to-spec` skill before writing feature code (then `to-tickets`); build
 straight from here only for a genuinely one-line, low-risk change.
 
 Deep dives: [schema-and-indexing](references/schema-and-indexing.md) (types, constraints, every index

package/skills/suggest/SKILL.md

@@ -34,8 +34,8 @@ The shape of the chain:
   when the effort will not fit one sitting.
 - Once the shape is known, capture it as a spec, and give any call that would be costly to undo
   its own ADR.
-- Build from a written plan. Tickets are the exception: only work that grew out of the
-  wayfinding step is broken into them first. A screen also routes through `flujo-interfaz`.
+- Small work builds straight from the clarified ask; big work is split into tickets first and
+  built from them. A screen also routes through `flujo-interfaz`.
 - Review the finished change against the repo's standards and against the spec before merging.
 
 Two exceptions, and say out loud when you take one:
@@ -54,9 +54,9 @@ whole run — advance through the phases without re-asking.
 If a step's skill is not installed, offer to add it (§2) before routing. `implement` always
 pairs with test-driven development and a verification pass before anything is called done.
 
-Exact skill names and order: `grill-with-docs` or `wayfinder` -> `superpowers:brainstorming` or
-`to-spec` (and `write-adr` for decisions) -> `superpowers:writing-plans` ->
-`superpowers:executing-plans` (big spec: `to-tickets` -> `implement-spec`) -> `code-review` -> `pr`.
+Exact skill names, by size. Small: `superpowers:brainstorming` or `grill-with-docs` ->
+`implement`. Big: `grill-with-docs` or `wayfinder` -> `to-spec` -> `to-tickets` ->
+`implement-spec`. Both: `write-adr` for decisions, then `code-review` -> `pr`.
 On Claude Code this rule also arrives as a per-turn hook; the brevity here is deduplication,
 not relaxation.
 

package/skills/to-spec/SKILL.md

@@ -2,7 +2,6 @@
 name: to-spec
 description: "Turns the current conversation into a spec (PRD) and publishes it to the project's issue tracker — no interview, just a synthesis of what has already been discussed."
 tags: ["spec", "prd", "issue-tracker"]
-disable-model-invocation: true
 profiles: [core, ui, full]
 origin: damiangil
 ---

package/skills/to-tickets/SKILL.md

@@ -2,7 +2,6 @@
 name: to-tickets
 description: "Breaks down a plan, a spec, or the current conversation into a set of \\"tracer bullet\\" tickets (vertical slices), each declaring which tickets block it, and publishes them to the configured tracker — as local files (one per ticket) or as issues with native blocking links in a real tracker."
 tags: ["tickets", "planning", "issue-tracker"]
-disable-model-invocation: true
 profiles: [core, ui, full]
 origin: damiangil
 ---

package/skills/wayfinder/SKILL.md

@@ -2,7 +2,6 @@
 name: wayfinder
 description: "Plans a huge chunk of work — more than fits in a single agent session — as a shared map of decision tickets in the repo's issue tracker, and resolves them one at a time until the path to the destination is clear."
 tags: ["planning", "issue-tracker", "large-scale-work"]
-disable-model-invocation: true
 profiles: [core, ui, full]
 origin: damiangil
 ---

package/targets/_md-block.js

@@ -21,7 +21,7 @@ export function writeSkill(id, fromDir, toPath) {
 export function wireHook(paths, sourceMd, policy = {}) {
   const full = stripFrontmatter(readFileSync(sourceMd, 'utf8'));
   const body = policy.codeHooks === false
-    ? `# rsc-suggest — always-on operations layer\n\nRead \`docs/wiki/harness/user-profile.md\` before acting. If the user wants to build, add or change something, route it through \`grill-with-docs\` or \`wayfinder\`, then write the spec with \`superpowers:brainstorming\` or \`to-spec\` (decisions go to \`write-adr\`) before any code, then build it with \`superpowers:writing-plans\` (or \`to-tickets\` then \`implement-spec\` for a big spec or one that came out of \`wayfinder\`), and review it with \`code-review\` before merging, writing the PR body with \`pr\` (si toca pantalla, \`flujo-interfaz\` dice que skill de diseno manda) — unless it is a one-line change, typo, or config bump, which skips the chain. Use \`orient\` to keep the user situated and \`suggest\` to offer a missing skill only when the current task needs it. Close with the configured orientation block.\n`
+    ? `# rsc-suggest — always-on operations layer\n\nRead \`docs/wiki/harness/user-profile.md\` before acting. If the user wants to build, add or change something, pick the chain by size and chain each step yourself. Small (one sitting, one ticket): clarify with \`superpowers:brainstorming\` (idea still vague) or \`grill-with-docs\` (a plan to harden), then build with \`implement\`. Big: \`grill-with-docs\` or \`wayfinder\` -> \`to-spec\` -> \`to-tickets\` -> \`implement-spec\`. Hard-to-reverse decisions go to \`write-adr\`; review with \`code-review\` and write the PR with \`pr\` before merging (si toca pantalla, \`flujo-interfaz\` dice que skill de diseno manda) — unless it is a one-line change, typo, or config bump, which skips the chain. Use \`orient\` to keep the user situated and \`suggest\` to offer a missing skill only when the current task needs it. Close with the configured orientation block.\n`
     : full;
   const block = `${MARK_START}\n${body}\n${MARK_END}`;
   let doc = existsSync(paths.hookTarget) ? readFileSync(paths.hookTarget, 'utf8') : '';

package/targets/claude.js

@@ -175,7 +175,8 @@ export function wireHook(paths, sourceMd, policy = {}) {
 
   if (policy.codeHooks !== false) {
   // Ship guard: a PreToolUse(Bash) hook that DENIES switching to / merging the trunk
-  // while the current feature branch has uncommitted or unpushed work — forcing the
+  // while the current feature branch has unpushed commits (uncommitted changes only get a
+  // worktree hint: they may be the user's own) — forcing the
   // commit → push → PR close (the `ship` skill). Materialized + node-run (Windows-safe),
   // registered idempotently, fail-open, opt-out via .rsc/.no-ship-guard. Other
   // (non-rsc) PreToolUse hooks are preserved.

package/targets/danger-guard.mjs

@@ -3,37 +3,43 @@
 // as `node ...` so it runs on every platform including Windows.
 //   argv[2] = absolute project root   stdin = PreToolUse hook JSON
 //
-// For a NON-TECHNICAL user (per docs/wiki/harness/user-profile.md → technical_level),
-// it DENIES irreversible, foot-gun Bash commands and tells the agent to find a safer,
-// scoped alternative. A fully `technical` user is never guarded. Default-safe: if there
-// is no profile yet, the harness convention is "assume non-technical", so the guard is ON.
+// It catches irreversible, foot-gun shell commands and puts a HUMAN in front of them. What it does
+// depends on docs/wiki/harness/user-profile.md -> technical_level:
+//   - technical      -> never guarded.
+//   - mixed          -> not blocked: the command goes through the normal permission flow, with a
+//                       one-line warning that names the risk.
+//   - non-technical  -> `ask`: Claude Code shows the user a confirmation. Their approval IS the
+//     or no profile     explicit order that unblocks it (default-safe: no profile = assume
+//                       non-technical, so the guard is ON).
 //
-// Disable per project with .rsc/.no-danger-guard — but only when the USER explicitly asks
-// for it (the deny message says so). Fail-open on any internal error (never brick a shell).
+// It used to `deny` for everyone below `technical`, with a reason that began "BLOCKED for a
+// non-technical user". In real sessions that denied ~20 `rm -rf` / `git branch -D` the user had
+// just asked for in so many words ("bórrala"): a deny cannot be overridden from the conversation,
+// so the order never reached the shell, and the label sent the agent into over-explaining to
+// someone it had just been told was not technical. `ask` keeps the stop and lets the person
+// decide; the message describes the COMMAND's risk and never the user.
+//
+// Disable per project with .rsc/.no-danger-guard — only when the USER explicitly asks for it.
+// Fail-open on any internal error (never brick a shell).
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 const root = process.argv[2] || process.cwd();
 
 function allow() { process.exit(0); }
-function deny(why) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason:
-        `BLOCKED for a non-technical user — this command ${why}. ` +
-        `Do NOT run it: explain the risk in plain language and propose a safer, scoped alternative ` +
-        `(name exact paths, add a WHERE clause, back up first, etc.). ` +
-        `Only if the USER explicitly insists on allowing dangerous commands here, create .rsc/.no-danger-guard to disable this guard.`,
-    },
-  }));
+// `ask` is the human gate; `mixed` gets a warning and no decision at all, so whatever permission
+// rules the project already has still apply (an explicit `allow` here would bypass them).
+function stop(why) {
+  const reason = `Este comando ${why}. No se puede deshacer: confirma solo si es lo que quieres.`;
+  const out = level === 'mixed'
+    ? { systemMessage: `Aviso: este comando ${why}.` }
+    : { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask', permissionDecisionReason: reason } };
+  process.stdout.write(JSON.stringify(out));
   process.exit(0);
 }
 
 if (existsSync(join(root, '.rsc', '.no-danger-guard'))) allow();
 
-// technical_level === 'technical' → not guarded. non-technical / mixed / missing → guarded.
 function technicalLevel() {
   try {
     const txt = readFileSync(join(root, 'docs', 'wiki', 'harness', 'user-profile.md'), 'utf8');
@@ -41,14 +47,41 @@ function technicalLevel() {
     return m ? m[1].toLowerCase() : null;
   } catch { return null; }
 }
-if (technicalLevel() === 'technical') allow();
+const level = technicalLevel();
+if (level === 'technical') allow();
 
-// Only Bash commands can be dangerous here.
+// Only shell commands can be dangerous here.
 let input = {};
 try { input = JSON.parse(readFileSync(0, 'utf8') || '{}'); } catch { allow(); }
 if (!['Bash', 'PowerShell'].includes(input.tool_name || input.toolName)) allow();
-const cmd = input.tool_input?.command || input.toolInput?.command || '';
-if (typeof cmd !== 'string' || !cmd) allow();
+const raw = input.tool_input?.command || input.toolInput?.command || '';
+if (typeof raw !== 'string' || !raw) allow();
+
+// --- text that is written, not run ------------------------------------------
+// A heredoc body or the value of a message flag is DATA: `cat > doc.md <<'EOF' … rm -rf … EOF`,
+// `git commit -m "… rm -rf …"`, `gh pr create --body "| rm -rf /agent |"`. The guard matched all of
+// them — a markdown table even splits on `|` into a segment that starts with `rm`. They are stripped
+// before any rule looks at the command. A heredoc fed to something that EXECUTES it (a shell, a SQL
+// client, mongosh) keeps its body: `bash <<EOF rm -rf / EOF` really does delete.
+const INTERPRETER = /(^|[\s|;&(])(sudo\s+)?(bash|sh|zsh|dash|ksh|psql|mysql|mariadb|sqlite3|mongosh|mongo|duckdb|clickhouse-client)(?=\s|$)/;
+function stripHeredocs(text) {
+  const lines = text.split('\n');
+  const out = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    out.push(lines[i]);
+    const m = lines[i].match(/(?<!<)<<(?!<)-?\s*(['"]?)([A-Za-z_][\w.-]*)\1/);
+    if (!m) continue;
+    let end = i + 1;
+    while (end < lines.length && lines[end].trim() !== m[2]) end += 1;
+    if (end >= lines.length) continue; // unterminated: leave it, judge what is there
+    if (INTERPRETER.test(lines[i])) out.push(...lines.slice(i + 1, end));
+    out.push(lines[end]);
+    i = end;
+  }
+  return out.join('\n');
+}
+const MESSAGE_FLAG = /(\s(?:-m|--message|-b|--body|-t|--title|--notes|--description)(?:\s+|=))("(?:[^"\\]|\\[\s\S])*"|'[^']*')/g;
+const cmd = stripHeredocs(raw).replace(MESSAGE_FLAG, '$1""');
 
 // --- the dangerous-command list ---------------------------------------------
 // High-signal, low-false-positive. Each rule: what it catches and the plain why.
@@ -84,7 +117,32 @@ const SHELLS = /^(bash|sh|zsh|dash|ksh)$/i;
 // this, `echo "never run rm -rf /"` was denied — the guard blocking the conversation about a
 // command instead of the command, exactly the defect the gitmoji guard had to fix with its own
 // RUNS_GIT check. A guard that argues with you about a sentence is a guard you turn off.
-function runsRm(segment) {
+//
+// Split on shell separators that are OUTSIDE quotes. Splitting the raw string cut `echo "a | rm -rf x"`
+// into a segment that begins with `rm`.
+function splitTopLevel(text) {
+  const parts = [];
+  let cur = '';
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) {
+      if (c === '\\' && quote === '"') { cur += c + (text[i + 1] ?? ''); i += 1; continue; }
+      if (c === quote) quote = null;
+      cur += c;
+      continue;
+    }
+    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (c === '\n' || c === ';' || c === '|' || c === '&') { parts.push(cur); cur = ''; continue; }
+    cur += c;
+  }
+  parts.push(cur);
+  return parts;
+}
+
+// Is this segment a recursive force delete? A shell with -c is walked INTO — `bash -c "cd x && rm -rf y"`
+// really deletes — by judging its quoted script the same way, a few levels deep at most.
+function segmentIsRmRf(segment, depth) {
   const tokens = segment.trim().split(/\s+/).filter(Boolean);
   let i = 0;
   while (i < tokens.length) {
@@ -92,47 +150,51 @@ function runsRm(segment) {
     if (WRAPPERS.test(bare)) { i += 1; continue; }
     if (SHELLS.test(bare)) {
       i += 1;
-      while (i < tokens.length && /^-/.test(tokens[i])) i += 1; // skip -c and friends
+      let script = false;
+      while (i < tokens.length && /^-/.test(tokens[i])) { if (/c/.test(tokens[i])) script = true; i += 1; }
+      if (script && depth < 3) {
+        const body = tokens.slice(i).join(' ').replace(/^(['"])([\s\S]*)\1$/, '$2');
+        return commandIsRmRf(body, depth + 1);
+      }
       continue;
     }
-    return bare === 'rm' || bare.endsWith('/rm');
-  }
-  return false;
-}
-
-function isRmRecursiveForce() {
-  if (!/\brm\b/.test(cmd)) return false;
-  for (const segment of cmd.split(/\|\||&&|[|;&]/)) {
-    if (!runsRm(segment)) continue;
+    if (bare !== 'rm' && !bare.endsWith('/rm')) return false;
     const flags = rmFlagsIn(segment);
     const hasR = flags.some((f) => /^--recursive$/i.test(f) || /^-[A-Za-z]*r/i.test(f));
     const hasF = flags.some((f) => /^--force$/i.test(f) || /^-[A-Za-z]*f/i.test(f));
-    if (hasR && hasF) return true; // -rf / -fr / -Rf / -r -f / --recursive --force
+    return hasR && hasF; // -rf / -fr / -Rf / -r -f / --recursive --force
   }
   return false;
 }
 
+function commandIsRmRf(text, depth = 0) {
+  if (!/\brm\b/.test(text)) return false;
+  return splitTopLevel(text).some((segment) => segmentIsRmRf(segment, depth));
+}
+
+function isRmRecursiveForce() { return commandIsRmRf(cmd); }
+
 const RULES = [
-  { id: 'rm-rf', why: 'deletes whole files/folders irreversibly (rm with -r and -f)', match: isRmRecursiveForce },
-  { id: 'find-delete', why: 'mass-deletes matched files (find … -delete / -exec rm)', match: () => /\bfind\b[^|;&]*(-delete\b|-exec\s+rm\b)/i.test(cmd) },
-  { id: 'dd-disk', why: 'overwrites a raw disk device and can destroy the whole drive (dd of=/dev/…)', match: () => /\bdd\b[^|;&]*\bof=\/dev\//i.test(cmd) },
-  { id: 'mkfs', why: 'formats a filesystem, erasing everything on it (mkfs)', match: () => /\bmkfs(\.\w+)?\b/i.test(cmd) },
-  { id: 'curl-pipe-shell', why: 'pipes a downloaded script straight into a shell (curl|bash) — runs untrusted code', match: () => /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i.test(cmd) },
-
-  { id: 'git-push-force', why: 'force-pushes and can overwrite shared history for everyone (git push --force)', match: () => /\bgit\s+push\b[^|;&]*(--force(?!-with-lease)\b|\s-f\b)/i.test(cmd) },
-  { id: 'git-reset-hard', why: 'throws away all uncommitted work with no undo (git reset --hard)', match: () => /\bgit\s+reset\b[^|;&]*--hard\b/i.test(cmd) },
-  { id: 'git-clean', why: 'permanently deletes untracked files (git clean -f)', match: () => /\bgit\s+clean\b[^|;&]*-[a-z]*f/i.test(cmd) },
-  { id: 'git-branch-D', why: 'force-deletes a branch even if its work was never merged (git branch -D)', match: () => /\bgit\s+branch\b[^|;&]*\s-D\b/.test(cmd) },
-
-  { id: 'sql-drop', why: 'drops an entire database/schema/table (DROP …)', match: () => /\bdrop\s+(database|schema|table)\b/i.test(cmd) },
-  { id: 'sql-truncate', why: 'empties an entire table (TRUNCATE)', match: () => /\btruncate\s+(table\s+)?\S/i.test(cmd) },
-  { id: 'sql-delete-no-where', why: 'deletes EVERY row — a DELETE with no WHERE clause', match: () => noWhere(/\bdelete\s+from\s+\S/i) },
-  { id: 'sql-update-no-where', why: 'rewrites EVERY row — an UPDATE with no WHERE clause', match: () => noWhere(/\bupdate\s+\S+\s+set\b/i) },
-  { id: 'mongo-wipe', why: 'drops a collection/database or deletes all documents (drop()/dropDatabase/deleteMany({}))', match: () => /\.drop\(\s*\)|dropdatabase\s*\(|deletemany\(\s*\{\s*\}\s*\)|\.remove\(\s*\{\s*\}\s*\)/i.test(cmd) },
+  { id: 'rm-rf', why: 'borra archivos o carpetas enteras de forma irreversible (rm con -r y -f)', match: isRmRecursiveForce },
+  { id: 'find-delete', why: 'borra en masa todos los archivos que encuentra (find … -delete / -exec rm)', match: () => /\bfind\b[^|;&]*(-delete\b|-exec\s+rm\b)/i.test(cmd) },
+  { id: 'dd-disk', why: 'sobrescribe un disco entero y puede destruir todo lo que contiene (dd of=/dev/…)', match: () => /\bdd\b[^|;&]*\bof=\/dev\//i.test(cmd) },
+  { id: 'mkfs', why: 'formatea un sistema de archivos y borra todo lo que hay en él (mkfs)', match: () => /\bmkfs(\.\w+)?\b/i.test(cmd) },
+  { id: 'curl-pipe-shell', why: 'ejecuta un script descargado sin revisarlo (curl | bash): código que no conocemos', match: () => /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i.test(cmd) },
+
+  { id: 'git-push-force', why: 'reescribe en el remoto el historial compartido, para todos (git push --force)', match: () => /\bgit\s+push\b[^|;&]*(--force(?!-with-lease)\b|\s-f\b)/i.test(cmd) },
+  { id: 'git-reset-hard', why: 'descarta todo el trabajo sin commitear y no hay forma de recuperarlo (git reset --hard)', match: () => /\bgit\s+reset\b[^|;&]*--hard\b/i.test(cmd) },
+  { id: 'git-clean', why: 'borra para siempre los archivos que git no sigue (git clean -f)', match: () => /\bgit\s+clean\b[^|;&]*-[a-z]*f/i.test(cmd) },
+  { id: 'git-branch-D', why: 'borra una rama aunque su trabajo no esté fusionado (git branch -D)', match: () => /\bgit\s+branch\b[^|;&]*\s-D\b/.test(cmd) },
+
+  { id: 'sql-drop', why: 'elimina una base de datos, esquema o tabla entera (DROP …)', match: () => /\bdrop\s+(database|schema|table)\b/i.test(cmd) },
+  { id: 'sql-truncate', why: 'vacía una tabla entera (TRUNCATE)', match: () => /\btruncate\s+(table\s+)?\S/i.test(cmd) },
+  { id: 'sql-delete-no-where', why: 'borra todas las filas: es un DELETE sin WHERE', match: () => noWhere(/\bdelete\s+from\s+\S/i) },
+  { id: 'sql-update-no-where', why: 'reescribe todas las filas: es un UPDATE sin WHERE', match: () => noWhere(/\bupdate\s+\S+\s+set\b/i) },
+  { id: 'mongo-wipe', why: 'elimina una colección o base de datos, o todos sus documentos (drop()/dropDatabase/deleteMany({}))', match: () => /\.drop\(\s*\)|dropdatabase\s*\(|deletemany\(\s*\{\s*\}\s*\)|\.remove\(\s*\{\s*\}\s*\)/i.test(cmd) },
 ];
 
 for (const rule of RULES) {
-  try { if (rule.match()) deny(rule.why); } catch { /* a rule erroring must never block */ }
+  try { if (rule.match()) stop(rule.why); } catch { /* a rule erroring must never block */ }
 }
 
 allow();

package/targets/hook-once.mjs

@@ -94,25 +94,56 @@ Responde en el idioma en que escribe la persona, no en el de este texto.
 Si el usuario pide construir, anadir o cambiar algo (en cualquier idioma, se juzga la intencion),
 sigue esta cadena ANTES de escribir codigo. Ninguna skill escribe codigo de una feature hasta que
 el que esta claro y el usuario ha dado el visto bueno.
-1. Aclarar el que:
-   - Peticion concreta y acotada -> \`grill-with-docs\`.
-   - Tema amplio, o el usuario no sabe como abordarlo -> recomiendale \`wayfinder\`.
-   - \`superpowers:brainstorming\` vale para lo mismo si el usuario lo prefiere.
-   Cada decision dificil de revertir se registra con \`write-adr\`, en docs/adr/.
-2. Escribir la spec: \`to-spec\`, o \`superpowers:brainstorming\` para cerrarla por secciones.
-   Sin spec escrita no se programa.
-3. Construir: \`superpowers:writing-plans\` -> \`superpowers:executing-plans\`. Spec grande o que
-   salio de \`wayfinder\` -> \`to-tickets\` -> \`implement-spec\` (subagentes en paralelo sobre el
-   grafo de tickets); un solo ticket suelto -> \`implement\`.
-   Si la tarea toca pantalla, invoca ademas \`flujo-interfaz\`: dice que skill de diseno manda.
-4. Antes de fusionar: \`code-review\` (estandares del repo + lo que pedia la spec), y el cuerpo
-   de la PR con \`pr\` (resumen visual, evidencia antes/despues, peligro de fusion).
+Elige la cadena por el tamano y encadena tu mismo cada paso, sin esperar a que el usuario lo pida:
+- Pequeno (cabe en una sesion, un solo ticket):
+  1. Aclarar: \`superpowers:brainstorming\` si la idea aun esta verde; \`grill-with-docs\` si ya
+     hay un plan que endurecer.
+  2. Construir: \`implement\`.
+- Grande (varias sesiones o muchas piezas):
+  1. Aclarar: \`grill-with-docs\`; tema amplio o sin camino claro -> \`wayfinder\`.
+  2. Escribir la spec: \`to-spec\`. Sin spec escrita no se programa.
+  3. Partirla: \`to-tickets\` (grafo de tickets con bloqueos). Sin tickets no hay \`implement-spec\`.
+  4. Construir: \`implement-spec\` (subagentes en paralelo sobre el grafo de tickets).
+En ambas: cada decision dificil de revertir va a \`write-adr\`, en docs/adr/.
+Si la tarea toca pantalla, invoca ademas \`flujo-interfaz\`: dice que skill de diseno manda.
+Antes de fusionar: \`code-review\` (estandares del repo + lo que pedia la spec), y la PR con \`pr\`.
 Siempre: \`superpowers:test-driven-development\` y \`superpowers:verification-before-completion\`
 antes de dar nada por terminado. Los bugs entran por \`superpowers:systematic-debugging\`.
 Cambio de una linea, typo o ajuste de configuracion -> hazlo y di que te saltas la cadena.
 ==========================================================
 `;
 
+// Some skills the gate names carry `disable-model-invocation: true`: the Skill tool refuses them,
+// so telling the agent to "use `to-spec`" sends it into a refusal and the user ends up typing the
+// command anyway. The flag lives in each SKILL.md, so the gate reads it from there at emit time
+// instead of keeping a second, hand-written list that drifts. Each flagged id is rendered as the
+// slash command the user has to type, plus one line saying so. `roots` are searched in order
+// (project, then user scope); the first SKILL.md found decides. Fail-safe: a skill whose file
+// cannot be read keeps the current wording — this runs every turn and must never break the gate.
+const GATE_ID = /`([a-z][a-z0-9-]*)`/g;
+export function renderGate(text, roots = []) {
+  const manual = [];
+  for (const id of new Set([...text.matchAll(GATE_ID)].map((m) => m[1]))) {
+    for (const r of roots) {
+      let md;
+      try { md = readFileSync(join(r, '.claude', 'skills', id, 'SKILL.md'), 'utf8'); } catch { continue; }
+      const fm = md.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      if (fm && /^disable-model-invocation:\s*true\s*$/m.test(fm[1])) manual.push(id);
+      break;
+    }
+  }
+  if (!manual.length) return text;
+  const flagged = new Set(manual);
+  const lines = text.replace(GATE_ID, (m, id) => (flagged.has(id) ? `\`/${id}\`` : m)).split('\n');
+  const note = `Las que van con / (${manual.map((id) => `\`/${id}\``).join(', ')}) no las lances tu: la\n` +
+    `herramienta Skill las rechaza. Pide al usuario que escriba \`/<skill>\` (p. ej. \`/${manual[0]}\`).`;
+  let close = lines.length - 1;
+  while (close > 0 && !lines[close].startsWith('=====')) close -= 1;
+  if (close <= 0) return `${lines.join('\n')}\n${note}\n`;
+  lines.splice(close, 0, note);
+  return lines.join('\n');
+}
+
 /**
  * Parse the hook payload Claude Code writes to stdin.
  * Pass `raw` explicitly in tests; in a hook, call with no argument to read fd 0.