@devrik-tools/claude-gates 0.7.2 → 0.9.0

package/plugins/gates/hooks/gates/lint-commit/index.mjs

@@ -1,99 +1,85 @@
-// lint-commit — denies `git commit` while the project's lint script fails. The gate never
-// invents a lint step: it only runs a `lint` script the project itself declared in
-// package.json (or an explicit override), so a project with no linter configured is left
-// alone (allow, silent).
-//
-// justification: no existing tool covers this. bash-commands (the other shell gate) only
-// pattern-matches the command text; it never SPAWNS a check. This is the first gate that
-// runs an external process as its verdict.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   lintCommand     explicit command to run instead of autodetecting `npm run lint`.
-//                   null (default) means: read package.json's `scripts.lint`, and if
-//                   absent, allow — this gate does not invent a lint step.
-//   lintTimeoutMs   how long the lint run may take before it is treated as a failure.
-// The defaults live here, in the source, so a project reads them and knows exactly what
-// its override replaces.
-//
-// ── How it detects a commit ──────────────────────────────────────────────────────────
-// Reuses bash-commands' git-global-option normalization idea: `git -C <path> commit` or
-// `git -c user.name=x commit` must be caught the same as a bare `git commit`. Only a real
-// commit (not `git commit --help`, not a mention inside a delegation prompt describing one)
-// is gated — this runs on the shell tool only, not on delegation text, because spawning a
-// lint run for a prompt that merely MENTIONS a commit would be wasted work and a false
-// blocker on unrelated delegations.
-//
-// ── Why spawnSync + shell:true on Windows ────────────────────────────────────────────
-// `npm` is `npm.cmd` on Windows; resolving the concrete binary name per platform is more
-// fragile than letting the shell resolve it, so this always spawns through the shell.
-//
-// ── Fail-safe shape ───────────────────────────────────────────────────────────────────
-// No package.json, or package.json with no `scripts.lint` and no `lintCommand` override:
-// allow (nothing to enforce, never invented). Lint run exits non-zero: deny with the last
-// ~15 lines of its combined output. Lint run exits zero: allow.
+// lint-commit — denies a `git commit` while the project's lint script fails. It never invents
+// a lint step: only a `lint` script the project declared in package.json (or an explicit
+// lintCommand) runs, and only for a command segment that RUNS git commit (a `grep "git
+// commit"` is not one; a `--dry-run` writes nothing). The lint runs in the repo the commit
+// targets: `-C <path>` when given, else the project root of the cwd. Spawned through the
+// shell because `npm` is `npm.cmd` on Windows. A commit that cannot be evaluated (the lint
+// process fails to spawn) is denied: a commit gate must not silently permit.
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { runGate, deny, toolInGroups } from '../../lib/hook-io.mjs';
+import { join, resolve } from 'node:path';
+import { projectRootOf, readJsonOrNull } from '../../lib/config.mjs';
+import {
+  isDryRunCommit,
+  isGitCommit,
+  normalizeGitCommand,
+} from '../../lib/git.mjs';
+import {
+  deny,
+  runGate,
+  shellCommandOf,
+  toolInGroups,
+} from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'lint-commit';
 const CONFIG_KEY = 'blockCommitWithFailingLint';
 
-const SHELL_GROUPS = ['shell'];
 const DEFAULT_LINT_TIMEOUT_MS = 60000;
 const OUTPUT_TAIL_LINES = 15;
 
-// One global git option at a time, stripped repeatedly — same normalization bash-commands
-// uses so `git -C /repo -c x=y commit` reduces to `git commit` before the pattern runs.
-const GIT_OPTION_WITH_VALUE = String.raw`(?:-[Cc]|--git-dir|--work-tree|--namespace|--exec-path|--config-env)(?:\s+|=)\S+`;
-const GIT_FLAG_OPTION = String.raw`--(?:paginate|no-pager|bare|no-optional-locks)|-p`;
-const GIT_GLOBAL_OPTION_PATTERN = new RegExp(
-  String.raw`\bgit\s+(?:${GIT_OPTION_WITH_VALUE}|${GIT_FLAG_OPTION})\s+`,
-  'i',
-);
-const GIT_COMMIT_PATTERN = /\bgit\s+commit\b/i;
-
-function normalizeGitOptions(command) {
-  let previous;
-  let normalized = command;
-  do {
-    previous = normalized;
-    normalized = normalized.replace(GIT_GLOBAL_OPTION_PATTERN, 'git ');
-  } while (normalized !== previous);
-  return normalized;
+// ── The commit segment ──────────────────────────────────────────────────────────────
+const SEGMENT_SEPARATOR = /;|&&|\|\||\||\n/;
+const ARGUMENT_PATTERN = /"([^"]*)"|'([^']*)'|(\S+)/g;
+const GIT_BINARY_TOKEN = /(?:^|[\\/])git(?:\.exe)?$/i;
+const WRAPPER_TOKEN = /^(?:\w+=\S*|command|sudo|env)$/i;
+
+function tokensOf(text) {
+  const tokens = [];
+  for (const match of text.matchAll(ARGUMENT_PATTERN))
+    tokens.push(match[1] ?? match[2] ?? match[3]);
+  return tokens;
 }
 
-function isGitCommit(command) {
-  return GIT_COMMIT_PATTERN.test(normalizeGitOptions(command));
+function runsGit(segment) {
+  const tokens = tokensOf(segment);
+  while (tokens.length > 0 && WRAPPER_TOKEN.test(tokens[0])) tokens.shift();
+  return tokens.length > 0 && GIT_BINARY_TOKEN.test(tokens[0]);
 }
 
-function commandTextFrom(toolInput) {
-  return String(toolInput.CommandLine ?? toolInput.command ?? '');
+function commitSegmentOf(command) {
+  for (const segment of String(command).split(SEGMENT_SEPARATOR)) {
+    if (!runsGit(segment)) continue;
+    const normalized = normalizeGitCommand(segment);
+    if (isGitCommit(normalized) && !isDryRunCommit(normalized)) return segment;
+  }
+  return null;
 }
 
-/** The project's declared lint command, or null when none is declared (never invented). */
-function resolveLintCommand(cwd, lintCommandOverride) {
-  if (lintCommandOverride) return lintCommandOverride;
-
-  const packageJsonPath = join(cwd, 'package.json');
-  if (!existsSync(packageJsonPath)) return null;
-
-  try {
-    const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
-    if (packageJson?.scripts?.lint) return 'npm run lint';
-    return null;
-  } catch {
-    // Corrupt package.json is not this gate's problem to diagnose; do not invent a lint step.
-    return null;
+// `-C` BEFORE the subcommand is git's working directory; after `commit` it reuses a message.
+function commitDirectoryOf(segment) {
+  const tokens = tokensOf(segment);
+  const gitIndex = tokens.findIndex((token) => GIT_BINARY_TOKEN.test(token));
+  for (let index = gitIndex + 1; index < tokens.length; index += 1) {
+    if (tokens[index] === 'commit') return null;
+    if (tokens[index] === '-C') return tokens[index + 1] ?? null;
   }
+  return null;
+}
+
+// ── Lint ────────────────────────────────────────────────────────────────────────────
+function resolveLintCommand(lintDirectory, lintCommandOverride) {
+  if (typeof lintCommandOverride === 'string' && lintCommandOverride.trim())
+    return lintCommandOverride;
+  const packageJson = readJsonOrNull(join(lintDirectory, 'package.json'));
+  return packageJson?.scripts?.lint ? 'npm run lint' : null;
 }
 
 function tailLines(text, count) {
-  const lines = String(text)
+  return String(text)
     .split(/\r?\n/)
-    .filter((line) => line.length > 0);
-  return lines.slice(-count).join('\n');
+    .filter((line) => line.length > 0)
+    .slice(-count)
+    .join('\n');
 }
 
 function runLint(lintCommand, cwd, timeoutMs) {
@@ -115,37 +101,42 @@ runGate(
       lintTimeoutMs: DEFAULT_LINT_TIMEOUT_MS,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    if (!toolInGroups(toolName, SHELL_GROUPS)) return;
-
-    const command = commandTextFrom(toolInput);
-    if (!isGitCommit(command)) return;
-
-    const cwd = process.cwd();
-    const lintCommand = resolveLintCommand(cwd, parameters.lintCommand);
-    if (!lintCommand) return; // no lint script declared anywhere: nothing to enforce
-
-    const timeoutMs = parameters.lintTimeoutMs ?? DEFAULT_LINT_TIMEOUT_MS;
-    const result = runLint(lintCommand, cwd, timeoutMs);
-
+  ({ toolName, toolInput, parameters, cwd }) => {
+    if (!toolInGroups(toolName, ['shell'])) return;
+
+    const segment = commitSegmentOf(shellCommandOf(toolInput));
+    if (segment === null) return;
+
+    const explicitDirectory = commitDirectoryOf(segment);
+    const lintDirectory = explicitDirectory
+      ? resolve(cwd, explicitDirectory)
+      : (projectRootOf(cwd) ?? cwd);
+    const lintCommand = resolveLintCommand(
+      lintDirectory,
+      parameters.lintCommand,
+    );
+    if (!lintCommand) return;
+
+    const result = runLint(
+      lintCommand,
+      lintDirectory,
+      parameters.lintTimeoutMs,
+    );
     if (result.error) {
-      // The lint process itself could not be spawned (bad shell, missing interpreter, or a
-      // timeout kill). A commit gate that cannot evaluate must not silently permit — deny
-      // with the spawn error so the user can fix the environment, not guess.
       deny(
         CONFIG_KEY,
-        `Could not run the lint command ("${lintCommand}"): ${result.error.message}. Fix ` +
-          'the lint setup or set lintCommand/blockCommitWithFailingLint in .ai/config.json.',
+        `Could not run the lint command ("${lintCommand}" in ${lintDirectory}): ` +
+          `${result.error.message}. Fix the lint setup, or set lintCommand under ` +
+          `${CONFIG_KEY} in .ai/config.json.`,
       );
     }
-
     if (result.status !== 0) {
       const combinedOutput =
         `${result.stdout ?? ''}\n${result.stderr ?? ''}`.trim();
       deny(
         CONFIG_KEY,
-        `Lint failed (exit ${result.status}) — commit blocked until it passes:\n` +
-          `${tailLines(combinedOutput, OUTPUT_TAIL_LINES)}`,
+        `Lint failed (exit ${result.status}, "${lintCommand}" in ${lintDirectory}) — ` +
+          `commit blocked until it passes:\n${tailLines(combinedOutput, OUTPUT_TAIL_LINES)}`,
       );
     }
   },

package/plugins/gates/hooks/gates/mandatory-flow/index.mjs

@@ -1,23 +1,24 @@
-// mandatory-flow — denies an implementation delegation when there is no live task
-// pointer on disk backed by a contract file. Declaring pipeline stages in prose (what
-// implementation-pipeline.mjs checks) is not the same as a live task actually existing
-// on disk; this gate checks the disk fact, not the prompt's wording. Migrated from
-// ~/.claude/hooks/guard-flujo-obligatorio.mjs.
+// mandatory-flow — denies a STANDARD/HIGH-RISK implementation delegation when no live task
+// exists on disk: a pointer file naming the active task slug, and a non-empty contract file
+// under that task's directory. Declaring stages in prose (implementation-pipeline) is not
+// the same as a task actually existing; this gate checks the disk fact.
 //
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   activePointerPath   path (relative to the project root) to the file naming the
-//                        active task/pipeline slug.
-//   exemptSubagents      subagent types exempt outright (read-only pipeline stages).
-//                        Replaces the built-in list wholesale.
-// The defaults live here, in the source, so a project reads them and knows exactly what
-// its override replaces.
-//
-// ── Off by default, and quiet outside its narrow trigger ───────────────────────────
-// Only STANDARD/HIGH-RISK implementation delegations, on non-exempt subagents, not
-// about the harness itself, reach the disk check.
-
-import { existsSync, readFileSync } from 'node:fs';
-import { join, normalize, sep } from 'node:path';
+// Decisions: the contract root follows the pointer — `<dir of activePointerPath>/<slug>/` —
+// so a project that moves the pointer moves its tasks with it; an absolute pointer path is
+// honored as-is. A slug is a directory name, never a path (traversal is rejected). An empty
+// contract file is not a contract. Only the exempt list exempts a subagent type.
+
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, normalize, sep } from 'node:path';
+import { projectRootOf } from '../../lib/config.mjs';
+import {
+  DEFAULT_EXEMPT_SUBAGENTS,
+  DEMANDING_LEVELS,
+  isHarnessWork,
+  isImplementationRequest,
+  isSubagentNamedIn,
+  operativeLevelOf,
+} from '../../lib/delegation.mjs';
 import {
   runGate,
   deny,
@@ -30,19 +31,6 @@ const CONFIG_KEY = 'requireLiveTaskWhenImplementing';
 
 const DEFAULT_ACTIVE_POINTER_PATH = join('.ai', 'pipeline', 'ACTIVA');
 
-const DEFAULT_EXEMPT_SUBAGENTS = [
-  'explore',
-  'plan',
-  'scout',
-  'revision',
-  'contraste',
-  'test-planner',
-  'qa',
-  'ui',
-  'ux',
-];
-
-/** Contract files that count as evidence a task's contract exists on disk. */
 const TASK_CONTRACT_FILES = [
   'asserts.md',
   'task.json',
@@ -51,58 +39,27 @@ const TASK_CONTRACT_FILES = [
   'acceptance.md',
 ];
 
-function withWordBoundary(alternation) {
-  return new RegExp(
-    `(?:^|[^\\p{L}\\p{N}_])(?:${alternation})(?:[^\\p{L}\\p{N}_]|$)`,
-    'iu',
-  );
+function isExempt(toolInput, prompt, exemptSubagents) {
+  if (isSubagentNamedIn(toolInput, exemptSubagents)) return true;
+  if (!DEMANDING_LEVELS.has(operativeLevelOf(prompt))) return true;
+  if (!isImplementationRequest(prompt)) return true;
+  return isHarnessWork(prompt);
 }
 
-const IMPLEMENTATION_VERBS = withWordBoundary(
-  'implementa|implementar|implement(á|é)|agreg(a|á)|agregar|añad(e|í)|añadir|cre(a|á)|crear|' +
-    'arregl(a|á)|arreglar|cambi(a|á)|cambiar|migr(a|á)|migrar|' +
-    'corrige|corregir|correg(í|ir)|constru(ye|í)|construir|modific(a|á)|modificar|' +
-    'refactoriz(a|á)|refactorizar|elimin(a|á)|eliminar|reescrib(e|í)|reescribir|desplieg(a|á)|desplegar|' +
-    'escrib(í|e)|escribir|implement\\w*|writ(?:e|ing)|creat\\w*|fix\\w*|build\\w*|refactor\\w*|migrat\\w*|' +
-    'add\\w*|remov\\w*|delet\\w*|modify|modifies|modifying|rewrit\\w*',
-);
-
-/** Declared LEVEL near the word "level"/"classification" in Spanish or English, matching
- * the plugin-wide convention (see risk-level.mjs). */
-const DEMANDING_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(STANDARD|HIGH-RISK)\b/iu;
-const EXEMPT_LEVEL_PATTERN =
-  /(nivel|level|clasificaci[oó]n|classification)[^\n]{0,25}?\b(QUESTION|MICRO)\b/iu;
-
-const HARNESS_PATTERN =
-  /(\.claude[\\/]|hooks[\\/]|plugins[\\/]gates|settings\.json|[\\/]agents[\\/]\w|[\\/]rules[\\/]\w|[\\/]skills[\\/]\w)/i;
-
-function isExempt(toolInput, prompt, exemptSubagents) {
-  const subagentType = String(
-    toolInput.subagent_type ?? toolInput.subagentType ?? '',
-  ).toLowerCase();
-  if (exemptSubagents.includes(subagentType)) return true;
-  if (EXEMPT_LEVEL_PATTERN.test(prompt)) return true;
-  if (!DEMANDING_LEVEL_PATTERN.test(prompt)) return true;
-  if (!IMPLEMENTATION_VERBS.test(prompt)) return true;
-  if (HARNESS_PATTERN.test(prompt)) return true;
-  return false;
+function fileExistsNonEmpty(path) {
+  try {
+    return existsSync(path) && statSync(path).size > 0;
+  } catch {
+    return false;
+  }
 }
 
 function hasTaskContract(taskDirectory) {
-  return TASK_CONTRACT_FILES.some((file) => {
-    try {
-      return existsSync(join(taskDirectory, file));
-    } catch {
-      return false;
-    }
-  });
+  return TASK_CONTRACT_FILES.some((file) =>
+    fileExistsNonEmpty(join(taskDirectory, file)),
+  );
 }
 
-/** The pointer file's trimmed content, or '' when it cannot be read or the slug
- * attempts path traversal. A slug is a directory name, not a path: rejecting any
- * segment separator or '..' closes off `join(cwd, '.ai', 'pipeline', slug)` escaping
- * that directory to accept an unrelated file elsewhere on disk as the task contract. */
 function readSlug(pointerPath) {
   let raw;
   try {
@@ -121,7 +78,6 @@ function readSlug(pointerPath) {
   return normalized;
 }
 
-/** Denies for whichever of the three live-task facts is missing, or does nothing. */
 function checkLiveTask(pointerPath) {
   if (!existsSync(pointerPath)) {
     deny(
@@ -136,20 +92,19 @@ function checkLiveTask(pointerPath) {
   if (!slug) {
     deny(
       CONFIG_KEY,
-      `${pointerPath} exists but is empty. An active-task pointer with no slug is not ` +
-        'a live task. Write the task slug into it before delegating.',
+      `${pointerPath} exists but names no valid task slug (empty, or a path instead of a ` +
+        'directory name). Write the task slug into it before delegating.',
     );
   }
 
-  const taskDirectory = join(process.cwd(), '.ai', 'pipeline', slug);
+  const taskDirectory = join(dirname(pointerPath), slug);
   if (!hasTaskContract(taskDirectory)) {
     deny(
       CONFIG_KEY,
-      `The active task '${slug}' has no contract on disk: none of ` +
-        `${TASK_CONTRACT_FILES.join(', ')} exists under ${taskDirectory}. ` +
-        `Write ONE of those files there before implementing (this gate's contract root is ` +
-        `.ai/pipeline/${slug}/ — a brief.md under .ai/features/${slug}/ satisfies a ` +
-        'different gate, sdd-specs, but NOT this one; if you already wrote a brief there, ' +
+      `The active task '${slug}' has no non-empty contract on disk: none of ` +
+        `${TASK_CONTRACT_FILES.join(', ')} exists (with content) under ${taskDirectory}. ` +
+        'Write ONE of those files there before implementing (a brief.md under ' +
+        `.ai/features/${slug}/ satisfies sdd-specs, not this gate; if you already wrote one, ` +
         `create a short asserts.md under ${taskDirectory} referencing it).`,
     );
   }
@@ -165,19 +120,17 @@ runGate(
       exemptSubagents: DEFAULT_EXEMPT_SUBAGENTS,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
+  ({ toolName, toolInput, parameters, cwd }) => {
     if (!toolInGroups(toolName, ['delegation'])) return;
 
     const prompt = delegationPromptOf(toolInput);
     if (!prompt.trim()) return;
+    if (isExempt(toolInput, prompt, parameters.exemptSubagents)) return;
 
-    const exemptSubagents =
-      parameters.exemptSubagents ?? DEFAULT_EXEMPT_SUBAGENTS;
-    if (isExempt(toolInput, prompt, exemptSubagents)) return;
-
-    const activePointerPath = String(
-      parameters.activePointerPath ?? DEFAULT_ACTIVE_POINTER_PATH,
-    );
-    checkLiveTask(join(process.cwd(), activePointerPath));
+    const root = projectRootOf(cwd) ?? cwd;
+    const pointer =
+      String(parameters.activePointerPath ?? '').trim() ||
+      DEFAULT_ACTIVE_POINTER_PATH;
+    checkLiveTask(isAbsolute(pointer) ? pointer : join(root, pointer));
   },
 );

package/plugins/gates/hooks/gates/neutral-spanish/index.mjs

@@ -1,28 +1,44 @@
+// neutral-spanish — regional Spanish (voseo, Rioplatense lexicon) is denied in Spanish
+// prose. Only prose is scanned: a text-type file, or content carrying enough Spanish
+// function words to be Spanish — so an English "Author: Dale Carnegie" in code is not a
+// marker hit. A deliberate quote/fixture/log opts out with the escape-hatch marker.
+
+import { extname } from 'node:path';
 import {
   runGate,
   deny,
   toolInGroups,
   writtenContentOf,
+  writtenPathOf,
+  escapeRegExp,
 } from '../../lib/hook-io.mjs';
+import { withUnicodeWordBoundary } from '../../lib/signals.mjs';
 
 const GATE_ID = 'neutral-spanish';
 const CONFIG_KEY = 'warnNonNeutralSpanish';
 
 const MAX_REPORTED_MARKERS = 8;
-
-// Escape hatch: when a written file legitimately needs regional text (a literal quote, a
-// test fixture, a captured log, a data sample), placing this marker anywhere in the content
-// tells the gate the regional wording is intentional and lets the write through. A deny (as
-// opposed to the old warn) cannot "advise and let pass", so a legitimate case needs an
-// explicit, greppable opt-out — a marker the author writes on purpose, never one the agent
-// could infer. A project can override it via config (escapeHatch).
+const MIN_SPANISH_FUNCTION_WORDS = 3;
 const DEFAULT_ESCAPE_HATCH = 'neutral-spanish:allow';
+const DEFAULT_TEXT_EXTENSIONS = [
+  '.md',
+  '.mdx',
+  '.txt',
+  '.rst',
+  '.html',
+  '.htm',
+  '.adoc',
+  '.json',
+  '.yml',
+  '.yaml',
+];
+
+const SPANISH_FUNCTION_WORD = withUnicodeWordBoundary(
+  'que|de|la|el|los|las|para|con|una|por|como|también|está|más|este|esta|hay|muy|sin',
+);
 
 // Data strings, not identifiers — never add these to a cSpell dictionary.
 // neutral-spanish:allow — this list IS the marker data; the gate must not deny its own source.
-// Now that this gate DENIES (not warns), a marker must be unambiguously regional. Tokens that
-// also occur in neutral Spanish were removed: "de una" (matches "de una lista/vez"), "allá"
-// (standard across the whole language) — a false positive here blocks a legitimate write.
 const DEFAULT_REGIONAL_MARKERS = [
   'tenés',
   'podés',
@@ -54,9 +70,34 @@ const DEFAULT_REGIONAL_MARKERS = [
   'capaz que', // neutral-spanish:allow (marker data, not prose)
 ];
 
-function extractText(toolName, toolInput) {
-  if (!toolInGroups(toolName, ['write'])) return '';
-  return writtenContentOf(toolInput);
+function isSpanishProse(text) {
+  const global = new RegExp(
+    SPANISH_FUNCTION_WORD.source,
+    `${SPANISH_FUNCTION_WORD.flags}g`,
+  );
+  const distinct = new Set();
+  for (const match of text.matchAll(global)) {
+    distinct.add(match[0].toLowerCase());
+    if (distinct.size >= MIN_SPANISH_FUNCTION_WORDS) return true;
+  }
+  return false;
+}
+
+function hasTextExtension(path, textExtensions) {
+  const extension = extname(path).toLowerCase();
+  return textExtensions.some(
+    (candidate) => String(candidate).toLowerCase() === extension,
+  );
+}
+
+function markerHits(text, markers) {
+  const hits = [];
+  for (const marker of markers) {
+    if (typeof marker !== 'string' || marker.length === 0) continue;
+    if (withUnicodeWordBoundary(escapeRegExp(marker)).test(text))
+      hits.push(marker);
+  }
+  return hits;
 }
 
 runGate(
@@ -66,30 +107,27 @@ runGate(
     enabledByDefault: true,
     defaultParams: {
       regionalMarkers: DEFAULT_REGIONAL_MARKERS,
+      textExtensions: DEFAULT_TEXT_EXTENSIONS,
       escapeHatch: DEFAULT_ESCAPE_HATCH,
     },
   },
   ({ toolName, toolInput, parameters }) => {
-    const text = extractText(toolName, toolInput).toLowerCase();
+    if (!toolInGroups(toolName, ['write'])) return;
+    const text = writtenContentOf(toolInput);
     if (!text) return;
 
-    // Explicit opt-out for legitimate regional text (quote/fixture/log/data sample).
-    const escapeHatch = (
-      parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH
-    ).toLowerCase();
-    if (escapeHatch && text.includes(escapeHatch)) return;
+    const escapeHatch = parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH;
+    if (escapeHatch && text.toLowerCase().includes(escapeHatch.toLowerCase()))
+      return;
 
-    const hits = [];
-    for (const marker of parameters.regionalMarkers) {
-      const escaped = marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-      // \p{L} (any Unicode letter) as the non-boundary class, instead of a hand-written
-      // accented-character set, so accented word boundaries are handled correctly without
-      // spelling out literal accented characters in the source (the project keeps its
-      // spell-check dictionary untouched, so no word list may lean on this being a string).
-      const pattern = new RegExp(`(^|[^\\p{L}])${escaped}([^\\p{L}]|$)`, 'iu');
-      if (pattern.test(text)) hits.push(marker);
-    }
+    const path = writtenPathOf(toolInput);
+    if (
+      !hasTextExtension(path, parameters.textExtensions) &&
+      !isSpanishProse(text)
+    )
+      return;
 
+    const hits = markerHits(text, parameters.regionalMarkers);
     if (hits.length === 0) return;
 
     const unique = [...new Set(hits)].slice(0, MAX_REPORTED_MARKERS);
@@ -97,8 +135,8 @@ runGate(
       CONFIG_KEY,
       `Text being written contains regional Spanish markers: ${unique.join(', ')}. ` +
         'Rewrite in neutral Spanish before writing. If the regional wording is intentional ' +
-        `(a literal quote, a test fixture, a captured log, a data sample), add the marker ` +
-        `"${parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH}" somewhere in the content to allow it.`,
+        '(a literal quote, a test fixture, a captured log, a data sample), add the marker ' +
+        `"${escapeHatch}" somewhere in the content to allow it.`,
     );
   },
 );

package/plugins/gates/hooks/gates/never-assume/index.mjs

@@ -1,59 +1,64 @@
+// never-assume — conjecture phrasing in a brief or in written code gets a reminder to verify.
+// Advisory only: a guess is a prompt to check, never a blocker. Every pattern (default or
+// configured) is word-bounded, so "might benefit" does not trip "might be".
+
 import {
   runGate,
   warn,
   toolInGroups,
   writtenContentOf,
   delegationPromptOf,
+  compileRegex,
 } from '../../lib/hook-io.mjs';
 import { CONJECTURE_SOURCES } from '../../lib/signals.mjs';
 
 const GATE_ID = 'never-assume';
 const CONFIG_KEY = 'requireVerificationBeforeAssuming';
 
-// Bilingual (ES+EN) conjecture phrasing, centralized in lib/signals.mjs so every gate
-// that needs to recognize unverified-assumption prose shares the same coverage. See
-// signals.mjs header for the ES/EN-only limitation.
-const DEFAULT_CONJECTURE_PATTERNS = CONJECTURE_SOURCES;
-
 function extractContent(toolName, toolInput) {
   if (toolInGroups(toolName, ['delegation']))
     return delegationPromptOf(toolInput);
   return writtenContentOf(toolInput);
 }
 
+// Same boundary as signals.withUnicodeWordBoundary, applied per source so an invalid
+// config entry is skipped instead of poisoning the whole alternation.
+function boundedPattern(source) {
+  if (typeof source !== 'string' || source.length === 0) return null;
+  return compileRegex(
+    `(?<![\\p{L}\\p{N}_])(?:${source})(?![\\p{L}\\p{N}_])`,
+    'iu',
+  );
+}
+
 runGate(
   {
     id: GATE_ID,
     configKey: CONFIG_KEY,
     enabledByDefault: false,
+    severity: 'warn',
     defaultParams: {
-      conjecturePatterns: DEFAULT_CONJECTURE_PATTERNS,
+      conjecturePatterns: CONJECTURE_SOURCES,
     },
   },
   ({ toolName, toolInput, parameters }) => {
-    const isWrite = toolInGroups(toolName, ['write']);
-    const isDelegation = toolInGroups(toolName, ['delegation']);
-    if (!isWrite && !isDelegation) return;
+    if (!toolInGroups(toolName, ['write', 'delegation'])) return;
 
     const content = extractContent(toolName, toolInput);
     if (!content) return;
 
-    const patterns = parameters.conjecturePatterns.map(
-      (source) => new RegExp(source, 'i'),
-    );
     const hits = [];
-    for (const pattern of patterns) {
-      const match = content.match(pattern);
+    for (const source of parameters.conjecturePatterns) {
+      const match = boundedPattern(source)?.exec(content);
       if (match) hits.push(match[0]);
     }
     if (hits.length === 0) return;
 
     warn(
       CONFIG_KEY,
-      `Content contains conjecture phrasing without stated verification: ${hits.join(', ')}. Verify before asserting instead of assuming.`,
+      `Content contains conjecture phrasing without stated verification: ${hits.join(', ')}. ` +
+        'Verify before asserting instead of assuming. This is advisory; to change the ' +
+        `phrases, set conjecturePatterns for ${CONFIG_KEY} in .ai/config.json.`,
     );
   },
 );
-
-// The source guard (guard-never-assume.mjs) is explicit: this never denies,
-// only warns — conjecture language is a prompt to verify, not a blocker.