@devrik-tools/claude-gates 0.1.0

package/plugins/gates/hooks/gates/forge-flow/test.mjs

@@ -0,0 +1,135 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+// Builds a forge SQLite DB with the runs table and optional active run for a given cwd.
+function makeForgeDatabase(directory, activeCwd) {
+  const databasePath = join(directory, 'forge.db');
+  const database = new DatabaseSync(databasePath);
+  database.exec(
+    'CREATE TABLE runs (id TEXT, cwd TEXT, current_phase TEXT, status TEXT)',
+  );
+  if (activeCwd) {
+    database
+      .prepare(
+        'INSERT INTO runs (id, cwd, current_phase, status) VALUES (?,?,?,?)',
+      )
+      .run('r1', activeCwd, 'build', 'active');
+  }
+  database.close();
+  return databasePath;
+}
+
+// Runs the gate in a temp project. `adopted` writes the forge marker; `forgeDatabasePath` is
+// passed as the gate's param via config. HOME is isolated so the real global config is
+// never read. Returns the parsed deny output, or null when the gate allowed.
+function runGate(payload, { adopted, forgeDatabasePath, enabled = true } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'forge-flow-'));
+  mkdirSync(join(project, '.git'));
+  mkdirSync(join(project, '.ai'));
+  if (adopted) writeFileSync(join(project, '.ai', 'forge.json'), '{}');
+  const gateEntry = { enabled };
+  if (forgeDatabasePath) gateEntry.forgeDatabasePath = forgeDatabasePath;
+  writeFileSync(
+    join(project, '.ai', 'config.json'),
+    JSON.stringify({ gates: { requireForgeRunToEdit: gateEntry } }),
+  );
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return { output: out.trim() ? JSON.parse(out.trim()) : null, project };
+}
+
+function write(filePath) {
+  return {
+    tool_name: 'Write',
+    tool_input: { file_path: filePath, content: 'x' },
+  };
+}
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+test('a project that did NOT adopt forge is never blocked', () => {
+  const { output } = runGate(write('src/x.js'), { adopted: false });
+  assert.equal(output, null);
+});
+
+test('adopted forge, no active run: a write is denied', () => {
+  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
+  const databasePath = makeForgeDatabase(home); // no active run
+  const { output } = runGate(write('src/x.js'), {
+    adopted: true,
+    forgeDatabasePath: databasePath,
+  });
+  assert.ok(isDeny(output));
+});
+
+test('adopted forge, active run for this project: the write is allowed', () => {
+  // The run's cwd must equal the project root the gate resolves. Run once to learn the
+  // project path, then rebuild the DB with that cwd — the helper makes a fresh project each
+  // call, so we seed the DB against the project it actually created.
+  const project = mkdtempSync(join(tmpdir(), 'forge-flow-'));
+  mkdirSync(join(project, '.git'));
+  mkdirSync(join(project, '.ai'));
+  writeFileSync(join(project, '.ai', 'forge.json'), '{}');
+  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
+  const databasePath = makeForgeDatabase(home, project); // active run whose cwd = this project
+  writeFileSync(
+    join(project, '.ai', 'config.json'),
+    JSON.stringify({
+      gates: {
+        requireForgeRunToEdit: {
+          enabled: true,
+          forgeDatabasePath: databasePath,
+        },
+      },
+    }),
+  );
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(write('src/x.js')),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  assert.equal(out.trim(), '', 'allowed: no output');
+});
+
+test('adopted forge but DB missing: denied (no runs at all)', () => {
+  const { output } = runGate(write('src/x.js'), {
+    adopted: true,
+    forgeDatabasePath: join(tmpdir(), 'does-not-exist', 'forge.db'),
+  });
+  assert.ok(isDeny(output));
+});
+
+test('disabled by config: not blocked even in an adopted project', () => {
+  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
+  const databasePath = makeForgeDatabase(home);
+  const { output } = runGate(write('src/x.js'), {
+    adopted: true,
+    forgeDatabasePath: databasePath,
+    enabled: false,
+  });
+  assert.equal(output, null);
+});
+
+test('a read-only tool (no write/shell) is never blocked', () => {
+  const home = mkdtempSync(join(tmpdir(), 'forge-db-'));
+  const databasePath = makeForgeDatabase(home);
+  const { output } = runGate(
+    { tool_name: 'Read', tool_input: { file_path: 'src/x.js' } },
+    { adopted: true, forgeDatabasePath: databasePath },
+  );
+  assert.equal(output, null);
+});

package/plugins/gates/hooks/gates/implementation-pipeline/index.mjs

@@ -0,0 +1,186 @@
+// implementation-pipeline — denies a delegation that sends a builder subagent straight
+// to writing code without the prompt declaring the pipeline stages around it:
+// definition (where the context came from), writing's own verification plan, and a
+// separate reviewer for validation/QA/closure. Migrated from
+// ~/.claude/hooks/guard-pipeline-de-implementacion.mjs.
+//
+// ── What a project can configure (params) ───────────────────────────────────────────
+//   builderSubagents   subagent types that count as builders — the ones this gate
+//                       holds to the pipeline. Replaces the built-in list wholesale.
+//   exemptSubagents     subagent types exempt outright: read-only pipeline stages that
+//                       cannot be required to declare a pipeline around themselves.
+//                       Replaces the built-in list wholesale.
+// The defaults live here, in the source, so a project reads them and knows exactly what
+// its override replaces.
+//
+// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
+// This gate only evaluates a delegation whose prompt declares a STANDARD/HIGH-RISK
+// level, uses an implementation verb, targets a builder subagent, and is not about the
+// harness itself. A prompt that only describes work, or that is read-only/exploratory,
+// never reaches the check.
+
+import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'implementation-pipeline';
+const CONFIG_KEY = 'requireImplementationPipeline';
+
+const DELEGATION_TOOLS = new Set(TOOL_GROUPS.delegation);
+
+const DEFAULT_BUILDER_SUBAGENTS = [
+  'frontend',
+  'backend',
+  'worker',
+  'worker-senior',
+  'general-purpose',
+];
+
+const DEFAULT_EXEMPT_SUBAGENTS = [
+  'scout',
+  'explore',
+  'plan',
+  'revision',
+  'contraste',
+  'test-planner',
+  'qa',
+  'ui',
+  'ux',
+];
+
+function withWordBoundary(alternation) {
+  return new RegExp(
+    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
+    'iu',
+  );
+}
+
+const IMPLEMENTATION_VERBS = withWordBoundary(
+  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
+    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
+    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
+    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
+    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
+    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
+);
+
+/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
+ * the plugin-wide convention (see risk-level.mjs). */
+const DEMANDING_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
+const EXEMPT_LEVEL_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
+const HIGH_RISK_PATTERN =
+  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\bHIGH-RISK\b/iu;
+
+const HARNESS_PATTERN =
+  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
+
+// Several small patterns instead of one long alternation: a single big regex here
+// tripped the linter's regex-complexity limit. Any one matching counts as declared.
+const REVIEWER_NAME_PATTERN =
+  /\b(reviewer|revisor|separate review|revisi[oó]n separada|contraste|auditor)\b/i;
+const REVIEWER_LABEL_PATTERN = /(review|revisi[oó]n)\s*:/i;
+const REVIEWER_ACTION_EN_PATTERN =
+  /\breview\s+(?:the\s+)?(?:diff|result|work)\b/i;
+const REVIEWER_ACTION_ES_PATTERN =
+  /\brevisa\s+(?:el\s+)?(?:diff|resultado|trabajo)\b/i;
+const REVIEWER_CODE_REVIEW_PATTERN = /code.review/i;
+
+function reviewerStageDeclared(prompt) {
+  return (
+    REVIEWER_NAME_PATTERN.test(prompt) ||
+    REVIEWER_LABEL_PATTERN.test(prompt) ||
+    REVIEWER_ACTION_EN_PATTERN.test(prompt) ||
+    REVIEWER_ACTION_ES_PATTERN.test(prompt) ||
+    REVIEWER_CODE_REVIEW_PATTERN.test(prompt)
+  );
+}
+
+const DEFINITION_PATTERN =
+  /\b(scout|reconnaissance|reconocimiento|prior exploration|explora(?:ci[oó]n)? previa|verified context|contexto verificado|asserts\.md|brief\.md)\b/i;
+const WRITING_PATTERN =
+  /\b(test|tests|prueba|pruebas|vitest|jest|playwright|typecheck|lint|verification|verificaci[oó]n|verification criteria)\b/i;
+
+/** The three pipeline stages this gate requires be declared, in this order. */
+const REQUIRED_STAGES = [
+  {
+    id: 'definition',
+    isDeclared: (prompt) => DEFINITION_PATTERN.test(prompt),
+    missing:
+      'DEFINITION: does not declare where the context came from (a prior scout, read-only exploration, or an already-written asserts/brief).',
+    line: 'Verified context: <path to the cited asserts/brief> — or: a prior scout ran, findings at <path>.',
+  },
+  {
+    id: 'writing',
+    isDeclared: (prompt) => WRITING_PATTERN.test(prompt),
+    missing:
+      'WRITING: does not declare what is verified nor with what command. A builder does not validate its own work without a criterion written beforehand.',
+    line: 'Verification: <exact command> and what is expected. Anything that cannot run is reported OMITTED, never PASS.',
+  },
+  {
+    id: 'reviewer',
+    isDeclared: reviewerStageDeclared,
+    missing:
+      'REVIEWER: does not declare who reviews the result. Whoever implements does not validate their own work.',
+    line: 'Review: the coordinator reviews the diff and the evidence before closing — or: a read-only `revision`/`contraste` agent reviews it.',
+  },
+];
+
+function isExempt(toolInput, prompt, builderSubagents, exemptSubagents) {
+  const subagentType = String(
+    toolInput.subagent_type ?? toolInput.subagentType ?? '',
+  ).toLowerCase();
+  if (exemptSubagents.includes(subagentType)) return true;
+  // An unknown type is not assumed to be a builder: the safe side here is not to
+  // invent requirements for agents this gate cannot classify.
+  if (subagentType && !builderSubagents.includes(subagentType)) return true;
+  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
+  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
+  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
+  if (HARNESS_PATTERN.test(prompt)) return true;
+  return false;
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      builderSubagents: DEFAULT_BUILDER_SUBAGENTS,
+      exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!DELEGATION_TOOLS.has(toolName)) return;
+
+    const prompt = String(
+      toolInput.prompt ?? toolInput.Prompt ?? toolInput.task ?? '',
+    );
+    if (!prompt.trim()) return;
+
+    const builderSubagents =
+      parameters.builderSubagents ?? DEFAULT_BUILDER_SUBAGENTS;
+    const exemptSubagents =
+      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
+    if (isExempt(toolInput, prompt, builderSubagents, exemptSubagents)) return;
+
+    const missingStages = REQUIRED_STAGES.filter(
+      (stage) => !stage.isDeclared(prompt),
+    );
+    if (missingStages.length === 0) return;
+
+    const isHighRisk = HIGH_RISK_PATTERN.test(prompt);
+    const details = missingStages.map((stage) => stage.missing).join(' ');
+    const lines = missingStages.map((stage) => `  ${stage.line}`).join('\n');
+
+    deny(
+      GATE_ID,
+      `This delegation is going to build code but skips ${missingStages.length} pipeline ` +
+        `stage(s). ${details} ${
+          isHighRisk
+            ? 'In HIGH-RISK a separate reviewer is not negotiable. '
+            : ''
+        }PASTE THESE LINES INTO THE PROMPT AND RELAUNCH:\n${lines}`,
+    );
+  },
+);

package/plugins/gates/hooks/gates/implementation-pipeline/test.mjs

@@ -0,0 +1,86 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'implementation-pipeline-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    // Isolate from the user's real global config: point homedir() at the temp
+    // project so the global-config fallback finds nothing (registry default).
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function delegate(prompt, subagentType = 'backend') {
+  return {
+    tool_name: 'Agent',
+    tool_input: { prompt, subagent_type: subagentType },
+  };
+}
+
+function isDeny(result) {
+  return result?.hookSpecificOutput?.permissionDecision === 'deny';
+}
+
+function enabledConfig(extraParameters) {
+  return {
+    gates: {
+      requireImplementationPipeline: extraParameters
+        ? { enabled: true, ...extraParameters }
+        : true,
+    },
+  };
+}
+
+test('disabled by default: a builder delegation with no pipeline stages is allowed', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
+  assert.equal(runGate(delegate(prompt)), null);
+});
+
+test('denies a builder delegation missing all three pipeline stages', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
+  assert.ok(isDeny(runGate(delegate(prompt), { config: enabledConfig() })));
+});
+
+test('allows a builder delegation that declares all three stages', () => {
+  const prompt =
+    'Nivel: STANDARD\nImplementá el checkout. Contexto verificado: .ai/features/checkout/brief.md. ' +
+    'Verificación: npm test debe pasar. Revisión: el principal revisa el diff antes de cerrar.';
+  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
+});
+
+test('exempt subagent type (scout) is never held to the pipeline', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
+  assert.equal(
+    runGate(delegate(prompt, 'scout'), { config: enabledConfig() }),
+    null,
+  );
+});
+
+test('a prompt that only describes, does not order, is exempt via QUESTION level', () => {
+  const prompt = 'Nivel: QUESTION\nExplicá cómo funciona el checkout hoy.';
+  assert.equal(runGate(delegate(prompt), { config: enabledConfig() }), null);
+});
+
+test('builderSubagents param override holds a custom type to the pipeline', () => {
+  const prompt = 'Nivel: STANDARD\nImplementá el checkout.';
+  const config = enabledConfig({ builderSubagents: ['custom-builder'] });
+  assert.ok(isDeny(runGate(delegate(prompt, 'custom-builder'), { config })));
+  // a type NOT in the overridden list is not assumed to be a builder
+  assert.equal(runGate(delegate(prompt, 'backend'), { config }), null);
+});

package/plugins/gates/hooks/gates/intent-flow/index.mjs

@@ -0,0 +1,238 @@
+// intent-flow — denies an implementation delegation that has real intent to mutate a
+// high-impact area (money, auth, persisted data, public contract, irreversible...)
+// without declaring IN SCOPE / OUT OF SCOPE / EDGE CASES, and hard-denies whenever it
+// also leaves a high-impact UNKNOWN unresolved.
+//
+// ── How this differs from brief-before-delegate ─────────────────────────────────────
+// brief-before-delegate asks "was the task thought through" (goal+steps+criterion).
+// This gate asks a different, complementary question: "was the SCOPE declared — what
+// is in, what is explicitly out, and what edge cases were considered — for work that
+// really intends to touch a sensitive area?" Both run on the same delegation prompt
+// independently; neither depends on the other's verdict.
+//
+// ── Two-stage intent check (not lexical match) ──────────────────────────────────────
+// Stage 1 (cheap prefilter): does the raw prompt contain BOTH an implementation verb
+// and a high-impact signal anywhere? If not, there is no candidate — allow immediately.
+// Stage 2 (confirmation, only on candidates): strip quoted/templated text, then require
+// near co-occurrence between an implementation verb and a high-impact signal, and
+// discard a verb whose immediate object is a documentary deliverable (a doc/report/
+// README/.md/.html describing the area is not mutating it). Only surviving (a)+(b)+(c)
+// counts as real intent.
+
+import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'intent-flow';
+const CONFIG_KEY = 'requireScopeListBeforeDelegating';
+
+const DELEGATION_TOOLS = new Set(TOOL_GROUPS.delegation);
+
+const DEFAULT_READ_ONLY_SUBAGENTS = ['explore', 'claude-code-guide', 'plan'];
+const DEFAULT_HIGH_IMPACT_PATTERNS = [
+  'dinero|pago|cobro|money|payment',
+  'auth|autenticaci[oó]n|authentication|permiso|permission|token|sesi[oó]n|session|seguridad|security|PII',
+  'borrar|delete|drop|migraci[oó]n|migration|schema',
+  'contrato|contract|irreversible|producci[oó]n|production|API p[uú]blica|public api',
+];
+
+const MIN_REQUEST_LENGTH = 40;
+const CO_OCCURRENCE_WINDOW = 100;
+const VERB_OBJECT_WINDOW = 60;
+// How much of an over-length prompt to quote back in a denial message.
+const PROMPT_EXCERPT_LENGTH = 80;
+
+function withUnicodeWordBoundary(alternatives) {
+  return new RegExp(
+    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
+    'iu',
+  );
+}
+
+const IMPLEMENTATION_VERBS = withUnicodeWordBoundary(
+  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
+    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|escrib(í|e) c[oó]digo|escribir c[oó]digo|' +
+    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
+    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
+    'implement|build|fix|migrate|modify|refactor|remove|rewrite|deploy',
+);
+
+const QUERY_VERBS = withUnicodeWordBoundary(
+  'explica|explic(á|ar)|qu[eé]|c[oó]mo|muestra|mostr(á|ar)|analiza|analiz(á|ar)|investiga|' +
+    'investig(á|ar)|revisa|revis(á|ar)|audita|audit(á|ar)|diagnostica|diagnostic(á|ar)|' +
+    'explain|what|how|show|analyze|investigate|review|audit|diagnose',
+);
+
+const IN_SCOPE_PATTERN = withUnicodeWordBoundary(
+  'qu[eé] s[ií]|qu[eé] s[ií] entra|alcance|in scope|lo pedido|se va a hacer|incluye',
+);
+const OUT_OF_SCOPE_PATTERN = withUnicodeWordBoundary(
+  'qu[eé] no|fuera de alcance|out of scope|no tocar|no modificar|no debe cambiar|' +
+    'must not change|no se debe (cambiar|tocar|modificar)',
+);
+const EDGE_CASES_PATTERN = withUnicodeWordBoundary(
+  'edge cases?|edge-cases?|casos? borde|casos? l[ií]mite|caso l[ií]mite|sin edge cases|' +
+    'no (hay|aplican) edge cases|no hay casos borde',
+);
+const UNRESOLVED_UNKNOWN_PATTERN = withUnicodeWordBoundary(
+  'unknown|no se sabe|no sabemos|sin resolver|no est[aá] claro|no est[aá] definido|' +
+    'a definir|por definir|desconocido|no est[aá] decidido',
+);
+const DOCUMENTARY_DELIVERABLE_PATTERN = withUnicodeWordBoundary(
+  'documento|documentaci[oó]n|reporte|informe|diagrama|readme|wiki|changelog|' +
+    'p[aá]gina de documentaci[oó]n|archivo html|p[aá]gina html|markdown|document|documentation|report',
+);
+const DOCUMENTARY_EXTENSION_PATTERN = /\.(md|html?|adoc)\b/iu;
+
+function isReadOnlySubagent(toolInput, readOnlySubagents) {
+  const type = String(
+    toolInput.subagent_type ?? toolInput.subagentType ?? '',
+  ).toLowerCase();
+  return new Set(readOnlySubagents.map((name) => name.toLowerCase())).has(type);
+}
+
+function isImplementationRequest(prompt) {
+  return IMPLEMENTATION_VERBS.test(prompt);
+}
+
+function isExemptQuery(prompt) {
+  if (isImplementationRequest(prompt)) return false; // implementation verb takes priority
+  return QUERY_VERBS.test(prompt);
+}
+
+function stripQuoted(text) {
+  return text
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/"[^"\n]{0,300}"/g, ' ')
+    .replace(/'[^'\n]{0,300}'/g, ' ');
+}
+
+function allMatches(pattern, text) {
+  const flags = pattern.flags.includes('g')
+    ? pattern.flags
+    : `${pattern.flags}g`;
+  return [...text.matchAll(new RegExp(pattern.source, flags))];
+}
+
+function verbProducesDocument(text, verbMatch) {
+  const from = verbMatch.index;
+  const to = from + verbMatch[0].length + VERB_OBJECT_WINDOW;
+  const objectOfVerb = text.slice(from, to);
+  return (
+    DOCUMENTARY_DELIVERABLE_PATTERN.test(objectOfVerb) ||
+    DOCUMENTARY_EXTENSION_PATTERN.test(objectOfVerb)
+  );
+}
+
+function hasRealSensitiveMutation(prompt, highImpactPattern) {
+  const isCandidate =
+    IMPLEMENTATION_VERBS.test(prompt) && highImpactPattern.test(prompt);
+  if (!isCandidate) return false; // stage 1: cheap, no stage 2 spent
+
+  const text = stripQuoted(prompt); // stage 2(a)
+  const verbs = allMatches(IMPLEMENTATION_VERBS, text);
+  const signals = allMatches(highImpactPattern, text);
+
+  for (const verb of verbs) {
+    if (verbProducesDocument(text, verb)) continue; // stage 2(c)
+    for (const signal of signals) {
+      if (Math.abs(signal.index - verb.index) <= CO_OCCURRENCE_WINDOW)
+        return true; // stage 2(b)
+    }
+  }
+  return false;
+}
+
+function missingSignals(prompt) {
+  const missing = [];
+  if (!IN_SCOPE_PATTERN.test(prompt))
+    missing.push('IN SCOPE (what is requested, stated explicitly)');
+  if (!OUT_OF_SCOPE_PATTERN.test(prompt))
+    missing.push('OUT OF SCOPE (what must not be touched)');
+  if (!EDGE_CASES_PATTERN.test(prompt)) {
+    missing.push(
+      'EDGE CASES (considered, or an explicit mark that none apply)',
+    );
+  }
+  return missing;
+}
+
+function denyUnresolvedUnknown() {
+  deny(
+    GATE_ID,
+    'This request touches a high-impact signal (money/auth/persisted data/public contract/' +
+      'irreversible/production) AND declares an unresolved UNKNOWN. Do not relaunch assuming an ' +
+      'answer — ask the user what to decide about that UNKNOWN before delegating again.',
+  );
+}
+
+function denyTooShortForScopeList(prompt) {
+  const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
+  const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
+  deny(
+    GATE_ID,
+    `This implementation request ("${excerpt}${ellipsis}") does not carry a scope list: missing IN ` +
+      'SCOPE, OUT OF SCOPE and EDGE CASES. Add it to the prompt before relaunching.',
+  );
+}
+
+function denyMissingSignals(missing) {
+  deny(
+    GATE_ID,
+    `This implementation request does not declare, in recognizable form: ${missing.join('; ')}. ` +
+      'Add what is missing to the prompt before relaunching this delegation.',
+  );
+}
+
+function buildHighImpactPattern(highImpactPatterns) {
+  return new RegExp(
+    (highImpactPatterns ?? []).map((source) => `(?:${source})`).join('|'),
+    'iu',
+  );
+}
+
+/** True when this delegation is exempt from the whole check: not a recognizable
+ * implementation request, a read-only subagent, or an exempt query. */
+function isExempt(toolInput, prompt, readOnlySubagents) {
+  if (!prompt.trim()) return true;
+  if (isReadOnlySubagent(toolInput, readOnlySubagents)) return true;
+  if (isExemptQuery(prompt)) return true;
+  return !isImplementationRequest(prompt);
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      highImpactPatterns: DEFAULT_HIGH_IMPACT_PATTERNS,
+      readOnlySubagents: DEFAULT_READ_ONLY_SUBAGENTS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!DELEGATION_TOOLS.has(toolName)) return;
+
+    const prompt = String(
+      toolInput.prompt ?? toolInput.description ?? toolInput.task ?? '',
+    );
+    if (isExempt(toolInput, prompt, parameters.readOnlySubagents)) return;
+
+    const highImpactPattern = buildHighImpactPattern(
+      parameters.highImpactPatterns,
+    );
+    if (!hasRealSensitiveMutation(prompt, highImpactPattern)) return;
+
+    if (UNRESOLVED_UNKNOWN_PATTERN.test(stripQuoted(prompt))) {
+      denyUnresolvedUnknown();
+    }
+
+    const trimmed = prompt.trim();
+    if (trimmed.length < MIN_REQUEST_LENGTH) {
+      denyTooShortForScopeList(trimmed);
+    }
+
+    const missing = missingSignals(prompt);
+    if (missing.length === 0) return;
+
+    denyMissingSignals(missing);
+  },
+);