@devrik-tools/claude-gates 0.1.2 → 0.2.0

package/plugins/gates/hooks/gates/no-memory-dependency/index.mjs

@@ -1,120 +1,123 @@
-// no-memory-dependency — warns (never denies) when a delegation prompt leans on the
-// subagent "remembering" something said earlier in conversation instead of carrying
-// the data itself. A fresh subagent has no access to the delegator's conversation
-// history: if the data matters, it must travel IN the prompt, in a file the subagent
-// reads, or in an already-persisted decision.
-//
-// ── Two stages, same pattern as intent-flow ─────────────────────────────────────────
-// Stage 1 (cheap): does any memory-dependency phrase appear anywhere? If not, allow.
-// Stage 2 (confirmation, only on candidates): strip quoted text, then discard a phrase
-// that has a deterministic persistence instruction nearby (a file, flag, env var, gate)
-// — "remember to save this to notes.md" does not depend on model memory, it depends on
-// a real file. This is a soft signal (warn), not a hard block: whether the brief truly
-// needs the data or is just referencing prior agreement needs judgment this gate can't
-// supply on its own.
-
-import { runGate, warn, TOOL_GROUPS } from '../../lib/hook-io.mjs';
-
-const GATE_ID = 'no-memory-dependency';
-const CONFIG_KEY = 'warnMemoryDependencyInBrief';
-
-const DELEGATION_TOOLS = new Set(TOOL_GROUPS.delegation);
-
-const DEFAULT_MEMORY_DEPENDENCY_PATTERNS = [
-  'acordate de|acu[eé]rdate de',
-  'no olvides|no te olvides',
-  'record[aá] que|ten[eé] en cuenta que',
-  'como te dije|como ya te dije|ya te dije|te lo dije antes|ya te ped[ií]',
-  "remember to|don'?t forget|keep in mind",
-];
-
-// Split into two simpler alternations (tested with plain OR at call time) instead of
-// one large regex: each half stays well under the complexity/backtracking budget a
-// single combined pattern would hit.
-const PERSISTENCE_NOUN_PATTERN =
-  /archivo|file|flag|variable de entorno|env var|gate determinista|deterministic gate|\.md|\.json/i;
-// Kept deliberately flat (no nested optional groups) to stay under the regex-complexity
-// budget: a handful of plain alternatives rather than one clever pattern with backtracking.
-const PERSISTENCE_VERB_PATTERN =
-  /guardal[oa]|guarda|guardá esto|persisti|persiste|persistir|persistido|escribil[oa] en|escribi en|save it in|save this in|save it to|save this to/i;
-
-const PERSISTENCE_WINDOW = 80;
-
-function withUnicodeWordBoundary(alternatives) {
-  return new RegExp(
-    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
-    'iu',
-  );
-}
-
-function stripQuoted(text) {
-  return text
-    .replace(/```[\s\S]*?```/g, ' ')
-    .replace(/"[^"\n]{0,300}"/g, ' ')
-    .replace(/'[^'\n]{0,300}'/g, ' ');
-}
-
-function allMatches(pattern, text) {
-  const flags = pattern.flags.includes('g')
-    ? pattern.flags
-    : `${pattern.flags}g`;
-  return [...text.matchAll(new RegExp(pattern.source, flags))];
-}
-
-function hasPersistenceInstructionNearby(text, match) {
-  const from = Math.max(0, match.index - PERSISTENCE_WINDOW);
-  const to = Math.min(
-    text.length,
-    match.index + match[0].length + PERSISTENCE_WINDOW,
-  );
-  const window = text.slice(from, to);
-  return (
-    PERSISTENCE_NOUN_PATTERN.test(window) ||
-    PERSISTENCE_VERB_PATTERN.test(window)
-  );
-}
-
-function unresolvedMemoryPhrases(prompt, memoryPattern) {
-  if (!memoryPattern.test(prompt)) return []; // stage 1: no candidate, allow cheap
-
-  const text = stripQuoted(prompt); // stage 2(a)
-  const matches = allMatches(memoryPattern, text);
-
-  return matches
-    .filter((match) => !hasPersistenceInstructionNearby(text, match))
-    .map((match) => match[0].trim());
-}
-
-runGate(
-  {
-    id: GATE_ID,
-    configKey: CONFIG_KEY,
-    enabledByDefault: false,
-    defaultParams: {
-      memoryDependencyPatterns: DEFAULT_MEMORY_DEPENDENCY_PATTERNS,
-    },
-  },
-  ({ toolName, toolInput, parameters }) => {
-    if (!DELEGATION_TOOLS.has(toolName)) return;
-
-    const prompt = String(
-      toolInput.prompt ?? toolInput.description ?? toolInput.task ?? '',
-    );
-    if (!prompt.trim()) return;
-
-    const memoryPattern = withUnicodeWordBoundary(
-      (parameters.memoryDependencyPatterns ?? []).join('|'),
-    );
-
-    const phrases = unresolvedMemoryPhrases(prompt, memoryPattern);
-    if (phrases.length === 0) return;
-
-    const quotedPhrases = phrases.map((phrase) => `"${phrase}"`).join(', ');
-    warn(
-      GATE_ID,
-      `This delegation depends on the model remembering something (${quotedPhrases}). ` +
-        'If it matters, it should live in a file, a flag, an environment variable, or a deterministic gate — ' +
-        "not in the model's memory.",
-    );
-  },
-);
+// no-memory-dependency — warns (never denies) when a delegation prompt leans on the
+// subagent "remembering" something said earlier in conversation instead of carrying
+// the data itself. A fresh subagent has no access to the delegator's conversation
+// history: if the data matters, it must travel IN the prompt, in a file the subagent
+// reads, or in an already-persisted decision.
+//
+// ── Two stages, same pattern as intent-flow ─────────────────────────────────────────
+// Stage 1 (cheap): does any memory-dependency phrase appear anywhere? If not, allow.
+// Stage 2 (confirmation, only on candidates): strip quoted text, then discard a phrase
+// that has a REAL deterministic persistence INSTRUCTION nearby (not just a noun/verb
+// mentioned in passing) — "no te olvides de guardar la decision en .ai/decision.md"
+// genuinely depends on a file, not on model memory. A persistence noun/verb that merely
+// co-occurs in the window without forming an instruction TO persist THIS remembered
+// thing (e.g. an unrelated file named elsewhere in the same sentence) does not suppress
+// the warning. This stays a soft signal (warn), never a hard block: whether the brief
+// truly needs the data or is just referencing prior agreement needs judgment this gate
+// can't supply on its own.
+
+import {
+  runGate,
+  warn,
+  toolInGroups,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+import { PERSISTENCE_VERB } from '../../lib/signals.mjs';
+
+const GATE_ID = 'no-memory-dependency';
+const CONFIG_KEY = 'warnMemoryDependencyInBrief';
+
+const DEFAULT_MEMORY_DEPENDENCY_PATTERNS = [
+  'acordate de|acu[eé]rdate de',
+  'no olvides|no te olvides',
+  'record[aá] que|ten[eé] en cuenta que',
+  'como te dije|como ya te dije|ya te dije|te lo dije antes|ya te ped[ií]',
+  "remember to|don'?t forget|keep in mind",
+];
+
+// A real persistence INSTRUCTION requires an imperative persistence VERB (an actual
+// directive to save/persist/write THIS remembered thing), not merely a persistence-
+// related NOUN mentioned somewhere nearby (a stray "incident.md" in the same sentence
+// names a file without instructing anything be saved to it). Centralized in
+// lib/signals.mjs (ES+EN) so this class of signal is not duplicated per gate.
+const PERSISTENCE_VERB_PATTERN = PERSISTENCE_VERB;
+
+const PERSISTENCE_WINDOW = 80;
+
+function withUnicodeWordBoundary(alternatives) {
+  return new RegExp(
+    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
+    'iu',
+  );
+}
+
+function stripQuoted(text) {
+  return text
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/"[^"\n]{0,300}"/g, ' ')
+    .replace(/'[^'\n]{0,300}'/g, ' ');
+}
+
+function allMatches(pattern, text) {
+  const flags = pattern.flags.includes('g')
+    ? pattern.flags
+    : `${pattern.flags}g`;
+  return [...text.matchAll(new RegExp(pattern.source, flags))];
+}
+
+/** True only when the window around a memory phrase carries a real persistence
+ * INSTRUCTION — an imperative persistence verb — not merely a persistence-related noun
+ * mentioned in passing. A noun alone ("el reporte esta en incident.md") names a file
+ * without instructing anything be saved to it, so it must NOT suppress the warning. */
+function hasPersistenceInstructionNearby(text, match) {
+  const from = Math.max(0, match.index - PERSISTENCE_WINDOW);
+  const to = Math.min(
+    text.length,
+    match.index + match[0].length + PERSISTENCE_WINDOW,
+  );
+  const window = text.slice(from, to);
+  return PERSISTENCE_VERB_PATTERN.test(window);
+}
+
+function unresolvedMemoryPhrases(prompt, memoryPattern) {
+  if (!memoryPattern.test(prompt)) return []; // stage 1: no candidate, allow cheap
+
+  const text = stripQuoted(prompt); // stage 2(a)
+  const matches = allMatches(memoryPattern, text);
+
+  return matches
+    .filter((match) => !hasPersistenceInstructionNearby(text, match))
+    .map((match) => match[0].trim());
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: false,
+    defaultParams: {
+      memoryDependencyPatterns: DEFAULT_MEMORY_DEPENDENCY_PATTERNS,
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    if (!toolInGroups(toolName, ['delegation'])) return;
+
+    const prompt = delegationPromptOf(toolInput);
+    if (!prompt.trim()) return;
+
+    const memoryPattern = withUnicodeWordBoundary(
+      (parameters.memoryDependencyPatterns ?? []).join('|'),
+    );
+
+    const phrases = unresolvedMemoryPhrases(prompt, memoryPattern);
+    if (phrases.length === 0) return;
+
+    const quotedPhrases = phrases.map((phrase) => `"${phrase}"`).join(', ');
+    warn(
+      GATE_ID,
+      `This delegation depends on the model remembering something (${quotedPhrases}). ` +
+        'If it matters, it should live in a file, a flag, an environment variable, or a deterministic gate — ' +
+        "not in the model's memory.",
+    );
+  },
+);

package/plugins/gates/hooks/gates/no-memory-dependency/no-memory-dependency.edge.test.mjs

@@ -0,0 +1,83 @@
+// Edge-case audit for no-memory-dependency. This gate only warns, never denies, so a
+// "bypass" here means the warning silently fails to fire for a prompt that really does
+// depend on the model's memory, not that anything unsafe was blocked.
+// Run: node --test no-memory-dependency.edge.test.mjs
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function runGate(payload, { config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'no-memory-dependency-edge-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function isWarn(result) {
+  return typeof result?.hookSpecificOutput?.additionalContext === 'string';
+}
+
+const ENABLED = { config: { gates: { warnMemoryDependencyInBrief: true } } };
+const MEMORY_PROMPT = 'Acordate de lo que hablamos antes y aplica el mismo criterio.';
+
+test('FIXED: a delegation tool name outside the native list is now caught via toolInGroups (MCP delegation signal)', () => {
+  const result = runGate(
+    { tool_name: 'mcp__orchestrator__spawn_agent', tool_input: { prompt: MEMORY_PROMPT } },
+    ENABLED,
+  );
+  assert.ok(isWarn(result), 'gate now warns for the memory-dependency prompt under the MCP tool name too');
+});
+
+test('FIXED: prompt carried in a field other than prompt/description/task is now read via delegationPromptOf', () => {
+  const result = runGate(
+    { tool_name: 'Agent', tool_input: { instructions: MEMORY_PROMPT } },
+    ENABLED,
+  );
+  assert.ok(isWarn(result), 'gate now sees the prompt under "instructions" and warns');
+});
+
+test('FIXED: a persistence noun with no verb no longer suppresses the warning', () => {
+  // hasPersistenceInstructionNearby now requires an imperative persistence VERB nearby,
+  // not merely a noun. A prompt that mentions an unrelated file's name within the window
+  // (with no verb instructing anything be saved) no longer suppresses the warning.
+  const prompt =
+    'Acordate de lo que dijimos del login (el reporte esta en incident.md) y aplica el ' +
+    'mismo criterio de siempre.';
+  const result = runGate({ tool_name: 'Agent', tool_input: { prompt } }, ENABLED);
+  assert.ok(
+    isWarn(result),
+    'gate now warns: "incident.md" nearby with no persistence verb is not a real persistence instruction',
+  );
+});
+
+test('OK: a genuine memory-dependency phrase via Agent is warned', () => {
+  assert.ok(isWarn(runGate({ tool_name: 'Agent', tool_input: { prompt: MEMORY_PROMPT } }, ENABLED)));
+});
+
+test('OK: a memory phrase paired with a real persistence verb still suppresses the warning', () => {
+  const result = runGate(
+    {
+      tool_name: 'Agent',
+      tool_input: {
+        prompt: 'No te olvides de guardar la decision en .ai/decision.md antes de continuar.',
+      },
+    },
+    ENABLED,
+  );
+  assert.equal(result, null);
+});

package/plugins/gates/hooks/gates/no-reconfirm/no-reconfirm.edge.test.mjs

@@ -0,0 +1,91 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const GATE = join(dirname(fileURLToPath(import.meta.url)), 'index.mjs');
+
+function newProject({ config } = {}) {
+  const project = mkdtempSync(join(tmpdir(), 'no-reconfirm-edge-'));
+  mkdirSync(join(project, '.git'));
+  if (config) {
+    mkdirSync(join(project, '.ai'));
+    writeFileSync(join(project, '.ai', 'config.json'), JSON.stringify(config));
+  }
+  return project;
+}
+
+function writeTranscript(project, events) {
+  const transcriptPath = join(project, 'transcript.jsonl');
+  writeFileSync(transcriptPath, events.map((e) => JSON.stringify(e)).join('\n'));
+  return transcriptPath;
+}
+
+function humanTurn(text) {
+  return { type: 'user', userType: 'external', message: { content: text } };
+}
+
+function askQuestion(transcriptPath, question) {
+  return {
+    tool_name: 'AskUserQuestion',
+    transcript_path: transcriptPath,
+    tool_input: { questions: [question] },
+  };
+}
+
+function runGateIn(project, payload) {
+  const out = execFileSync(process.execPath, [GATE], {
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    cwd: project,
+    env: { ...process.env, HOME: project, USERPROFILE: project },
+  });
+  return out.trim() ? JSON.parse(out.trim()) : null;
+}
+
+function isWarn(result) {
+  return result?.hookSpecificOutput?.additionalContext !== undefined;
+}
+
+// EDGE CASE (BUG, confirmed via manual calculation before writing this test): the overlap
+// check has no notion of WHICH entity the action targets — it only counts shared
+// significant (>=5 char) words between the approving turn and the new question's topic
+// text (header+question+option labels). Approving "migrate the STAGING database schema"
+// shares 3 of 4 topic words (migrate/database/schema) with an unrelated question about
+// migrating the BILLING database schema — a materially different target — and clears both
+// MIN_SHARED_WORDS (2) and the default overlapThreshold (0.34): shared=3, fraction=0.75.
+test('BUG: approving one migration is treated as approval for an unrelated migration of a different entity (staging vs billing)', () => {
+  const project = newProject();
+  const transcriptPath = writeTranscript(project, [
+    humanTurn('go ahead, migrate the staging database schema now'),
+  ]);
+  const question = {
+    header: '',
+    question: 'Should I migrate the billing database schema?',
+    options: [],
+  };
+  const result = runGateIn(project, askQuestion(transcriptPath, question));
+  // Documents the false positive: the gate claims this was "already approved" even though
+  // the user approved a migration of a DIFFERENT database (staging, not billing).
+  assert.ok(isWarn(result), 'expected the (buggy) false-positive warn to fire: no entity/target check, only generic word overlap');
+});
+
+// EDGE CASE (BUG candidate): false negative via negation. The APPROVAL_PATTERN matches
+// literal phrases like "go ahead" / "do it" without checking for a preceding negation.
+// "don't go ahead" or "no, don't do it yet" still matches the raw pattern.
+test('BUG: a NEGATED approval phrase ("do not go ahead") is still treated as approval', () => {
+  const project = newProject();
+  const transcriptPath = writeTranscript(project, [
+    humanTurn('do not go ahead with migrating the authentication database schema'),
+  ]);
+  const question = {
+    header: 'Migration',
+    question: 'Should I migrate the authentication database schema?',
+    options: [],
+  };
+  const result = runGateIn(project, askQuestion(transcriptPath, question));
+  assert.ok(isWarn(result), 'expected the (buggy) warn to fire even though the user said NOT to go ahead — APPROVAL_PATTERN has no negation check');
+});