@devrik-tools/claude-gates 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrik-tools/claude-gates",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
   "keywords": [
     "claude-code",

package/plugins/gates/hooks/gates/autonomous-mode/index.mjs

@@ -0,0 +1,45 @@
+// autonomous-mode — when the project turns on autonomous mode, the assistant must stop
+// asking and decide. This gate denies the AskUserQuestion tool while the mode is on, so a
+// question popup cannot interrupt an unattended run. The assistant is expected to take the
+// best, aligned decision and state the reversible assumption instead of asking.
+//
+// justification: no existing tool covers this. It is the deterministic half of "run without
+// asking": a gate can block the question tool; the prose reminder (via the session-start
+// hook and this gate's message) covers the rest, which a hook cannot force.
+//
+// ── When it acts ────────────────────────────────────────────────────────────────────
+// Only when autonomousMode is enabled in .ai/config.json (project) or the global config.
+// Off by default. The user is also reminded at session start that the mode is on (see the
+// session hook), in case they forgot to turn it off.
+//
+// ── What it does NOT do ─────────────────────────────────────────────────────────────
+// It blocks the AskUserQuestion TOOL. It cannot stop the assistant from asking in plain
+// prose (no hook sees chat text) — the injected reminder pushes against that, but the only
+// deterministic lever is the question tool, and this gate pulls it.
+
+import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'autonomous-mode';
+const CONFIG_KEY = 'autonomousMode';
+
+const QUESTION_TOOLS = new Set(TOOL_GROUPS.question);
+
+const DENY_MESSAGE =
+  'Autonomous mode is ON for this project: do not ask the user. Take the best decision ' +
+  'that is aligned with the goal and the project rules, state the reversible assumption you ' +
+  'made, and proceed. Only a genuinely irreversible or dangerous choice (deleting data, ' +
+  'money, production) would justify stopping — and then say so in prose, do not use the ' +
+  'question popup. To let questions through again, set "autonomousMode": false in ' +
+  '.ai/config.json.';
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+  },
+  ({ toolName }) => {
+    if (!QUESTION_TOOLS.has(toolName)) return;
+    deny(GATE_ID, DENY_MESSAGE);
+  },
+);

package/plugins/gates/hooks/gates/autonomous-mode/test.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+// Runs the gate in a temp project with HOME isolated (so the real global config is not
+// read). `autonomous` writes the flag on. Returns the parsed deny output, or null.
+function runGate(payload, { autonomous } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'autonomous-mode-'));
+  mkdirSync(join(project, '.git'));
+  mkdirSync(join(project, '.ai'));
+  writeFileSync(
+    join(project, '.ai', 'config.json'),
+    JSON.stringify({
+      gates: { autonomousMode: { enabled: Boolean(autonomous) } },
+    }),
+  );
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function ask() {
+  return {
+    tool_name: 'AskUserQuestion',
+    tool_input: { questions: [{ question: 'A or B?' }] },
+  };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+test('autonomous mode ON: AskUserQuestion is denied', () => {
+  assert.ok(isDeny(runGate(ask(), { autonomous: true })));
+});
+
+test('autonomous mode OFF (default): questions pass', () => {
+  assert.equal(runGate(ask(), { autonomous: false }), null);
+});
+
+test('even ON, a non-question tool is never blocked', () => {
+  assert.equal(
+    runGate(
+      { tool_name: 'Write', tool_input: { file_path: 'x.js', content: '' } },
+      { autonomous: true },
+    ),
+    null,
+  );
+});

package/plugins/gates/hooks/gates/bash-commands/index.mjs

@@ -125,6 +125,34 @@ function compile(source) {
   return new RegExp(source, 'i');
 }
 
+// git's GLOBAL options sit between `git` and the subcommand: `git -C <path> reset --hard`,
+// `git -c k=v push`, `git --git-dir=… clean -f`. A pattern that matches `git reset --hard`
+// contiguously is evaded by any of them. Stripping these options first — turning
+// `git -C /repo reset --hard` back into `git reset --hard` — closes that bypass for every
+// git rule at once, instead of teaching each pattern about every global option.
+//
+// A single global option, matched one at a time and stripped repeatedly (below), so the
+// pattern stays simple: an option taking a value (`-C /path`, `--git-dir=…`) or a flag
+// (`--no-pager`). The leading `git ` is kept; only the option after it is removed.
+const GIT_OPTION_WITH_VALUE = String.raw`(?:-[Cc]|--git-dir|--work-tree|--namespace|--exec-path|--config-env)(?:\s+|=)\S+`;
+const GIT_FLAG_OPTION = String.raw`--(?:paginate|no-pager|bare|no-optional-locks)|-p`;
+const GIT_GLOBAL_OPTION_PATTERN = new RegExp(
+  String.raw`\bgit\s+(?:${GIT_OPTION_WITH_VALUE}|${GIT_FLAG_OPTION})\s+`,
+  'i',
+);
+
+function normalizeGitOptions(command) {
+  // Strip one leading global option at a time and re-run, so a stacked
+  // `git -c a=b -C /x reset` is fully reduced to `git reset` before the deny patterns run.
+  let previous;
+  let normalized = command;
+  do {
+    previous = normalized;
+    normalized = normalized.replace(GIT_GLOBAL_OPTION_PATTERN, 'git ');
+  } while (normalized !== previous);
+  return normalized;
+}
+
 function stripQuoted(text) {
   return text
     .replace(/```[\s\S]*?```/g, ' ')
@@ -171,6 +199,10 @@ function commandTextFrom(toolName, toolInput) {
 
 /** Static deny rules + the runtime rm -rf rule, both read from config params. */
 function checkDestructive(command, parameters) {
+  // Strip git's global options so `git -C /repo reset --hard` cannot slip past a pattern
+  // written for `git reset --hard`. Non-git commands are unaffected.
+  const normalized = normalizeGitOptions(command);
+
   // denyPatterns may be a flat list of sources or [source, reason] pairs; normalize.
   const denyPairs = (parameters.denyPatterns ?? []).map((entry) =>
     Array.isArray(entry)
@@ -178,7 +210,7 @@ function checkDestructive(command, parameters) {
       : [entry, 'Destructive command is not allowed.'],
   );
   for (const [source, reason] of denyPairs) {
-    if (compile(source).test(command)) deny(GATE_ID, reason);
+    if (compile(source).test(normalized)) deny(GATE_ID, reason);
   }
 
   // rm -rf over a protected area: areas read from config at runtime, so editing
@@ -200,10 +232,13 @@ function checkDestructive(command, parameters) {
 
 /** Remote-publish rules: a real command is checked literally; a delegation prompt by intent. */
 function checkRemotePublish(command, isShell) {
+  // For a real shell command, normalize git's global options first (same bypass as above).
+  // For a delegation prompt (free text), the intent check runs on the raw text.
+  const shellCommand = normalizeGitOptions(command);
   for (const [source, reason] of REMOTE_PUBLISH_RULES) {
     const pattern = compile(source);
     if (isShell) {
-      if (pattern.test(command)) deny(GATE_ID, reason);
+      if (pattern.test(shellCommand)) deny(GATE_ID, reason);
     } else if (hasRealPublishIntent(command, pattern)) {
       deny(GATE_ID, reason);
     }

package/plugins/gates/hooks/gates/bash-commands/test.mjs

@@ -51,6 +51,19 @@ test('allows an innocuous command', () => {
   assert.equal(runGate(bash('rm -rf ./build/cache')), null);
 });
 
+test("git's global options (-C, -c, --git-dir) cannot smuggle a destructive subcommand past", () => {
+  // Regression: `git -C /path reset --hard` used to slip past the `git reset --hard` pattern
+  // because the option sat between `git` and the subcommand. Normalization strips it first.
+  assert.ok(isDeny(runGate(bash('git -C /home/code/orca reset --hard HEAD'))));
+  assert.ok(isDeny(runGate(bash('git -c core.editor=vim reset --hard'))));
+  assert.ok(isDeny(runGate(bash('git --git-dir=/x reset --hard'))));
+  assert.ok(isDeny(runGate(bash('git -c a=b -C /x clean -fd'))));
+  assert.ok(isDeny(runGate(bash('git -C /repo push origin main'))));
+  // A global option on a harmless subcommand is still allowed.
+  assert.equal(runGate(bash('git -C /repo status')), null);
+  assert.equal(runGate(bash('git reset --soft HEAD')), null);
+});
+
 test('denies a plain git push (remote publish needs fresh authorization)', () => {
   assert.ok(isDeny(runGate(bash('git push origin main'))));
   assert.ok(isDeny(runGate(bash('gh pr merge 12'))));

package/plugins/gates/hooks/hooks.json

@@ -260,6 +260,26 @@
             "timeout": 10
           }
         ]
+      },
+      {
+        "matcher": "Write|Edit|NotebookEdit|write_to_file|replace_file_content|Bash|run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gates/forge-flow/index.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "AskUserQuestion",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gates/autonomous-mode/index.mjs\"",
+            "timeout": 10
+          }
+        ]
       }
     ]
   }

package/registry.json

@@ -630,6 +630,24 @@
         }
       ]
     },
+    {
+      "id": "autonomy",
+      "name": "Autonomy",
+      "description": "Autonomous mode: block the question popup so an unattended run decides instead of asking.",
+      "gates": [
+        {
+          "id": "autonomous-mode",
+          "configKey": "autonomousMode",
+          "default": false,
+          "event": "PreToolUse",
+          "tools": [
+            "question"
+          ],
+          "description": "When autonomous mode is on, denies AskUserQuestion so the assistant decides instead of asking.",
+          "script": "gates/autonomous-mode/index.mjs"
+        }
+      ]
+    },
     {
       "id": "session",
       "name": "Session start",