@devrik-tools/claude-gates 0.7.2 → 0.8.0

package/cli/smoke-fixtures.json

@@ -8,7 +8,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git reset --hard HEAD~3" }
+        "tool_input": {
+          "command": "git reset --hard HEAD~3"
+        }
       },
       "needsState": false
     },
@@ -19,7 +21,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git push origin main" }
+        "tool_input": {
+          "command": "git push origin main"
+        }
       },
       "needsState": false
     },
@@ -30,7 +34,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Write",
-        "tool_input": { "file_path": "/repo/.env" }
+        "tool_input": {
+          "file_path": "/repo/.env"
+        }
       },
       "needsState": false
     },
@@ -41,7 +47,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Write",
-        "tool_input": { "file_path": "random-orphan.txt" }
+        "tool_input": {
+          "file_path": "random-orphan.txt"
+        }
       },
       "needsState": true,
       "note": "file_path must resolve against the scratch project root; a literal alone does not reproduce root detection."
@@ -53,7 +61,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "sleep 30" }
+        "tool_input": {
+          "command": "sleep 30"
+        }
       },
       "needsState": false
     },
@@ -64,7 +74,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "Fix the login bug please, thanks." }
+        "tool_input": {
+          "prompt": "Fix the login bug please, thanks."
+        }
       },
       "needsState": false
     },
@@ -101,7 +113,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "fix the scoring threshold" }
+        "tool_input": {
+          "prompt": "fix the scoring threshold"
+        }
       },
       "needsState": true,
       "note": "stateful: denies only on the 3rd identical retry under the same session id."
@@ -114,7 +128,7 @@
       "payload": {
         "tool_name": "Agent",
         "tool_input": {
-          "prompt": "Acordate de lo que hablamos antes y aplica el mismo criterio."
+          "prompt": "Como te dije antes, aplica el mismo criterio al nuevo archivo."
         }
       },
       "needsState": false
@@ -124,7 +138,12 @@
       "configKey": "warnSequentialDelegations",
       "enabledByDefault": false,
       "type": "warn",
-      "payload": { "tool_name": "Task", "tool_input": { "prompt": "do work" } },
+      "payload": {
+        "tool_name": "Task",
+        "tool_input": {
+          "prompt": "do work"
+        }
+      },
       "needsState": true,
       "note": "stateful: warns only on the 3rd consecutive delegation under one session."
     },
@@ -178,7 +197,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "Nivel: STANDARD\nImplementa el checkout." }
+        "tool_input": {
+          "prompt": "Nivel: STANDARD\nImplementa el checkout."
+        }
       },
       "needsState": false
     },
@@ -189,7 +210,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "Nivel: STANDARD\nImplementa el checkout." }
+        "tool_input": {
+          "prompt": "Nivel: STANDARD\nImplementa el checkout."
+        }
       },
       "needsState": false
     },
@@ -242,7 +265,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "create a new script that checks X" }
+        "tool_input": {
+          "prompt": "create a new script that checks X"
+        }
       },
       "needsState": false
     },
@@ -267,7 +292,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "echo hi" }
+        "tool_input": {
+          "command": "echo hi"
+        }
       },
       "needsState": true,
       "note": "needs a project rules/ or .claude/skills gate script present that exits non-zero."
@@ -279,7 +306,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "echo hi" }
+        "tool_input": {
+          "command": "echo hi"
+        }
       },
       "needsState": true,
       "note": "needs .ai/reincidencias.json with an open class at/above threshold."
@@ -307,7 +336,11 @@
       "payload": {
         "tool_name": "AskUserQuestion",
         "tool_input": {
-          "questions": [{ "question": "Should I migrate the auth schema?" }]
+          "questions": [
+            {
+              "question": "Should I migrate the auth schema?"
+            }
+          ]
         }
       },
       "needsState": true,
@@ -334,10 +367,11 @@
       "enabledByDefault": true,
       "type": "warn",
       "payload": {
-        "tool_name": "Write",
+        "tool_name": "Edit",
         "tool_input": {
           "file_path": "/repo/src/config.js",
-          "content": "const REQUEST_TIMEOUT_MS = 30000;"
+          "old_string": "const REQUEST_TIMEOUT_MS = 30000;",
+          "new_string": "const REQUEST_TIMEOUT_MS = 60000;"
         }
       },
       "needsState": false
@@ -349,7 +383,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git commit -m x" }
+        "tool_input": {
+          "command": "git commit -m x"
+        }
       },
       "needsState": true,
       "note": "needs a project package.json whose lint script exits non-zero."
@@ -384,7 +420,10 @@
       "type": "deny",
       "payload": {
         "tool_name": "Write",
-        "tool_input": { "file_path": "src/x.js", "content": "x" }
+        "tool_input": {
+          "file_path": "src/x.js",
+          "content": "x"
+        }
       },
       "needsState": true,
       "note": "needs a forge adoption marker + sqlite db with no active run."
@@ -396,7 +435,13 @@
       "type": "deny",
       "payload": {
         "tool_name": "AskUserQuestion",
-        "tool_input": { "questions": [{ "question": "A or B?" }] }
+        "tool_input": {
+          "questions": [
+            {
+              "question": "A or B?"
+            }
+          ]
+        }
       },
       "needsState": false
     },
@@ -434,7 +479,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git commit -m \"wip\"" }
+        "tool_input": {
+          "command": "git commit -m \"wip\""
+        }
       },
       "needsState": true,
       "note": "needs a git repo with a staged lintable file that fails lint and a resolvable linter; a bare payload cannot reproduce the staged-file scan."
@@ -446,10 +493,55 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git commit -m \"stuff\"" }
+        "tool_input": {
+          "command": "git commit -m \"stuff\""
+        }
       },
       "needsState": true,
       "note": "needs a git repo with a staged set that mixes >maxNatures natures or exceeds maxFiles; a bare payload cannot reproduce the staged-file scan."
+    },
+    {
+      "id": "engram-first",
+      "configKey": "requireEngramBeforeResearch",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "WebSearch",
+        "tool_input": {
+          "query": "how to use zod refine"
+        },
+        "session_id": "smoke-engram-first"
+      },
+      "needsState": false
+    },
+    {
+      "id": "library-docs",
+      "configKey": "requireDocsBeforeUsingNewLibrary",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Write",
+        "tool_input": {
+          "file_path": "src/schema.ts",
+          "content": "import { z } from 'zod';\n"
+        },
+        "session_id": "smoke-library-docs"
+      },
+      "needsState": false
+    },
+    {
+      "id": "no-explanatory-comments",
+      "configKey": "blockExplanatoryComments",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Write",
+        "tool_input": {
+          "file_path": "src/a.mjs",
+          "content": "// reads the config and returns it\nexport const x = 1;\n"
+        }
+      },
+      "needsState": false
     }
   ]
 }

package/cli/task.mjs

@@ -12,6 +12,7 @@ import {
   STATUS,
 } from '../plugins/tasks/hooks/lib/task-store.mjs';
 import { EXIT_CODE } from './constants.mjs';
+import { verifyCommand, verifyPath } from './evidence.mjs';
 
 const DEFAULT_SIZE = 'unspecified';
 
@@ -64,19 +65,36 @@ function reportCloseResult(result) {
   process.stdout.write(`${JSON.stringify(result.task, null, 2)}\n`);
 }
 
+const EVIDENCE_USAGE =
+  'closing a task as done requires verified evidence: --check "<command>" ' +
+  '[--expect <text>] (the command must exit 0) or --exists <path> [--contains <text>]. ' +
+  'Free text (--evidence/--note) is only a note. Use `task abandon` if it will not be finished.';
+
+function collectEvidence(options, cwd) {
+  if (options.check) {
+    return verifyCommand(options.check, { cwd, expect: options.expect });
+  }
+  if (options.exists) {
+    return verifyPath(options.exists, { cwd, contains: options.contains });
+  }
+  return null;
+}
+
 function taskClose(id, options, { cwd = process.cwd() } = {}) {
-  if (!options.evidence || !options.evidence.trim()) {
+  const store = openStoreOrFail(cwd);
+  const evidence = collectEvidence(options, store.root);
+  if (!evidence) fail(EVIDENCE_USAGE);
+  if (!evidence.verified) {
+    const output = evidence.outputTail ? `\n${evidence.outputTail}` : '';
     fail(
-      'closing a task as done requires evidence that it was attended and resolved ' +
-        '(test output, a diff, a verification note). Pass --evidence, or use ' +
-        '`task abandon` if it will not be finished.',
+      `evidence did not verify (${evidence.failure}); the task stays open.${output}`,
     );
   }
-  const store = openStoreOrFail(cwd);
+  const note = options.note ?? options.evidence ?? '';
   reportCloseResult(
     store.close(id, STATUS.DONE, {
       reason: options.reason ?? '',
-      evidence: options.evidence,
+      evidence: note ? { ...evidence, note } : evidence,
     }),
   );
 }
@@ -117,10 +135,20 @@ export function registerTaskCommand(program) {
 
   task
     .command('close <id>')
-    .description('Close a task as done. Requires --evidence.')
+    .description(
+      'Close a task as done. Requires verified evidence: --check or --exists.',
+    )
+    .option(
+      '--check <command>',
+      'command that must exit 0 (run at the project root)',
+    )
+    .option('--expect <text>', 'text the --check output must contain')
+    .option('--exists <path>', 'file or directory that must exist')
+    .option('--contains <text>', 'text the --exists file must contain')
+    .option('--note <text>', 'free-text context stored with the evidence')
     .option(
       '--evidence <text>',
-      'proof the task was attended and resolved (required)',
+      'alias of --note (free text alone is not evidence)',
     )
     .option('--reason <text>', 'closing note')
     .action((id, options) => taskClose(id, options));

package/cli/toggle.mjs

@@ -0,0 +1,125 @@
+import { existsSync } from 'node:fs';
+import { readJsonOrNull } from '../plugins/gates/hooks/lib/config.mjs';
+import { SCOPES, configPathFor, readConfig, writeConfig } from './config.mjs';
+import { defaultParametersOf } from './materialize.mjs';
+import { allGates } from './registry.mjs';
+import { adoptionOf } from './selection.mjs';
+
+const ALL_TARGET = 'all';
+
+export function resolveTargets(registry, ids) {
+  const gates = allGates(registry);
+  const families = new Set(registry.families.map((family) => family.id));
+  const keys = new Set();
+  const unknown = [];
+  for (const id of ids) {
+    if (id === ALL_TARGET) {
+      for (const gate of gates) keys.add(gate.configKey);
+      continue;
+    }
+    if (families.has(id)) {
+      for (const gate of gates.filter((entry) => entry.family === id))
+        keys.add(gate.configKey);
+      continue;
+    }
+    const gate = gates.find(
+      (entry) => entry.id === id || entry.configKey === id,
+    );
+    if (gate) keys.add(gate.configKey);
+    else unknown.push(id);
+  }
+  if (unknown.length > 0)
+    throw new Error(
+      `Unknown gate, family or config key: ${unknown.join(', ')}. Run \`claude-gates registry --list\` to see the ids.`,
+    );
+  return [...keys];
+}
+
+export function enabledOf(entry, fallback) {
+  if (typeof entry === 'boolean') return entry;
+  if (entry && typeof entry === 'object')
+    return entry.enabled === undefined ? fallback : entry.enabled !== false;
+  return fallback;
+}
+
+function entryWithEnabled(gate, existing, enabled) {
+  if (existing && typeof existing === 'object') return { ...existing, enabled };
+  const hasParameters = Array.isArray(gate.params) && gate.params.length > 0;
+  if (!hasParameters) return enabled;
+  return { enabled, ...defaultParametersOf(gate) };
+}
+
+function adoptionFromGates(registry, gates) {
+  const map = {};
+  for (const gate of allGates(registry))
+    map[gate.configKey] = enabledOf(gates[gate.configKey], gate.default);
+  return adoptionOf(map);
+}
+
+export function toggleGates(path, registry, configKeys, enabled) {
+  const existing = readConfig(path);
+  if (existing.corrupt)
+    throw new Error(`${path} exists but is not valid JSON. Fix it first.`);
+  const gates = { ...(existing.data.gates ?? {}) };
+  const changed = [];
+  for (const gate of allGates(registry)) {
+    if (!configKeys.includes(gate.configKey)) continue;
+    const before = enabledOf(gates[gate.configKey], gate.default);
+    gates[gate.configKey] = entryWithEnabled(
+      gate,
+      gates[gate.configKey],
+      enabled,
+    );
+    if (before !== enabled) changed.push(gate.configKey);
+  }
+  const next = {
+    ...existing.data,
+    adopted: adoptionFromGates(registry, gates),
+    gateVersion: registry.gateVersion,
+    gates,
+  };
+  writeConfig(path, next);
+  return { path, changed, unchanged: configKeys.length - changed.length };
+}
+
+export function defaultScopeFor(cwd) {
+  if (existsSync(configPathFor(SCOPES.PROJECT, { cwd }))) return SCOPES.PROJECT;
+  if (existsSync(configPathFor(SCOPES.GLOBAL))) return SCOPES.GLOBAL;
+  return SCOPES.PROJECT;
+}
+
+function effectiveLayer(projectConfig, globalConfig) {
+  if (projectConfig)
+    return { name: SCOPES.PROJECT, gates: projectConfig.gates ?? {} };
+  if (globalConfig)
+    return { name: SCOPES.GLOBAL, gates: globalConfig.gates ?? {} };
+  return { name: 'default', gates: {} };
+}
+
+export function statusRows(registry, { cwd = process.cwd() } = {}) {
+  const projectPath = configPathFor(SCOPES.PROJECT, { cwd });
+  const globalPath = configPathFor(SCOPES.GLOBAL);
+  const projectConfig = readJsonOrNull(projectPath);
+  const globalConfig = readJsonOrNull(globalPath);
+  const layer = effectiveLayer(projectConfig, globalConfig);
+  return allGates(registry).map((gate) => {
+    const entry = layer.gates[gate.configKey];
+    const declared = entry !== undefined;
+    return {
+      id: gate.id,
+      configKey: gate.configKey,
+      family: gate.family,
+      enabled: enabledOf(entry, gate.default),
+      source: declared ? layer.name : 'default',
+    };
+  });
+}
+
+export function renderStatus(rows, layerLabel) {
+  const width = Math.max(...rows.map((row) => row.id.length));
+  const lines = rows.map(
+    (row) =>
+      `${row.enabled ? 'on ' : 'off'}  ${row.id.padEnd(width)}  ${row.configKey}  (${row.source})`,
+  );
+  return `${layerLabel}\n${lines.join('\n')}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devrik-tools/claude-gates",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
   "keywords": [
     "claude-code",

package/plugins/gates/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gates",
-  "version": "0.7.2",
+  "version": "0.8.0",
   "description": "Deterministic gates for Claude Code: destructive-command blocks, protected paths, delegation briefs, spec-driven flow and session-start validation. Selection lives in config, not in code.",
   "author": {
     "name": "Devrik"

package/plugins/gates/hooks/doctor.mjs

@@ -15,7 +15,7 @@
 // Fail-safe: every check is wrapped so a doctor bug never blocks a session from
 // starting — worst case it silently skips a check rather than throwing.
 
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -29,6 +29,14 @@ const HOOKS_DIRECTORY = dirname(fileURLToPath(import.meta.url));
 const REPOSITORY_ROOT = join(HOOKS_DIRECTORY, '..', '..', '..');
 const PACKAGE_JSON_PATH = join(REPOSITORY_ROOT, 'package.json');
 const REGISTRY_PATH = join(REPOSITORY_ROOT, 'registry.json');
+const PLUGIN_MANIFEST_PATH = join(
+  HOOKS_DIRECTORY,
+  '..',
+  '.claude-plugin',
+  'plugin.json',
+);
+const PLUGIN_CACHE = join(homedir(), '.claude', 'plugins', 'cache');
+const PLUGIN_NAME = 'gates';
 
 // Same config lookup as the other session hooks (see session-tasks.mjs / register-requests.mjs):
 // kept local and dependency-free so this plugin works standalone.
@@ -126,6 +134,41 @@ function minNodeVersionRequired(configuredMin) {
   return token ?? DEFAULT_MIN_NODE_VERSION;
 }
 
+function directoriesIn(path) {
+  try {
+    return readdirSync(path, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+
+/** A newer gates version sitting in Claude Code's plugin cache means this session runs a
+ * stale install (the marketplace still points at an old package path). */
+function staleInstallProblem() {
+  const running = readJson(PLUGIN_MANIFEST_PATH)?.version;
+  if (!parseVersion(running)) return null;
+  let newest = running;
+  let marketplace = null;
+  for (const marketplaceName of directoriesIn(PLUGIN_CACHE)) {
+    for (const version of directoriesIn(
+      join(PLUGIN_CACHE, marketplaceName, PLUGIN_NAME),
+    )) {
+      if (parseVersion(version) && !versionAtLeast(newest, version)) {
+        newest = version;
+        marketplace = marketplaceName;
+      }
+    }
+  }
+  if (newest === running) return null;
+  return (
+    `the gates plugin running in this session is ${running} but ${newest} is installed in the ` +
+    `plugin cache (${marketplace}). Run \`claude plugin update ${PLUGIN_NAME}@${marketplace}\` or ` +
+    '`claude-gates init --global --defaults --yes` from the newer package, then restart the session.'
+  );
+}
+
 function checkNodeVersion(minVersion) {
   if (versionAtLeast(process.version, minVersion)) return null;
   return (
@@ -184,6 +227,9 @@ function main() {
   const versionProblem = checkNodeVersion(minVersion);
   if (versionProblem) problems.push(versionProblem);
 
+  const staleInstall = staleInstallProblem();
+  if (staleInstall) problems.push(staleInstall);
+
   const missingScripts = missingFolderGateScripts();
   if (missingScripts.length > 0) {
     problems.push(