@devrik-tools/claude-gates 0.1.2 → 0.2.0

package/plugins/gates/hooks/lib/hook-io.mjs

@@ -1,208 +1,318 @@
-// Process I/O shared by every gate. Self-contained: Node built-ins only, so a gate keeps
-// working when installed outside this repo.
-//
-// There is no dispatcher: Claude Code runs one hook entry per gate natively (each with its
-// own `matcher`, all matching entries in parallel), so each gate is its own process and
-// reads its own stdin. This module holds what every gate needs, none of it gate-specific:
-//   1. Reading and parsing the hook payload Claude Code writes to stdin.
-//   2. Translating the registry's semantic tool groups (write/shell/...) into the concrete
-//      tool names Claude Code sends — used to derive each gate's `matcher` and, when a gate
-//      also inspects delegation prompts, to recognize the tool at runtime.
-//   3. Reading a deny/warn decision out of a gate's own JSON output shape.
-
-import { readFileSync } from 'node:fs';
-import { gateParameters, isGateEnabled } from './config.mjs';
-
-const STDIN_FILE_DESCRIPTOR = 0;
-
-/**
- * Semantic tool groups (as declared in registry.json's `tools`) mapped to the concrete
- * tool names Claude Code emits. Keeping the map here (not in the registry) keeps the
- * catalog declarative: which tool names exist is a fact about the Claude Code runtime,
- * not about the gate. `matcherFor` turns a group set into the `Tool1|Tool2` string a
- * hooks.json entry uses; `toolNamesFor` gives the flat list a gate matches at runtime.
- */
-export const TOOL_GROUPS = Object.freeze({
-  write: [
-    'Write',
-    'Edit',
-    'NotebookEdit',
-    'write_to_file',
-    'replace_file_content',
-  ],
-  shell: ['Bash', 'run_command'],
-  delegation: ['Agent', 'Task', 'invoke_subagent'],
-  question: ['AskUserQuestion'],
-  // The main agent materializing a change directly, whatever the surface.
-  execution: [
-    'Write',
-    'Edit',
-    'NotebookEdit',
-    'write_to_file',
-    'replace_file_content',
-    'Bash',
-    'run_command',
-    'mcp__ide__executeCode',
-  ],
-});
-
-/** Every concrete tool name a set of groups expands to, de-duplicated. */
-export function toolNamesFor(groups) {
-  const names = new Set();
-  for (const group of groups) {
-    for (const name of TOOL_GROUPS[group] ?? []) names.add(name);
-  }
-  return [...names];
-}
-
-/** The `matcher` string for a hooks.json entry: `Bash|Edit|Write`, or '' when empty. */
-export function matcherFor(groups) {
-  return toolNamesFor(groups).join('|');
-}
-
-/** Reads the raw hook payload from stdin. Returns null when stdin cannot be read. */
-export function readHookPayload() {
-  try {
-    return readFileSync(STDIN_FILE_DESCRIPTOR, 'utf8');
-  } catch {
-    return null;
-  }
-}
-
-/**
- * The tool name inside a raw payload. Returns null when the payload is unparseable —
- * the caller cannot filter by tool then, so it must run every gate rather than skip
- * silently (erring toward over-running protects; erring toward skipping leaves a mute hole).
- */
-export function toolNameOf(rawPayload) {
-  try {
-    const payload = JSON.parse(rawPayload);
-    return payload?.tool_name ?? payload?.name ?? '';
-  } catch {
-    return null;
-  }
-}
-
-/** The session id inside a raw payload, or null when absent/unparseable. */
-export function sessionIdOf(rawPayload) {
-  try {
-    return JSON.parse(rawPayload)?.session_id ?? null;
-  } catch {
-    return null;
-  }
-}
-
-/** The tool input object inside a raw payload, or {} when absent/unparseable. */
-export function toolInputOf(rawPayload) {
-  try {
-    const payload = JSON.parse(rawPayload);
-    return payload?.tool_input ?? payload?.input ?? {};
-  } catch {
-    return {};
-  }
-}
-
-const PRE_TOOL_USE_EVENT = 'PreToolUse';
-
-/**
- * A gate answers Claude Code in exactly one of three ways, and every gate uses these
- * emitters so the JSON shape is written once:
- *   - deny:  the rule is deterministic and the action is wrong. Blocks the tool call.
- *   - warn:  the question needs judgment; the gate surfaces context at the right moment
- *            (additionalContext) and lets the call proceed.
- *   - allow: nothing to say. The common path — silent and cheap.
- * Each emitter exits the process (exit 0 always: a PreToolUse deny is expressed in the
- * JSON, not in the exit code — reserving exit codes keeps a crash distinguishable).
- *
- * `label` is the gate id, prefixed to every message so a block names its source.
- */
-export function deny(label, reason) {
-  process.stdout.write(
-    JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: PRE_TOOL_USE_EVENT,
-        permissionDecision: 'deny',
-        permissionDecisionReason: `[${label}] ${reason}`,
-      },
-    }),
-  );
-  process.exit(0);
-}
-
-export function warn(label, context) {
-  process.stdout.write(
-    JSON.stringify({
-      hookSpecificOutput: {
-        hookEventName: PRE_TOOL_USE_EVENT,
-        additionalContext: `[${label}] ${context}`,
-      },
-    }),
-  );
-  process.exit(0);
-}
-
-export function allow() {
-  process.exit(0);
-}
-
-/**
- * The scaffolding every gate shares, so a gate file is just its rule. Given a gate's
- * identity and a `check` function, this: reads stdin (allow when unreadable), turns the
- * gate off when the project config disables it (allow), loads the project's params merged
- * over the gate's own defaults, and runs `check`. `check` calls `deny`/`warn` to object,
- * or returns to allow. A throw inside `check` is caught and turned into a deny — a gate
- * that cannot evaluate must not silently permit.
- *
- * @param {object} gate
- * @param {string} gate.id            registry id, used as the message label
- * @param {string} gate.configKey     the config flag that enables/disables this gate
- * @param {boolean} gate.enabledByDefault  the registry default when config is silent
- * @param {object} [gate.defaultParams]    the gate's built-in params (the readable defaults)
- * @param {(context: { rawPayload: string, toolName: string, toolInput: object,
- *                     sessionId: string|null, parameters: object }) => void} check
- */
-export async function runGate(gate, check) {
-  // Defaults-dump mode: when the CLI spawns a gate with this flag set, the gate prints its
-  // own descriptor (id, configKey, default flag and built-in params) and exits — before
-  // touching stdin. This lets `init` materialize each gate's defaults into the config it
-  // writes, with the gate as the single source of truth (no duplication in the registry).
-  if (process.env.CLAUDE_GATES_DUMP_DEFAULTS) {
-    process.stdout.write(
-      JSON.stringify({
-        id: gate.id,
-        configKey: gate.configKey,
-        enabledByDefault: gate.enabledByDefault,
-        defaultParams: gate.defaultParams ?? {},
-      }),
-    );
-    process.exit(0);
-  }
-
-  const rawPayload = readHookPayload();
-  if (rawPayload === null) allow();
-
-  if (!isGateEnabled(gate.configKey, gate.enabledByDefault, process.cwd()))
-    allow();
-
-  const declared = gateParameters(gate.configKey, process.cwd());
-  const parameters = { ...(gate.defaultParams ?? {}), ...declared };
-
-  try {
-    // `check` may be sync or async; awaiting a non-promise is transparent, so the same
-    // scaffolding serves both. Crucially, allow() runs only AFTER the check settles — an
-    // async gate that permits early would never block.
-    await check({
-      rawPayload,
-      toolName: toolNameOf(rawPayload) ?? '',
-      toolInput: toolInputOf(rawPayload),
-      sessionId: sessionIdOf(rawPayload),
-      parameters,
-    });
-  } catch (error) {
-    deny(
-      gate.id,
-      `The gate failed to evaluate and blocks the action for safety: ${error?.message ?? error}.`,
-    );
-  }
-  allow();
-}
+// Process I/O shared by every gate. Self-contained: Node built-ins only, so a gate keeps
+// working when installed outside this repo.
+//
+// There is no dispatcher: Claude Code runs one hook entry per gate natively (each with its
+// own `matcher`, all matching entries in parallel), so each gate is its own process and
+// reads its own stdin. This module holds what every gate needs, none of it gate-specific:
+//   1. Reading and parsing the hook payload Claude Code writes to stdin.
+//   2. Translating the registry's semantic tool groups (write/shell/...) into the concrete
+//      tool names Claude Code sends — used to derive each gate's `matcher` and, when a gate
+//      also inspects delegation prompts, to recognize the tool at runtime.
+//   3. Reading a deny/warn decision out of a gate's own JSON output shape.
+
+import { readFileSync } from 'node:fs';
+import { gateParameters, isGateEnabled } from './config.mjs';
+
+const STDIN_FILE_DESCRIPTOR = 0;
+
+/**
+ * Semantic tool groups (as declared in registry.json's `tools`) mapped to the concrete
+ * tool names Claude Code emits. Keeping the map here (not in the registry) keeps the
+ * catalog declarative: which tool names exist is a fact about the Claude Code runtime,
+ * not about the gate. `matcherFor` turns a group set into the `Tool1|Tool2` string a
+ * hooks.json entry uses; `toolNamesFor` gives the flat list a gate matches at runtime.
+ */
+export const TOOL_GROUPS = Object.freeze({
+  write: [
+    'Write',
+    'Edit',
+    'NotebookEdit',
+    'write_to_file',
+    'replace_file_content',
+  ],
+  shell: ['Bash', 'run_command'],
+  delegation: ['Agent', 'Task', 'invoke_subagent'],
+  question: ['AskUserQuestion'],
+  // The main agent materializing a change directly, whatever the surface.
+  execution: [
+    'Write',
+    'Edit',
+    'NotebookEdit',
+    'write_to_file',
+    'replace_file_content',
+    'Bash',
+    'run_command',
+    'mcp__ide__executeCode',
+  ],
+});
+
+/** Every concrete tool name a set of groups expands to, de-duplicated. */
+export function toolNamesFor(groups) {
+  const names = new Set();
+  for (const group of groups) {
+    for (const name of TOOL_GROUPS[group] ?? []) names.add(name);
+  }
+  return [...names];
+}
+
+/**
+ * MCP tools are named `mcp__<server>__<tool>`, and any connected server can expose a write,
+ * shell, delegation or ask surface under a name this repo has never seen. Enumerating exact
+ * names (the old approach) left every such tool invisible: the gate never fired. Instead,
+ * each group carries a substring rule matched against the MCP tool's action segment, so a
+ * NEW server's `mcp__fs__write_file` or `mcp__shell__exec` is classified by what it does, not
+ * by a name we had to know in advance. The rule intentionally over-includes (a false match
+ * makes a gate inspect a payload it then finds benign — cheap) rather than under-includes (a
+ * miss is a silent hole). `question` stays deny-heavy so autonomous mode cannot be dodged by
+ * an MCP ask tool. Native (non-mcp) names are still matched exactly via TOOL_GROUPS.
+ */
+const MCP_GROUP_SIGNALS = Object.freeze({
+  write: /(?:write|edit|create|append|patch|replace|insert|modify|save|update)/i,
+  shell: /(?:shell|bash|exec|run|command|terminal|process|spawn|cmd|powershell|sh)/i,
+  delegation: /(?:agent|task|delegat|subagent|spawn|dispatch|orchestrat|worker)/i,
+  question: /(?:ask|question|confirm|prompt|approv|choice|elicit|clarif)/i,
+  execution: /(?:write|edit|create|append|patch|replace|insert|modify|save|update|shell|bash|exec|run|command|terminal|process|spawn|cmd|powershell|sh)/i,
+});
+
+const MCP_TOOL_PREFIX = 'mcp__';
+
+/** The action segment of an MCP tool name (`mcp__server__do_thing` -> `do_thing`), or ''. */
+function mcpActionSegment(toolName) {
+  if (!toolName.startsWith(MCP_TOOL_PREFIX)) return '';
+  const parts = toolName.split('__');
+  return parts.length >= 3 ? parts.slice(2).join('__') : '';
+}
+
+/**
+ * Whether a tool name belongs to any of the given groups. A native tool matches by exact
+ * membership; an MCP tool (`mcp__*`) matches when its action segment hits the group's signal
+ * regex. This is what every gate should use instead of a private `Set.has(toolName)` — the
+ * private sets were the second half of the MCP blind spot (even a payload that reached the
+ * gate was rejected by an exact-name check).
+ */
+export function toolInGroups(toolName, groups) {
+  if (!toolName) return false;
+  const native = toolNamesFor(groups);
+  // Native tool names from Claude Code are canonical (`AskUserQuestion`), but match
+  // case-insensitively so a differently-cased spelling from any surface can't dodge a gate.
+  const lowered = toolName.toLowerCase();
+  if (native.some((name) => name.toLowerCase() === lowered)) return true;
+  const action = mcpActionSegment(toolName);
+  if (!action) return false;
+  return groups.some((group) => MCP_GROUP_SIGNALS[group]?.test(action));
+}
+
+/**
+ * The `matcher` string for a hooks.json entry. Native names are listed explicitly; a trailing
+ * `mcp__.*` alternative makes Claude Code also route EVERY MCP tool call to the hook, so the
+ * gate can classify it at runtime with `toolInGroups`. Without the `mcp__.*` clause the hook
+ * is never even invoked for an MCP tool — the deepest layer of the blind spot, since no
+ * runtime check can compensate for a hook that never runs.
+ */
+export function matcherFor(groups) {
+  return [...toolNamesFor(groups), String.raw`mcp__.*`].join('|');
+}
+
+/**
+ * The content a write-style tool is about to put on disk, across every native and MCP field
+ * shape seen in the wild: Write/create (`content`), Edit (`new_string`), NotebookEdit
+ * (`new_source`), MultiEdit (`edits[].new_string`), replace_file_content (`new_content`,
+ * `ReplacementContent`), and MCP variants (`text`, `data`, `CodeContent`). Returns '' when
+ * none is present. A gate that inspects written text MUST read through this, so a differently
+ * shaped payload can no longer degrade silently to '' and slip past.
+ */
+export function writtenContentOf(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return '';
+  if (Array.isArray(toolInput.edits)) {
+    return toolInput.edits
+      .map((edit) => String(edit?.new_string ?? edit?.new_source ?? edit?.content ?? ''))
+      .join('\n');
+  }
+  const direct =
+    toolInput.content ??
+    toolInput.new_string ??
+    toolInput.new_source ??
+    toolInput.new_content ??
+    toolInput.ReplacementContent ??
+    toolInput.CodeContent ??
+    toolInput.text ??
+    toolInput.data ??
+    '';
+  return String(direct);
+}
+
+/** The file path a write-style tool targets, across native and MCP field shapes. */
+export function writtenPathOf(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return '';
+  const path =
+    toolInput.file_path ??
+    toolInput.path ??
+    toolInput.target_file ??
+    toolInput.notebook_path ??
+    toolInput.filename ??
+    toolInput.uri ??
+    '';
+  return String(path);
+}
+
+/** The brief/prompt a delegation carries, across native and MCP field shapes. */
+export function delegationPromptOf(toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return '';
+  const prompt =
+    toolInput.prompt ??
+    toolInput.Prompt ??
+    toolInput.description ??
+    toolInput.task ??
+    toolInput.instructions ??
+    toolInput.message ??
+    toolInput.input ??
+    '';
+  return String(prompt);
+}
+
+/** Reads the raw hook payload from stdin. Returns null when stdin cannot be read. */
+export function readHookPayload() {
+  try {
+    return readFileSync(STDIN_FILE_DESCRIPTOR, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The tool name inside a raw payload. Returns null when the payload is unparseable —
+ * the caller cannot filter by tool then, so it must run every gate rather than skip
+ * silently (erring toward over-running protects; erring toward skipping leaves a mute hole).
+ */
+export function toolNameOf(rawPayload) {
+  try {
+    const payload = JSON.parse(rawPayload);
+    return payload?.tool_name ?? payload?.name ?? '';
+  } catch {
+    return null;
+  }
+}
+
+/** The session id inside a raw payload, or null when absent/unparseable. */
+export function sessionIdOf(rawPayload) {
+  try {
+    return JSON.parse(rawPayload)?.session_id ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/** The tool input object inside a raw payload, or {} when absent/unparseable. */
+export function toolInputOf(rawPayload) {
+  try {
+    const payload = JSON.parse(rawPayload);
+    return payload?.tool_input ?? payload?.input ?? {};
+  } catch {
+    return {};
+  }
+}
+
+const PRE_TOOL_USE_EVENT = 'PreToolUse';
+
+/**
+ * A gate answers Claude Code in exactly one of three ways, and every gate uses these
+ * emitters so the JSON shape is written once:
+ *   - deny:  the rule is deterministic and the action is wrong. Blocks the tool call.
+ *   - warn:  the question needs judgment; the gate surfaces context at the right moment
+ *            (additionalContext) and lets the call proceed.
+ *   - allow: nothing to say. The common path — silent and cheap.
+ * Each emitter exits the process (exit 0 always: a PreToolUse deny is expressed in the
+ * JSON, not in the exit code — reserving exit codes keeps a crash distinguishable).
+ *
+ * `label` is the gate id, prefixed to every message so a block names its source.
+ */
+export function deny(label, reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: PRE_TOOL_USE_EVENT,
+        permissionDecision: 'deny',
+        permissionDecisionReason: `[${label}] ${reason}`,
+      },
+    }),
+  );
+  process.exit(0);
+}
+
+export function warn(label, context) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: PRE_TOOL_USE_EVENT,
+        additionalContext: `[${label}] ${context}`,
+      },
+    }),
+  );
+  process.exit(0);
+}
+
+export function allow() {
+  process.exit(0);
+}
+
+/**
+ * The scaffolding every gate shares, so a gate file is just its rule. Given a gate's
+ * identity and a `check` function, this: reads stdin (allow when unreadable), turns the
+ * gate off when the project config disables it (allow), loads the project's params merged
+ * over the gate's own defaults, and runs `check`. `check` calls `deny`/`warn` to object,
+ * or returns to allow. A throw inside `check` is caught and turned into a deny — a gate
+ * that cannot evaluate must not silently permit.
+ *
+ * @param {object} gate
+ * @param {string} gate.id            registry id, used as the message label
+ * @param {string} gate.configKey     the config flag that enables/disables this gate
+ * @param {boolean} gate.enabledByDefault  the registry default when config is silent
+ * @param {object} [gate.defaultParams]    the gate's built-in params (the readable defaults)
+ * @param {(context: { rawPayload: string, toolName: string, toolInput: object,
+ *                     sessionId: string|null, parameters: object }) => void} check
+ */
+export async function runGate(gate, check) {
+  // Defaults-dump mode: when the CLI spawns a gate with this flag set, the gate prints its
+  // own descriptor (id, configKey, default flag and built-in params) and exits — before
+  // touching stdin. This lets `init` materialize each gate's defaults into the config it
+  // writes, with the gate as the single source of truth (no duplication in the registry).
+  if (process.env.CLAUDE_GATES_DUMP_DEFAULTS) {
+    process.stdout.write(
+      JSON.stringify({
+        id: gate.id,
+        configKey: gate.configKey,
+        enabledByDefault: gate.enabledByDefault,
+        defaultParams: gate.defaultParams ?? {},
+      }),
+    );
+    process.exit(0);
+  }
+
+  const rawPayload = readHookPayload();
+  if (rawPayload === null) allow();
+
+  if (!isGateEnabled(gate.configKey, gate.enabledByDefault, process.cwd()))
+    allow();
+
+  const declared = gateParameters(gate.configKey, process.cwd());
+  const parameters = { ...(gate.defaultParams ?? {}), ...declared };
+
+  try {
+    // `check` may be sync or async; awaiting a non-promise is transparent, so the same
+    // scaffolding serves both. Crucially, allow() runs only AFTER the check settles — an
+    // async gate that permits early would never block.
+    await check({
+      rawPayload,
+      toolName: toolNameOf(rawPayload) ?? '',
+      toolInput: toolInputOf(rawPayload),
+      sessionId: sessionIdOf(rawPayload),
+      parameters,
+    });
+  } catch (error) {
+    deny(
+      gate.id,
+      `The gate failed to evaluate and blocks the action for safety: ${error?.message ?? error}.`,
+    );
+  }
+  allow();
+}

package/plugins/gates/hooks/lib/signals.mjs

@@ -0,0 +1,127 @@
+// signals.mjs — central catalog of LEXICAL prose signals, each covering Spanish AND
+// English, for every gate that matches free text (briefs, delegation prompts, written
+// content). Written once here; gates import instead of keeping their own monolingual or
+// partially-bilingual copy.
+//
+// ── Scope: lexical only ──────────────────────────────────────────────────────────────
+// A gate whose real signal lives in the ACTION (a shell command, a tool name, a file
+// path) keeps using structural detection for that part — this module does not replace
+// toolInGroups/writtenPathOf/etc., and a gate should prefer the structural check first
+// wherever the signal is genuinely structural. This module exists for the remaining
+// case: prose written by a human or a model, in either language, that a gate must
+// recognize regardless of which language it was written in.
+//
+// ── Honest limitation ────────────────────────────────────────────────────────────────
+// Coverage is ES + EN only. A prompt written in a third language (or a language-neutral
+// paraphrase using none of these terms) is NOT covered by any pattern here — this module
+// closes the specific ES/EN gap the gates had, it does not claim language-agnostic
+// detection. Where the underlying signal can instead be read off the action itself
+// (structural), that stays the primary defense; lexical matching is the fallback layer
+// for prose that never had a structural signal to read.
+//
+// ── Word-boundary and accent handling ────────────────────────────────────────────────
+// `withUnicodeWordBoundary` uses lookarounds over `\p{L}|\p{N}|_` (not `\b`, which does
+// not treat accented letters as word characters) so short/dangerous terms ("auth",
+// "prod") require a full word match and do not fire inside "autor" or "producto".
+// Spanish terms that carry an accent in correct spelling (contraseña, sesión, migración)
+// are matched with an optional accent (`sesi[oó]n`) because normalized/ASCII input is
+// common in prompts and commit messages.
+
+/** Unicode-aware word boundary: matches only when the alternation is not adjacent to
+ * another letter/digit/underscore, so short terms cannot match as a substring of a
+ * longer unrelated word. */
+export function withUnicodeWordBoundary(alternatives) {
+  return new RegExp(
+    `(?<![\\p{L}\\p{N}_])(?:${alternatives})(?![\\p{L}\\p{N}_])`,
+    'iu',
+  );
+}
+
+// ── RISK_SIGNAL: high-impact mutation area (money / auth / destructive-deploy) ───────
+// Used where a gate must recognize that a request touches a sensitive domain,
+// regardless of whether it was phrased in Spanish or English. Three sub-domains kept
+// separate so a gate can compose only the ones it needs, and one combined export for
+// gates that want the whole class.
+
+const MONEY_TERMS =
+  'money|payment|pago|dinero|cobro|charge|invoice|factura|precio|price|saldo|balance|amount|monto';
+
+const AUTH_TERMS =
+  'auth|autenticaci[oó]n|authentication|credencial|credential|contrase[nñ]a|password|' +
+  'token|sesi[oó]n|session|permiso|permission|role|rol';
+
+const DESTRUCTIVE_DEPLOY_TERMS =
+  'deploy|desplieg(?:a|ue|ar)?|producci[oó]n|production|prod|borrar|delete|drop|truncate|' +
+  'migraci[oó]n|migration|migrate|migr(?:a|ar)|eliminar';
+
+export const MONEY_SIGNAL = withUnicodeWordBoundary(MONEY_TERMS);
+export const AUTH_SIGNAL = withUnicodeWordBoundary(AUTH_TERMS);
+export const DESTRUCTIVE_DEPLOY_SIGNAL = withUnicodeWordBoundary(
+  DESTRUCTIVE_DEPLOY_TERMS,
+);
+
+/** Combined high-impact mutation signal: money OR auth OR a destructive/deploy verb. */
+export const RISK_SIGNAL = withUnicodeWordBoundary(
+  `${MONEY_TERMS}|${AUTH_TERMS}|${DESTRUCTIVE_DEPLOY_TERMS}`,
+);
+
+/** RISK_SIGNAL as plain regex-source alternatives (no boundary/flags), for gates that
+ * build their own combined pattern (e.g. joined with other domain-specific sources). */
+export const RISK_SIGNAL_SOURCES = [MONEY_TERMS, AUTH_TERMS, DESTRUCTIVE_DEPLOY_TERMS];
+
+// ── MUTATION_RISK_SIGNAL: broader than RISK_SIGNAL, used only to VOID an exemption ──
+// Several gates let a whitelisted read-only subagent name (or an exempt-query verb)
+// skip their check — but only when the prompt itself carries no mutation risk. That
+// exemption-voiding check is deliberately broader than RISK_SIGNAL: it also counts a
+// bare "data"/"datos"/"write"/"escrib*" mention, because the name/label is unverified
+// and a false positive here only means the underlying check still runs (cheap), while a
+// false negative would let a real mutator dodge the check via a trusted-sounding label.
+// Kept as a distinct export from RISK_SIGNAL because the two answer different
+// questions (RISK_SIGNAL: "is this domain high-impact?" vs MUTATION_RISK_SIGNAL: "is it
+// unsafe to trust this label/verb at all?").
+const MUTATION_RISK_TERMS =
+  `${MONEY_TERMS}|${AUTH_TERMS}|credencial|credential|data|datos|borrar|delete|drop|` +
+  `write|escrib|${DESTRUCTIVE_DEPLOY_TERMS}`;
+
+export const MUTATION_RISK_SIGNAL = withUnicodeWordBoundary(MUTATION_RISK_TERMS);
+
+// ── CONJECTURE: never-assume phrasing ────────────────────────────────────────────────
+// Prose stating an unverified assumption instead of a checked fact.
+
+export const CONJECTURE_SOURCES = [
+  'i assume',
+  'assuming that',
+  'probably',
+  'i guess',
+  'should be',
+  "i'll default to",
+  'might be',
+  'supongo',
+  'asumo',
+  'asumiendo que',
+  'probablemente',
+  'deber[ií]a ser',
+  'quiz[aá]s',
+  'tal vez',
+  'creo que',
+  'me imagino que',
+];
+
+export const CONJECTURE = withUnicodeWordBoundary(CONJECTURE_SOURCES.join('|'));
+
+// ── PERSISTENCE_VERB: an instruction to save/persist/store something ────────────────
+// Used to detect a REAL persistence instruction nearby a memory-dependency phrase (see
+// no-memory-dependency), so a bare mention of a memory phrase with a genuine "save this
+// to <file>" nearby is not flagged as depending on model memory.
+
+export const PERSISTENCE_VERB_SOURCES = [
+  'save|persist|store',
+  'guarda(?:l[oa])?|guard[aá]|persist[eií]|persistir|persistido|almacena|almacenar',
+  'escrib(?:e|í|i) .{0,20}en|escribir .{0,20}en|write .{0,20}(?:to|in)',
+  'anota|anotar|registra|registrar',
+];
+
+export const PERSISTENCE_VERB = new RegExp(
+  PERSISTENCE_VERB_SOURCES.join('|'),
+  'iu',
+);