@devrik-tools/claude-gates 0.7.2 → 0.9.0

package/plugins/gates/hooks/gates/no-memory-dependency/index.mjs

@@ -1,33 +1,29 @@
-// no-memory-dependency — denies when a delegation prompt leans on the subagent
-// "remembering" something said earlier in conversation instead of carrying the data itself.
-// A fresh subagent has no access to the delegator's conversation history: if the data
-// matters, it must travel IN the prompt, in a file the subagent reads, or in an
-// already-persisted decision. The dependency on unavailable memory is a complete, objective
-// fact once stage 2 has ruled out a real persistence instruction — so this blocks.
+// no-memory-dependency — denies a delegation whose prompt refers the subagent to something
+// said earlier in the conversation ("como te dije", "as we discussed") instead of carrying
+// the data itself: a fresh subagent has none of the delegator's history.
 //
-// ── Two stages, same pattern as intent-flow ─────────────────────────────────────────
-// Stage 1 (cheap): does any memory-dependency phrase appear anywhere? If not, allow.
-// Stage 2 (confirmation, only on candidates): strip quoted text, then discard a phrase
-// that has a REAL deterministic persistence INSTRUCTION nearby (not just a noun/verb
-// mentioned in passing) — "no te olvides de guardar la decision en .ai/decision.md"
-// genuinely depends on a file, not on model memory. A persistence noun/verb that merely
-// co-occurs in the window without forming an instruction TO persist THIS remembered
-// thing (e.g. an unrelated file named elsewhere in the same sentence) does not suppress
-// the deny.
-//
-// ── Escape hatch ─────────────────────────────────────────────────────────────────────
-// A memory phrase can be a false positive: "no te olvides de cerrar el server al final"
-// directs the SUBAGENT'S own future action, not data it must recall from the delegator. For
-// that case the author adds the escapeHatch marker to the prompt to state, explicitly, that
-// no cross-conversation memory is actually required.
+// Decisions: the default phrases are references to PRIOR CONVERSATION only — "don't forget
+// to X", "keep in mind that <fact>", "remember to run the tests" carry their own content and
+// are allowed. A reference next to a real persistence instruction ("como quedamos, guardá la
+// decisión en .ai/decision.md") depends on a file, not on memory, and is allowed. The escape
+// hatch marker states that no recalled data is actually needed.
 
+import {
+  allMatches,
+  promptExcerpt,
+  stripQuoted,
+} from '../../lib/delegation.mjs';
 import {
   runGate,
   deny,
+  compileRegexList,
   toolInGroups,
   delegationPromptOf,
 } from '../../lib/hook-io.mjs';
-import { PERSISTENCE_VERB } from '../../lib/signals.mjs';
+import {
+  PERSISTENCE_VERB,
+  withUnicodeWordBoundary,
+} from '../../lib/signals.mjs';
 
 const GATE_ID = 'no-memory-dependency';
 const CONFIG_KEY = 'warnMemoryDependencyInBrief';
@@ -35,64 +31,39 @@ const CONFIG_KEY = 'warnMemoryDependencyInBrief';
 const DEFAULT_ESCAPE_HATCH = 'memory-not-needed';
 
 const DEFAULT_MEMORY_DEPENDENCY_PATTERNS = [
-  'acordate de|acu[eé]rdate de',
-  'no olvides|no te olvides',
-  'record[aá] que|ten[eé] en cuenta que',
-  'como te dije|como ya te dije|ya te dije|te lo dije antes|ya te ped[ií]',
-  "remember to|don'?t forget|keep in mind",
+  'recuerda que|acu[eé]rdate de (?:lo )?que|acordate de (?:lo )?que|como te dije',
+  'como (vimos|hablamos|dijimos|quedamos)|lo de antes',
+  'lo que te (dije|comenté|pasé)|ya sabes cu[aá]l',
+  'el (archivo|cambio|tema) de antes',
+  'remember that we|as (i|we) (said|discussed|mentioned|agreed)|as discussed',
+  'as mentioned (earlier|before|above)|the one from (before|earlier)',
+  'what we (discussed|talked about|decided)|you know which',
+  'like (before|last time)|the previous (one|file|change) i mentioned',
 ];
 
-// A real persistence INSTRUCTION requires an imperative persistence VERB (an actual
-// directive to save/persist/write THIS remembered thing), not merely a persistence-
-// related NOUN mentioned somewhere nearby (a stray "incident.md" in the same sentence
-// names a file without instructing anything be saved to it). Centralized in
-// lib/signals.mjs (ES+EN) so this class of signal is not duplicated per gate.
-const PERSISTENCE_VERB_PATTERN = PERSISTENCE_VERB;
-
 const PERSISTENCE_WINDOW = 80;
 
-function withUnicodeWordBoundary(alternatives) {
-  return new RegExp(
-    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
-    'iu',
-  );
-}
-
-function stripQuoted(text) {
-  return text
-    .replace(/```[\s\S]*?```/g, ' ')
-    .replace(/"[^"\n]{0,300}"/g, ' ')
-    .replace(/'[^'\n]{0,300}'/g, ' ');
-}
-
-function allMatches(pattern, text) {
-  const flags = pattern.flags.includes('g')
-    ? pattern.flags
-    : `${pattern.flags}g`;
-  return [...text.matchAll(new RegExp(pattern.source, flags))];
-}
-
-/** True only when the window around a memory phrase carries a real persistence
- * INSTRUCTION — an imperative persistence verb — not merely a persistence-related noun
- * mentioned in passing. A noun alone ("el reporte esta en incident.md") names a file
- * without instructing anything be saved to it, so it must NOT suppress the warning. */
 function hasPersistenceInstructionNearby(text, match) {
   const from = Math.max(0, match.index - PERSISTENCE_WINDOW);
   const to = Math.min(
     text.length,
     match.index + match[0].length + PERSISTENCE_WINDOW,
   );
-  const window = text.slice(from, to);
-  return PERSISTENCE_VERB_PATTERN.test(window);
+  return PERSISTENCE_VERB.test(text.slice(from, to));
 }
 
-function unresolvedMemoryPhrases(prompt, memoryPattern) {
-  if (!memoryPattern.test(prompt)) return []; // stage 1: no candidate, allow cheap
-
-  const text = stripQuoted(prompt); // stage 2(a)
-  const matches = allMatches(memoryPattern, text);
+function memoryPatternFrom(sources) {
+  const { patterns } = compileRegexList(sources, 'iu');
+  if (patterns.length === 0) return null;
+  return withUnicodeWordBoundary(
+    patterns.map((pattern) => `(?:${pattern.source})`).join('|'),
+  );
+}
 
-  return matches
+function unresolvedMemoryPhrases(prompt, memoryPattern) {
+  if (!memoryPattern.test(prompt)) return [];
+  const text = stripQuoted(prompt);
+  return allMatches(memoryPattern, text)
     .filter((match) => !hasPersistenceInstructionNearby(text, match))
     .map((match) => match[0].trim());
 }
@@ -113,15 +84,13 @@ runGate(
     const prompt = delegationPromptOf(toolInput);
     if (!prompt.trim()) return;
 
-    // Explicit opt-out: the author states no cross-conversation memory is actually required.
-    const escapeHatch = (
-      parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH
-    ).toLowerCase();
+    const escapeHatch = String(parameters.escapeHatch ?? '').toLowerCase();
     if (escapeHatch && prompt.toLowerCase().includes(escapeHatch)) return;
 
-    const memoryPattern = withUnicodeWordBoundary(
-      (parameters.memoryDependencyPatterns ?? []).join('|'),
+    const memoryPattern = memoryPatternFrom(
+      parameters.memoryDependencyPatterns,
     );
+    if (!memoryPattern) return;
 
     const phrases = unresolvedMemoryPhrases(prompt, memoryPattern);
     if (phrases.length === 0) return;
@@ -129,10 +98,10 @@ runGate(
     const quotedPhrases = phrases.map((phrase) => `"${phrase}"`).join(', ');
     deny(
       CONFIG_KEY,
-      `This delegation depends on the subagent remembering something (${quotedPhrases}), but a ` +
-        'fresh subagent has none of this conversation. Put the data IN the prompt, in a file it ' +
-        'reads, a flag, or an already-persisted decision. If the phrase directs the subagent’s ' +
-        `own future action and needs no recalled data, add the marker "${parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH}" to the prompt.`,
+      `This delegation ("${promptExcerpt(prompt)}") depends on the subagent remembering something ` +
+        `(${quotedPhrases}), but a fresh subagent has none of this conversation. Put the data IN the ` +
+        'prompt, in a file it reads, a flag, or an already-persisted decision. If the phrase needs no ' +
+        `recalled data, add the marker "${escapeHatch || DEFAULT_ESCAPE_HATCH}" to the prompt.`,
     );
   },
 );

package/plugins/gates/hooks/gates/no-reconfirm/index.mjs

@@ -1,5 +1,10 @@
-import { readFileSync, existsSync } from 'node:fs';
-import { runGate, warn, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+// no-reconfirm — asking again what the user already approved gets a reminder to proceed.
+// Advisory only. An approval is a human turn that STARTS with an affirmative; a turn that
+// merely contains "proceed" ("how should I proceed?") is a question, not an approval. Only
+// the tail of the transcript is read: an approval given hundreds of turns ago is stale.
+
+import { closeSync, fstatSync, openSync, readSync } from 'node:fs';
+import { runGate, warn, toolInGroups } from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'no-reconfirm';
 const CONFIG_KEY = 'requireNoReconfirmOfApproved';
@@ -9,17 +14,33 @@ const MIN_SHARED_WORDS = 2;
 const MIN_SIGNIFICANT_WORD_LENGTH = 5;
 const QUESTION_PREVIEW_LENGTH = 100;
 const APPROVING_TURN_PREVIEW_LENGTH = 140;
-
-function wordBoundary(alternatives) {
-  return new RegExp(
-    `(?<![\\p{L}\\p{N}_])(${alternatives})(?![\\p{L}\\p{N}_])`,
-    'iu',
-  );
-}
-
-const APPROVAL_PATTERN = wordBoundary(
-  'go ahead|approved|i approve|authorized|proceed|do it|confirmed|i confirm|' +
-    'sounds good,? do it|yes,? (do it|go ahead|proceed)|ok,? (do it|go ahead|proceed)',
+const TRANSCRIPT_TAIL_LINES = 400;
+const KIB = 1024;
+const TRANSCRIPT_TAIL_BYTES = KIB * KIB;
+
+const AFFIRMATIVES = [
+  'yes',
+  'yeah',
+  'yep',
+  'ok',
+  'okay',
+  'sure',
+  'go ahead',
+  'proceed',
+  'approved',
+  'do it',
+  's[ií]',
+  'de acuerdo',
+  'adelante',
+  'procede',
+  'hazlo',
+  'correcto',
+  'confirmo',
+  'aprobado',
+];
+const APPROVAL_START_PATTERN = new RegExp(
+  String.raw`^\s*(?:${AFFIRMATIVES.join('|')})(?![\p{L}\p{N}_])`,
+  'iu',
 );
 
 const STOP_WORDS = new Set([
@@ -67,18 +88,29 @@ function textOf(event) {
   return content.map((block) => block.text || '').join(' ');
 }
 
-function humanTurnsFrom(transcriptPath) {
-  if (!transcriptPath || !existsSync(transcriptPath)) return null;
-
-  let raw;
+function tailLinesOf(path) {
+  let descriptor;
   try {
-    raw = readFileSync(transcriptPath, 'utf8');
+    descriptor = openSync(path, 'r');
+    const { size } = fstatSync(descriptor);
+    const length = Math.min(size, TRANSCRIPT_TAIL_BYTES);
+    const buffer = Buffer.alloc(length);
+    readSync(descriptor, buffer, 0, length, size - length);
+    const lines = buffer.toString('utf8').split('\n');
+    if (length < size) lines.shift();
+    return lines.slice(-TRANSCRIPT_TAIL_LINES);
   } catch {
     return null;
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
   }
+}
 
+function humanTurnsFrom(transcriptPath) {
+  const lines = tailLinesOf(transcriptPath);
+  if (lines === null) return null;
   const turns = [];
-  for (const line of raw.split('\n')) {
+  for (const line of lines) {
     if (!line.trim()) continue;
     let event;
     try {
@@ -105,10 +137,14 @@ function significantWords(text) {
   );
 }
 
+function optionsOf(question) {
+  return Array.isArray(question?.options) ? question.options : [];
+}
+
 function topicOfQuestion(question) {
   const header = String(question?.header || '');
   const body = String(question?.question || '');
-  const optionLabels = (question?.options || [])
+  const optionLabels = optionsOf(question)
     .map((option) => String(option?.label || ''))
     .join(' ');
   return `${header} ${body} ${optionLabels}`;
@@ -123,8 +159,7 @@ function turnThatAlreadyApprovedThisTopic(
   if (topicWords.size === 0) return null;
 
   for (const turn of humanTurns) {
-    if (!APPROVAL_PATTERN.test(turn)) continue;
-
+    if (!APPROVAL_START_PATTERN.test(turn)) continue;
     const turnWords = significantWords(turn);
     let shared = 0;
     for (const word of topicWords) {
@@ -144,6 +179,17 @@ function transcriptPathOf(rawPayload) {
   }
 }
 
+function questionsOf(toolInput) {
+  if (Array.isArray(toolInput?.questions)) {
+    return toolInput.questions.filter(
+      (question) => question && typeof question === 'object',
+    );
+  }
+  if (typeof toolInput?.question === 'string')
+    return [{ question: toolInput.question }];
+  return [];
+}
+
 function noticeFor(question, approvingTurn) {
   const questionPreview = String(question?.question || '').slice(
     0,
@@ -155,47 +201,39 @@ function noticeFor(question, approvingTurn) {
   return `Question "${questionPreview}" shares its topic with a turn where the user already gave explicit approval: "${approvingTurnPreview}". If it is the same decision, do not re-ask — proceed.`;
 }
 
-function collectReconfirmationNotices(questions, humanTurns, overlapThreshold) {
-  const notices = [];
-  for (const question of questions) {
-    const approvingTurn = turnThatAlreadyApprovedThisTopic(
-      humanTurns,
-      question,
-      overlapThreshold,
-    );
-    if (approvingTurn) notices.push(noticeFor(question, approvingTurn));
-  }
-  return notices;
-}
-
 runGate(
   {
     id: GATE_ID,
     configKey: CONFIG_KEY,
     enabledByDefault: true,
+    severity: 'warn',
     defaultParams: {
       overlapThreshold: DEFAULT_OVERLAP_THRESHOLD,
     },
   },
   ({ toolName, toolInput, parameters, rawPayload }) => {
-    if (!TOOL_GROUPS.question.includes(toolName)) return;
+    if (!toolInGroups(toolName, ['question'])) return;
 
-    const questions = Array.isArray(toolInput?.questions)
-      ? toolInput.questions
-      : [];
+    const questions = questionsOf(toolInput);
     if (questions.length === 0) return;
 
     const transcriptPath = transcriptPathOf(rawPayload);
-    if (!transcriptPath) return;
+    if (typeof transcriptPath !== 'string' || !transcriptPath) return;
 
     const humanTurns = humanTurnsFrom(transcriptPath);
-    if (humanTurns === null || humanTurns.length === 0) return; // no readable transcript: cannot verify
-
-    const notices = collectReconfirmationNotices(
-      questions,
-      humanTurns,
-      parameters.overlapThreshold,
-    );
+    if (!humanTurns || humanTurns.length === 0) return;
+
+    const notices = questions
+      .map((question) => ({
+        question,
+        approvingTurn: turnThatAlreadyApprovedThisTopic(
+          humanTurns,
+          question,
+          parameters.overlapThreshold,
+        ),
+      }))
+      .filter((entry) => entry.approvingTurn)
+      .map((entry) => noticeFor(entry.question, entry.approvingTurn));
     if (notices.length === 0) return;
     warn(CONFIG_KEY, notices.join('\n\n'));
   },

package/plugins/gates/hooks/gates/no-trivial-scripts/index.mjs

@@ -0,0 +1,114 @@
+// no-trivial-scripts — denies inline interpreter scripts (node -e, python -c, sed -i,
+// perl -e, PowerShell one-liners with [IO.File]/Set-Content/Add-Content) when they perform
+// file operations that the Edit or Write tool would handle directly: inserting a line,
+// replacing text, creating a file, appending content. Legitimate uses of inline scripts
+// (JSON processing, running a test harness, computing a value) are not caught because they
+// don't touch the filesystem.
+//
+// Deterministic: pattern match on the command, unconditional deny. No model judgment.
+
+import {
+  deny,
+  runGate,
+  shellCommandOf,
+  toolInGroups,
+} from '../../lib/hook-io.mjs';
+
+const GATE_ID = 'no-trivial-scripts';
+const CONFIG_KEY = 'blockTrivialInlineScripts';
+
+// Node/Deno/Bun inline eval doing file operations
+const NODE_EVAL_PATTERN =
+  /\b(?:node|deno|bun)\b(?:\s+-\S+)*?\s+(?:-e|--eval|-p|--print)\b/i;
+const NODE_FILE_OPS =
+  /\b(?:writeFileSync|appendFileSync|mkdirSync|unlinkSync|renameSync|copyFileSync|fs\.writeFile|fs\.appendFile|fs\.unlink|fs\.rename|fs\.mkdir|fs\.copyFile|createWriteStream)\b/;
+
+// Python inline doing file operations
+const PYTHON_EVAL_PATTERN = /\bpython3?\b(?:\s+-\S+)*?\s+-c\b/i;
+const PYTHON_OPEN_FOR_WRITING = /\bopen\s*\([^)]*,\s*['"][wax]/;
+const PYTHON_FILE_OPS =
+  /\.write\s*\(|\bshutil\.|\bos\.(?:rename|remove|unlink|makedirs)\b|\bpathlib\.Path\b[^)]*\.write_text/;
+
+// sed/awk/perl inline edits — these are always file edits
+const SED_INLINE_PATTERN = /\bsed\s+(?:-[^;\s]*\s+)*-i/;
+const PERL_INLINE_PATTERN = /\bperl\s+(?:-[^;\s]*\s+)*-[ip]/;
+const AWK_INLINE_PATTERN = /\bawk\s+(?:-[^;\s]*\s+)*-i\s+inplace\b/;
+
+// PowerShell file manipulation one-liners
+const PS_FILE_OPS_PATTERN =
+  /\b(?:Set-Content|Add-Content|Out-File|\[System\.IO\.File\]::(?:WriteAll|AppendAll)|New-Item\s[^|;]*-ItemType\s+File)\b/i;
+
+const REMEDY =
+  'This command uses an inline script for a file operation that the Edit or Write tool ' +
+  'handles directly. Use Edit to modify existing files (insert, replace, delete lines) ' +
+  'or Write to create new files. Inline scripts are for computation, not file manipulation.';
+
+function checkCommand(command) {
+  if (!command) return;
+
+  // Node/Deno/Bun -e with file operations
+  const nodeMatch = NODE_EVAL_PATTERN.exec(command);
+  if (nodeMatch) {
+    const afterEval = command.slice(nodeMatch.index + nodeMatch[0].length);
+    if (NODE_FILE_OPS.test(afterEval)) {
+      deny(CONFIG_KEY, `${REMEDY} (detected: inline Node.js file operation)`);
+    }
+  }
+
+  // Python -c with file operations
+  const pythonMatch = PYTHON_EVAL_PATTERN.exec(command);
+  if (pythonMatch) {
+    const afterEval = command.slice(pythonMatch.index + pythonMatch[0].length);
+    if (
+      PYTHON_OPEN_FOR_WRITING.test(afterEval) ||
+      PYTHON_FILE_OPS.test(afterEval)
+    ) {
+      deny(CONFIG_KEY, `${REMEDY} (detected: inline Python file operation)`);
+    }
+  }
+
+  // sed -i is always an in-place file edit
+  if (SED_INLINE_PATTERN.test(command)) {
+    deny(
+      CONFIG_KEY,
+      `${REMEDY} (detected: sed -i in-place edit — use Edit tool instead)`,
+    );
+  }
+
+  // perl -i/-p is always an in-place file edit
+  if (PERL_INLINE_PATTERN.test(command)) {
+    deny(
+      CONFIG_KEY,
+      `${REMEDY} (detected: perl -i/-p in-place edit — use Edit tool instead)`,
+    );
+  }
+
+  // awk -i inplace
+  if (AWK_INLINE_PATTERN.test(command)) {
+    deny(
+      CONFIG_KEY,
+      `${REMEDY} (detected: awk -i inplace — use Edit tool instead)`,
+    );
+  }
+
+  // PowerShell file write one-liners
+  if (PS_FILE_OPS_PATTERN.test(command)) {
+    deny(
+      CONFIG_KEY,
+      `${REMEDY} (detected: PowerShell file write cmdlet — use Edit or Write tool instead)`,
+    );
+  }
+}
+
+runGate(
+  {
+    id: GATE_ID,
+    configKey: CONFIG_KEY,
+    enabledByDefault: true,
+    defaultParams: {},
+  },
+  ({ toolName, toolInput }) => {
+    if (!toolInGroups(toolName, ['shell'])) return;
+    checkCommand(shellCommandOf(toolInput));
+  },
+);