@devrik-tools/claude-gates 0.2.1 → 0.3.0

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
       "name": "gates",
       "source": "./plugins/gates",
       "description": "PreToolUse gates: destructive-command blocks, protected paths, delegation/spec/quality rules, tool-discovery and forge-pipeline enforcement. Which gates run is decided by .ai/config.json (project) or ~/.claude/claude-gates/config.json (global).",
-      "version": "0.2.1"
+      "version": "0.3.0"
     },
     {
       "name": "tasks",
       "source": "./plugins/tasks",
       "description": "Deterministic task tracking: the model registers tasks via the CLI, a UserPromptSubmit hook reminds of open tasks every few messages, and a SessionStart hook lists active tasks when a session opens.",
-      "version": "0.2.1"
+      "version": "0.3.0"
     }
   ]
 }

package/README.es.md

@@ -68,9 +68,10 @@ ejecución), así que funciona aunque instales uno suelto por fuera.
 ### 🔒 Security — bloqueos duros sobre lo destructivo
 | Gate | | Qué hace |
 |---|---|---|
-| `bash-commands` | on | Bloquea `git reset --hard`, `rm -rf`, force push, matar procesos por nombre, y publicar al remoto sin autorización. |
+| `bash-commands` | on | Bloquea `git reset --hard`, `rm -rf` sobre áreas protegidas, force push, y matar procesos por nombre. |
+| `block-remote-publish` | on | Bloquea `git push`, `gh pr merge`, `gh release create` sin autorización. Poné `blockRemotePublish: false` para permitir que el agente publique por su cuenta. |
 | `protected-paths` | on | Bloquea escrituras a `.env`, lockfiles y el propio harness. |
-| `root-whitelist` | on | Bloquea crear archivos/carpetas nuevos en la raíz fuera de una lista blanca. |
+| `root-whitelist` | on | Bloquea crear archivos/carpetas nuevos en la raíz fuera de la lista blanca. |
 | `no-blocking` | off | Bloquea `sleep`, `tail -f`, bucles de sondeo y servidores en primer plano. |
 
 ### 🤝 Delegation — exigencias sobre el brief al delegar a un subagente
@@ -80,7 +81,7 @@ ejecución), así que funciona aunque instales uno suelto por fuera.
 | `intent-flow` | off | Exige secciones QUÉ SÍ / QUÉ NO / EDGE CASES. |
 | `risk-level` | off | Exige declarar el nivel (QUESTION/MICRO/STANDARD/HIGH-RISK). |
 | `circuit-breaker` | off | Corta la misma delegación reintentada sin cambios reales. |
-| `no-memory-dependency` | off | Avisa si el brief depende de que el subagente "recuerde" la conversación. |
+| `no-memory-dependency` | off | Bloquea un brief que depende de que el subagente "recuerde" la conversación (marcador `memory-not-needed` para un falso positivo). |
 
 ### 📋 Spec-driven flow — solo aplican si el proyecto adoptó desarrollo por specs
 | Gate | | Qué hace |
@@ -94,15 +95,15 @@ ejecución), así que funciona aunque instales uno suelto por fuera.
 ### ✨ Quality — higiene de código, diagnóstico y lenguaje
 | Gate | | Qué hace |
 |---|---|---|
-| `dependency-skills` | on | Una dependencia directa nueva exige una skill vigente. |
+| `dependency-skills` | on | Bloquea una dependencia directa nueva sin skill que la cubra (declarala en `depsWithoutOwnApi` si no necesita). |
 | `root-cause-first` | off | Exige un diagnóstico origen→síntoma antes de un parche. |
 | `audit-before-build` | off | Antes de un script/gate nuevo, exige declarar que nada existente lo cubre. |
 | `never-assume` | off | Marca suposiciones sin verificar en briefs y código. |
 | `rule-skill-autodiscovery` | off | Carga los gates que el proyecto declara en sus `rules/` y `skills/`. |
 | `recurrence-lock` | on | La segunda aparición de un defecto exige su bloqueo determinista. |
-| `test-after-implementation` | off | Avisa cuando se escribe un test después de su implementación. |
+| `test-after-implementation` | off | Bloquea un test escrito después de su implementación pareja (marcador `test-after-impl:allow` para un test de regresión). |
 | `no-reconfirm` | on | Nunca vuelve a preguntar lo que ya respondiste. |
-| `neutral-spanish` | on | Avisa sobre voseo o léxico regional en el texto escrito. |
+| `neutral-spanish` | on | Bloquea voseo o léxico regional en el texto escrito (marcador `neutral-spanish:allow` para una cita/fixture deliberada). |
 | `diagnosis-before-patch` | on | Avisa cuando se cambian timeouts/reintentos sin evidencia. |
 
 ### 🔎 Tool discovery — no reinventar la rueda

package/README.md

@@ -60,14 +60,15 @@ works even if you install one on its own.
 
 ---
 
-## The gates (30, in 7 families)
+## The gates (in families)
 
 `[on]` = enabled by default; `[off]` = enable it if you want it.
 
 ### 🔒 Security — hard blocks on destructive actions
 | Gate | | What it does |
 |---|---|---|
-| `bash-commands` | on | Blocks `git reset --hard`, `rm -rf`, force push, killing processes by name, and publishing to a remote without authorization. |
+| `bash-commands` | on | Blocks `git reset --hard`, `rm -rf` over protected areas, force push, and killing processes by name. |
+| `block-remote-publish` | on | Blocks `git push`, `gh pr merge`, `gh release create` without authorization. Set `blockRemotePublish: false` to let the agent publish on its own. |
 | `protected-paths` | on | Blocks writes to `.env`, lockfiles and the harness itself. |
 | `root-whitelist` | on | Blocks new root-level files/folders outside a whitelist. |
 | `no-blocking` | off | Blocks `sleep`, `tail -f`, polling loops and foreground servers. |
@@ -79,7 +80,7 @@ works even if you install one on its own.
 | `intent-flow` | off | Requires IN SCOPE / OUT OF SCOPE / EDGE CASES sections. |
 | `risk-level` | off | Requires a declared level (QUESTION/MICRO/STANDARD/HIGH-RISK). |
 | `circuit-breaker` | off | Cuts the same delegation retried without real changes. |
-| `no-memory-dependency` | off | Warns when the brief relies on the subagent "remembering" the chat. |
+| `no-memory-dependency` | off | Blocks a brief that relies on the subagent "remembering" the chat (add `memory-not-needed` to allow a false positive). |
 
 ### 📋 Spec-driven flow — only relevant if the project adopted spec-driven development
 | Gate | | What it does |
@@ -93,15 +94,15 @@ works even if you install one on its own.
 ### ✨ Quality — code hygiene, diagnosis and language
 | Gate | | What it does |
 |---|---|---|
-| `dependency-skills` | on | A new direct dependency requires a current skill. |
+| `dependency-skills` | on | Blocks a new direct dependency with no matching skill (declare it in `depsWithoutOwnApi` if it needs none). |
 | `root-cause-first` | off | Requires an origin→symptom diagnosis before a patch. |
 | `audit-before-build` | off | Before a new script/gate, requires stating that nothing existing covers it. |
 | `never-assume` | off | Flags unverified assumptions in briefs and code. |
 | `rule-skill-autodiscovery` | off | Loads gates the project declares in its `rules/` and `skills/`. |
 | `recurrence-lock` | on | A second occurrence of a defect class requires its deterministic block. |
-| `test-after-implementation` | off | Warns when a test is written after its paired implementation. |
+| `test-after-implementation` | off | Blocks a test written after its paired implementation (add `test-after-impl:allow` for a regression test). |
 | `no-reconfirm` | on | Never re-ask what you already answered. |
-| `neutral-spanish` | on | Warns about voseo or regional lexicon in written text. |
+| `neutral-spanish` | on | Blocks voseo or regional lexicon in written text (add `neutral-spanish:allow` for a deliberate quote/fixture). |
 | `diagnosis-before-patch` | on | Warns when timeouts/retries change without evidence. |
 
 ### 🔎 Tool discovery — don't reinvent the wheel
@@ -141,9 +142,11 @@ see and edit every knob:
       "rmRfProtectedAreas": ["/", "*", "src", "tests"],
       "denyPatterns": ["git reset --hard", "…"]
     },
+    "blockRemotePublish": { "enabled": false },
     "warnNonNeutralSpanish": {
       "enabled": true,
-      "regionalMarkers": ["tenés", "podés", "…"]
+      "regionalMarkers": ["tenés", "podés", "…"],
+      "escapeHatch": "neutral-spanish:allow"
     },
     "requireBriefBeforeDelegating": { "enabled": false }
   }
@@ -155,6 +158,12 @@ see and edit every knob:
   What the project declares **replaces** the gate's default.
 - A gate absent from the config uses its catalog default. Keys you already had in the file
   (e.g. `autoCommit`) are kept intact.
+- **Let the agent push:** set `"blockRemotePublish": { "enabled": false }`. Nothing is
+  hardcoded — every gate, remote publish included, obeys this flag.
+- **Escape hatches:** a few gates block (deny) but accept an explicit opt-out marker in the
+  content/prompt for a legitimate case: `neutral-spanish:allow` (a deliberate regional
+  quote), `test-after-impl:allow` (a regression test), `memory-not-needed` (a
+  non-memory phrase). `dependency-skills` opts out via its `depsWithoutOwnApi` list.
 
 ---
 

package/cli/index.mjs

@@ -78,6 +78,10 @@ program
   )
   .option('-y, --yes', 'never prompt; use flags and defaults')
   .option('--no-install', 'write the config but do not install the plugin')
+  .option(
+    '--no-remove-previous',
+    'keep any previously installed plugin version instead of removing it first',
+  )
   .option('--dry-run', 'show the selection without writing')
   .action(async (options) => {
     const { runInit } = await import('./init.mjs');

package/cli/init.mjs

@@ -68,6 +68,7 @@ export function normalizeOptions(options = {}) {
     yes: Boolean(options.yes),
     dryRun: Boolean(options.dryRun),
     install: options.install,
+    removePrevious: options.removePrevious,
   };
 }
 
@@ -172,6 +173,15 @@ function renderSummary(registry, gatesMap) {
     .join('\n');
 }
 
+async function askRemovePrevious(io) {
+  return bail(
+    await io.confirm({
+      message: 'Remove the previous plugin version before installing the new one?',
+      initialValue: true,
+    }),
+  );
+}
+
 async function confirmWrite(io, fileExists) {
   const confirmed = bail(
     await io.confirm({
@@ -239,7 +249,14 @@ export async function runInit(
     return { path, config: merged, written: true, installed: false };
   }
 
-  const result = installPlugin(scope, { cwd });
+  // Default true: a previous plugin version is removed before installing the new one, unless
+  // --no-remove-previous turned it off. Only asked when interactive — --yes or no TTY uses the
+  // flag/default without a prompt, so scripted and non-interactive runs never block on input.
+  const removePrevious =
+    flags.removePrevious !== false &&
+    (!interactive || (await askRemovePrevious(io)));
+
+  const result = installPlugin(scope, { cwd, removePrevious });
   if (result.installed) {
     io.outro(
       `Written ${path} and installed all plugins (${result.scope} scope). ` +

package/cli/install.mjs

@@ -88,6 +88,25 @@ function reasonFor(error) {
     : (error?.stderr || error?.message || String(error)).trim().split('\n')[0];
 }
 
+/**
+ * Best-effort removal of a previously installed version of each manifest plugin, at the
+ * given scope, before the fresh install runs. `claude plugin uninstall <plugin> --scope
+ * <scope>` is verified (via `claude plugin uninstall --help`) to take the bare plugin name
+ * (no `@marketplace`, unlike install) and the same `--scope` values as install. When there
+ * is no previous install, uninstall fails — that is expected and non-fatal, so failures here
+ * are swallowed and never stop the install that follows.
+ */
+function removePreviousInstalls(targets, scope, runClaude) {
+  for (const { plugin } of targets) {
+    try {
+      runClaude(['plugin', 'uninstall', plugin, '--scope', scope, '--yes']);
+    } catch {
+      // No previous install (or removal failed for some other reason) — non-fatal either way;
+      // the install below is what actually matters.
+    }
+  }
+}
+
 /**
  * Registers the marketplace (idempotent: a second add just reports it already exists, which
  * is not fatal) once, then installs EVERY plugin the manifest declares at the scope matching
@@ -102,10 +121,14 @@ function reasonFor(error) {
  * `runClaude` is an injectable seam (defaults to the real `claude` binary) so tests can
  * exercise the multi-plugin partial-failure logic without actually invoking the CLI and
  * installing plugins on the machine running the test.
+ *
+ * `removePrevious` (default true) uninstalls each plugin's previous version at this scope
+ * before installing, so a stale version never lingers alongside the new one. It is best-effort
+ * and never fails the overall install.
  */
 export function installPlugin(
   configScope,
-  { cwd = process.cwd(), runClaude = realClaude } = {},
+  { cwd = process.cwd(), runClaude = realClaude, removePrevious = true } = {},
 ) {
   const scope = PLUGIN_SCOPE[configScope] ?? 'user';
 
@@ -120,6 +143,8 @@ export function installPlugin(
   // module top, means the name reflects the live registration this run just ensured.
   const targets = marketplaceAndPlugins(runClaude);
 
+  if (removePrevious) removePreviousInstalls(targets, scope, runClaude);
+
   const results = targets.map(({ marketplace, plugin }) => {
     try {
       runClaude([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrik-tools/claude-gates",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
   "keywords": [
     "claude-code",
@@ -33,7 +33,10 @@
     "README.md",
     "README.es.md",
     "plugins",
-    ".claude-plugin"
+    ".claude-plugin",
+    "!**/*.test.mjs",
+    "!**/test.mjs",
+    "!**/__tests__/**"
   ],
   "scripts": {
     "test": "node --test",

package/plugins/gates/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gates",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Deterministic gates for Claude Code: destructive-command blocks, protected paths, delegation briefs, spec-driven flow and session-start validation. Selection lives in config, not in code.",
   "author": {
     "name": "Devrik"

package/plugins/gates/hooks/gates/autonomous-mode/stop.mjs

@@ -0,0 +1,78 @@
+// autonomous-mode (Stop half) — closes the hole its PreToolUse half cannot reach. The
+// PreToolUse gate (index.mjs) blocks the AskUserQuestion TOOL, but nothing stops the
+// assistant from ending its turn with a question in plain PROSE — and when it does, the
+// session just sits there waiting for a human who is supposed to be away. No hook can read
+// chat text to detect that a turn ended on a question. So this Stop hook takes the only
+// deterministic lever available: when autonomous mode is ON and the turn is ending, it
+// re-injects an instruction to NOT wait — decide, delegate, and keep going on everything
+// that does not strictly require the user's own explicit decision.
+//
+// ── What the re-injected message says (per the user's own framing) ───────────────────
+// In autonomous mode work is delegated to the assistant. It must only leave pending the ONE
+// thing that genuinely needs the user's exclusive, explicit decision (irreversible/dangerous
+// — deleting data, money, production). Everything else: proceed. If there are OTHER tasks it
+// can advance, advance them; isolate only the truly blocking one and state it in prose, then
+// stop. It must not end the turn on a prose question just to wait.
+//
+// ── stop_hook_active loop-guard (mandatory) ──────────────────────────────────────────
+// Claude Code re-invokes Stop hooks with stop_hook_active=true after a block. Blocking again
+// would loop forever. So when stop_hook_active === true this hook unconditionally allows the
+// stop: the reminder is injected exactly once per cycle. After that one nudge, if the
+// assistant still ends the turn, it genuinely had nothing to proceed on (or a real blocker),
+// and the session must be allowed to end — a frozen session is worse than one missed nudge.
+//
+// ── Fail-safe (mandatory for a Stop hook) ────────────────────────────────────────────
+// Everything is wrapped so that no config, no project, a corrupt payload, or any unexpected
+// error allows the stop. A broken Stop hook must never hang a session.
+
+import { isGateEnabled } from '../../lib/config.mjs';
+import { readHookPayload } from '../../lib/hook-io.mjs';
+
+const CONFIG_KEY = 'autonomousMode';
+
+const CONTINUE_MESSAGE =
+  '[autonomous] Autonomous mode is ON — do not end the turn to wait for the user. Work here ' +
+  'is delegated to you. Leave PENDING only the one thing that genuinely needs the user’s own ' +
+  'explicit, exclusive decision (a truly irreversible or dangerous choice: deleting data, ' +
+  'money, production). For everything else: decide the best goal-aligned option, state the ' +
+  'reversible assumption in one line, and proceed. If there are OTHER tasks you can advance, ' +
+  'advance them now instead of stopping; isolate only the genuinely blocking item, state it ' +
+  'in prose, and stop only for that. Do NOT end the turn on a prose question just to wait. ' +
+  'If you have truly nothing left to do and nothing needs the user, ending is fine — this ' +
+  'reminder fires once, so a real end will go through on the next stop.';
+
+function block(reason) {
+  process.stdout.write(JSON.stringify({ decision: 'block', reason }));
+  process.exit(0);
+}
+
+function allow() {
+  process.exit(0);
+}
+
+function main() {
+  try {
+    const rawPayload = readHookPayload();
+    if (rawPayload === null) return allow();
+
+    let payload;
+    try {
+      payload = JSON.parse(rawPayload);
+    } catch {
+      return allow(); // unparseable Stop payload: fail-safe, never hang the session
+    }
+
+    // Loop-guard: this hook already nudged once this cycle. Never block again.
+    if (payload?.stop_hook_active === true) return allow();
+
+    // Only act when the project turned autonomous mode ON. Off by default (registry).
+    if (!isGateEnabled(CONFIG_KEY, false, process.cwd())) return allow();
+
+    return block(CONTINUE_MESSAGE);
+  } catch {
+    // A broken Stop hook must never hang a session.
+    return allow();
+  }
+}
+
+main();

package/plugins/gates/hooks/gates/bash-commands/index.mjs

@@ -1,6 +1,11 @@
-// bash-commands — denies destructive shell commands, and blocks publishing to a remote
-// without fresh authorization. Runs on a real Bash/run_command call and on a delegation
-// prompt (a subagent can be told "run git reset --hard" in prose).
+// bash-commands — denies destructive shell commands (rm -rf over protected areas, git
+// reset --hard, force push, kill-by-name). Runs on a real Bash/run_command call and on a
+// delegation prompt (a subagent can be told "run git reset --hard" in prose).
+//
+// Remote-publish blocking (git push / gh pr merge / gh release create) used to live here as
+// a hardcoded, non-configurable block. It was split out into the block-remote-publish gate
+// so it carries its own enabled flag: a project can now allow the agent to push by disabling
+// that gate WITHOUT also disabling the destructive-command protections below.
 //
 // ── What a project can configure (params) ───────────────────────────────────────────
 //   denyPatterns          regex sources (matched case-insensitively) of destructive
@@ -10,18 +15,6 @@
 //                         by default: this harness legitimately uses inline interpreters.
 // The defaults live here, in the source, so a project reads them and knows exactly what
 // its override replaces.
-//
-// ── What is NOT configurable (base, non-negotiable) ─────────────────────────────────
-// Remote-publish detection (`git push`, `gh pr merge`, `gh release create`) is a hard
-// block with no config knob and no in-command escape hatch: authorization is something
-// the USER states in chat, never a token the agent could write into its own command.
-//
-// ── Two-stage intent check, only for delegation prompts ─────────────────────────────
-// A real command's `command` field IS what the shell runs — a single-stage regex is
-// right. A delegation prompt is natural language that may DESCRIBE a command ("I extended
-// the guard to deny git push") without asking anyone to run it. There, publish rules run
-// a second stage: strip quoted/example text, then require that at least one surviving
-// mention is not governed by a reporting verb before denying.
 
 import {
   runGate,
@@ -107,22 +100,6 @@ function defaultDenyPatterns() {
   ];
 }
 
-/** Remote-publish rules. Base, non-configurable — see the header. */
-const REMOTE_PUBLISH_RULES = [
-  [
-    String.raw`\bgit\s+(?:-C\s+\S+\s+)?push\b`,
-    "Publishing to a remote ('git push') needs fresh authorization from the user naming " +
-      'commits, local branch, remote and target. This gate cannot verify that from the ' +
-      'command itself — ask the user and let them run it.',
-  ],
-  [
-    String.raw`\bgh\s+(?:pr\s+merge|release\s+create)\b`,
-    'Publishing via GitHub CLI (merging a PR or creating a release) needs fresh ' +
-      'authorization from the user naming commits, local branch, remote and target. ' +
-      'Ask the user and let them run it.',
-  ],
-];
-
 // Interpreter name, then any intermediate flags (e.g. --input-type=module), then an
 // eval flag. Intermediate flags are matched loosely (`-\S+`) to keep the pattern simple.
 const INTERPRETER_EVAL_PATTERN =
@@ -130,14 +107,6 @@ const INTERPRETER_EVAL_PATTERN =
 const RAW_FILE_OPS_PATTERN =
   /\b(writeFileSync|readFileSync|appendFileSync|fs\.writeFile|fs\.readFile|fs\.unlink|fs\.mkdir)\b/;
 
-// How far back from a mention to look for a governing verb, and the reporting-verb lexicon
-// that marks a mention as description rather than an order. Only the text before a mention
-// is inspected: what governs it is what precedes it (appending words after a real command
-// would otherwise be a trivial bypass).
-const DESCRIPTION_LOOK_BACK = 80;
-const REPORTING_VERB_PATTERN =
-  /(describe|explain|summar|mention|added|built|extended|denies?|deny|prohibit|protection|report|documentation|changelog)/i;
-
 function compile(source) {
   return new RegExp(source, 'i');
 }
@@ -170,29 +139,6 @@ function normalizeGitOptions(command) {
   return normalized;
 }
 
-function stripQuoted(text) {
-  return text
-    .replace(/```[\s\S]*?```/g, ' ')
-    .replace(/"[^"\n]{0,300}"/g, ' ')
-    .replace(/'[^'\n]{0,300}'/g, ' ');
-}
-
-/** True when a surviving, non-quoted mention is not governed by a reporting verb. */
-function hasRealPublishIntent(text, pattern) {
-  if (!pattern.test(text)) return false;
-  const cleaned = stripQuoted(text);
-  const global = new RegExp(
-    pattern.source,
-    `${pattern.flags.replace('g', '')}g`,
-  );
-  const matches = [...cleaned.matchAll(global)];
-  if (matches.length === 0) return false;
-  return matches.some((match) => {
-    const from = Math.max(0, match.index - DESCRIPTION_LOOK_BACK);
-    return !REPORTING_VERB_PATTERN.test(cleaned.slice(from, match.index));
-  });
-}
-
 function checkEmbeddedInterpreter(command) {
   const match = INTERPRETER_EVAL_PATTERN.exec(command);
   if (!match) return null;
@@ -247,21 +193,6 @@ function checkDestructive(command, parameters) {
   }
 }
 
-/** Remote-publish rules: a real command is checked literally; a delegation prompt by intent. */
-function checkRemotePublish(command, isShell) {
-  // For a real shell command, normalize git's global options first (same bypass as above).
-  // For a delegation prompt (free text), the intent check runs on the raw text.
-  const shellCommand = normalizeGitOptions(command);
-  for (const [source, reason] of REMOTE_PUBLISH_RULES) {
-    const pattern = compile(source);
-    if (isShell) {
-      if (pattern.test(shellCommand)) deny(GATE_ID, reason);
-    } else if (hasRealPublishIntent(command, pattern)) {
-      deny(GATE_ID, reason);
-    }
-  }
-}
-
 runGate(
   {
     id: GATE_ID,
@@ -274,12 +205,11 @@ runGate(
     },
   },
   ({ toolName, toolInput, parameters }) => {
-    const isShell = toolInGroups(toolName, ['shell']);
-    const isDelegation = toolInGroups(toolName, ['delegation']);
-    if (!isShell && !isDelegation) return;
+    // Destructive-command rules act on a real shell command AND on a delegation prompt (a
+    // subagent can be told "run rm -rf" in prose). commandTextFrom picks the right text.
+    if (!toolInGroups(toolName, ['shell', 'delegation'])) return;
 
     const command = commandTextFrom(toolName, toolInput);
     checkDestructive(command, parameters);
-    checkRemotePublish(command, isShell);
   },
 );

package/plugins/gates/hooks/gates/block-remote-publish/index.mjs

@@ -0,0 +1,140 @@
+// block-remote-publish — denies publishing to a remote (`git push`, `gh pr merge`,
+// `gh release create`) without fresh human authorization. Split out of bash-commands so it
+// carries its OWN enabled flag: a project can turn remote-publish blocking off in config
+// (blockRemotePublish: false) WITHOUT losing the destructive-command protections (rm -rf,
+// git reset --hard) that live in bash-commands. Nothing is hardcoded any more — this gate
+// obeys its flag like every other, and appears in the CLI's gate selector on its own.
+//
+// Default: enabled. The safe posture is that the human states the authorization in chat,
+// naming commits, branch, remote and target — a project that wants the agent to push on its
+// own opts in explicitly by disabling this gate.
+//
+// ── Two-stage intent check, only for delegation prompts ─────────────────────────────
+// A real command's `command` field IS what the shell runs — a single-stage regex is right.
+// A delegation prompt is natural language that may DESCRIBE a command ("I extended the guard
+// to deny git push") without asking anyone to run it. There, publish rules run a second
+// stage: strip quoted/example text, then require that at least one surviving mention is not
+// governed by a reporting verb before denying.
+
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'block-remote-publish';
+const CONFIG_KEY = 'blockRemotePublish';
+
+// Remote-publish rules as `[regexSource, reason]`. Sources (not RegExp) so a project could
+// override them through config if it ever needed to.
+function defaultPublishRules() {
+  return [
+    [
+      String.raw`\bgit\s+(?:-C\s+\S+\s+)?push\b`,
+      "Publishing to a remote ('git push') needs fresh authorization from the user naming " +
+        'commits, local branch, remote and target. This gate cannot verify that from the ' +
+        'command itself — ask the user and let them run it. To let the agent push on its ' +
+        'own, set "blockRemotePublish": false in .ai/config.json.',
+    ],
+    [
+      String.raw`\bgh\s+(?:pr\s+merge|release\s+create)\b`,
+      'Publishing via GitHub CLI (merging a PR or creating a release) needs fresh ' +
+        'authorization from the user naming commits, local branch, remote and target. ' +
+        'Ask the user and let them run it. To let the agent publish on its own, set ' +
+        '"blockRemotePublish": false in .ai/config.json.',
+    ],
+  ];
+}
+
+// How far back from a mention to look for a governing verb, and the reporting-verb lexicon
+// that marks a mention as description rather than an order. Only the text before a mention
+// is inspected: what governs it is what precedes it (appending words after a real command
+// would otherwise be a trivial bypass).
+const DESCRIPTION_LOOK_BACK = 80;
+const REPORTING_VERB_PATTERN =
+  /(describe|explain|summar|mention|added|built|extended|denies?|deny|prohibit|protection|report|documentation|changelog)/i;
+
+function compile(source) {
+  return new RegExp(source, 'i');
+}
+
+// git's GLOBAL options sit between `git` and the subcommand: `git -C <path> push`, etc. A
+// pattern that matches `git push` contiguously is evaded by any of them. Stripping these
+// first — turning `git -C /repo push` back into `git push` — closes that bypass at once.
+const GIT_OPTION_WITH_VALUE = String.raw`(?:-[Cc]|--git-dir|--work-tree|--namespace|--exec-path|--config-env)(?:\s+|=)\S+`;
+const GIT_FLAG_OPTION = String.raw`--(?:paginate|no-pager|bare|no-optional-locks)|-p`;
+const GIT_GLOBAL_OPTION_PATTERN = new RegExp(
+  String.raw`\bgit\s+(?:${GIT_OPTION_WITH_VALUE}|${GIT_FLAG_OPTION})\s+`,
+  'i',
+);
+
+function normalizeGitOptions(command) {
+  let previous;
+  let normalized = command;
+  do {
+    previous = normalized;
+    normalized = normalized.replace(GIT_GLOBAL_OPTION_PATTERN, 'git ');
+  } while (normalized !== previous);
+  return normalized;
+}
+
+function stripQuoted(text) {
+  return text
+    .replace(/```[\s\S]*?```/g, ' ')
+    .replace(/"[^"\n]{0,300}"/g, ' ')
+    .replace(/'[^'\n]{0,300}'/g, ' ');
+}
+
+/** True when a surviving, non-quoted mention is not governed by a reporting verb. */
+function hasRealPublishIntent(text, pattern) {
+  if (!pattern.test(text)) return false;
+  const cleaned = stripQuoted(text);
+  const global = new RegExp(
+    pattern.source,
+    `${pattern.flags.replace('g', '')}g`,
+  );
+  const matches = [...cleaned.matchAll(global)];
+  if (matches.length === 0) return false;
+  return matches.some((match) => {
+    const from = Math.max(0, match.index - DESCRIPTION_LOOK_BACK);
+    return !REPORTING_VERB_PATTERN.test(cleaned.slice(from, match.index));
+  });
+}
+
+/** The text to inspect: a real command's command line, or the delegation prompt. */
+function commandTextFrom(toolName, toolInput) {
+  if (toolInGroups(toolName, ['shell'])) {
+    return String(toolInput.CommandLine ?? toolInput.command ?? '');
+  }
+  return delegationPromptOf(toolInput);
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: true,
+    defaultParams: {
+      publishRules: defaultPublishRules(),
+    },
+  },
+  ({ toolName, toolInput, parameters }) => {
+    const isShell = toolInGroups(toolName, ['shell']);
+    const isDelegation = toolInGroups(toolName, ['delegation']);
+    if (!isShell && !isDelegation) return;
+
+    const command = commandTextFrom(toolName, toolInput);
+    // For a real shell command, normalize git's global options first. For a delegation
+    // prompt (free text), the intent check runs on the raw text.
+    const shellCommand = normalizeGitOptions(command);
+    for (const [source, reason] of parameters.publishRules) {
+      const pattern = compile(source);
+      if (isShell) {
+        if (pattern.test(shellCommand)) deny(GATE_ID, reason);
+      } else if (hasRealPublishIntent(command, pattern)) {
+        deny(GATE_ID, reason);
+      }
+    }
+  },
+);