@devrik-tools/claude-gates 0.7.0 → 0.7.1

package/.claude-plugin/marketplace.json

@@ -11,13 +11,13 @@
       "name": "gates",
       "source": "./plugins/gates",
       "description": "PreToolUse gates: destructive-command blocks, protected paths, delegation/spec/quality rules, tool-discovery and forge-pipeline enforcement. Which gates run is decided by .ai/config.json (project) or ~/.claude/claude-gates/config.json (global).",
-      "version": "0.7.0"
+      "version": "0.7.1"
     },
     {
       "name": "tasks",
       "source": "./plugins/tasks",
       "description": "Deterministic task tracking: the model registers tasks via the CLI, a UserPromptSubmit hook reminds of open tasks every few messages, and a SessionStart hook lists active tasks when a session opens.",
-      "version": "0.7.0"
+      "version": "0.7.1"
     }
   ]
 }

package/README.es.md

@@ -56,6 +56,12 @@ Si algún gate bloquea, la herramienta no se ejecuta.
 - **WARN**: la acción necesita criterio → el gate inyecta un aviso y deja seguir.
 - **Silencio**: el caso común. Un gate no molesta si no hay nada que objetar.
 
+Todo mensaje DENY/WARN lleva el prefijo `[configKey]` — el nombre exacto de la clave para
+buscar (o apagar/ajustar) bajo `"gates"` en `.ai/config.json`, por ejemplo
+`[blockPathsOutsideRootWhitelist] '...' no está en la whitelist.` significa que la
+configuración es `blockPathsOutsideRootWhitelist` en la tabla de abajo, no otro nombre que
+haya que adivinar o traducir desde un id corto de gate.
+
 Cada gate es **autocontenido** (solo Node built-ins, sin dependencias en tiempo de
 ejecución), así que funciona aunque instales uno suelto por fuera.
 

package/README.md

@@ -55,6 +55,11 @@ If any gate blocks, the tool does not run.
 - **WARN**: the action needs judgment → the gate injects a note and lets it proceed.
 - **Silence**: the common path. A gate never nags when there is nothing to object to.
 
+Every DENY/WARN message is prefixed `[configKey]` — the exact key name to look up (or turn
+off/tune) under `"gates"` in `.ai/config.json`, e.g. `[blockPathsOutsideRootWhitelist] '...'
+is not on the whitelist.` means the setting is `blockPathsOutsideRootWhitelist` in the table
+below, not some other name you'd have to guess or map from a short gate id.
+
 Every gate is **self-contained** (Node built-ins only, no runtime dependencies), so it
 works even if you install one on its own.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrik-tools/claude-gates",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
   "keywords": [
     "claude-code",

package/plugins/gates/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gates",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Deterministic gates for Claude Code: destructive-command blocks, protected paths, delegation briefs, spec-driven flow and session-start validation. Selection lives in config, not in code.",
   "author": {
     "name": "Devrik"

package/plugins/gates/hooks/gates/atomic-commit/index.mjs

@@ -208,7 +208,7 @@ runGate(
 
     if (countedNatures.size > maxNatures) {
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `This commit mixes ${countedNatures.size} kinds of change ` +
           `(${[...countedNatures].join(', ')}) — a commit should be one cohesive change ` +
           `(max ${maxNatures}). Split it: stage and commit one nature at a time (e.g. the ` +
@@ -219,7 +219,7 @@ runGate(
 
     if (counted.length > maxFiles) {
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `This commit stages ${counted.length} reviewable files (max ${maxFiles}) — too large ` +
           `to review as one unit. Split it into smaller, cohesive commits (docs/assets/` +
           `generated files are not counted). Add "${escapeHatch}" for one deliberately broad commit.`,

package/plugins/gates/hooks/gates/audit-before-build/index.mjs

@@ -53,7 +53,7 @@ function checkDelegation(toolInput) {
   if (AUDIT_EVIDENCE_PATTERN.test(prompt)) return;
 
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     'Delegating creation of a new script/checker/gate/hook/linter/tool without evidence of a prior audit. State what you searched and why no existing tool covers this (e.g. "audited and no existing tool...").',
   );
 }
@@ -84,7 +84,7 @@ function checkWrite(toolInput, parameters) {
   if (INLINE_JUSTIFICATION_PATTERN.test(content)) return;
 
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `Creating a new executable tool at ${filePath} without a justification comment (e.g. "justification: ..."). Document why no existing tool covers this before building a new one.`,
   );
 }

package/plugins/gates/hooks/gates/autonomous-mode/index.mjs

@@ -45,6 +45,6 @@ runGate(
   },
   ({ toolName }) => {
     if (!toolInGroups(toolName, QUESTION_GROUPS)) return;
-    deny(GATE_ID, DENY_MESSAGE);
+    deny(CONFIG_KEY, DENY_MESSAGE);
   },
 );

package/plugins/gates/hooks/gates/bash-commands/index.mjs

@@ -173,7 +173,7 @@ function checkDestructive(command, parameters) {
       : [entry, 'Destructive command is not allowed.'],
   );
   for (const [source, reason] of denyPairs) {
-    if (compile(source).test(normalized)) deny(GATE_ID, reason);
+    if (compile(source).test(normalized)) deny(CONFIG_KEY, reason);
   }
 
   // rm -rf over a protected area: areas read from config at runtime, so editing
@@ -184,12 +184,12 @@ function checkDestructive(command, parameters) {
     rmRfAreas.length > 0 &&
     compile(rmRfSourceFrom(rmRfAreas)).test(command)
   ) {
-    deny(GATE_ID, "'rm -rf' over a protected area is not allowed.");
+    deny(CONFIG_KEY, "'rm -rf' over a protected area is not allowed.");
   }
 
   if (parameters.embeddedInterpreterEnabled) {
     const reason = checkEmbeddedInterpreter(command);
-    if (reason) deny(GATE_ID, reason);
+    if (reason) deny(CONFIG_KEY, reason);
   }
 }
 

package/plugins/gates/hooks/gates/block-remote-publish/index.mjs

@@ -131,9 +131,9 @@ runGate(
     for (const [source, reason] of parameters.publishRules) {
       const pattern = compile(source);
       if (isShell) {
-        if (pattern.test(shellCommand)) deny(GATE_ID, reason);
+        if (pattern.test(shellCommand)) deny(CONFIG_KEY, reason);
       } else if (hasRealPublishIntent(command, pattern)) {
-        deny(GATE_ID, reason);
+        deny(CONFIG_KEY, reason);
       }
     }
   },

package/plugins/gates/hooks/gates/brief-approved/index.mjs

@@ -203,7 +203,7 @@ runGate(
     if (unapproved.length === 0) return;
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This implementation delegation cites feature(s) [${unapproved.join(', ')}] ` +
         'whose brief/contract has no recorded approval. Paste the FULL brief into the ' +
         'chat, get an explicit confirmation from the user (not a vague "dale"/"sigamos" ' +

package/plugins/gates/hooks/gates/brief-before-delegate/index.mjs

@@ -209,7 +209,7 @@ function denyTooShort(prompt) {
   const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
   const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This delegation asks for implementation ("${excerpt}${ellipsis}") in a ${prompt.length}-character ` +
       'prompt — too short to carry a goal, steps and a done-when criterion. State what this aims to ' +
       'achieve, what concretely needs doing (as a list or steps), and how completion is verified, then ' +
@@ -222,7 +222,7 @@ function reportMissingSignals(missing) {
 
   if (missing.length < TOTAL_REQUIRED_SIGNALS) {
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       `This implementation delegation does not recognizably state: ${missing.join('; ')}. ` +
         'If it is already there under different wording, proceed — this is only a warning. ' +
         'Otherwise add it before the subagent starts blind.',
@@ -231,7 +231,7 @@ function reportMissingSignals(missing) {
   }
 
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     'This delegation asks for implementation but states neither as a list nor recognizable prose: ' +
       `${missing.join('; ')}. Add to the prompt: (1) the GOAL — what this aims to achieve; ` +
       '(2) the STEPS — concrete files/actions, as a list; (3) the CRITERION — how completion is ' +

package/plugins/gates/hooks/gates/circuit-breaker/index.mjs

@@ -448,7 +448,7 @@ function identityKey(signature) {
 
 function denyRepeatedAttempt(count) {
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This same task received ${count} consecutive attempts (same goal, same scope and the same files) ` +
       'in this session, regardless of which subagent_type carried it. STOP retrying and ASK THE USER ' +
       'for help now: state what you tried, what blocked it, and the specific decision or input you need ' +

package/plugins/gates/hooks/gates/dependency-skills/index.mjs

@@ -112,7 +112,7 @@ runGate(
     if (unmatched.length === 0) return;
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `New dependencies without a matching skill in ${parameters.projectSkillsDir}: ${unmatched.join(', ')}. ` +
         'Add a skill documenting how to use each (directory name matching or containing the ' +
         'package name), OR, if a dependency genuinely needs no skill, declare it in ' +

package/plugins/gates/hooks/gates/diagnosis-before-patch/index.mjs

@@ -41,7 +41,7 @@ runGate(
     if (!touchesTimeout) return;
 
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       'Diagnosis before patch: you are adjusting a timeout/deadline/retry value. Before changing a value to fix a symptom ("X is slow/fails"), confirm you read the evidence that proves the cause (a log line from the failing provider/process, not a hypothesis). A timeout should measure inactivity, not total time: a process that is progressing should not be cut off.',
     );
   },

package/plugins/gates/hooks/gates/feature-catalog/index.mjs

@@ -61,7 +61,7 @@ runGate(
     // Base, non-negotiable: `done` is never written directly to the catalog.
     if (DONE_STATUS_PATTERN.test(content)) {
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `Writing 'status: done' directly to ${catalogFileName} is not allowed. ` +
           'Only a review/QA subagent or a validated automated process may close a feature.',
       );
@@ -74,7 +74,7 @@ runGate(
       .length;
     if (inProgressCount > maxInProgress) {
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `${catalogFileName} would have ${inProgressCount} features 'in_progress'; ` +
           `the maximum allowed is ${maxInProgress}.`,
       );

package/plugins/gates/hooks/gates/force-parallel/index.mjs

@@ -122,7 +122,7 @@ runGate(
     if (nextCount < threshold) return;
 
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       WARN_MESSAGE.replace('{count}', String(nextCount))
         .replace(
           '{windowSeconds}',

package/plugins/gates/hooks/gates/forge-flow/index.mjs

@@ -121,11 +121,11 @@ runGate(
     const result = await forgeRunState(root, forgeDatabasePath);
 
     if (result.state === 'active') return; // pipeline is running → allow
-    if (result.state === 'none') deny(GATE_ID, DENY_MESSAGE); // no run → block
+    if (result.state === 'none') deny(CONFIG_KEY, DENY_MESSAGE); // no run → block
     // state 'unknown': the DB could not be read. Allow so a broken lookup never freezes work,
     // but surface it loudly — a silent allow here would disable the enforcer without a trace.
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       `forge enforcement is degraded: the forge DB could not be read (${result.reason}). ` +
         'Allowing this action, but the pipeline is NOT being enforced. Check that forge is ' +
         `installed and ${forgeDatabasePath} is readable, or turn this gate off if intended.`,

package/plugins/gates/hooks/gates/implementation-pipeline/index.mjs

@@ -175,7 +175,7 @@ runGate(
     const lines = missingStages.map((stage) => `  ${stage.line}`).join('\n');
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This delegation is going to build code but skips ${missingStages.length} pipeline ` +
         `stage(s). ${details} ${
           isHighRisk

package/plugins/gates/hooks/gates/intent-flow/index.mjs

@@ -181,7 +181,7 @@ function missingSignals(prompt) {
 
 function denyUnresolvedUnknown() {
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     'This request touches a high-impact signal (money/auth/persisted data/public contract/' +
       'irreversible/production) AND declares an unresolved UNKNOWN. Do not relaunch assuming an ' +
       'answer — ask the user what to decide about that UNKNOWN before delegating again.',
@@ -192,7 +192,7 @@ function denyTooShortForScopeList(prompt) {
   const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
   const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This implementation request ("${excerpt}${ellipsis}") does not carry a scope list: missing IN ` +
       'SCOPE, OUT OF SCOPE and EDGE CASES. Add it to the prompt before relaunching.',
   );
@@ -200,7 +200,7 @@ function denyTooShortForScopeList(prompt) {
 
 function denyMissingSignals(missing) {
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This implementation request does not declare, in recognizable form: ${missing.join('; ')}. ` +
       'Add what is missing to the prompt before relaunching this delegation.',
   );

package/plugins/gates/hooks/gates/lint-commit/index.mjs

@@ -133,7 +133,7 @@ runGate(
       // timeout kill). A commit gate that cannot evaluate must not silently permit — deny
       // with the spawn error so the user can fix the environment, not guess.
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `Could not run the lint command ("${lintCommand}"): ${result.error.message}. Fix ` +
           'the lint setup or set lintCommand/blockCommitWithFailingLint in .ai/config.json.',
       );
@@ -143,7 +143,7 @@ runGate(
       const combinedOutput =
         `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
       deny(
-        GATE_ID,
+        CONFIG_KEY,
         `Lint failed (exit ${result.status}) — commit blocked until it passes:\n` +
           `${tailLines(combinedOutput, OUTPUT_TAIL_LINES)}`,
       );

package/plugins/gates/hooks/gates/mandatory-flow/index.mjs

@@ -125,7 +125,7 @@ function readSlug(pointerPath) {
 function checkLiveTask(pointerPath) {
   if (!existsSync(pointerPath)) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This delegation is going to implement, but there is no live task: ${pointerPath} ` +
         'does not exist. Start a task pointing to it before delegating, or declare ' +
         'LEVEL: QUESTION/MICRO if this is not implementation.',
@@ -135,7 +135,7 @@ function checkLiveTask(pointerPath) {
   const slug = readSlug(pointerPath);
   if (!slug) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `${pointerPath} exists but is empty. An active-task pointer with no slug is not ` +
         'a live task. Write the task slug into it before delegating.',
     );
@@ -144,7 +144,7 @@ function checkLiveTask(pointerPath) {
   const taskDirectory = join(process.cwd(), '.ai', 'pipeline', slug);
   if (!hasTaskContract(taskDirectory)) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `The active task '${slug}' has no contract on disk: none of ` +
         `${TASK_CONTRACT_FILES.join(', ')} exists under ${taskDirectory}. ` +
         'Write the contract before implementing.',

package/plugins/gates/hooks/gates/neutral-spanish/index.mjs

@@ -94,7 +94,7 @@ runGate(
 
     const unique = [...new Set(hits)].slice(0, MAX_REPORTED_MARKERS);
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Text being written contains regional Spanish markers: ${unique.join(', ')}. ` +
         'Rewrite in neutral Spanish before writing. If the regional wording is intentional ' +
         `(a literal quote, a test fixture, a captured log, a data sample), add the marker ` +

package/plugins/gates/hooks/gates/never-assume/index.mjs

@@ -49,7 +49,7 @@ runGate(
     if (hits.length === 0) return;
 
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       `Content contains conjecture phrasing without stated verification: ${hits.join(', ')}. Verify before asserting instead of assuming.`,
     );
   },

package/plugins/gates/hooks/gates/no-blocking/index.mjs

@@ -153,7 +153,7 @@ runGate(
     for (const [source, reason] of blockingPairs) {
       if (compile(source).test(command)) {
         deny(
-          GATE_ID,
+          CONFIG_KEY,
           `${reason} If this wait is genuinely justified, add "${marker} <concrete reason>" ` +
             'to the command and try again. A declared wait is a decision; a silent one is an oversight.',
         );

package/plugins/gates/hooks/gates/no-coauthor/index.mjs

@@ -116,7 +116,7 @@ runGate(
     if (!match) return;
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This commit message carries an AI/agent attribution trailer (matched "${match}"). ` +
         'Remove it — no Co-Authored-By, no "Generated with", no session trailer. If this ' +
         `commit legitimately must keep a co-author (e.g. importing external history), add ` +

package/plugins/gates/hooks/gates/no-lint-suppression/index.mjs

@@ -173,7 +173,7 @@ runGate(
     if (!offender) return;
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This write silences the linter/type-checker instead of fixing the code: "${offender}". ` +
         'Fix the underlying issue rather than turning the check off. If this is a genuine, ' +
         `documented false positive, put "${escapeHatch} <reason>" on the same line so the ` +

package/plugins/gates/hooks/gates/no-memory-dependency/index.mjs

@@ -128,7 +128,7 @@ runGate(
 
     const quotedPhrases = phrases.map((phrase) => `"${phrase}"`).join(', ');
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This delegation depends on the subagent remembering something (${quotedPhrases}), but a ` +
         'fresh subagent has none of this conversation. Put the data IN the prompt, in a file it ' +
         'reads, a flag, or an already-persisted decision. If the phrase directs the subagent’s ' +

package/plugins/gates/hooks/gates/no-reconfirm/index.mjs

@@ -197,6 +197,6 @@ runGate(
       parameters.overlapThreshold,
     );
     if (notices.length === 0) return;
-    warn(GATE_ID, notices.join('\n\n'));
+    warn(CONFIG_KEY, notices.join('\n\n'));
   },
 );

package/plugins/gates/hooks/gates/protected-paths/index.mjs

@@ -87,7 +87,7 @@ function checkWrite(toolInput, protectedPaths) {
   const target = writtenPathOf(toolInput);
   if (target && isProtectedPath(target, protectedPaths)) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Writing to '${target}' is not allowed: it matches a protected path (${protectedPaths.join(', ')}).`,
     );
   }
@@ -110,7 +110,7 @@ function checkShellCommand(toolInput, protectedPaths, mutatingCommands) {
 
   if (targetsProtected) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This command targets a protected path (${protectedPaths.join(', ')}) with a mutating operation. ` +
         'Reading (echo/cat/grep) is fine; modifying it is not.',
     );

package/plugins/gates/hooks/gates/recurrence-lock/index.mjs

@@ -84,7 +84,7 @@ runGate(
 
     const names = openRecurrences.map((entry) => entry.class).join(', ');
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Registered recurring issue classes are still open and at/above threshold: ${names}. Resolve or close them before proceeding.`,
     );
   },

package/plugins/gates/hooks/gates/reuse-before-build/index.mjs

@@ -224,7 +224,7 @@ function checkDelegation(toolInput, cwd, parameters) {
   const prompt = delegationPromptOf(toolInput);
   if (!isBuildIntent(prompt)) return;
   if (buildIsCleared(prompt, cwd, parameters, null)) return;
-  deny(GATE_ID, DENY_MESSAGE);
+  deny(CONFIG_KEY, DENY_MESSAGE);
 }
 
 /** Write: block a new tool-like file that is not cleared by content, map, or an installed dep. */
@@ -237,7 +237,7 @@ function checkWrite(toolInput, cwd, parameters) {
   const content = writtenContentOf(toolInput);
   const toolBaseName = basename(filePath).replace(/\.[^.]+$/, '');
   if (buildIsCleared(content, cwd, parameters, toolBaseName)) return;
-  deny(GATE_ID, DENY_MESSAGE);
+  deny(CONFIG_KEY, DENY_MESSAGE);
 }
 
 runGate(

package/plugins/gates/hooks/gates/risk-level/index.mjs

@@ -191,7 +191,7 @@ function denyNoLevelDeclared(prompt) {
   const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
   const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This implementation delegation ("${excerpt}${ellipsis}") does not declare its risk LEVEL. Add a ` +
       'line such as "LEVEL: STANDARD" (or QUESTION/MICRO/HIGH-RISK, whichever fits) before relaunching ' +
       'this delegation.',
@@ -200,7 +200,7 @@ function denyNoLevelDeclared(prompt) {
 
 function denyAmbiguousLevel(levels) {
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This delegation declares multiple different risk levels (${[...new Set(levels)].join(', ')}) — ` +
       'it is not clear which one governs this task. Declare a single, unambiguous LEVEL for this ' +
       'delegation (remove any decoy/reference mention of a different level) before relaunching.',
@@ -209,7 +209,7 @@ function denyAmbiguousLevel(levels) {
 
 function denyLevelContradictsSignal(level, signal) {
   deny(
-    GATE_ID,
+    CONFIG_KEY,
     `This delegation declares LEVEL: ${level}, but the request touches the risk signal "${signal}" near ` +
       'an implementation verb (not quoted, not the topic of a documentary deliverable) — that requires ' +
       `LEVEL: HIGH-RISK, not ${level}. Raise the declaration to HIGH-RISK before relaunching.`,

package/plugins/gates/hooks/gates/root-cause-first/index.mjs

@@ -43,7 +43,7 @@ runGate(
     if (!matched) return;
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Content matches a patch-without-diagnosis marker (${matched.source}). Identify and fix the root cause before patching; do not defer with a "fix later" marker.`,
     );
   },

package/plugins/gates/hooks/gates/root-whitelist/index.mjs

@@ -205,7 +205,7 @@ runGate(
         filesWhitelist,
         foldersWhitelist,
       );
-      if (reason) deny(GATE_ID, reason);
+      if (reason) deny(CONFIG_KEY, reason);
     }
   },
 );

package/plugins/gates/hooks/gates/rule-skill-autodiscovery/index.mjs

@@ -163,7 +163,7 @@ runGate(
       if (configsTampered(before)) {
         revertConfigs(before);
         deny(
-          GATE_ID,
+          CONFIG_KEY,
           `Discovered rule/skill script ${relative(projectRoot, script)} attempted to modify gate security configuration (.ai/config.json or the global config). The change was reverted and the action is blocked.`,
         );
         return;
@@ -171,7 +171,7 @@ runGate(
 
       if (failed) {
         deny(
-          GATE_ID,
+          CONFIG_KEY,
           `Sub-gate failed: ${relative(projectRoot, script)}. Fix it before continuing.`,
         );
         return;

package/plugins/gates/hooks/gates/sdd-specs/index.mjs

@@ -153,7 +153,7 @@ function denyIfAdvancedFeatureLacksContract(features, treeRoot) {
     if (!feature?.name || !ADVANCED_STATUSES.has(feature.status)) continue;
     if (contractExistsFor(treeRoot, feature.name)) continue;
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Feature '${feature.name}' is set to '${feature.status}' but has no non-empty ` +
         `contract (${CONTRACT_FILES.join(', ')}) under the discovered contract tree.`,
     );
@@ -171,7 +171,7 @@ function checkCatalogWrite(toolInput, catalogPath, treeRoot) {
     // still targets the catalog is suspicious on its own -- a spec_ready/done transition
     // hidden behind a malformed payload must not be silently allowed through.
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `The write to ${CATALOG_FILE_NAME} does not parse as JSON. A catalog write that ` +
         'cannot be verified for the spec-contract invariant is not allowed; fix the JSON ' +
         'or write valid content.',
@@ -213,7 +213,7 @@ function checkDelegation(toolInput, treeRoot, exemptSubagents) {
   );
   if (missing.length === citedFeatures.length) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `This implementation delegation cites feature(s) [${missing.join(', ')}] with no ` +
         `non-empty contract (${CONTRACT_FILES.join(', ')}) on disk. Write the contract ` +
         'before implementing.',

package/plugins/gates/hooks/gates/staged-lint/index.mjs

@@ -133,7 +133,7 @@ function runLintOverStaged(lintCommand, files, cwd, timeoutMs) {
 function denyIfLintFailed(result, lintCommand, escapeHatch) {
   if (result.error) {
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Could not run the lint command ("${lintCommand}") over the staged files: ` +
         `${result.error.message}. Fix the lint setup or set lintCommand/` +
         `${CONFIG_KEY} in .ai/config.json.`,
@@ -144,7 +144,7 @@ function denyIfLintFailed(result, lintCommand, escapeHatch) {
       `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
     const outputTail = tailLines(combinedOutput, OUTPUT_TAIL_LINES);
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `The files you staged fail lint — commit blocked until your own changes are clean ` +
         `(the rest of the repo is not checked). Fix them, or add "${escapeHatch}" to the ` +
         `commit command for a deliberate exception:\n${outputTail}`,

package/plugins/gates/hooks/gates/stop-pending/index.mjs

@@ -50,7 +50,6 @@ import { dirname, join } from 'node:path';
 import { isGateEnabled, gateParameters } from '../../lib/config.mjs';
 import { readHookPayload } from '../../lib/hook-io.mjs';
 
-const GATE_ID = 'stop-pending';
 const CONFIG_KEY = 'blockStopWithPendingTasks';
 
 const PROJECT_ROOT_MARKERS = ['.git', '.ai'];
@@ -153,7 +152,7 @@ function main() {
     if (blockingTasks.length === 0) return allow();
 
     return block(
-      `[${GATE_ID}] There are ${blockingTasks.length} pending task(s) still active for this ` +
+      `[${CONFIG_KEY}] There are ${blockingTasks.length} pending task(s) still active for this ` +
         `project:\n${describeTasks(blockingTasks)}\n` +
         'Close each before ending the turn: `task close <id> --evidence "..."` when done, ' +
         'or `task abandon <id> --reason "..."` when it will not be finished. A task left ' +

package/plugins/gates/hooks/gates/test-after-implementation/index.mjs

@@ -107,7 +107,7 @@ runGate(
     if (!pairedImplementationChanged) return;
 
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Creating test ${testFileName} after its paired implementation was already modified ` +
         '(uncommitted). Write the test before or alongside the implementation, not after — a ' +
         'test that passes the first time it runs proves nothing about the change. If this is a ' +

package/plugins/gates/hooks/gates/test-matrix/index.mjs

@@ -175,7 +175,7 @@ runGate(
 
     const lines = missing.map((entry) => `  ${entry.line}`).join('\n');
     deny(
-      GATE_ID,
+      CONFIG_KEY,
       `Missing ${missing.length} test type(s) the requirement makes mandatory. Test types ` +
         'are chosen ACCORDING TO THE REQUIREMENT: E2E if it touches money/auth/persistence, ' +
         'visual/QA if it touches UI, and always unit or mutation. ' +

package/plugins/gates/hooks/gates/tool-map/index.mjs

@@ -129,7 +129,7 @@ function recordTool(mapPath, normalizedPath, auditLine, toolMapFile) {
     );
   } catch (error) {
     warn(
-      GATE_ID,
+      CONFIG_KEY,
       `Could not record this tool in ${toolMapFile}: ${error?.message ?? error}. ` +
         'The build proceeds, but the discovery was not remembered.',
     );

package/plugins/gates/hooks/lib/hook-io.mjs

@@ -359,7 +359,7 @@ export async function runGate(gate, check) {
     });
   } catch (error) {
     deny(
-      gate.id,
+      gate.configKey,
       `The gate failed to evaluate and blocks the action for safety: ${error?.message ?? error}.`,
     );
   }

package/plugins/tasks/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tasks",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Deterministic task tracking for Claude Code: persists tasks the model registers via the CLI, reminds of open tasks on a message counter, and lists active tasks on session start.",
   "author": {
     "name": "Devrik"