@devrik-tools/claude-gates 0.7.2 → 0.8.0

package/plugins/gates/hooks/gates/reuse-before-build/index.mjs

@@ -1,41 +1,13 @@
-// reuse-before-build — do not reinvent the wheel. Before building a new script, gate,
-// verifier, helper, composable, component or generic utility, consult what already solves
-// the need: the per-project tool map (a record of past findings), the installed dependencies
-// (package.json), and — declared by the author — a local→cloud audit. This gate is the
-// deterministic half: it objects when a build is starting without evidence of a check.
-// It never reaches the network: the cloud search (npm, marketplaces) is the assistant's or
-// the CLI's job, so the hook stays self-contained.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   toolMapFile     path to the per-project tool map, relative to the project root.
-//                   Default .ai/tool-map.json.
-//   toolFolders     folder names that mark a file as a "tool/helper". Replaces the built-in
-//                   list wholesale.
-//   toolNamePatterns regex sources; a new file whose BASENAME matches any is treated as a
-//                   generic helper regardless of its folder (useFoo, fooHelper, fooUtil...).
-//   toolExtensions  file extensions considered code that can reinvent a wheel.
-//
-// ── How it decides (deterministic, no judgment) ─────────────────────────────────────
-// A write that creates a tool/helper (by folder, by name pattern, or by a helper-ish
-// extension), or a delegation prompt that asks to build one, must carry evidence the wheel
-// was checked: (a) an audit phrase in the text, OR (b) the tool's own name already recorded
-// in the tool map, OR (c) an installed dependency whose name matches the tool's name (there
-// is already a package that plausibly covers it — reuse it or justify not to). Absent all
-// three, the gate blocks with an actionable message.
-//
-// ── What changed vs the first version (closed holes) ────────────────────────────────
-//   · Map match was a lax "any 4+-letter word of the target appears anywhere in the JSON",
-//     which produced false "already covered" (a `parser.mjs` cleared by any unrelated entry
-//     mentioning "parser"). Now it matches the tool's own basename as a whole token against
-//     the recorded tool paths — structural, not substring-of-prose.
-//   · Scope was only scripts/hooks/tools/gates + executable extensions. Now it also covers
-//     lib/utils/helpers/composables/components/services AND name patterns (useX, XHelper,
-//     XUtil, XService) anywhere, which is where a wheel is most often reinvented.
-//   · Build-intent detection was English-only prose; now it uses the bilingual BUILD_INTENT.
-//   · Adds an installed-dependency check: a matching package.json dep also clears the build.
-
-import { existsSync, readFileSync } from 'node:fs';
-import { basename, dirname, extname, join } from 'node:path';
+// reuse-before-build — do not reinvent the wheel. A write that creates a tool/helper, or a
+// delegation asking to build one, must carry evidence the wheel was checked: an audit
+// phrase, the tool's basename already recorded in the project's tool map, or an installed
+// dependency of the same name. What counts as a tool and as evidence is shared with
+// tool-map (lib/tools.mjs) so the read and write halves of the pair cannot drift apart.
+// The gate never reaches the network: the cloud search is the assistant's job.
+
+import { existsSync } from 'node:fs';
+import { basename, isAbsolute, join, relative, resolve } from 'node:path';
+import { projectRootOf, readJsonOrNull } from '../../lib/config.mjs';
 import {
   runGate,
   deny,
@@ -45,167 +17,57 @@ import {
   delegationPromptOf,
 } from '../../lib/hook-io.mjs';
 import { isBuildIntent } from '../../lib/signals.mjs';
+import {
+  AUDIT_DONE_PATTERN,
+  DEFAULT_TOOL_EXTENSIONS,
+  DEFAULT_TOOL_FOLDERS,
+  DEFAULT_TOOL_NAME_PATTERNS,
+  hasAuditEvidence,
+  isToolPath,
+} from '../../lib/tools.mjs';
 
 const GATE_ID = 'reuse-before-build';
 const CONFIG_KEY = 'requireReuseCheckBeforeBuilding';
 
 const DEFAULT_TOOL_MAP_FILE = join('.ai', 'tool-map.json');
+const AUDIT_DONE_EXAMPLE_PHRASE = 'no existing tool covers this';
 
-// Code that can reinvent a wheel — broad, because a helper is a helper in any language.
-const DEFAULT_TOOL_EXTENSIONS = [
-  '.js',
-  '.mjs',
-  '.cjs',
-  '.ts',
-  '.tsx',
-  '.jsx',
-  '.vue',
-  '.py',
-  '.sh',
-  '.ps1',
-  '.rb',
-  '.go',
-];
-
-// Folders whose files are "tools/helpers" worth a reuse check. Beyond the original four,
-// this now includes the places generic reusable code actually lives.
-const DEFAULT_TOOL_FOLDERS = [
-  'scripts',
-  'hooks',
-  'tools',
-  'gates',
-  'lib',
-  'libs',
-  'utils',
-  'util',
-  'helpers',
-  'helper',
-  'composables',
-  'components',
-  'services',
-  'shared',
-  'common',
-];
-
-// A file whose BASENAME matches one of these is a generic helper wherever it lives —
-// useDebounce.ts in features/x/ is still a candidate for "does this already exist?".
-const DEFAULT_TOOL_NAME_PATTERNS = [
-  String.raw`^use[A-Z]`, // React/Vue hook/composable: useFoo
-  String.raw`[-.]?helpers?\.`, // foo.helper.ts, foo-helpers.js
-  String.raw`[-.]?utils?\.`, // foo.util.ts, string-utils.js
-  String.raw`[-.]?service\.`, // foo.service.ts
-  String.raw`[-.]?wrapper\.`, // foo.wrapper.ts
-];
-
-// Evidence the wheel was already checked: any phrase stating the audit result. Bilingual.
-const AUDIT_DONE_PATTERN =
-  /(already exists|no existing tool|there is no plugin|audited|checked whether|nothing does this|justification:|ya existe|no existe (?:una |la )?herramienta|no hay plugin|audit[eé]|verifiqu[eé] que no)/i;
-
-function projectRootOf(startDirectory) {
-  let current = startDirectory;
-  while (true) {
-    if (existsSync(join(current, '.git'))) return current;
-    const parent = dirname(current);
-    if (parent === current) return null;
-    current = parent;
-  }
-}
-
-/**
- * Whether the tool map already records THIS tool, matched structurally: the new file's
- * basename (without extension) is compared as a whole `-`/`.`-delimited token against the
- * basenames of the recorded tool paths. This replaces the old "any 4+-letter word appears
- * anywhere in the JSON blob", which cleared unrelated builds by coincidental word overlap.
- */
-function toolAlreadyInMap(startDirectory, toolMapFile, toolBaseName) {
-  const root = projectRootOf(startDirectory);
-  if (!root) return false;
-  const path = join(root, toolMapFile);
-  if (!existsSync(path)) return false;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(path, 'utf8'));
-  } catch {
-    return false;
-  }
-  if (!Array.isArray(parsed.tools)) return false;
-  const target = toolBaseName.toLowerCase();
-  return parsed.tools.some((tool) => {
-    const recorded = basename(String(tool.path ?? ''))
-      .replace(/\.[^.]+$/, '')
-      .toLowerCase();
-    return recorded === target;
-  });
-}
-
-/** Whether an installed dependency's name matches the tool's name (a package likely covers
- * it). Normalizes scoped names (@scope/foo → foo) and matches whole, so `parser` is cleared
- * by a `parser`/`@x/parser` dep but not by an unrelated `body-parser`. */
-function installedDependencyCovers(startDirectory, toolBaseName) {
-  const root = projectRootOf(startDirectory);
-  if (!root) return false;
-  const path = join(root, 'package.json');
-  if (!existsSync(path)) return false;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(path, 'utf8'));
-  } catch {
-    return false;
-  }
-  const names = [
-    ...Object.keys(parsed.dependencies ?? {}),
-    ...Object.keys(parsed.devDependencies ?? {}),
-  ];
-  const target = toolBaseName.toLowerCase();
-  return names.some((name) => {
-    const bare = name.replace(/^@[^/]+\//, '').toLowerCase();
-    return bare === target;
-  });
-}
-
-function hasToolExtension(filePath, toolExtensions) {
-  return toolExtensions.includes(extname(filePath).toLowerCase());
+// A configured map path that escapes the project root is ignored in favor of the default:
+// the map is project state, never a file elsewhere on the machine.
+function toolMapPathFor(root, toolMapFile) {
+  const resolved = resolve(root, String(toolMapFile || DEFAULT_TOOL_MAP_FILE));
+  const relativePath = relative(root, resolved);
+  const inside =
+    relativePath !== '' &&
+    !relativePath.startsWith('..') &&
+    !isAbsolute(relativePath);
+  return inside ? resolved : join(root, DEFAULT_TOOL_MAP_FILE);
 }
 
-/** A real path SEGMENT equal to one of the tool-folder names (not a mere substring, so
- * `src/mytools/x` does not match `tools`). */
-function inToolFolder(filePath, toolFolders) {
-  const segments = filePath.replace(/\\/g, '/').split('/');
-  return segments.some((segment) =>
-    toolFolders.includes(segment.toLowerCase()),
-  );
+function stemOf(path) {
+  return basename(String(path ?? ''))
+    .replace(/\.[^.]+$/, '')
+    .toLowerCase();
 }
 
-function matchesToolNamePattern(fileName, toolNamePatterns) {
-  return toolNamePatterns.some((source) => {
-    try {
-      return new RegExp(source).test(fileName);
-    } catch {
-      return false;
-    }
-  });
+function toolAlreadyInMap(root, toolMapFile, toolBaseName) {
+  const parsed = readJsonOrNull(toolMapPathFor(root, toolMapFile));
+  if (!Array.isArray(parsed?.tools)) return false;
+  return parsed.tools.some((tool) => stemOf(tool?.path) === toolBaseName);
 }
 
-/** Whether a new file at this path should be treated as a reusable tool/helper. */
-function isToolLikePath(filePath, parameters) {
-  if (!hasToolExtension(filePath, parameters.toolExtensions)) return false;
-  const fileName = basename(filePath);
-  return (
-    inToolFolder(filePath, parameters.toolFolders) ||
-    matchesToolNamePattern(fileName, parameters.toolNamePatterns)
+function installedDependencyCovers(root, toolBaseName) {
+  const parsed = readJsonOrNull(join(root, 'package.json'));
+  const names = [];
+  for (const field of ['dependencies', 'devDependencies']) {
+    const block = parsed?.[field];
+    if (block && typeof block === 'object') names.push(...Object.keys(block));
+  }
+  return names.some(
+    (name) => name.replace(/^@[^/]+\//, '').toLowerCase() === toolBaseName,
   );
 }
 
-// The exact phrase AUDIT_DONE_PATTERN matches — quoted verbatim in the deny message so the
-// model can copy it instead of guessing a paraphrase the regex might not recognize (a vague
-// "I checked" or "no lo encontré" does NOT match AUDIT_DONE_PATTERN and the gate fires again).
-const AUDIT_DONE_EXAMPLE_PHRASE = 'no existing tool covers this';
-
-/** The concrete deny message for a blocked WRITE: names the exact file and gives the exact
- * text to add (copy-pasteable, matches AUDIT_DONE_PATTERN verbatim) — no exploration needed
- * to find any of this, it is the gate's own job to hand it over. Adding the phrase also
- * satisfies the tool-map gate (maintainToolMap), which records the file + this same line
- * into .ai/tool-map.json automatically — no separate command to run. */
 function writeDenyMessage(filePath) {
   return (
     `Blocked: '${filePath}' looks like a new tool/helper, and nothing shows the wheel was ` +
@@ -214,16 +76,14 @@ function writeDenyMessage(filePath) {
     'reuse/import the existing one instead.\n' +
     '  2. It does not exist anywhere you checked (repo, installed deps, npm/marketplaces) — ' +
     "add ONE line to the file's content stating that, e.g.: " +
-    `"// ${AUDIT_DONE_EXAMPLE_PHRASE}" (any phrase matching /${AUDIT_DONE_PATTERN.source}/i ` +
+    `"// ${AUDIT_DONE_EXAMPLE_PHRASE}" (any phrase matching /${AUDIT_DONE_PATTERN.source}/iu ` +
     'works, this one is guaranteed to). That line also gets this file auto-recorded into ' +
-    '.ai/tool-map.json — nothing further to run.\n' +
+    'the tool map — nothing further to run.\n' +
     'No filesystem exploration is required to satisfy this gate — the audit is a sentence ' +
     'in the file or a matching package.json dependency, nothing else.'
   );
 }
 
-/** The concrete deny message for a blocked DELEGATION prompt: same two options, but no file
- * name exists yet (only a prompt), so both talk about the prompt text, not a file. */
 function delegationDenyMessage() {
   return (
     "Blocked: this delegation's prompt asks to build a new tool/helper, and nothing in " +
@@ -233,46 +93,42 @@ function delegationDenyMessage() {
     'reference the existing one in the prompt instead.\n' +
     '  2. It does not exist anywhere you checked — add ONE line to the prompt stating ' +
     `that, e.g.: "${AUDIT_DONE_EXAMPLE_PHRASE}" (any phrase matching ` +
-    `/${AUDIT_DONE_PATTERN.source}/i works, this one is guaranteed to). Once the delegate ` +
+    `/${AUDIT_DONE_PATTERN.source}/iu works, this one is guaranteed to). Once the delegate ` +
     'actually writes the file, include the same phrase in its content so it also gets ' +
-    'auto-recorded into .ai/tool-map.json.\n' +
+    'auto-recorded into the tool map.\n' +
     'No filesystem exploration is required to satisfy this gate — the audit is a sentence ' +
     'in the prompt, or a matching package.json dependency, nothing else.'
   );
 }
 
-/** A build is cleared when its text declares an audit, its name is already recorded in the
- * map, or an installed dependency covers it. `toolBaseName` is used for the last two. */
-function buildIsCleared(text, cwd, parameters, toolBaseName) {
-  if (AUDIT_DONE_PATTERN.test(text)) return true;
-  if (
-    toolBaseName &&
-    toolAlreadyInMap(cwd, parameters.toolMapFile, toolBaseName)
-  )
-    return true;
-  if (toolBaseName && installedDependencyCovers(cwd, toolBaseName)) return true;
-  return false;
+function buildIsCleared(text, root, parameters, toolBaseName) {
+  if (hasAuditEvidence(text)) return true;
+  if (!toolBaseName) return false;
+  return (
+    toolAlreadyInMap(root, parameters.toolMapFile, toolBaseName) ||
+    installedDependencyCovers(root, toolBaseName)
+  );
 }
 
-/** Delegation: block a build-a-tool prompt that is not cleared. No file name is known from a
- * prompt, so only the audit-phrase evidence applies there. */
-function checkDelegation(toolInput, cwd, parameters) {
+function checkDelegation(toolInput, root, parameters) {
   const prompt = delegationPromptOf(toolInput);
   if (!isBuildIntent(prompt)) return;
-  if (buildIsCleared(prompt, cwd, parameters, null)) return;
+  if (buildIsCleared(prompt, root, parameters, null)) return;
   deny(CONFIG_KEY, delegationDenyMessage());
 }
 
-/** Write: block a new tool-like file that is not cleared by content, map, or an installed dep. */
-function checkWrite(toolInput, cwd, parameters) {
+function checkWrite(toolInput, root, parameters) {
   const rawPath = writtenPathOf(toolInput);
   const filePath = rawPath.replace(/\\/g, '/');
-  if (!isToolLikePath(filePath, parameters)) return;
-  // Editing an EXISTING file is not building a new tool — only creation triggers the audit.
-  if (rawPath && existsSync(rawPath)) return;
+  const isTool = isToolPath(filePath, {
+    folders: parameters.toolFolders,
+    extensions: parameters.toolExtensions,
+    namePatterns: parameters.toolNamePatterns,
+  });
+  if (!isTool) return;
+  if (existsSync(isAbsolute(rawPath) ? rawPath : join(root, rawPath))) return;
   const content = writtenContentOf(toolInput);
-  const toolBaseName = basename(filePath).replace(/\.[^.]+$/, '');
-  if (buildIsCleared(content, cwd, parameters, toolBaseName)) return;
+  if (buildIsCleared(content, root, parameters, stemOf(filePath))) return;
   deny(CONFIG_KEY, writeDenyMessage(filePath));
 }
 
@@ -288,12 +144,12 @@ runGate(
       toolExtensions: DEFAULT_TOOL_EXTENSIONS,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    const cwd = process.cwd();
+  ({ toolName, toolInput, parameters, cwd }) => {
+    const root = projectRootOf(cwd) ?? cwd;
     if (toolInGroups(toolName, ['delegation'])) {
-      checkDelegation(toolInput, cwd, parameters);
+      checkDelegation(toolInput, root, parameters);
     } else if (toolInGroups(toolName, ['write'])) {
-      checkWrite(toolInput, cwd, parameters);
+      checkWrite(toolInput, root, parameters);
     }
   },
 );

package/plugins/gates/hooks/gates/risk-level/index.mjs

@@ -1,198 +1,45 @@
-// risk-level — denies an implementation delegation that does not declare its risk
-// LEVEL (QUESTION|MICRO|STANDARD|HIGH-RISK), and denies a declared level that
-// contradicts a real high-impact signal in the prompt itself (anything but HIGH-RISK).
+// risk-level — denies an implementation delegation that does not declare its risk LEVEL
+// (QUESTION|MICRO|STANDARD|HIGH-RISK), and denies a declared level that contradicts a real
+// high-impact signal in the prompt (anything but HIGH-RISK).
 //
-// ── What this does and does not decide ──────────────────────────────────────────────
-// Classifying a task correctly between QUESTION/MICRO/STANDARD stays the delegator's
-// judgment — this gate cannot tell whether STANDARD was the "right" level for a task
-// with no detectable high-impact signal. The only deterministic thing it can and does
-// impose: the declaration EXISTS, and it does not contradict a real, non-quoted signal
-// of high risk. The level vocabulary itself (the four tokens) is a fixed base, not a
-// project param — only which signals count as high-impact, and which subagents are
-// exempt, are configurable.
-//
-// ── Same two-stage intent pattern as intent-flow ────────────────────────────────────
-// Stage 1: cheap lexical prefilter (implementation verb + high-impact signal present
-// anywhere). Stage 2: strip quoted/templated text, require near co-occurrence between
-// the verb and the signal, discard a verb whose object is a documentary deliverable.
-// Over-declaring HIGH-RISK is never penalized — this gate only catches under-declaring.
-//
-// ── Which declaration governs ────────────────────────────────────────────────────────
-// A prompt can mention the LEVEL token more than once (a decoy/reference to a previous
-// task, then the real declaration for THIS task). Taking the first match lets an early,
-// irrelevant mention govern instead of the operative one. This gate instead takes the
-// LAST declaration as operative (a delegator revising a decoy note downward writes the
-// real value last); when multiple declarations disagree, it denies and asks for a single
-// unambiguous LEVEL rather than guessing which one is real.
-//
-// ── readOnlySubagents is a declared label, not a verified capability ────────────────
-// This hook cannot check what tools a named subagent actually has — the whitelist
-// exemption is void whenever the prompt itself carries a mutation-risk signal (money/
-// auth/data/write/deploy): the signal in the text outranks the label on the call.
+// Decisions: classifying between QUESTION/MICRO/STANDARD stays the delegator's judgment;
+// the gate only imposes that the declaration EXISTS and does not contradict a real,
+// non-quoted high-impact signal. Over-declaring HIGH-RISK is never penalized. The LAST
+// declaration governs, and contradictory declarations deny rather than guess. A documentary
+// deliverable (a report on the payment flow) is not an implementation and needs no LEVEL.
+// An empty `highImpactPatterns` turns the contradiction check off, not the LEVEL requirement.
 
+import {
+  DEFAULT_HIGH_IMPACT_PATTERNS,
+  DEFAULT_READ_ONLY_SUBAGENTS,
+  LEVELS,
+  allMatches,
+  buildHighImpactPattern,
+  declaredLevelsOf,
+  hasAmbiguousLevel,
+  hasRealSensitiveMutation,
+  isDocumentaryRequest,
+  isExemptQuery,
+  isImplementationRequest,
+  isReadOnlySubagent,
+  operativeLevelOf,
+  promptExcerpt,
+  stripQuoted,
+} from '../../lib/delegation.mjs';
 import {
   runGate,
   deny,
   toolInGroups,
   delegationPromptOf,
 } from '../../lib/hook-io.mjs';
-import { MUTATION_RISK_SIGNAL } from '../../lib/signals.mjs';
 
 const GATE_ID = 'risk-level';
 const CONFIG_KEY = 'requireDeclaredRiskLevel';
 
-const DEFAULT_READ_ONLY_SUBAGENTS = ['explore', 'claude-code-guide', 'plan'];
-const DEFAULT_HIGH_IMPACT_PATTERNS = [
-  'dinero|pago|cobro|money|payment',
-  'auth|autenticaci[oó]n|authentication|permiso|permission|credencial|credential|token|' +
-    'sesi[oó]n|session|seguridad|security|PII',
-  'borrar|delete|drop|migraci[oó]n|migration|schema',
-  'contrato|contract|irreversible|producci[oó]n|production|API p[uú]blica|public api',
-];
-
-const CO_OCCURRENCE_WINDOW = 100;
-const VERB_OBJECT_WINDOW = 60;
-// How much of an over-length prompt to quote back in a denial message.
-const PROMPT_EXCERPT_LENGTH = 80;
-
-function withUnicodeWordBoundary(alternatives) {
-  return new RegExp(
-    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
-    'iu',
-  );
-}
-
-// A prompt-level signal that a whitelisted read-only subagent name should NOT be
-// trusted to exempt this call: the name is a declared label, never a verified
-// capability this hook can check, and real mutation risk in the text must win over it.
-// Centralized in lib/signals.mjs (ES+EN) — see its header for the class this covers.
-const MUTATION_RISK_SIGNAL_PATTERN = MUTATION_RISK_SIGNAL;
-
-const IMPLEMENTATION_VERBS = withUnicodeWordBoundary(
-  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
-    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|escrib(í|e) c[oó]digo|escribir c[oó]digo|' +
-    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
-    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
-    'escrib(í|e)|escribir|implement|build|fix|migrate|modify|refactor|remove|rewrite|deploy|write',
-);
-
-const QUERY_VERBS = withUnicodeWordBoundary(
-  'explica|explic(á|ar)|qu[eé]|c[oó]mo|muestra|mostr(á|ar)|analiza|analiz(á|ar)|investiga|' +
-    'investig(á|ar)|revisa|revis(á|ar)|audita|audit(á|ar)|diagnostica|diagnostic(á|ar)|' +
-    'explain|what|how|show|analyze|investigate|review|audit|diagnose',
-);
-
-const DOCUMENTARY_DELIVERABLE_PATTERN = withUnicodeWordBoundary(
-  'documento|documentaci[oó]n|reporte|informe|diagrama|readme|wiki|changelog|' +
-    'p[aá]gina de documentaci[oó]n|archivo html|p[aá]gina html|markdown|document|documentation|report',
-);
-const DOCUMENTARY_EXTENSION_PATTERN = /\.(md|html?|adoc)\b/iu;
-
-/** Declared LEVEL: one of the four fixed tokens, near the word "level"/"classification"
- * (in Spanish or English) so a stray mention elsewhere in the prompt is not mistaken
- * for a declaration. */
-const DECLARED_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO|STANDARD|HIGH-RISK)\b/iu;
-
-function isReadOnlySubagentName(toolInput, readOnlySubagents) {
-  const type = String(
-    toolInput.subagent_type ?? toolInput.subagentType ?? '',
-  ).toLowerCase();
-  return new Set(readOnlySubagents.map((name) => name.toLowerCase())).has(type);
-}
-
-/** A whitelisted subagent name exempts a call ONLY when the prompt carries no
- * mutation-risk signal. The name is a declared label, never a verified capability this
- * hook can check — a real risk signal in the text must win over it. */
-function isReadOnlySubagent(toolInput, prompt, readOnlySubagents) {
-  if (!isReadOnlySubagentName(toolInput, readOnlySubagents)) return false;
-  return !MUTATION_RISK_SIGNAL_PATTERN.test(prompt);
-}
-
-function isImplementationRequest(prompt) {
-  return IMPLEMENTATION_VERBS.test(prompt);
-}
-
-function isExemptQuery(prompt) {
-  if (isImplementationRequest(prompt)) return false;
-  return QUERY_VERBS.test(prompt);
-}
-
-function stripQuoted(text) {
-  return text
-    .replace(/```[\s\S]*?```/g, ' ')
-    .replace(/"[^"\n]{0,300}"/g, ' ')
-    .replace(/'[^'\n]{0,300}'/g, ' ');
-}
-
-function allMatches(pattern, text) {
-  const flags = pattern.flags.includes('g')
-    ? pattern.flags
-    : `${pattern.flags}g`;
-  return [...text.matchAll(new RegExp(pattern.source, flags))];
-}
-
-function verbProducesDocument(text, verbMatch) {
-  const from = verbMatch.index;
-  const to = from + verbMatch[0].length + VERB_OBJECT_WINDOW;
-  const objectOfVerb = text.slice(from, to);
-  return (
-    DOCUMENTARY_DELIVERABLE_PATTERN.test(objectOfVerb) ||
-    DOCUMENTARY_EXTENSION_PATTERN.test(objectOfVerb)
-  );
-}
-
-/** Returns the matched high-impact signal text if real (non-quoted) intent survives
- * stage 2, else null. Returns null immediately when stage 1 finds no candidate. */
-function realHighImpactSignal(prompt, highImpactPattern) {
-  const isCandidate =
-    IMPLEMENTATION_VERBS.test(prompt) && highImpactPattern.test(prompt);
-  if (!isCandidate) return null;
-
-  const text = stripQuoted(prompt);
-  const verbs = allMatches(IMPLEMENTATION_VERBS, text);
-  const signals = allMatches(highImpactPattern, text);
-
-  for (const verb of verbs) {
-    if (verbProducesDocument(text, verb)) continue;
-    for (const signal of signals) {
-      if (Math.abs(signal.index - verb.index) <= CO_OCCURRENCE_WINDOW)
-        return signal[0];
-    }
-  }
-  return null;
-}
-
-/** Every LEVEL declaration in the prompt, in order of appearance. */
-function declaredLevels(prompt) {
-  const withGlobal = new RegExp(
-    DECLARED_LEVEL_PATTERN.source,
-    `${DECLARED_LEVEL_PATTERN.flags}g`,
-  );
-  return [...prompt.matchAll(withGlobal)].map((match) =>
-    match[2].toUpperCase(),
-  );
-}
-
-/** The operative LEVEL: the LAST declaration in the prompt (a delegator who corrects an
- * earlier decoy/reference mention writes the real value last). Returns `{ level }` when
- * every declaration agrees or there is exactly one; returns `{ ambiguous: true }` when
- * two or more DIFFERENT levels are declared — the gate cannot know which one governs,
- * so it asks for a single unambiguous LEVEL rather than silently picking one. */
-function operativeLevel(prompt) {
-  const levels = declaredLevels(prompt);
-  if (levels.length === 0) return { level: null };
-  const distinct = new Set(levels);
-  if (distinct.size > 1) return { ambiguous: true, levels };
-  return { level: levels[levels.length - 1] };
-}
-
 function denyNoLevelDeclared(prompt) {
-  const excerpt = prompt.slice(0, PROMPT_EXCERPT_LENGTH);
-  const ellipsis = prompt.length > PROMPT_EXCERPT_LENGTH ? '…' : '';
   deny(
     CONFIG_KEY,
-    `This implementation delegation ("${excerpt}${ellipsis}") does not declare its risk LEVEL. Add a ` +
+    `This implementation delegation ("${promptExcerpt(prompt)}") does not declare its risk LEVEL. Add a ` +
       'line such as "LEVEL: STANDARD" (or QUESTION/MICRO/HIGH-RISK, whichever fits) before relaunching ' +
       'this delegation.',
   );
@@ -216,11 +63,16 @@ function denyLevelContradictsSignal(level, signal) {
   );
 }
 
-function buildHighImpactPattern(highImpactPatterns) {
-  return new RegExp(
-    (highImpactPatterns ?? []).map((source) => `(?:${source})`).join('|'),
-    'iu',
-  );
+function firstSignalText(prompt, highImpactPattern) {
+  return allMatches(highImpactPattern, stripQuoted(prompt))[0]?.[0] ?? '';
+}
+
+function isExempt(toolInput, prompt, readOnlySubagents) {
+  if (!prompt.trim()) return true;
+  if (isReadOnlySubagent(toolInput, prompt, readOnlySubagents)) return true;
+  if (isExemptQuery(prompt)) return true;
+  if (!isImplementationRequest(prompt)) return true;
+  return isDocumentaryRequest(prompt);
 }
 
 runGate(
@@ -237,29 +89,24 @@ runGate(
     if (!toolInGroups(toolName, ['delegation'])) return;
 
     const prompt = delegationPromptOf(toolInput);
-    if (!prompt.trim()) return;
-    if (isReadOnlySubagent(toolInput, prompt, parameters.readOnlySubagents))
-      return;
-    if (isExemptQuery(prompt)) return;
-    if (!isImplementationRequest(prompt)) return;
+    if (isExempt(toolInput, prompt, parameters.readOnlySubagents)) return;
+
+    if (hasAmbiguousLevel(prompt)) denyAmbiguousLevel(declaredLevelsOf(prompt));
+
+    const level = operativeLevelOf(prompt);
+    if (!level) denyNoLevelDeclared(prompt.trim());
 
     const highImpactPattern = buildHighImpactPattern(
       parameters.highImpactPatterns,
     );
-
-    const { level, ambiguous, levels } = operativeLevel(prompt);
-    const signal = realHighImpactSignal(prompt, highImpactPattern);
-
-    if (ambiguous) {
-      denyAmbiguousLevel(levels);
-    }
-
-    if (!level) {
-      denyNoLevelDeclared(prompt.trim());
-    }
-
-    if (signal && level !== 'HIGH-RISK') {
-      denyLevelContradictsSignal(level, signal);
+    if (
+      level !== LEVELS.HIGH_RISK &&
+      hasRealSensitiveMutation(prompt, highImpactPattern)
+    ) {
+      denyLevelContradictsSignal(
+        level,
+        firstSignalText(prompt, highImpactPattern),
+      );
     }
   },
 );