@devrik-tools/claude-gates 0.1.0

package/plugins/gates/hooks/gates/recurrence-lock/test.mjs

@@ -0,0 +1,99 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function newProject({ config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'recurrence-lock-'));
+  mkdirSync(join(project, '.git'));
+  mkdirSync(join(project, '.ai'), { recursive: true });
+  if (config) {
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  return project;
+}
+
+function runGateIn(project, payload) {
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function exec() {
+  return { tool_name: 'Bash', tool_input: { command: 'echo hi' } };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+test('denies when an open recurrence class is at/above threshold', () => {
+  const project = newProject();
+  writeFileSync(
+    join(project, '.ai', 'reincidencias.json'),
+    JSON.stringify({
+      classes: [
+        { class: 'duplicate-catch', occurrences: [1, 2], status: 'open' },
+      ],
+    }),
+  );
+  assert.ok(isDeny(runGateIn(project, exec())));
+});
+
+test('allows when the recurrence class is closed', () => {
+  const project = newProject();
+  writeFileSync(
+    join(project, '.ai', 'reincidencias.json'),
+    JSON.stringify({
+      classes: [
+        { class: 'duplicate-catch', occurrences: [1, 2], status: 'closed' },
+      ],
+    }),
+  );
+  assert.equal(runGateIn(project, exec()), null);
+});
+
+test('degrades to allow when the recurrence file does not exist', () => {
+  const project = newProject();
+  assert.equal(runGateIn(project, exec()), null);
+});
+
+test('disabled by config: the gate does not run', () => {
+  const project = newProject({
+    config: { gates: { blockRegisteredRecurrences: false } },
+  });
+  writeFileSync(
+    join(project, '.ai', 'reincidencias.json'),
+    JSON.stringify({
+      classes: [{ class: 'x', occurrences: [1, 2], status: 'open' }],
+    }),
+  );
+  assert.equal(runGateIn(project, exec()), null);
+});
+
+test('thresholdAppearances override changes the trigger point', () => {
+  const project = newProject({
+    config: {
+      gates: {
+        blockRegisteredRecurrences: { enabled: true, thresholdAppearances: 3 },
+      },
+    },
+  });
+  writeFileSync(
+    join(project, '.ai', 'reincidencias.json'),
+    JSON.stringify({
+      classes: [{ class: 'x', occurrences: [1, 2], status: 'open' }],
+    }),
+  );
+  assert.equal(runGateIn(project, exec()), null);
+});

package/plugins/gates/hooks/gates/reuse-before-build/index.mjs

@@ -0,0 +1,150 @@
+// reuse-before-build — do not reinvent the wheel. Before building a new script, gate,
+// verifier or generic helper, consult the per-project tool map: a record of what already
+// solves a given need, local first, cloud second. This gate is the deterministic half —
+// it consults the map and objects when a build is starting without evidence of a check.
+// It never reaches the network: the cloud search (npm, marketplaces) is done by the
+// assistant or the `claude-gates tool-map` CLI, so the hook stays self-contained.
+//
+// ── What a project can configure (params) ───────────────────────────────────────────
+//   toolMapFile   path to the per-project tool map, relative to the project root.
+//                 Default .ai/tool-map.json.
+//
+// ── How it decides (deterministic, no judgment) ─────────────────────────────────────
+// A write that creates an executable tool (by extension) inside a tools folder, or a
+// delegation prompt that asks to build one, must carry evidence that the wheel was
+// checked: either an audit phrase in the text, or the need already recorded in the tool
+// map. Absent both, the gate blocks with an actionable message — consult the map, then
+// (if truly absent) search local→cloud and record the result with the CLI.
+
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, extname, join } from 'node:path';
+import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'reuse-before-build';
+const CONFIG_KEY = 'requireReuseCheckBeforeBuilding';
+
+const WRITE_TOOLS = new Set(TOOL_GROUPS.write);
+const DELEGATION_TOOLS = new Set(TOOL_GROUPS.delegation);
+
+const DEFAULT_TOOL_MAP_FILE = join('.ai', 'tool-map.json');
+const EXECUTABLE_EXTENSIONS = new Set([
+  '.js',
+  '.mjs',
+  '.cjs',
+  '.ts',
+  '.py',
+  '.sh',
+  '.ps1',
+]);
+const TOOL_FOLDERS = ['scripts/', 'hooks/', 'tools/', 'gates/'];
+// A map word must be this long to count as a real signal (skip "the", "csv" is 3 but rare).
+const MIN_SIGNIFICANT_WORD_LENGTH = 4;
+
+// A verb of creation next to a tool noun. Deliberately narrow: "write a report" or
+// "create a folder" do not match because the noun is not one of these.
+const BUILD_INTENT_PATTERN =
+  /\b(write|create|build|implement|add)\s+(a |the )?(new )?(script|verifier|gate|hook|linter|checker|tool)\b/i;
+// Evidence the wheel was already checked: any phrase stating the audit result.
+const AUDIT_DONE_PATTERN =
+  /(already exists|no existing tool|there is no plugin|audited|checked whether|nothing does this|justification:)/i;
+
+function projectRootOf(startDirectory) {
+  let current = startDirectory;
+  while (true) {
+    if (existsSync(join(current, '.git'))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+/**
+ * Whether the tool map already records a need matching the given text. The map is a JSON
+ * blob; a cheap lowercased contains-check over the significant words of the build target
+ * is enough — the gate does not parse the map's shape, so the CLI is free to evolve it.
+ * A word of 4+ chars found in the map counts as "this need is already tracked".
+ */
+function needRecordedInMap(startDirectory, toolMapFile, targetText) {
+  const root = projectRootOf(startDirectory);
+  if (!root) return false;
+  const path = join(root, toolMapFile);
+  if (!existsSync(path)) return false;
+  let map;
+  try {
+    map = readFileSync(path, 'utf8').toLowerCase();
+  } catch {
+    return false;
+  }
+  const words = targetText
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter((word) => word.length >= MIN_SIGNIFICANT_WORD_LENGTH);
+  return words.some((word) => map.includes(word));
+}
+
+function isExecutableToolPath(filePath) {
+  const inToolFolder = TOOL_FOLDERS.some((folder) =>
+    filePath.replace(/\\/g, '/').includes(folder),
+  );
+  return (
+    inToolFolder && EXECUTABLE_EXTENSIONS.has(extname(filePath).toLowerCase())
+  );
+}
+
+const DENY_MESSAGE =
+  'Do not reinvent the wheel. Before building this, consult the project tool map and ' +
+  'confirm nothing already covers it, auditing in this order: (1) LOCAL — the repo and ' +
+  'installed deps (search by name and usage, read the manifest); (2) CONTEXT7 — resolve ' +
+  'the candidate library and read its docs to confirm whether it truly covers the need; ' +
+  '(3) WEB — search npm and plugin marketplaces for a maintained package. If it is ' +
+  'genuinely absent, record the finding (e.g. `claude-gates tool-map add`) and state the ' +
+  'audit in the text, so the exploration is not repeated next time.';
+
+/** A build is allowed when its text declares an audit or the need is already in the map. */
+function buildIsCleared(text, cwd, toolMapFile) {
+  return (
+    AUDIT_DONE_PATTERN.test(text) || needRecordedInMap(cwd, toolMapFile, text)
+  );
+}
+
+/** Delegation: block a build-a-tool prompt that is not cleared. */
+function checkDelegation(toolInput, cwd, toolMapFile) {
+  const prompt = String(toolInput.prompt ?? toolInput.description ?? '');
+  if (!BUILD_INTENT_PATTERN.test(prompt)) return;
+  if (buildIsCleared(prompt, cwd, toolMapFile)) return;
+  deny(GATE_ID, DENY_MESSAGE);
+}
+
+/** Write: block a new executable tool that is not cleared by its content or the map. */
+function checkWrite(toolInput, cwd, toolMapFile) {
+  const rawPath = String(
+    toolInput.file_path ?? toolInput.target_file ?? toolInput.path ?? '',
+  );
+  const filePath = rawPath.replace(/\\/g, '/');
+  if (!isExecutableToolPath(filePath)) return;
+  // Editing an EXISTING file is not building a new tool — only creation triggers the audit.
+  // A file already on disk is an edit, so it is allowed (lets the gates maintain themselves).
+  if (rawPath && existsSync(rawPath)) return;
+  const content = String(toolInput.content ?? toolInput.CodeContent ?? '');
+  if (AUDIT_DONE_PATTERN.test(content)) return;
+  if (needRecordedInMap(cwd, toolMapFile, filePath)) return;
+  deny(GATE_ID, DENY_MESSAGE);
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: { toolMapFile: DEFAULT_TOOL_MAP_FILE },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    const toolMapFile = parameters.toolMapFile ?? DEFAULT_TOOL_MAP_FILE;
+    const cwd = process.cwd();
+    if (DELEGATION_TOOLS.has(toolName)) {
+      checkDelegation(toolInput, cwd, toolMapFile);
+    } else if (WRITE_TOOLS.has(toolName)) {
+      checkWrite(toolInput, cwd, toolMapFile);
+    }
+  },
+);

package/plugins/gates/hooks/gates/reuse-before-build/test.mjs

@@ -0,0 +1,101 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+// Runs the gate as a child process inside a temp project (with .git so config/root resolve).
+// The gate is off by default, so config enables it unless a test overrides that. An optional
+// tool map is seeded. Returns parsed stdout or null when it allowed.
+function runGate(payload, { config, toolMap } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'reuse-before-build-'));
+  mkdirSync(join(project, '.git'));
+  mkdirSync(join(project, '.ai'));
+  const effectiveConfig = config ?? {
+    gates: { requireReuseCheckBeforeBuilding: true },
+  };
+  writeFileSync(
+    join(project, '.ai', 'config.json'),
+    JSON.stringify(effectiveConfig),
+  );
+  if (toolMap) {
+    writeFileSync(
+      join(project, '.ai', 'tool-map.json'),
+      JSON.stringify(toolMap),
+    );
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function writeTool(content) {
+  return {
+    tool_name: 'Write',
+    tool_input: { file_path: 'scripts/csv-parser.mjs', content },
+  };
+}
+function delegate(prompt) {
+  return { tool_name: 'Agent', tool_input: { prompt } };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+test('denies building a new tool without an audit', () => {
+  assert.ok(isDeny(runGate(writeTool('export function parse() {}'))));
+  assert.ok(
+    isDeny(
+      runGate(delegate('Please write a new script that parses CSV files.')),
+    ),
+  );
+});
+
+test('allows when the text declares an audit was done', () => {
+  assert.equal(
+    runGate(
+      writeTool('// Justification: no existing tool covers this.\nexport {}'),
+    ),
+    null,
+  );
+  assert.equal(
+    runGate(
+      delegate('Write a new script for CSV — I audited and nothing does this.'),
+    ),
+    null,
+  );
+});
+
+test('allows when the need is already recorded in the tool map', () => {
+  const toolMap = { tools: [{ path: 'scripts/csv-parser.mjs', audit: 'x' }] };
+  assert.equal(runGate(writeTool('export {}'), { toolMap }), null);
+});
+
+test('ignores non-tool writes (a plain markdown file)', () => {
+  assert.equal(
+    runGate({
+      tool_name: 'Write',
+      tool_input: { file_path: 'docs/readme.md', content: 'hello' },
+    }),
+    null,
+  );
+});
+
+test('disabled by config: the gate does not run', () => {
+  assert.equal(
+    runGate(writeTool('export {}'), {
+      config: { gates: { requireReuseCheckBeforeBuilding: false } },
+    }),
+    null,
+  );
+});

package/plugins/gates/hooks/gates/risk-level/index.mjs

@@ -0,0 +1,203 @@
+// risk-level — denies an implementation delegation that does not declare its risk
+// LEVEL (QUESTION|MICRO|STANDARD|HIGH-RISK), and denies a declared level that
+// contradicts a real high-impact signal in the prompt itself (anything but HIGH-RISK).
+//
+// ── What this does and does not decide ──────────────────────────────────────────────
+// Classifying a task correctly between QUESTION/MICRO/STANDARD stays the delegator's
+// judgment — this gate cannot tell whether STANDARD was the "right" level for a task
+// with no detectable high-impact signal. The only deterministic thing it can and does
+// impose: the declaration EXISTS, and it does not contradict a real, non-quoted signal
+// of high risk. The level vocabulary itself (the four tokens) is a fixed base, not a
+// project param — only which signals count as high-impact, and which subagents are
+// exempt, are configurable.
+//
+// ── Same two-stage intent pattern as intent-flow ────────────────────────────────────
+// Stage 1: cheap lexical prefilter (implementation verb + high-impact signal present
+// anywhere). Stage 2: strip quoted/templated text, require near co-occurrence between
+// the verb and the signal, discard a verb whose object is a documentary deliverable.
+// Over-declaring HIGH-RISK is never penalized — this gate only catches under-declaring.
+
+import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'risk-level';
+const CONFIG_KEY = 'requireDeclaredRiskLevel';
+
+const DELEGATION_TOOLS = new Set(TOOL_GROUPS.delegation);
+
+const DEFAULT_READ_ONLY_SUBAGENTS = ['explore', 'claude-code-guide', 'plan'];
+const DEFAULT_HIGH_IMPACT_PATTERNS = [
+  'dinero|pago|cobro|money|payment',
+  'auth|autenticaci[oó]n|authentication|permiso|permission|credencial|credential|token|' +
+    'sesi[oó]n|session|seguridad|security|PII',
+  'borrar|delete|drop|migraci[oó]n|migration|schema',
+  'contrato|contract|irreversible|producci[oó]n|production|API p[uú]blica|public api',
+];
+
+const CO_OCCURRENCE_WINDOW = 100;
+const VERB_OBJECT_WINDOW = 60;
+// How much of an over-length prompt to quote back in a denial message.
+const PROMPT_EXCERPT_LENGTH = 80;
+
+function withUnicodeWordBoundary(alternatives) {
+  return new RegExp(
+    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
+    'iu',
+  );
+}
+
+const IMPLEMENTATION_VERBS = withUnicodeWordBoundary(
+  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
+    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|escrib(í|e) c[oó]digo|escribir c[oó]digo|' +
+    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
+    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
+    'escrib(í|e)|escribir|implement|build|fix|migrate|modify|refactor|remove|rewrite|deploy|write',
+);
+
+const QUERY_VERBS = withUnicodeWordBoundary(
+  'explica|explic(á|ar)|qu[eé]|c[oó]mo|muestra|mostr(á|ar)|analiza|analiz(á|ar)|investiga|' +
+    'investig(á|ar)|revisa|revis(á|ar)|audita|audit(á|ar)|diagnostica|diagnostic(á|ar)|' +
+    'explain|what|how|show|analyze|investigate|review|audit|diagnose',
+);
+
+const DOCUMENTARY_DELIVERABLE_PATTERN = withUnicodeWordBoundary(
+  'documento|documentaci[oó]n|reporte|informe|diagrama|readme|wiki|changelog|' +
+    'p[aá]gina de documentaci[oó]n|archivo html|p[aá]gina html|markdown|document|documentation|report',
+);
+const DOCUMENTARY_EXTENSION_PATTERN = /\.(md|html?|adoc)\b/iu;
+
+/** Declared LEVEL: one of the four fixed tokens, near the word "level"/"classification"
+ * (in Spanish or English) so a stray mention elsewhere in the prompt is not mistaken
+ * for a declaration. */
+const DECLARED_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO|STANDARD|HIGH-RISK)\b/iu;
+
+function isReadOnlySubagent(toolInput, readOnlySubagents) {
+  const type = String(
+    toolInput.subagent_type ?? toolInput.subagentType ?? '',
+  ).toLowerCase();
+  return new Set(readOnlySubagents.map((name) => name.toLowerCase())).has(type);
+}
+
+function isImplementationRequest(prompt) {
+  return IMPLEMENTATION_VERBS.test(prompt);
+}
+
+function isExemptQuery(prompt) {
+  if (isImplementationRequest(prompt)) return false;
+  return QUERY_VERBS.test(prompt);
+}
+
+function stripQuoted(text) {
+  return text
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/"[^"\n]{0,300}"/g, ' ')
+    .replace(/'[^'\n]{0,300}'/g, ' ');
+}
+
+function allMatches(pattern, text) {
+  const flags = pattern.flags.includes('g')
+    ? pattern.flags
+    : `${pattern.flags}g`;
+  return [...text.matchAll(new RegExp(pattern.source, flags))];
+}
+
+function verbProducesDocument(text, verbMatch) {
+  const from = verbMatch.index;
+  const to = from + verbMatch[0].length + VERB_OBJECT_WINDOW;
+  const objectOfVerb = text.slice(from, to);
+  return (
+    DOCUMENTARY_DELIVERABLE_PATTERN.test(objectOfVerb) ||
+    DOCUMENTARY_EXTENSION_PATTERN.test(objectOfVerb)
+  );
+}
+
+/** Returns the matched high-impact signal text if real (non-quoted) intent survives
+ * stage 2, else null. Returns null immediately when stage 1 finds no candidate. */
+function realHighImpactSignal(prompt, highImpactPattern) {
+  const isCandidate =
+    IMPLEMENTATION_VERBS.test(prompt) && highImpactPattern.test(prompt);
+  if (!isCandidate) return null;
+
+  const text = stripQuoted(prompt);
+  const verbs = allMatches(IMPLEMENTATION_VERBS, text);
+  const signals = allMatches(highImpactPattern, text);
+
+  for (const verb of verbs) {
+    if (verbProducesDocument(text, verb)) continue;
+    for (const signal of signals) {
+      if (Math.abs(signal.index - verb.index) <= CO_OCCURRENCE_WINDOW)
+        return signal[0];
+    }
+  }
+  return null;
+}
+
+function declaredLevel(prompt) {
+  const match = DECLARED_LEVEL_PATTERN.exec(prompt);
+  return match ? match[2].toUpperCase() : null;
+}
+
+function denyNoLevelDeclared(prompt) {
+  const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
+  const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
+  deny(
+    GATE_ID,
+    `This implementation delegation ("${excerpt}${ellipsis}") does not declare its risk LEVEL. Add a ` +
+      'line such as "LEVEL: STANDARD" (or QUESTION/MICRO/HIGH-RISK, whichever fits) before relaunching ' +
+      'this delegation.',
+  );
+}
+
+function denyLevelContradictsSignal(level, signal) {
+  deny(
+    GATE_ID,
+    `This delegation declares LEVEL: ${level}, but the request touches the risk signal "${signal}" near ` +
+      'an implementation verb (not quoted, not the topic of a documentary deliverable) — that requires ' +
+      `LEVEL: HIGH-RISK, not ${level}. Raise the declaration to HIGH-RISK before relaunching.`,
+  );
+}
+
+function buildHighImpactPattern(highImpactPatterns) {
+  return new RegExp(
+    (highImpactPatterns ?? []).map((source) => `(?:${source})`).join('|'),
+    'iu',
+  );
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      highImpactPatterns: DEFAULT_HIGH_IMPACT_PATTERNS,
+      readOnlySubagents: DEFAULT_READ_ONLY_SUBAGENTS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!DELEGATION_TOOLS.has(toolName)) return;
+
+    const prompt = String(
+      toolInput.prompt ?? toolInput.description ?? toolInput.task ?? '',
+    );
+    if (!prompt.trim()) return;
+    if (isReadOnlySubagent(toolInput, parameters.readOnlySubagents)) return;
+    if (isExemptQuery(prompt)) return;
+    if (!isImplementationRequest(prompt)) return;
+
+    const highImpactPattern = buildHighImpactPattern(
+      parameters.highImpactPatterns,
+    );
+
+    const level = declaredLevel(prompt);
+    const signal = realHighImpactSignal(prompt, highImpactPattern);
+
+    if (!level) {
+      denyNoLevelDeclared(prompt.trim());
+    }
+
+    if (signal && level !== 'HIGH-RISK') {
+      denyLevelContradictsSignal(level, signal);
+    }
+  },
+);

package/plugins/gates/hooks/gates/risk-level/test.mjs

@@ -0,0 +1,125 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'risk-level-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function delegate(prompt, extra = {}) {
+  return { tool_name: 'Agent', tool_input: { prompt, ...extra } };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+const ENABLED = { config: { gates: { requireDeclaredRiskLevel: true } } };
+
+test('denies an implementation delegation with no declared level', () => {
+  assert.ok(
+    isDeny(
+      runGate(
+        delegate('Arregla el boton que no cambia de color en la pagina.'),
+        ENABLED,
+      ),
+    ),
+  );
+});
+
+test('allows a declared level consistent with a low-risk request', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'NIVEL: STANDARD\n\nArregla el boton que no cambia de color en la pagina.',
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('denies a declared level that contradicts a real high-impact signal', () => {
+  assert.ok(
+    isDeny(
+      runGate(
+        delegate(
+          'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
+        ),
+        ENABLED,
+      ),
+    ),
+  );
+});
+
+test('allows HIGH-RISK declared for a high-impact request', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'NIVEL: HIGH-RISK\n\nImplementa el cobro del pago con la nueva pasarela de dinero.',
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('allows a read-only subagent without a declared level', () => {
+  assert.equal(
+    runGate(
+      delegate(
+        'Implementa el cobro del pago con la nueva pasarela de dinero.',
+        {
+          subagent_type: 'explore',
+        },
+      ),
+      ENABLED,
+    ),
+    null,
+  );
+});
+
+test('disabled by config: the gate does not run', () => {
+  assert.equal(
+    runGate(delegate('Arregla el boton que no cambia de color en la pagina.'), {
+      config: { gates: { requireDeclaredRiskLevel: false } },
+    }),
+    null,
+  );
+});
+
+test('project highImpactPatterns override narrows what forces HIGH-RISK', () => {
+  const config = {
+    gates: {
+      requireDeclaredRiskLevel: {
+        enabled: true,
+        highImpactPatterns: ['pagin[ao]ci[oó]n'],
+      },
+    },
+  };
+  const prompt =
+    'NIVEL: MICRO\n\nImplementa el cobro del pago con la nueva pasarela de dinero.';
+  // With the default patterns (money/payment), MICRO contradicts the signal and is denied.
+  assert.ok(isDeny(runGate(delegate(prompt), ENABLED)));
+  // Once overridden, "dinero/pago" no longer counts as high-impact, so MICRO is allowed.
+  assert.equal(runGate(delegate(prompt), { config }), null);
+});