@damiangilgonzalez/harness 1.3.17 → 1.3.19

package/targets/danger-guard.mjs

@@ -3,37 +3,43 @@
 // as `node ...` so it runs on every platform including Windows.
 //   argv[2] = absolute project root   stdin = PreToolUse hook JSON
 //
-// For a NON-TECHNICAL user (per docs/wiki/harness/user-profile.md → technical_level),
-// it DENIES irreversible, foot-gun Bash commands and tells the agent to find a safer,
-// scoped alternative. A fully `technical` user is never guarded. Default-safe: if there
-// is no profile yet, the harness convention is "assume non-technical", so the guard is ON.
+// It catches irreversible, foot-gun shell commands and puts a HUMAN in front of them. What it does
+// depends on docs/wiki/harness/user-profile.md -> technical_level:
+//   - technical      -> never guarded.
+//   - mixed          -> not blocked: the command goes through the normal permission flow, with a
+//                       one-line warning that names the risk.
+//   - non-technical  -> `ask`: Claude Code shows the user a confirmation. Their approval IS the
+//     or no profile     explicit order that unblocks it (default-safe: no profile = assume
+//                       non-technical, so the guard is ON).
 //
-// Disable per project with .rsc/.no-danger-guard — but only when the USER explicitly asks
-// for it (the deny message says so). Fail-open on any internal error (never brick a shell).
+// It used to `deny` for everyone below `technical`, with a reason that began "BLOCKED for a
+// non-technical user". In real sessions that denied ~20 `rm -rf` / `git branch -D` the user had
+// just asked for in so many words ("bórrala"): a deny cannot be overridden from the conversation,
+// so the order never reached the shell, and the label sent the agent into over-explaining to
+// someone it had just been told was not technical. `ask` keeps the stop and lets the person
+// decide; the message describes the COMMAND's risk and never the user.
+//
+// Disable per project with .rsc/.no-danger-guard — only when the USER explicitly asks for it.
+// Fail-open on any internal error (never brick a shell).
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 const root = process.argv[2] || process.cwd();
 
 function allow() { process.exit(0); }
-function deny(why) {
-  process.stdout.write(JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason:
-        `BLOCKED for a non-technical user — this command ${why}. ` +
-        `Do NOT run it: explain the risk in plain language and propose a safer, scoped alternative ` +
-        `(name exact paths, add a WHERE clause, back up first, etc.). ` +
-        `Only if the USER explicitly insists on allowing dangerous commands here, create .rsc/.no-danger-guard to disable this guard.`,
-    },
-  }));
+// `ask` is the human gate; `mixed` gets a warning and no decision at all, so whatever permission
+// rules the project already has still apply (an explicit `allow` here would bypass them).
+function stop(why) {
+  const reason = `Este comando ${why}. No se puede deshacer: confirma solo si es lo que quieres.`;
+  const out = level === 'mixed'
+    ? { systemMessage: `Aviso: este comando ${why}.` }
+    : { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask', permissionDecisionReason: reason } };
+  process.stdout.write(JSON.stringify(out));
   process.exit(0);
 }
 
 if (existsSync(join(root, '.rsc', '.no-danger-guard'))) allow();
 
-// technical_level === 'technical' → not guarded. non-technical / mixed / missing → guarded.
 function technicalLevel() {
   try {
     const txt = readFileSync(join(root, 'docs', 'wiki', 'harness', 'user-profile.md'), 'utf8');
@@ -41,14 +47,41 @@ function technicalLevel() {
     return m ? m[1].toLowerCase() : null;
   } catch { return null; }
 }
-if (technicalLevel() === 'technical') allow();
+const level = technicalLevel();
+if (level === 'technical') allow();
 
-// Only Bash commands can be dangerous here.
+// Only shell commands can be dangerous here.
 let input = {};
 try { input = JSON.parse(readFileSync(0, 'utf8') || '{}'); } catch { allow(); }
 if (!['Bash', 'PowerShell'].includes(input.tool_name || input.toolName)) allow();
-const cmd = input.tool_input?.command || input.toolInput?.command || '';
-if (typeof cmd !== 'string' || !cmd) allow();
+const raw = input.tool_input?.command || input.toolInput?.command || '';
+if (typeof raw !== 'string' || !raw) allow();
+
+// --- text that is written, not run ------------------------------------------
+// A heredoc body or the value of a message flag is DATA: `cat > doc.md <<'EOF' … rm -rf … EOF`,
+// `git commit -m "… rm -rf …"`, `gh pr create --body "| rm -rf /agent |"`. The guard matched all of
+// them — a markdown table even splits on `|` into a segment that starts with `rm`. They are stripped
+// before any rule looks at the command. A heredoc fed to something that EXECUTES it (a shell, a SQL
+// client, mongosh) keeps its body: `bash <<EOF rm -rf / EOF` really does delete.
+const INTERPRETER = /(^|[\s|;&(])(sudo\s+)?(bash|sh|zsh|dash|ksh|psql|mysql|mariadb|sqlite3|mongosh|mongo|duckdb|clickhouse-client)(?=\s|$)/;
+function stripHeredocs(text) {
+  const lines = text.split('\n');
+  const out = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    out.push(lines[i]);
+    const m = lines[i].match(/(?<!<)<<(?!<)-?\s*(['"]?)([A-Za-z_][\w.-]*)\1/);
+    if (!m) continue;
+    let end = i + 1;
+    while (end < lines.length && lines[end].trim() !== m[2]) end += 1;
+    if (end >= lines.length) continue; // unterminated: leave it, judge what is there
+    if (INTERPRETER.test(lines[i])) out.push(...lines.slice(i + 1, end));
+    out.push(lines[end]);
+    i = end;
+  }
+  return out.join('\n');
+}
+const MESSAGE_FLAG = /(\s(?:-m|--message|-b|--body|-t|--title|--notes|--description)(?:\s+|=))("(?:[^"\\]|\\[\s\S])*"|'[^']*')/g;
+const cmd = stripHeredocs(raw).replace(MESSAGE_FLAG, '$1""');
 
 // --- the dangerous-command list ---------------------------------------------
 // High-signal, low-false-positive. Each rule: what it catches and the plain why.
@@ -84,7 +117,32 @@ const SHELLS = /^(bash|sh|zsh|dash|ksh)$/i;
 // this, `echo "never run rm -rf /"` was denied — the guard blocking the conversation about a
 // command instead of the command, exactly the defect the gitmoji guard had to fix with its own
 // RUNS_GIT check. A guard that argues with you about a sentence is a guard you turn off.
-function runsRm(segment) {
+//
+// Split on shell separators that are OUTSIDE quotes. Splitting the raw string cut `echo "a | rm -rf x"`
+// into a segment that begins with `rm`.
+function splitTopLevel(text) {
+  const parts = [];
+  let cur = '';
+  let quote = null;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i];
+    if (quote) {
+      if (c === '\\' && quote === '"') { cur += c + (text[i + 1] ?? ''); i += 1; continue; }
+      if (c === quote) quote = null;
+      cur += c;
+      continue;
+    }
+    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if (c === '\n' || c === ';' || c === '|' || c === '&') { parts.push(cur); cur = ''; continue; }
+    cur += c;
+  }
+  parts.push(cur);
+  return parts;
+}
+
+// Is this segment a recursive force delete? A shell with -c is walked INTO — `bash -c "cd x && rm -rf y"`
+// really deletes — by judging its quoted script the same way, a few levels deep at most.
+function segmentIsRmRf(segment, depth) {
   const tokens = segment.trim().split(/\s+/).filter(Boolean);
   let i = 0;
   while (i < tokens.length) {
@@ -92,47 +150,51 @@ function runsRm(segment) {
     if (WRAPPERS.test(bare)) { i += 1; continue; }
     if (SHELLS.test(bare)) {
       i += 1;
-      while (i < tokens.length && /^-/.test(tokens[i])) i += 1; // skip -c and friends
+      let script = false;
+      while (i < tokens.length && /^-/.test(tokens[i])) { if (/c/.test(tokens[i])) script = true; i += 1; }
+      if (script && depth < 3) {
+        const body = tokens.slice(i).join(' ').replace(/^(['"])([\s\S]*)\1$/, '$2');
+        return commandIsRmRf(body, depth + 1);
+      }
       continue;
     }
-    return bare === 'rm' || bare.endsWith('/rm');
-  }
-  return false;
-}
-
-function isRmRecursiveForce() {
-  if (!/\brm\b/.test(cmd)) return false;
-  for (const segment of cmd.split(/\|\||&&|[|;&]/)) {
-    if (!runsRm(segment)) continue;
+    if (bare !== 'rm' && !bare.endsWith('/rm')) return false;
     const flags = rmFlagsIn(segment);
     const hasR = flags.some((f) => /^--recursive$/i.test(f) || /^-[A-Za-z]*r/i.test(f));
     const hasF = flags.some((f) => /^--force$/i.test(f) || /^-[A-Za-z]*f/i.test(f));
-    if (hasR && hasF) return true; // -rf / -fr / -Rf / -r -f / --recursive --force
+    return hasR && hasF; // -rf / -fr / -Rf / -r -f / --recursive --force
   }
   return false;
 }
 
+function commandIsRmRf(text, depth = 0) {
+  if (!/\brm\b/.test(text)) return false;
+  return splitTopLevel(text).some((segment) => segmentIsRmRf(segment, depth));
+}
+
+function isRmRecursiveForce() { return commandIsRmRf(cmd); }
+
 const RULES = [
-  { id: 'rm-rf', why: 'deletes whole files/folders irreversibly (rm with -r and -f)', match: isRmRecursiveForce },
-  { id: 'find-delete', why: 'mass-deletes matched files (find … -delete / -exec rm)', match: () => /\bfind\b[^|;&]*(-delete\b|-exec\s+rm\b)/i.test(cmd) },
-  { id: 'dd-disk', why: 'overwrites a raw disk device and can destroy the whole drive (dd of=/dev/…)', match: () => /\bdd\b[^|;&]*\bof=\/dev\//i.test(cmd) },
-  { id: 'mkfs', why: 'formats a filesystem, erasing everything on it (mkfs)', match: () => /\bmkfs(\.\w+)?\b/i.test(cmd) },
-  { id: 'curl-pipe-shell', why: 'pipes a downloaded script straight into a shell (curl|bash) — runs untrusted code', match: () => /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i.test(cmd) },
-
-  { id: 'git-push-force', why: 'force-pushes and can overwrite shared history for everyone (git push --force)', match: () => /\bgit\s+push\b[^|;&]*(--force(?!-with-lease)\b|\s-f\b)/i.test(cmd) },
-  { id: 'git-reset-hard', why: 'throws away all uncommitted work with no undo (git reset --hard)', match: () => /\bgit\s+reset\b[^|;&]*--hard\b/i.test(cmd) },
-  { id: 'git-clean', why: 'permanently deletes untracked files (git clean -f)', match: () => /\bgit\s+clean\b[^|;&]*-[a-z]*f/i.test(cmd) },
-  { id: 'git-branch-D', why: 'force-deletes a branch even if its work was never merged (git branch -D)', match: () => /\bgit\s+branch\b[^|;&]*\s-D\b/.test(cmd) },
-
-  { id: 'sql-drop', why: 'drops an entire database/schema/table (DROP …)', match: () => /\bdrop\s+(database|schema|table)\b/i.test(cmd) },
-  { id: 'sql-truncate', why: 'empties an entire table (TRUNCATE)', match: () => /\btruncate\s+(table\s+)?\S/i.test(cmd) },
-  { id: 'sql-delete-no-where', why: 'deletes EVERY row — a DELETE with no WHERE clause', match: () => noWhere(/\bdelete\s+from\s+\S/i) },
-  { id: 'sql-update-no-where', why: 'rewrites EVERY row — an UPDATE with no WHERE clause', match: () => noWhere(/\bupdate\s+\S+\s+set\b/i) },
-  { id: 'mongo-wipe', why: 'drops a collection/database or deletes all documents (drop()/dropDatabase/deleteMany({}))', match: () => /\.drop\(\s*\)|dropdatabase\s*\(|deletemany\(\s*\{\s*\}\s*\)|\.remove\(\s*\{\s*\}\s*\)/i.test(cmd) },
+  { id: 'rm-rf', why: 'borra archivos o carpetas enteras de forma irreversible (rm con -r y -f)', match: isRmRecursiveForce },
+  { id: 'find-delete', why: 'borra en masa todos los archivos que encuentra (find … -delete / -exec rm)', match: () => /\bfind\b[^|;&]*(-delete\b|-exec\s+rm\b)/i.test(cmd) },
+  { id: 'dd-disk', why: 'sobrescribe un disco entero y puede destruir todo lo que contiene (dd of=/dev/…)', match: () => /\bdd\b[^|;&]*\bof=\/dev\//i.test(cmd) },
+  { id: 'mkfs', why: 'formatea un sistema de archivos y borra todo lo que hay en él (mkfs)', match: () => /\bmkfs(\.\w+)?\b/i.test(cmd) },
+  { id: 'curl-pipe-shell', why: 'ejecuta un script descargado sin revisarlo (curl | bash): código que no conocemos', match: () => /\b(curl|wget)\b[^|]*\|\s*(sudo\s+)?(sh|bash|zsh)\b/i.test(cmd) },
+
+  { id: 'git-push-force', why: 'reescribe en el remoto el historial compartido, para todos (git push --force)', match: () => /\bgit\s+push\b[^|;&]*(--force(?!-with-lease)\b|\s-f\b)/i.test(cmd) },
+  { id: 'git-reset-hard', why: 'descarta todo el trabajo sin commitear y no hay forma de recuperarlo (git reset --hard)', match: () => /\bgit\s+reset\b[^|;&]*--hard\b/i.test(cmd) },
+  { id: 'git-clean', why: 'borra para siempre los archivos que git no sigue (git clean -f)', match: () => /\bgit\s+clean\b[^|;&]*-[a-z]*f/i.test(cmd) },
+  { id: 'git-branch-D', why: 'borra una rama aunque su trabajo no esté fusionado (git branch -D)', match: () => /\bgit\s+branch\b[^|;&]*\s-D\b/.test(cmd) },
+
+  { id: 'sql-drop', why: 'elimina una base de datos, esquema o tabla entera (DROP …)', match: () => /\bdrop\s+(database|schema|table)\b/i.test(cmd) },
+  { id: 'sql-truncate', why: 'vacía una tabla entera (TRUNCATE)', match: () => /\btruncate\s+(table\s+)?\S/i.test(cmd) },
+  { id: 'sql-delete-no-where', why: 'borra todas las filas: es un DELETE sin WHERE', match: () => noWhere(/\bdelete\s+from\s+\S/i) },
+  { id: 'sql-update-no-where', why: 'reescribe todas las filas: es un UPDATE sin WHERE', match: () => noWhere(/\bupdate\s+\S+\s+set\b/i) },
+  { id: 'mongo-wipe', why: 'elimina una colección o base de datos, o todos sus documentos (drop()/dropDatabase/deleteMany({}))', match: () => /\.drop\(\s*\)|dropdatabase\s*\(|deletemany\(\s*\{\s*\}\s*\)|\.remove\(\s*\{\s*\}\s*\)/i.test(cmd) },
 ];
 
 for (const rule of RULES) {
-  try { if (rule.match()) deny(rule.why); } catch { /* a rule erroring must never block */ }
+  try { if (rule.match()) stop(rule.why); } catch { /* a rule erroring must never block */ }
 }
 
 allow();

package/targets/hook-once.mjs

@@ -94,25 +94,56 @@ Responde en el idioma en que escribe la persona, no en el de este texto.
 Si el usuario pide construir, anadir o cambiar algo (en cualquier idioma, se juzga la intencion),
 sigue esta cadena ANTES de escribir codigo. Ninguna skill escribe codigo de una feature hasta que
 el que esta claro y el usuario ha dado el visto bueno.
-1. Aclarar el que:
-   - Peticion concreta y acotada -> \`grill-with-docs\`.
-   - Tema amplio, o el usuario no sabe como abordarlo -> recomiendale \`wayfinder\`.
-   - \`superpowers:brainstorming\` vale para lo mismo si el usuario lo prefiere.
-   Cada decision dificil de revertir se registra con \`write-adr\`, en docs/adr/.
-2. Escribir la spec: \`to-spec\`, o \`superpowers:brainstorming\` para cerrarla por secciones.
-   Sin spec escrita no se programa.
-3. Construir: \`superpowers:writing-plans\` -> \`superpowers:executing-plans\`. Spec grande o que
-   salio de \`wayfinder\` -> \`to-tickets\` -> \`implement-spec\` (subagentes en paralelo sobre el
-   grafo de tickets); un solo ticket suelto -> \`implement\`.
-   Si la tarea toca pantalla, invoca ademas \`flujo-interfaz\`: dice que skill de diseno manda.
-4. Antes de fusionar: \`code-review\` (estandares del repo + lo que pedia la spec), y el cuerpo
-   de la PR con \`pr\` (resumen visual, evidencia antes/despues, peligro de fusion).
+Elige la cadena por el tamano y encadena tu mismo cada paso, sin esperar a que el usuario lo pida:
+- Pequeno (cabe en una sesion, un solo ticket):
+  1. Aclarar: \`superpowers:brainstorming\` si la idea aun esta verde; \`grill-with-docs\` si ya
+     hay un plan que endurecer.
+  2. Construir: \`implement\`.
+- Grande (varias sesiones o muchas piezas):
+  1. Aclarar: \`grill-with-docs\`; tema amplio o sin camino claro -> \`wayfinder\`.
+  2. Escribir la spec: \`to-spec\`. Sin spec escrita no se programa.
+  3. Partirla: \`to-tickets\` (grafo de tickets con bloqueos). Sin tickets no hay \`implement-spec\`.
+  4. Construir: \`implement-spec\` (subagentes en paralelo sobre el grafo de tickets).
+En ambas: cada decision dificil de revertir va a \`write-adr\`, en docs/adr/.
+Si la tarea toca pantalla, invoca ademas \`flujo-interfaz\`: dice que skill de diseno manda.
+Antes de fusionar: \`code-review\` (estandares del repo + lo que pedia la spec), y la PR con \`pr\`.
 Siempre: \`superpowers:test-driven-development\` y \`superpowers:verification-before-completion\`
 antes de dar nada por terminado. Los bugs entran por \`superpowers:systematic-debugging\`.
 Cambio de una linea, typo o ajuste de configuracion -> hazlo y di que te saltas la cadena.
 ==========================================================
 `;
 
+// Some skills the gate names carry `disable-model-invocation: true`: the Skill tool refuses them,
+// so telling the agent to "use `to-spec`" sends it into a refusal and the user ends up typing the
+// command anyway. The flag lives in each SKILL.md, so the gate reads it from there at emit time
+// instead of keeping a second, hand-written list that drifts. Each flagged id is rendered as the
+// slash command the user has to type, plus one line saying so. `roots` are searched in order
+// (project, then user scope); the first SKILL.md found decides. Fail-safe: a skill whose file
+// cannot be read keeps the current wording — this runs every turn and must never break the gate.
+const GATE_ID = /`([a-z][a-z0-9-]*)`/g;
+export function renderGate(text, roots = []) {
+  const manual = [];
+  for (const id of new Set([...text.matchAll(GATE_ID)].map((m) => m[1]))) {
+    for (const r of roots) {
+      let md;
+      try { md = readFileSync(join(r, '.claude', 'skills', id, 'SKILL.md'), 'utf8'); } catch { continue; }
+      const fm = md.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+      if (fm && /^disable-model-invocation:\s*true\s*$/m.test(fm[1])) manual.push(id);
+      break;
+    }
+  }
+  if (!manual.length) return text;
+  const flagged = new Set(manual);
+  const lines = text.replace(GATE_ID, (m, id) => (flagged.has(id) ? `\`/${id}\`` : m)).split('\n');
+  const note = `Las que van con / (${manual.map((id) => `\`/${id}\``).join(', ')}) no las lances tu: la\n` +
+    `herramienta Skill las rechaza. Pide al usuario que escriba \`/<skill>\` (p. ej. \`/${manual[0]}\`).`;
+  let close = lines.length - 1;
+  while (close > 0 && !lines[close].startsWith('=====')) close -= 1;
+  if (close <= 0) return `${lines.join('\n')}\n${note}\n`;
+  lines.splice(close, 0, note);
+  return lines.join('\n');
+}
+
 /**
  * Parse the hook payload Claude Code writes to stdin.
  * Pass `raw` explicitly in tests; in a hook, call with no argument to read fd 0.