@devrik-tools/claude-gates 0.1.0

package/cli/init.mjs

@@ -0,0 +1,256 @@
+// `claude-gates init` — the interactive flow: scope → mode → picks → confirm → write.
+// Every decision can also be passed as a flag so CI and scripts can run it without a TTY.
+
+import * as prompts from '@clack/prompts';
+import {
+  SCOPES,
+  configPathFor,
+  readConfig,
+  mergeConfig,
+  writeConfig,
+} from './config.mjs';
+import { EXIT_CODE } from './constants.mjs';
+import { installPlugin, pluginInstallCommand } from './install.mjs';
+import { materializeGates } from './materialize.mjs';
+import { loadRegistry, allGates } from './registry.mjs';
+import {
+  MODES,
+  resolveSelection,
+  adoptionOf,
+  summarize,
+} from './selection.mjs';
+
+const MODE_OPTIONS = [
+  {
+    value: MODES.DEFAULTS,
+    label: 'Recommended defaults',
+    hint: 'gates marked default in the registry',
+  },
+  { value: MODES.ALL, label: 'Everything', hint: 'every gate in every family' },
+  { value: MODES.FAMILIES, label: 'By family', hint: 'pick whole families' },
+  { value: MODES.GRANULAR, label: 'Granular', hint: 'pick individual gates' },
+  {
+    value: MODES.NONE,
+    label: 'Nothing',
+    hint: "record a 'no' so you are not asked again",
+  },
+];
+
+/** commander option name → selection mode */
+const MODE_BY_OPTION = {
+  defaults: MODES.DEFAULTS,
+  all: MODES.ALL,
+  none: MODES.NONE,
+  families: MODES.FAMILIES,
+  gates: MODES.GRANULAR,
+};
+
+/**
+ * Turns commander's options object into the decisions `runInit` needs.
+ * `scope`/`mode` stay `null` when no flag decided them (prompted later).
+ */
+export function normalizeOptions(options = {}) {
+  const modeFlags = Object.keys(MODE_BY_OPTION).filter((name) => options[name]);
+  if (modeFlags.length > 1)
+    throw new Error(`Pick one of --${modeFlags.join(', --')}`);
+  if (options.project && options.global)
+    throw new Error('Pick one of --project, --global');
+
+  let scope = null;
+  if (options.project) scope = SCOPES.PROJECT;
+  if (options.global) scope = SCOPES.GLOBAL;
+
+  return {
+    scope,
+    mode: modeFlags.length === 1 ? MODE_BY_OPTION[modeFlags[0]] : null,
+    families: Array.isArray(options.families) ? options.families : [],
+    gates: Array.isArray(options.gates) ? options.gates : [],
+    yes: Boolean(options.yes),
+    dryRun: Boolean(options.dryRun),
+    install: options.install,
+  };
+}
+
+function bail(value) {
+  if (prompts.isCancel(value)) {
+    prompts.cancel('Nothing written.');
+    process.exit(EXIT_CODE.FAILURE);
+  }
+  return value;
+}
+
+async function askScope(cwd) {
+  return bail(
+    await prompts.select({
+      message: 'Where should these gates apply?',
+      options: [
+        {
+          value: SCOPES.PROJECT,
+          label: 'This project',
+          hint: configPathFor(SCOPES.PROJECT, { cwd }),
+        },
+        {
+          value: SCOPES.GLOBAL,
+          label: 'Globally (fallback for every project)',
+          hint: configPathFor(SCOPES.GLOBAL),
+        },
+      ],
+    }),
+  );
+}
+
+async function askMode() {
+  return bail(
+    await prompts.select({
+      message: 'What do you want to adopt?',
+      options: MODE_OPTIONS,
+    }),
+  );
+}
+
+async function askFamilies(registry) {
+  return bail(
+    await prompts.multiselect({
+      message: 'Pick families (space to toggle, enter to confirm)',
+      options: registry.families.map((family) => ({
+        value: family.id,
+        label: family.name,
+        hint: family.description,
+      })),
+      initialValues: registry.families
+        .filter((family) => family.gates.some((gate) => gate.default))
+        .map((family) => family.id),
+      required: false,
+    }),
+  );
+}
+
+async function askGates(registry) {
+  const options = {};
+  for (const family of registry.families) {
+    options[family.name] = family.gates.map((gate) => ({
+      value: gate.id,
+      label: gate.id,
+      hint: gate.description,
+    }));
+  }
+  return bail(
+    await prompts.groupMultiselect({
+      message: 'Pick gates (space to toggle, enter to confirm)',
+      options,
+      initialValues: allGates(registry)
+        .filter((gate) => gate.default)
+        .map((gate) => gate.id),
+      required: false,
+    }),
+  );
+}
+
+/** `claude plugin install <plugin>@<marketplace>`, read from the marketplace manifest, never hard-coded. */
+
+/** Fills in whatever the flags left undecided, asking only when there is a TTY. */
+async function decide(flags, registry, cwd, interactive) {
+  const scope =
+    flags.scope ?? (interactive ? await askScope(cwd) : SCOPES.PROJECT);
+  const mode = flags.mode ?? (interactive ? await askMode() : MODES.DEFAULTS);
+  const picks = { families: flags.families, gates: flags.gates };
+  if (interactive && mode === MODES.FAMILIES && picks.families.length === 0) {
+    picks.families = await askFamilies(registry);
+  }
+  if (interactive && mode === MODES.GRANULAR && picks.gates.length === 0) {
+    picks.gates = await askGates(registry);
+  }
+  return { scope, mode, picks };
+}
+
+function renderSummary(registry, gatesMap) {
+  return summarize(registry, gatesMap)
+    .map((row) => {
+      const list = row.enabled.length > 0 ? ` — ${row.enabled.join(', ')}` : '';
+      return `${row.name}: ${row.enabled.length}/${row.total}${list}`;
+    })
+    .join('\n');
+}
+
+async function confirmWrite(io, fileExists) {
+  const confirmed = bail(
+    await io.confirm({
+      message: fileExists
+        ? 'File exists. Merge this selection into it?'
+        : 'Write this file?',
+    }),
+  );
+  if (!confirmed) {
+    io.cancel('Nothing written.');
+    process.exit(EXIT_CODE.FAILURE);
+  }
+}
+
+export async function runInit(
+  options,
+  { cwd = process.cwd(), io = prompts } = {},
+) {
+  const flags = normalizeOptions(options);
+  const registry = loadRegistry();
+  const interactive = !flags.yes && Boolean(process.stdin.isTTY);
+
+  if (interactive) io.intro('claude-gates');
+
+  const { scope, mode, picks } = await decide(
+    flags,
+    registry,
+    cwd,
+    interactive,
+  );
+  const gates = resolveSelection(registry, mode, picks);
+  const path = configPathFor(scope, { cwd });
+  const existing = readConfig(path);
+
+  if (existing.corrupt) {
+    io.log.error(
+      `${path} exists but is not valid JSON. Fix or remove it first; nothing written.`,
+    );
+    process.exit(EXIT_CODE.FAILURE);
+  }
+
+  const merged = mergeConfig(existing.data, {
+    adopted: adoptionOf(gates),
+    gates: materializeGates(registry, gates),
+    gateVersion: registry.gateVersion,
+  });
+
+  io.note(renderSummary(registry, gates), `Selection (${scope}) → ${path}`);
+
+  if (flags.dryRun) {
+    io.outro('Dry run: nothing written.');
+    return { path, config: merged, written: false };
+  }
+
+  if (interactive) await confirmWrite(io, existing.exists);
+
+  writeConfig(path, merged);
+
+  // Install based on the selection, unless the user turned everything off or opted out.
+  // Additive: `claude plugin install` merges the gate hooks next to whatever is already
+  // configured. If it cannot run, we fall back to printing the manual command.
+  const wantsInstall = flags.install !== false && adoptionOf(gates) !== false;
+  if (!wantsInstall) {
+    io.outro(`Written ${path}.`);
+    return { path, config: merged, written: true, installed: false };
+  }
+
+  const result = installPlugin(scope, { cwd });
+  if (result.installed) {
+    io.outro(
+      `Written ${path} and installed the plugin (${result.scope} scope). ` +
+        'Restart the session (or run /plugin) for the gates to load.',
+    );
+  } else {
+    io.log.warn(
+      `Config written, but the plugin was not installed automatically (${result.reason}). ` +
+        `Install it yourself with: ${pluginInstallCommand()}`,
+    );
+    io.outro(`Written ${path}.`);
+  }
+  return { path, config: merged, written: true, installed: result.installed };
+}

package/cli/install.mjs

@@ -0,0 +1,80 @@
+// Installs the gates plugin into Claude Code from the selection `init` just wrote.
+// Additive by design: `claude plugin install` merges the plugin's hooks alongside whatever
+// the user already has — it never rewrites their settings. If the `claude` binary is not
+// reachable, this degrades to printing the manual command, and `init` still succeeds.
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { SCOPES } from './config.mjs';
+import { MARKETPLACE_PATH, REPOSITORY_ROOT } from './constants.mjs';
+
+const CLAUDE_BIN = 'claude';
+
+// Config scope decides where the plugin is installed: a project selection stays local to
+// this project (its .claude/settings.json); a global selection installs for every project.
+const PLUGIN_SCOPE = Object.freeze({
+  [SCOPES.PROJECT]: 'project',
+  [SCOPES.GLOBAL]: 'user',
+});
+
+function marketplaceAndPlugin() {
+  const manifest = JSON.parse(readFileSync(MARKETPLACE_PATH, 'utf8'));
+  const [plugin] = manifest.plugins;
+  return { marketplace: manifest.name, plugin: plugin.name };
+}
+
+/** The `claude plugin install …` line, read from the manifest, never hard-coded. */
+export function pluginInstallCommand() {
+  const { marketplace, plugin } = marketplaceAndPlugin();
+  return `claude plugin install ${plugin}@${marketplace}`;
+}
+
+function claude(commandArguments) {
+  return execFileSync(CLAUDE_BIN, commandArguments, {
+    encoding: 'utf8',
+    stdio: 'pipe',
+  });
+}
+
+/**
+ * Registers the marketplace (idempotent: a second add just reports it already exists, which
+ * is not fatal) and installs the plugin at the scope matching the config choice.
+ * Returns { installed, scope } on success, or { installed:false, reason } to fall back to
+ * the printed command.
+ */
+export function installPlugin(configScope, { cwd = process.cwd() } = {}) {
+  const { marketplace, plugin } = marketplaceAndPlugin();
+  const scope = PLUGIN_SCOPE[configScope] ?? 'user';
+
+  try {
+    try {
+      claude([
+        'plugin',
+        'marketplace',
+        'add',
+        REPOSITORY_ROOT,
+        '--scope',
+        'user',
+      ]);
+    } catch {
+      // Already registered, or the marketplace add is a no-op — install can still proceed.
+    }
+    claude([
+      'plugin',
+      'install',
+      `${plugin}@${marketplace}`,
+      '--yes',
+      '--scope',
+      scope,
+    ]);
+    return { installed: true, scope };
+  } catch (error) {
+    const reason =
+      error?.code === 'ENOENT'
+        ? 'the `claude` command was not found on PATH'
+        : (error?.stderr || error?.message || String(error))
+            .trim()
+            .split('\n')[0];
+    return { installed: false, reason, cwd };
+  }
+}

package/cli/materialize.mjs

@@ -0,0 +1,51 @@
+// Materializes each gate's default params into the config that `init` writes, so every
+// configurable value (a whitelist, a pattern list, a threshold) lands in the user's
+// .ai/config.json ready to edit. The values come from the gates themselves — each gate,
+// run with CLAUDE_GATES_DUMP_DEFAULTS set, prints its own defaults — so there is a single
+// source of truth (the gate) and nothing is duplicated in the registry.
+
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+import { REPOSITORY_ROOT } from './constants.mjs';
+import { allGates } from './registry.mjs';
+
+const DUMP_ENV = 'CLAUDE_GATES_DUMP_DEFAULTS';
+const PLUGIN_HOOKS_DIR = join(REPOSITORY_ROOT, 'plugins', 'gates', 'hooks');
+
+/**
+ * Runs one gate in defaults-dump mode and returns its built-in params. The registry only
+ * lists gates that exist on disk (enforced by a test), so this always resolves; a genuine
+ * runtime failure yields {} rather than aborting the whole init.
+ */
+function defaultParametersOf(gate) {
+  try {
+    const out = execFileSync(
+      process.execPath,
+      [join(PLUGIN_HOOKS_DIR, gate.script)],
+      { encoding: 'utf8', env: { ...process.env, [DUMP_ENV]: '1' } },
+    );
+    return JSON.parse(out).defaultParams ?? {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Turns the flat `{ configKey: enabled }` selection into the config's gates map. A gate
+ * that declares params (per the registry) becomes `{ enabled, ...defaults }` so its knobs
+ * are visible and editable; a gate with no params stays a plain boolean, keeping the file
+ * compact. Only gates with params are spawned, so paramless selections cost nothing.
+ */
+export function materializeGates(registry, enabledMap) {
+  const gates = {};
+  for (const gate of allGates(registry)) {
+    const enabled = enabledMap[gate.configKey] === true;
+    const hasParameters = Array.isArray(gate.params) && gate.params.length > 0;
+    if (!hasParameters) {
+      gates[gate.configKey] = enabled;
+      continue;
+    }
+    gates[gate.configKey] = { enabled, ...defaultParametersOf(gate) };
+  }
+  return gates;
+}

package/cli/registry.mjs

@@ -0,0 +1,127 @@
+// Loads and validates registry.json — the catalog that menus, config and hooks derive from.
+// Validation is a zod schema so the shape is declared once and errors are uniform.
+// Fails loudly on a corrupt catalog: a menu built on invalid data would write a
+// configuration that no gate recognizes.
+
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+import { REGISTRY_PATH } from './constants.mjs';
+
+export const HOOK_EVENTS = [
+  'PreToolUse',
+  'SessionStart',
+  'PostToolUse',
+  'Stop',
+  'UserPromptSubmit',
+];
+export const TOOL_GROUPS = [
+  'write',
+  'shell',
+  'delegation',
+  'execution',
+  'question',
+];
+
+/** The kinds of value a gate param can take, so the CLI can describe and validate it. */
+export const PARAM_TYPES = ['string', 'number', 'boolean', 'string[]'];
+
+const ID_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const CONFIG_KEY_PATTERN = /^[a-z][A-Za-z0-9]*$/;
+const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+// A gate's script is a path relative to the plugin's hooks/ directory: `gates/x.mjs`
+// (a PreToolUse gate) or `x.mjs` (a session hook). Never absolute, never climbing out.
+const SCRIPT_PATTERN = /^(?!\/|[A-Za-z]:|\.\.\/)[\w./-]+\.mjs$/;
+
+/**
+ * A configurable param a project may override. The registry declares that the param
+ * EXISTS and its type; the default VALUE lives in the gate's own source, so the user
+ * reads it there and knows exactly what a project override replaces.
+ */
+const parameterSchema = z.object({
+  name: z.string().regex(CONFIG_KEY_PATTERN, 'param name must be camelCase'),
+  type: z.enum(PARAM_TYPES),
+  description: z.string().min(1),
+});
+
+const gateSchema = z.object({
+  id: z.string().regex(ID_PATTERN, 'gate id must be kebab-case'),
+  configKey: z
+    .string()
+    .regex(CONFIG_KEY_PATTERN, 'configKey must be camelCase'),
+  default: z.boolean(),
+  event: z.enum(HOOK_EVENTS),
+  tools: z.array(z.enum(TOOL_GROUPS)),
+  script: z
+    .string()
+    .regex(SCRIPT_PATTERN, 'script must be an .mjs path relative to hooks/'),
+  description: z.string().min(1),
+  // Optional: a gate with no configurable params omits it.
+  params: z.array(parameterSchema).optional(),
+});
+
+const familySchema = z.object({
+  id: z.string().regex(ID_PATTERN, 'family id must be kebab-case'),
+  name: z.string().min(1),
+  description: z.string().min(1),
+  gates: z.array(gateSchema).min(1),
+});
+
+function duplicatesIn(items) {
+  const seen = new Set();
+  const duplicates = new Set();
+  for (const item of items) {
+    if (seen.has(item)) duplicates.add(item);
+    seen.add(item);
+  }
+  return [...duplicates];
+}
+
+/** Uniqueness across families is not expressible per-field, so it is a second pass. */
+function duplicateProblems(candidate) {
+  const families = Array.isArray(candidate?.families) ? candidate.families : [];
+  const gates = families.flatMap((family) =>
+    Array.isArray(family?.gates) ? family.gates : [],
+  );
+  return [
+    ...duplicatesIn(families.map((family) => family?.id)).map(
+      (id) => `duplicate family id: ${id}`,
+    ),
+    ...duplicatesIn(gates.map((gate) => gate?.id)).map(
+      (id) => `duplicate gate id: ${id}`,
+    ),
+    ...duplicatesIn(gates.map((gate) => gate?.configKey)).map(
+      (key) => `duplicate configKey: ${key}`,
+    ),
+  ];
+}
+
+export const registrySchema = z.object({
+  gateVersion: z.string().regex(VERSION_PATTERN, 'gateVersion must be x.y.z'),
+  families: z.array(familySchema).min(1),
+});
+
+/** Returns a list of human-readable problems; empty when the registry is valid. */
+export function validateRegistry(candidate) {
+  const result = registrySchema.safeParse(candidate);
+  const schemaProblems = result.success
+    ? []
+    : result.error.issues.map(
+        (issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`,
+      );
+  return [...schemaProblems, ...duplicateProblems(candidate)];
+}
+
+export function loadRegistry(path = REGISTRY_PATH) {
+  const candidate = JSON.parse(readFileSync(path, 'utf8'));
+  const problems = validateRegistry(candidate);
+  if (problems.length > 0) {
+    throw new Error(`registry.json is invalid:\n- ${problems.join('\n- ')}`);
+  }
+  return candidate;
+}
+
+export function allGates(registry) {
+  return registry.families.flatMap((family) =>
+    family.gates.map((gate) => ({ ...gate, family: family.id })),
+  );
+}

package/cli/selection.mjs

@@ -0,0 +1,83 @@
+// Pure selection logic: turns a mode plus the user's picks into the
+// `gates` map (`configKey -> boolean`) that hooks read. No I/O here so it is
+// fully testable without a terminal.
+
+import { allGates } from './registry.mjs';
+
+export const MODES = Object.freeze({
+  ALL: 'all',
+  FAMILIES: 'families',
+  GRANULAR: 'granular',
+  DEFAULTS: 'defaults',
+  NONE: 'none',
+});
+
+function assertKnown(chosen, known, kind) {
+  const unknown = [...chosen].filter((id) => !known.has(id));
+  if (unknown.length > 0)
+    throw new Error(`Unknown ${kind} id(s): ${unknown.join(', ')}`);
+}
+
+/** mode → (gates, registry, picks) → Set of enabled gate ids */
+const STRATEGIES = {
+  [MODES.ALL]: (gates) => new Set(gates.map((gate) => gate.id)),
+  [MODES.DEFAULTS]: (gates) =>
+    new Set(gates.filter((gate) => gate.default).map((gate) => gate.id)),
+  [MODES.NONE]: () => new Set(),
+  [MODES.FAMILIES]: (gates, registry, picks) => {
+    const chosen = new Set(picks.families ?? []);
+    assertKnown(
+      chosen,
+      new Set(registry.families.map((family) => family.id)),
+      'family',
+    );
+    return new Set(
+      gates.filter((gate) => chosen.has(gate.family)).map((gate) => gate.id),
+    );
+  },
+  [MODES.GRANULAR]: (gates, _registry, picks) => {
+    const chosen = new Set(picks.gates ?? []);
+    assertKnown(chosen, new Set(gates.map((gate) => gate.id)), 'gate');
+    return chosen;
+  },
+};
+
+/**
+ * @param {object} registry validated registry
+ * @param {string} mode one of MODES
+ * @param {{ families?: string[], gates?: string[] }} picks family ids (FAMILIES) or gate ids (GRANULAR)
+ * @returns {Record<string, boolean>} configKey -> enabled
+ */
+export function resolveSelection(registry, mode, picks = {}) {
+  const strategy = STRATEGIES[mode];
+  if (!strategy) throw new Error(`Unknown selection mode: ${mode}`);
+  const gates = allGates(registry);
+  const enabledIds = strategy(gates, registry, picks);
+  const result = {};
+  for (const gate of gates) result[gate.configKey] = enabledIds.has(gate.id);
+  return result;
+}
+
+/** Adoption status derived from the resolved map — what `ask-adoption` reads later. */
+export function adoptionOf(gatesMap) {
+  const values = Object.values(gatesMap);
+  if (values.length === 0 || values.every((enabled) => enabled === false))
+    return false;
+  if (values.every((enabled) => enabled === true)) return true;
+  return 'partial';
+}
+
+/** Human summary grouped by family, for the confirmation step and the final report. */
+export function summarize(registry, gatesMap) {
+  return registry.families.map((family) => {
+    const enabled = family.gates
+      .filter((gate) => gatesMap[gate.configKey] === true)
+      .map((gate) => gate.id);
+    return {
+      family: family.id,
+      name: family.name,
+      enabled,
+      total: family.gates.length,
+    };
+  });
+}

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "@devrik-tools/claude-gates",
+  "version": "0.1.0",
+  "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
+  "keywords": [
+    "claude-code",
+    "hooks",
+    "gates",
+    "guardrails",
+    "pretooluse",
+    "policy-enforcement",
+    "ai-agent"
+  ],
+  "type": "module",
+  "bin": {
+    "claude-gates": "./cli/index.mjs"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DevRik99/claude-gates.git"
+  },
+  "homepage": "https://github.com/DevRik99/claude-gates#readme",
+  "bugs": {
+    "url": "https://github.com/DevRik99/claude-gates/issues"
+  },
+  "author": "Devrik",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "cli",
+    "registry.json",
+    "README.md",
+    "README.es.md",
+    "plugins",
+    ".claude-plugin"
+  ],
+  "scripts": {
+    "test": "node --test",
+    "test:gate": "node --test",
+    "registry:check": "node cli/index.mjs registry --check",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write \"cli/**/*.mjs\" \"*.mjs\" \"*.json\" \".claude-plugin/*.json\" \"plugins/gates/.claude-plugin/*.json\" \"plugins/gates/hooks/hooks.json\"",
+    "format:check": "prettier --check \"cli/**/*.mjs\" \"*.mjs\""
+  },
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "license": "MIT",
+  "dependencies": {
+    "@clack/prompts": "1.7.0",
+    "commander": "^15.0.0",
+    "find-up": "^8.0.0",
+    "zod": "^4.5.2"
+  },
+  "devDependencies": {
+    "@cspell/eslint-plugin": "^10.1.1",
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.9.1",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-boundaries": "^7.2.0",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-n": "^18.3.0",
+    "eslint-plugin-prettier": "^5.5.6",
+    "eslint-plugin-promise": "^7.3.0",
+    "eslint-plugin-sonarjs": "^4.2.0",
+    "eslint-plugin-unicorn": "^74.0.0",
+    "eslint-plugin-unused-imports": "^4.4.1",
+    "globals": "^17.11.0",
+    "prettier": "^3.9.6"
+  }
+}

package/plugins/gates/.claude-plugin/plugin.json

@@ -0,0 +1,9 @@
+{
+  "name": "gates",
+  "version": "0.1.0",
+  "description": "Deterministic gates for Claude Code: destructive-command blocks, protected paths, delegation briefs, spec-driven flow and session-start validation. Selection lives in config, not in code.",
+  "author": {
+    "name": "Devrik"
+  },
+  "keywords": ["hooks", "guards", "gates", "PreToolUse", "SessionStart"]
+}