@devrik-tools/claude-gates 0.7.2 → 0.8.0

package/plugins/gates/hooks/gates/atomic-commit/index.mjs

@@ -1,51 +1,38 @@
-// atomic-commit — denies a `git commit` that is not atomic: one that mixes too many distinct
-// NATURES of change (code + tests + deps + config in one shot) or stages more reviewable files
-// than a commit should carry. It never commits or groups for you (that is a tool, not a gate,
-// and the user already has guard-autocommit for it); it only OBJECTS when the staged set is not
-// a cohesive, reviewable unit, so the split happens before the commit lands.
-//
-// justification: no existing gate covers this. lint-commit/staged-lint run the linter on a
-// commit; no-coauthor reads the message; none look at the SHAPE of the staged set. This is the
-// first gate that judges whether a commit is atomic.
-//
-// ── How it decides (deterministic) ───────────────────────────────────────────────────
-// On a real `git commit`, it lists the staged files and classifies each by nature (deps,
-// generated, assets, docs, config, types, tests, tooling, or code). Docs/assets/generated do
-// NOT count toward the size or the mix — they are legitimately committed alongside anything and
-// are not reviewed line by line (same rule guard-autocommit uses). Among the files that DO
-// count, it blocks when either:
-//   · the number of distinct counted natures exceeds `maxNatures` (default 2 — e.g. code+tests
-//     is fine, but code+tests+deps+config in one commit is not atomic), or
-//   · the number of counted files exceeds `maxFiles` (default 12) — too large to review.
-// A commit that is already scoped (`--amend`, a merge, or the escape hatch) is left alone.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   maxFiles     max counted files in one commit. Default 12.
-//   maxNatures   max distinct counted natures in one commit. Default 2.
-//   escapeHatch  substring in the command that allows one deliberately broad commit.
-//                Default '[wip]'.
-//   natures      the classification table (name + regex source + counts flag). Replaces the
-//                built-in list wholesale.
-//
-// ── Fail-safe shape ──────────────────────────────────────────────────────────────────
-// Not a commit, an --amend, or nothing staged: allow (silent). git not queryable: allow (the
-// gate cannot judge and must not block a legitimate commit on a git error). Otherwise: deny
-// with the offending mix/size and how to split.
-
-import { spawnSync } from 'node:child_process';
-import { runGate, deny, toolInGroups } from '../../lib/hook-io.mjs';
+// atomic-commit — denies a `git commit` that is not atomic: one mixing more distinct NATURES
+// of change (code + tests + deps + config) than `maxNatures`, or carrying more reviewable
+// files than `maxFiles`. It judges what the commit WILL contain (the staged set, plus what a
+// `git add …` in the same command line or `-a` stages, plus staged deletions); docs, assets
+// and generated files count toward neither. An `--amend` reshapes an existing commit and is
+// left alone, as is a `--dry-run`. Only a command segment that RUNS git commit counts. git
+// not queryable: allow — the gate cannot judge and must not block on a git error.
+
+import { projectRootOf } from '../../lib/config.mjs';
+import {
+  effectiveCommitFiles,
+  isAmendCommit,
+  isDryRunCommit,
+  isGitCommit,
+  normalizeGitCommand,
+  stagedFiles,
+} from '../../lib/git.mjs';
+import {
+  compileRegex,
+  deny,
+  runGate,
+  shellCommandOf,
+  toolInGroups,
+} from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'atomic-commit';
 const CONFIG_KEY = 'blockNonAtomicCommits';
 
-const SHELL_GROUPS = ['shell'];
 const DEFAULT_MAX_FILES = 12;
 const DEFAULT_MAX_NATURES = 2;
 const DEFAULT_ESCAPE_HATCH = '[wip]';
 
-// Nature table, evaluated in order (first match wins), mirroring guard-autocommit's catalog so
-// a project that uses both sees the same grouping. `counts:false` = committed alongside anything
-// and not counted toward size/mix (docs, assets, generated artifacts).
+// First match wins. `counts:false` = committed alongside anything, never reviewed line by
+// line. A `hooks/` or `models/` folder is application code (React hooks, MVC models), not
+// tooling or types: types are `*.d.ts` and `types/` folders only.
 const DEFAULT_NATURES = [
   {
     name: 'deps',
@@ -74,7 +61,7 @@ const DEFAULT_NATURES = [
   },
   {
     name: 'types',
-    source: String.raw`(^|/)(types?|interfaces?|models?|schemas?)/|\.d\.ts$`,
+    source: String.raw`(^|/)types?/|\.d\.ts$`,
     counts: true,
   },
   {
@@ -84,84 +71,66 @@ const DEFAULT_NATURES = [
   },
   {
     name: 'tooling',
-    source: String.raw`(^|/)(scripts|hooks|\.ai|\.claude|\.github)/`,
+    source: String.raw`(^|/)(scripts|\.ai|\.claude|\.github)/`,
     counts: true,
   },
 ];
 const DEFAULT_NATURE = { name: 'code', counts: true };
 
-// git-global-option normalization, shared with the other commit gates.
-const GIT_OPTION_WITH_VALUE = String.raw`(?:-[Cc]|--git-dir|--work-tree|--namespace|--exec-path|--config-env)(?:\s+|=)\S+`;
-const GIT_FLAG_OPTION = String.raw`--(?:paginate|no-pager|bare|no-optional-locks)|-p`;
-const GIT_GLOBAL_OPTION_PATTERN = new RegExp(
-  String.raw`\bgit\s+(?:${GIT_OPTION_WITH_VALUE}|${GIT_FLAG_OPTION})\s+`,
-  'i',
-);
-const GIT_COMMIT_PATTERN = /\bgit\s+commit\b/i;
-// An --amend or a merge commit is a deliberate, already-scoped operation — not this gate's.
-const EXEMPT_COMMIT_PATTERN = /--amend\b|\bgit\s+merge\b/i;
-
-function normalizeGitOptions(command) {
-  let previous;
-  let normalized = command;
-  do {
-    previous = normalized;
-    normalized = normalized.replace(GIT_GLOBAL_OPTION_PATTERN, 'git ');
-  } while (normalized !== previous);
-  return normalized;
-}
-
-function isPlainCommit(command) {
-  const normalized = normalizeGitOptions(command);
-  return (
-    GIT_COMMIT_PATTERN.test(normalized) &&
-    !EXEMPT_COMMIT_PATTERN.test(normalized)
-  );
-}
-
-function commandTextFrom(toolInput) {
-  return String(toolInput.CommandLine ?? toolInput.command ?? '');
+// ── The commit segment ──────────────────────────────────────────────────────────────
+const SEGMENT_SEPARATOR = /;|&&|\|\||\||\n/;
+const ARGUMENT_PATTERN = /"([^"]*)"|'([^']*)'|(\S+)/g;
+const GIT_BINARY_TOKEN = /(?:^|[\\/])git(?:\.exe)?$/i;
+const WRAPPER_TOKEN = /^(?:\w+=\S*|command|sudo|env)$/i;
+
+function runsGit(segment) {
+  const tokens = [];
+  for (const match of segment.matchAll(ARGUMENT_PATTERN))
+    tokens.push(match[1] ?? match[2] ?? match[3]);
+  while (tokens.length > 0 && WRAPPER_TOKEN.test(tokens[0])) tokens.shift();
+  return tokens.length > 0 && GIT_BINARY_TOKEN.test(tokens[0]);
 }
 
-/** The staged files (added/copied/modified/renamed), or [] when git cannot be queried. */
-function stagedFiles(cwd) {
-  const result = spawnSync(
-    'git',
-    ['diff', '--cached', '--name-only', '--diff-filter=ACMR'],
-    { cwd, encoding: 'utf8' },
-  );
-  if (result.status !== 0 || !result.stdout) return [];
-  return result.stdout
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0)
-    .map((line) => line.replace(/\\/g, '/'));
+function runsJudgedCommit(command) {
+  return String(command)
+    .split(SEGMENT_SEPARATOR)
+    .some((segment) => {
+      if (!runsGit(segment)) return false;
+      const normalized = normalizeGitCommand(segment);
+      return (
+        isGitCommit(normalized) &&
+        !isDryRunCommit(normalized) &&
+        !isAmendCommit(normalized)
+      );
+    });
 }
 
+// ── Natures ─────────────────────────────────────────────────────────────────────────
 function compileNatures(natures) {
-  return natures.map((nature) => ({
-    name: nature.name,
-    counts: nature.counts !== false,
-    pattern: (() => {
-      try {
-        return new RegExp(nature.source, 'i');
-      } catch {
-        return null;
-      }
-    })(),
-  }));
+  const compiled = [];
+  for (const nature of natures) {
+    if (!nature || typeof nature !== 'object') continue;
+    if (typeof nature.name !== 'string' || typeof nature.source !== 'string')
+      continue;
+    const pattern = compileRegex(nature.source);
+    if (!pattern) continue;
+    compiled.push({
+      name: nature.name,
+      counts: nature.counts !== false,
+      pattern,
+    });
+  }
+  return compiled;
 }
 
 function natureOf(filePath, compiledNatures) {
-  for (const nature of compiledNatures) {
-    if (nature.pattern && nature.pattern.test(filePath)) return nature;
-  }
-  return DEFAULT_NATURE;
+  return (
+    compiledNatures.find((nature) => nature.pattern.test(filePath)) ??
+    DEFAULT_NATURE
+  );
 }
 
-/** Classifies the staged files: the counted (reviewable) ones and the distinct natures among
- * them. Docs/assets/generated (counts:false) are excluded from both. */
-function classifyStaged(files, compiledNatures) {
+function classify(files, compiledNatures) {
   const counted = [];
   const countedNatures = new Set();
   for (const file of files) {
@@ -173,6 +142,13 @@ function classifyStaged(files, compiledNatures) {
   return { counted, countedNatures };
 }
 
+function commitFiles(root, command) {
+  const files = effectiveCommitFiles(root, command);
+  if (files === null) return null;
+  const deletions = stagedFiles(root, { filter: 'D' }) ?? [];
+  return [...new Set([...files, ...deletions])];
+}
+
 runGate(
   {
     id: GATE_ID,
@@ -185,26 +161,23 @@ runGate(
       natures: DEFAULT_NATURES,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    if (!toolInGroups(toolName, SHELL_GROUPS)) return;
+  ({ toolName, toolInput, parameters, cwd }) => {
+    if (!toolInGroups(toolName, ['shell'])) return;
 
-    const command = commandTextFrom(toolInput);
-    if (!isPlainCommit(command)) return;
+    const command = shellCommandOf(toolInput);
+    if (!runsJudgedCommit(command)) return;
 
-    const escapeHatch = parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH;
+    const escapeHatch = String(parameters.escapeHatch ?? '');
     if (escapeHatch && command.includes(escapeHatch)) return;
 
-    const cwd = process.cwd();
-    const files = stagedFiles(cwd);
-    if (files.length === 0) return; // nothing staged (or git unqueryable): nothing to judge
+    const files = commitFiles(projectRootOf(cwd) ?? cwd, command);
+    if (!files || files.length === 0) return;
 
-    const compiledNatures = compileNatures(
-      parameters.natures ?? DEFAULT_NATURES,
+    const { counted, countedNatures } = classify(
+      files,
+      compileNatures(parameters.natures),
     );
-    const { counted, countedNatures } = classifyStaged(files, compiledNatures);
-
-    const maxFiles = parameters.maxFiles ?? DEFAULT_MAX_FILES;
-    const maxNatures = parameters.maxNatures ?? DEFAULT_MAX_NATURES;
+    const { maxFiles, maxNatures } = parameters;
 
     if (countedNatures.size > maxNatures) {
       deny(
@@ -220,7 +193,7 @@ runGate(
     if (counted.length > maxFiles) {
       deny(
         CONFIG_KEY,
-        `This commit stages ${counted.length} reviewable files (max ${maxFiles}) — too large ` +
+        `This commit carries ${counted.length} reviewable files (max ${maxFiles}) — too large ` +
           `to review as one unit. Split it into smaller, cohesive commits (docs/assets/` +
           `generated files are not counted). Add "${escapeHatch}" for one deliberately broad commit.`,
       );

package/plugins/gates/hooks/gates/audit-before-build/index.mjs

@@ -1,5 +1,24 @@
+// audit-before-build — creating a new executable tool (a file under a tool folder, or a
+// delegation asking to build one) must state that existing tools were audited. Editing an
+// existing file is never a build; the exemption is what lets the gates maintain themselves.
+
 import { existsSync } from 'node:fs';
-import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+import { isAbsolute, join } from 'node:path';
+import { projectRootOf } from '../../lib/config.mjs';
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  writtenPathOf,
+  writtenContentOf,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+import { isBuildIntent } from '../../lib/signals.mjs';
+import {
+  AUDIT_DONE_PATTERN,
+  hasAuditEvidence,
+  isToolPath,
+} from '../../lib/tools.mjs';
 
 const GATE_ID = 'audit-before-build';
 const CONFIG_KEY = 'requireAuditBeforeBuilding';
@@ -13,87 +32,103 @@ const DEFAULT_EXECUTABLE_EXTENSIONS = [
   '.sh',
   '.ps1',
 ];
-const DEFAULT_TOOL_FOLDERS = ['scripts/', 'hooks/', 'tools/'];
+const DEFAULT_TOOL_FOLDERS = ['scripts', 'hooks', 'tools'];
+// Vendored or VCS-internal trees are never the project's own new tool.
+const FOREIGN_SEGMENTS = new Set(['.git', 'node_modules']);
+const AUDIT_EXAMPLE_PHRASE = 'no existing tool covers this';
 
-// A verb ("create", "escribir", ...) followed within 60 non-period characters by a tool noun
-// ("script", "gate", ...) signals intent to build a new tool. Split into two smaller patterns
-// (checked one after the other, within a bounded window) instead of one combined alternation:
-// the single-regex form crossed sonarjs's regex-complexity budget, and this reads easier too.
-const NEW_TOOL_VERB_PATTERN =
-  /\b(?:create|write|build|add|cre[aá]r?|escrib(?:e|ir|í)|constru(?:ye|ir)|agreg[aá]r?)\b/giu;
-const NEW_TOOL_NOUN_PATTERN =
-  /\b(?:script|verifier|checker|gate|hook|linter|tool|verificador|chequeador|herramienta)\b/iu;
-const NEW_TOOL_NOUN_WINDOW = 60;
+// "the build script" is a noun phrase, and "add tests for the gate" builds a test, not a
+// gate; both would otherwise read as creation verb + tool noun.
+const BUILD_AS_NOUN_PATTERN =
+  /\b(?:the|a|an|this|that|our|your|my|el|la|un|una|este|esta)\s+build\b/giu;
+const CREATION_VERBS = [
+  'write',
+  'create',
+  'build',
+  'implement',
+  'add',
+  'make',
+  'escribe',
+  'escribi',
+  'escribir',
+  'crea',
+  'construye',
+  'construir',
+  'implementa',
+  'implementar',
+  'agrega',
+  'arma',
+  'hace',
+  'genera',
+  'generar',
+  'armá',
+  'hacé',
+  'creá',
+  'agregá',
+  'generá',
+  'escribí',
+  'construí',
+];
+const OBJECT_QUALIFIERS =
+  'a|the|some|new|more|unos|unas|los|las|más|nuevos|nuevas';
+const TEST_OBJECT_NOUNS = 'tests?|specs?|pruebas?';
+const TEST_OBJECT_PATTERN = new RegExp(
+  String.raw`\b(?:${CREATION_VERBS.join('|')})\s+(?:(?:${OBJECT_QUALIFIERS})\s+){0,2}(?:${TEST_OBJECT_NOUNS})\b`,
+  'giu',
+);
 
-function hasNewToolIntent(text) {
-  NEW_TOOL_VERB_PATTERN.lastIndex = 0;
-  let match;
-  while ((match = NEW_TOOL_VERB_PATTERN.exec(text)) !== null) {
-    const afterVerb = match.index + match[0].length;
-    let window = text.slice(afterVerb, afterVerb + NEW_TOOL_NOUN_WINDOW);
-    const dotIndex = window.indexOf('.');
-    if (dotIndex !== -1) window = window.slice(0, dotIndex);
-    if (NEW_TOOL_NOUN_PATTERN.test(window)) return true;
-    if (match.index === NEW_TOOL_VERB_PATTERN.lastIndex)
-      NEW_TOOL_VERB_PATTERN.lastIndex += 1;
-  }
-  return false;
+function hasNewToolIntent(prompt) {
+  const masked = prompt
+    .replace(BUILD_AS_NOUN_PATTERN, 'it')
+    .replace(TEST_OBJECT_PATTERN, 'tests');
+  return isBuildIntent(masked);
 }
 
-const AUDIT_EVIDENCE_PATTERN =
-  /already exists|no existing tool|no plugin|audited and|justification:|no existe una herramienta|no existe la herramienta|no hay plugin|ya existe|busque? si ya existe|verifiqu[eé] que no (hay|existe)|audit[eé] herramientas|justificacion:|justificaci[oó]n:/i;
-
-const INLINE_JUSTIFICATION_PATTERN =
-  /justification:|no-reinvent|audit:|justificacion:|justificaci[oó]n:/i;
-
 function checkDelegation(toolInput) {
-  const prompt = toolInput?.prompt;
-  if (typeof prompt !== 'string') return;
+  const prompt = delegationPromptOf(toolInput);
   if (!hasNewToolIntent(prompt)) return;
-  if (AUDIT_EVIDENCE_PATTERN.test(prompt)) return;
+  if (hasAuditEvidence(prompt)) return;
 
   deny(
     CONFIG_KEY,
     'Blocked: this delegation prompt asks to create a new script/checker/gate/hook/linter/' +
       'tool, and nothing in the prompt shows a prior audit. No filesystem exploration is ' +
-      'needed to fix this — add ONE phrase to the prompt matching ' +
-      `/${AUDIT_EVIDENCE_PATTERN.source}/i, e.g.: "audited and no existing tool covers this" ` +
-      '(this exact phrase is guaranteed to match). Then relaunch the same delegation.',
+      `needed to fix this — add ONE phrase to the prompt such as "${AUDIT_EXAMPLE_PHRASE}" ` +
+      `(any phrase matching /${AUDIT_DONE_PATTERN.source}/iu works). Then relaunch the same delegation.`,
   );
 }
 
-function isNewToolFile(filePath, parameters) {
-  if (!filePath) return false;
-  const inToolFolder = parameters.toolFolders.some((folder) =>
-    filePath.includes(folder),
-  );
-  if (!inToolFolder) return false;
-  return parameters.executableExtensions.some((extension) =>
-    filePath.endsWith(extension),
-  );
+function stripTrailingSlash(folder) {
+  let name = String(folder);
+  while (name.endsWith('/') || name.endsWith('\\')) name = name.slice(0, -1);
+  return name;
 }
 
-function checkWrite(toolInput, parameters) {
-  const rawPath = toolInput?.file_path ?? '';
-  const filePath = rawPath.replace(/\\/g, '/');
-  if (!isNewToolFile(filePath, parameters)) return;
-
-  // Editing an EXISTING file is not building a new tool — only creation needs the audit.
-  // A file already on disk (any tool that carries file_path) is an edit, so it is allowed.
-  // This is what makes maintaining the gates themselves possible with the gates active.
-  if (rawPath && existsSync(rawPath)) return;
+function isForeignPath(filePath) {
+  return filePath
+    .split('/')
+    .some((segment) => FOREIGN_SEGMENTS.has(segment.toLowerCase()));
+}
 
-  const content = toolInput?.content ?? toolInput?.new_string;
-  if (typeof content !== 'string') return;
-  if (INLINE_JUSTIFICATION_PATTERN.test(content)) return;
+function checkWrite(toolInput, parameters, root) {
+  const rawPath = writtenPathOf(toolInput);
+  const filePath = rawPath.replace(/\\/g, '/');
+  if (!filePath || isForeignPath(filePath)) return;
+  const isTool = isToolPath(filePath, {
+    folders: parameters.toolFolders.map(stripTrailingSlash),
+    extensions: parameters.executableExtensions,
+    namePatterns: [],
+  });
+  if (!isTool) return;
+  if (existsSync(isAbsolute(rawPath) ? rawPath : join(root, rawPath))) return;
+  if (hasAuditEvidence(writtenContentOf(toolInput))) return;
 
   deny(
     CONFIG_KEY,
-    `Blocked: '${filePath}' is a new executable tool with no justification comment in its ` +
-      'content. No filesystem exploration is needed to fix this — add ONE line to the ' +
-      `file's content matching /${INLINE_JUSTIFICATION_PATTERN.source}/i, e.g.: ` +
-      '"// justification: no existing tool covers this" (this exact phrase is guaranteed ' +
-      'to match). Then retry the exact same write.',
+    `Blocked: '${filePath}' is a new executable tool with no audit statement in its ` +
+      'content. No filesystem exploration is needed to fix this — add ONE comment line ' +
+      `such as "// justification: ${AUDIT_EXAMPLE_PHRASE}" (any phrase matching ` +
+      `/${AUDIT_DONE_PATTERN.source}/iu works). Then retry the exact same write.`,
   );
 }
 
@@ -107,12 +142,12 @@ runGate(
       toolFolders: DEFAULT_TOOL_FOLDERS,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    if (TOOL_GROUPS.delegation.includes(toolName)) {
+  ({ toolName, toolInput, parameters, cwd }) => {
+    if (toolInGroups(toolName, ['delegation'])) {
       checkDelegation(toolInput);
       return;
     }
-    if (!TOOL_GROUPS.write.includes(toolName)) return;
-    checkWrite(toolInput, parameters);
+    if (!toolInGroups(toolName, ['write'])) return;
+    checkWrite(toolInput, parameters, projectRootOf(cwd) ?? cwd);
   },
 );

package/plugins/gates/hooks/gates/autonomous-mode/index.mjs

@@ -28,14 +28,14 @@ const CONFIG_KEY = 'autonomousMode';
 const QUESTION_GROUPS = ['question'];
 
 const DENY_MESSAGE =
-  'Autonomous mode is ON for this project: do not ask the user, decide instead. The question ' +
-  'popup was intercepted and never shown. Now, in your VISIBLE reply, leave a one-line trace ' +
-  'so the user sees what was suppressed and what you chose — e.g. "[autonomous] I was going ' +
-  'to ask <the question>; I decided <choice>, assuming <reversible assumption>." Then take ' +
-  'that best, goal-aligned decision and proceed. Only a genuinely irreversible or dangerous ' +
-  'choice (deleting data, money, production) justifies stopping — and then stop in prose ' +
-  'saying exactly what and why, do not reach for the popup again. To let questions through, ' +
-  'set "autonomousMode": false in .ai/config.json.';
+  'Autonomous mode is ON. Do not ask the user. Decide and proceed. ' +
+  'Use this order: existing project decisions > existing patterns > requirements > project goals > your judgment. ' +
+  'Keep decisions consistent with the project. Do not invent new patterns or technologies unless needed. ' +
+  'When several choices work, pick the one best for the project. Make reasonable reversible assumptions instead of asking. ' +
+  'In your visible reply, leave one line: "[autonomous] I was going to ask <question>; I chose <decision>, assuming <assumption>." ' +
+  'Only stop for genuinely irreversible or dangerous actions (data deletion, money, destructive production changes). ' +
+  'If stopping, explain what and why. Never ask the popup again. ' +
+  'To enable questions, set "autonomousMode": false in .ai/config.json.';
 
 runGate(
   {

package/plugins/gates/hooks/gates/autonomous-mode/stop.mjs

@@ -1,37 +1,17 @@
-// autonomous-mode (Stop half) — closes the hole its PreToolUse half cannot reach. The
-// PreToolUse gate (index.mjs) blocks the AskUserQuestion TOOL, but nothing stops the
-// assistant from ending its turn with a question in plain PROSE — and when it does, the
-// session just sits there waiting for a human who is supposed to be away. No hook can read
-// chat text to detect that a turn ended on a question. So this Stop hook takes the only
-// deterministic lever available: when autonomous mode is ON and the turn is ending, it
-// re-injects an instruction to NOT wait — decide, delegate, and keep going on everything
-// that does not strictly require the user's own explicit decision.
-//
-// ── What the re-injected message says (per the user's own framing) ───────────────────
-// In autonomous mode work is delegated to the assistant. It must only leave pending the ONE
-// thing that genuinely needs the user's exclusive, explicit decision (irreversible/dangerous
-// — deleting data, money, production). Everything else: proceed. If there are OTHER tasks it
-// can advance, advance them; isolate only the truly blocking one and state it in prose, then
-// stop. It must not end the turn on a prose question just to wait.
-//
-// ── stop_hook_active loop-guard (mandatory) ──────────────────────────────────────────
-// Claude Code re-invokes Stop hooks with stop_hook_active=true after a block. Blocking again
-// would loop forever. So when stop_hook_active === true this hook unconditionally allows the
-// stop: the reminder is injected exactly once per cycle. After that one nudge, if the
-// assistant still ends the turn, it genuinely had nothing to proceed on (or a real blocker),
-// and the session must be allowed to end — a frozen session is worse than one missed nudge.
-//
-// ── Fail-safe (mandatory for a Stop hook) ────────────────────────────────────────────
-// Everything is wrapped so that no config, no project, a corrupt payload, or any unexpected
-// error allows the stop. A broken Stop hook must never hang a session.
+// autonomous-mode (Stop half) — the PreToolUse gate blocks the question TOOL, but nothing
+// stops the assistant from ending its turn on a question in plain prose, leaving the
+// session waiting for a human who is away. No hook can read chat text, so this Stop hook
+// re-injects, once per cycle, the instruction to decide and keep going. The loop guard
+// (stop_hook_active) and fail-open shape come from runStopHook: after one nudge, a real
+// end of turn goes through.
 
-import { isGateEnabled } from '../../lib/config.mjs';
-import { readHookPayload } from '../../lib/hook-io.mjs';
+import { block, runStopHook } from '../../lib/hook-io.mjs';
 
+const GATE_ID = 'autonomous-mode';
 const CONFIG_KEY = 'autonomousMode';
 
 const CONTINUE_MESSAGE =
-  '[autonomous] Autonomous mode is ON — do not end the turn to wait for the user. Work here ' +
+  'Autonomous mode is ON — do not end the turn to wait for the user. Work here ' +
   'is delegated to you. Leave PENDING only the one thing that genuinely needs the user’s own ' +
   'explicit, exclusive decision (a truly irreversible or dangerous choice: deleting data, ' +
   'money, production). For everything else: decide the best goal-aligned option, state the ' +
@@ -41,38 +21,7 @@ const CONTINUE_MESSAGE =
   'If you have truly nothing left to do and nothing needs the user, ending is fine — this ' +
   'reminder fires once, so a real end will go through on the next stop.';
 
-function block(reason) {
-  process.stdout.write(JSON.stringify({ decision: 'block', reason }));
-  process.exit(0);
-}
-
-function allow() {
-  process.exit(0);
-}
-
-function main() {
-  try {
-    const rawPayload = readHookPayload();
-    if (rawPayload === null) return allow();
-
-    let payload;
-    try {
-      payload = JSON.parse(rawPayload);
-    } catch {
-      return allow(); // unparseable Stop payload: fail-safe, never hang the session
-    }
-
-    // Loop-guard: this hook already nudged once this cycle. Never block again.
-    if (payload?.stop_hook_active === true) return allow();
-
-    // Only act when the project turned autonomous mode ON. Off by default (registry).
-    if (!isGateEnabled(CONFIG_KEY, false, process.cwd())) return allow();
-
-    return block(CONTINUE_MESSAGE);
-  } catch {
-    // A broken Stop hook must never hang a session.
-    return allow();
-  }
-}
-
-main();
+runStopHook(
+  { id: GATE_ID, configKey: CONFIG_KEY, enabledByDefault: false },
+  () => block(CONFIG_KEY, CONTINUE_MESSAGE),
+);