@devrik-tools/claude-gates 0.7.2 → 0.9.0

package/cli/smoke-fixtures.json

@@ -8,7 +8,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git reset --hard HEAD~3" }
+        "tool_input": {
+          "command": "git reset --hard HEAD~3"
+        }
       },
       "needsState": false
     },
@@ -19,7 +21,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git push origin main" }
+        "tool_input": {
+          "command": "git push origin main"
+        }
       },
       "needsState": false
     },
@@ -30,7 +34,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Write",
-        "tool_input": { "file_path": "/repo/.env" }
+        "tool_input": {
+          "file_path": "/repo/.env"
+        }
       },
       "needsState": false
     },
@@ -41,7 +47,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Write",
-        "tool_input": { "file_path": "random-orphan.txt" }
+        "tool_input": {
+          "file_path": "random-orphan.txt"
+        }
       },
       "needsState": true,
       "note": "file_path must resolve against the scratch project root; a literal alone does not reproduce root detection."
@@ -53,7 +61,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "sleep 30" }
+        "tool_input": {
+          "command": "sleep 30"
+        }
       },
       "needsState": false
     },
@@ -64,7 +74,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "Fix the login bug please, thanks." }
+        "tool_input": {
+          "prompt": "Fix the login bug please, thanks."
+        }
       },
       "needsState": false
     },
@@ -101,7 +113,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "fix the scoring threshold" }
+        "tool_input": {
+          "prompt": "fix the scoring threshold"
+        }
       },
       "needsState": true,
       "note": "stateful: denies only on the 3rd identical retry under the same session id."
@@ -114,7 +128,7 @@
       "payload": {
         "tool_name": "Agent",
         "tool_input": {
-          "prompt": "Acordate de lo que hablamos antes y aplica el mismo criterio."
+          "prompt": "Como te dije antes, aplica el mismo criterio al nuevo archivo."
         }
       },
       "needsState": false
@@ -122,11 +136,16 @@
     {
       "id": "force-parallel",
       "configKey": "warnSequentialDelegations",
-      "enabledByDefault": false,
-      "type": "warn",
-      "payload": { "tool_name": "Task", "tool_input": { "prompt": "do work" } },
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Task",
+        "tool_input": {
+          "prompt": "do work"
+        }
+      },
       "needsState": true,
-      "note": "stateful: warns only on the 3rd consecutive delegation under one session."
+      "note": "stateful: denies only on the 3rd consecutive delegation under one session."
     },
     {
       "id": "feature-catalog",
@@ -178,7 +197,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "Nivel: STANDARD\nImplementa el checkout." }
+        "tool_input": {
+          "prompt": "Nivel: STANDARD\nImplementa el checkout."
+        }
       },
       "needsState": false
     },
@@ -189,7 +210,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "Nivel: STANDARD\nImplementa el checkout." }
+        "tool_input": {
+          "prompt": "Nivel: STANDARD\nImplementa el checkout."
+        }
       },
       "needsState": false
     },
@@ -242,7 +265,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Agent",
-        "tool_input": { "prompt": "create a new script that checks X" }
+        "tool_input": {
+          "prompt": "create a new script that checks X"
+        }
       },
       "needsState": false
     },
@@ -267,7 +292,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "echo hi" }
+        "tool_input": {
+          "command": "echo hi"
+        }
       },
       "needsState": true,
       "note": "needs a project rules/ or .claude/skills gate script present that exits non-zero."
@@ -279,7 +306,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "echo hi" }
+        "tool_input": {
+          "command": "echo hi"
+        }
       },
       "needsState": true,
       "note": "needs .ai/reincidencias.json with an open class at/above threshold."
@@ -307,7 +336,11 @@
       "payload": {
         "tool_name": "AskUserQuestion",
         "tool_input": {
-          "questions": [{ "question": "Should I migrate the auth schema?" }]
+          "questions": [
+            {
+              "question": "Should I migrate the auth schema?"
+            }
+          ]
         }
       },
       "needsState": true,
@@ -334,10 +367,11 @@
       "enabledByDefault": true,
       "type": "warn",
       "payload": {
-        "tool_name": "Write",
+        "tool_name": "Edit",
         "tool_input": {
           "file_path": "/repo/src/config.js",
-          "content": "const REQUEST_TIMEOUT_MS = 30000;"
+          "old_string": "const REQUEST_TIMEOUT_MS = 30000;",
+          "new_string": "const REQUEST_TIMEOUT_MS = 60000;"
         }
       },
       "needsState": false
@@ -349,7 +383,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git commit -m x" }
+        "tool_input": {
+          "command": "git commit -m x"
+        }
       },
       "needsState": true,
       "note": "needs a project package.json whose lint script exits non-zero."
@@ -384,7 +420,10 @@
       "type": "deny",
       "payload": {
         "tool_name": "Write",
-        "tool_input": { "file_path": "src/x.js", "content": "x" }
+        "tool_input": {
+          "file_path": "src/x.js",
+          "content": "x"
+        }
       },
       "needsState": true,
       "note": "needs a forge adoption marker + sqlite db with no active run."
@@ -396,7 +435,13 @@
       "type": "deny",
       "payload": {
         "tool_name": "AskUserQuestion",
-        "tool_input": { "questions": [{ "question": "A or B?" }] }
+        "tool_input": {
+          "questions": [
+            {
+              "question": "A or B?"
+            }
+          ]
+        }
       },
       "needsState": false
     },
@@ -434,7 +479,9 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git commit -m \"wip\"" }
+        "tool_input": {
+          "command": "git commit -m \"wip\""
+        }
       },
       "needsState": true,
       "note": "needs a git repo with a staged lintable file that fails lint and a resolvable linter; a bare payload cannot reproduce the staged-file scan."
@@ -446,10 +493,97 @@
       "type": "deny",
       "payload": {
         "tool_name": "Bash",
-        "tool_input": { "command": "git commit -m \"stuff\"" }
+        "tool_input": {
+          "command": "git commit -m \"stuff\""
+        }
       },
       "needsState": true,
       "note": "needs a git repo with a staged set that mixes >maxNatures natures or exceeds maxFiles; a bare payload cannot reproduce the staged-file scan."
+    },
+    {
+      "id": "engram-first",
+      "configKey": "requireEngramBeforeResearch",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "WebSearch",
+        "tool_input": {
+          "query": "how to use zod refine"
+        },
+        "session_id": "smoke-engram-first"
+      },
+      "needsState": false
+    },
+    {
+      "id": "library-docs",
+      "configKey": "requireDocsBeforeUsingNewLibrary",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Write",
+        "tool_input": {
+          "file_path": "src/schema.ts",
+          "content": "import { z } from 'zod';\n"
+        },
+        "session_id": "smoke-library-docs"
+      },
+      "needsState": false
+    },
+    {
+      "id": "no-explanatory-comments",
+      "configKey": "blockExplanatoryComments",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Write",
+        "tool_input": {
+          "file_path": "src/a.mjs",
+          "content": "// reads the config and returns it\nexport const x = 1;\n"
+        }
+      },
+      "needsState": false
+    },
+    {
+      "id": "require-task-split",
+      "configKey": "requireTaskSplitBeforeImplementing",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Write",
+        "tool_input": {
+          "file_path": "src/x.js",
+          "content": "x"
+        }
+      },
+      "needsState": true,
+      "note": "needs an .ai/tasks/active.json with a medium+ task that has no children."
+    },
+    {
+      "id": "require-monitor",
+      "configKey": "requireMonitorForBackground",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Bash",
+        "tool_input": {
+          "command": "npm run build",
+          "run_in_background": true
+        }
+      },
+      "needsState": false
+    },
+    {
+      "id": "no-trivial-scripts",
+      "configKey": "blockTrivialInlineScripts",
+      "enabledByDefault": true,
+      "type": "deny",
+      "payload": {
+        "tool_name": "Bash",
+        "tool_input": {
+          "command": "sed -i 's/old/new/' src/a.mjs"
+        }
+      },
+      "needsState": false
     }
   ]
 }

package/cli/task.mjs

@@ -12,9 +12,16 @@ import {
   STATUS,
 } from '../plugins/tasks/hooks/lib/task-store.mjs';
 import { EXIT_CODE } from './constants.mjs';
+import { verifyCommand, verifyPath } from './evidence.mjs';
 
 const DEFAULT_SIZE = 'unspecified';
 
+const VERIFY_USAGE =
+  'task add requires a deterministic verification criterion: ' +
+  '--verify-command "<command>" [--verify-expect <text>] (command that must exit 0 when done) ' +
+  'or --verify-path <path> [--verify-contains <text>] (file/dir that must exist when done). ' +
+  'This defines HOW the task will be verified as complete — free text is not enough.';
+
 function fail(message) {
   process.stderr.write(`${message}\n`);
   process.exit(EXIT_CODE.FAILURE);
@@ -30,18 +37,41 @@ function openStoreOrFail(cwd) {
   return store;
 }
 
+function buildVerifyCriteria(options) {
+  if (options.verifyCommand) {
+    return {
+      kind: 'command',
+      command: options.verifyCommand,
+      expect: options.verifyExpect ?? null,
+    };
+  }
+  if (options.verifyPath) {
+    return {
+      kind: 'path',
+      path: options.verifyPath,
+      contains: options.verifyContains ?? null,
+    };
+  }
+  return null;
+}
+
 function taskAdd(title, options, { cwd = process.cwd() } = {}) {
   if (!title || !title.trim()) fail('task add requires a non-empty title.');
+  const verify = buildVerifyCriteria(options);
+  if (!verify) fail(VERIFY_USAGE);
   const store = openStoreOrFail(cwd);
-  const task = store.add({
+  const task = {
     id: options.id || randomUUID(),
     title: title.trim(),
     description: options.description ?? '',
     status: STATUS.OPEN,
     size: options.size ?? DEFAULT_SIZE,
+    verify,
     createdAt: new Date().toISOString(),
     messages: [],
-  });
+  };
+  if (options.parent) task.parentId = options.parent;
+  store.add(task);
   process.stdout.write(`${JSON.stringify(task, null, 2)}\n`);
 }
 
@@ -64,19 +94,53 @@ function reportCloseResult(result) {
   process.stdout.write(`${JSON.stringify(result.task, null, 2)}\n`);
 }
 
+const EVIDENCE_USAGE =
+  'closing a task as done requires verified evidence: --check "<command>" ' +
+  '[--expect <text>] (the command must exit 0) or --exists <path> [--contains <text>]. ' +
+  'Free text (--evidence/--note) is only a note. Use `task abandon` if it will not be finished.';
+
+function collectEvidence(options, cwd) {
+  if (options.check) {
+    return verifyCommand(options.check, { cwd, expect: options.expect });
+  }
+  if (options.exists) {
+    return verifyPath(options.exists, { cwd, contains: options.contains });
+  }
+  return null;
+}
+
+function autoVerifyFromTask(task, cwd) {
+  if (!task?.verify) return null;
+  const { kind, command, expect, path, contains } = task.verify;
+  if (kind === 'command' && command) {
+    return verifyCommand(command, { cwd, expect: expect ?? undefined });
+  }
+  if (kind === 'path' && path) {
+    return verifyPath(path, { cwd, contains: contains ?? undefined });
+  }
+  return null;
+}
+
 function taskClose(id, options, { cwd = process.cwd() } = {}) {
-  if (!options.evidence || !options.evidence.trim()) {
+  const store = openStoreOrFail(cwd);
+  let evidence = collectEvidence(options, store.root);
+  if (!evidence && options.evidence !== undefined) fail(EVIDENCE_USAGE);
+  if (!evidence) {
+    const task = store.active().find((entry) => entry.id === id);
+    evidence = autoVerifyFromTask(task, store.root);
+  }
+  if (!evidence) fail(EVIDENCE_USAGE);
+  if (!evidence.verified) {
+    const output = evidence.outputTail ? `\n${evidence.outputTail}` : '';
     fail(
-      'closing a task as done requires evidence that it was attended and resolved ' +
-        '(test output, a diff, a verification note). Pass --evidence, or use ' +
-        '`task abandon` if it will not be finished.',
+      `evidence did not verify (${evidence.failure}); the task stays open.${output}`,
     );
   }
-  const store = openStoreOrFail(cwd);
+  const note = options.note ?? options.evidence ?? '';
   reportCloseResult(
     store.close(id, STATUS.DONE, {
       reason: options.reason ?? '',
-      evidence: options.evidence,
+      evidence: note ? { ...evidence, note } : evidence,
     }),
   );
 }
@@ -103,10 +167,29 @@ export function registerTaskCommand(program) {
 
   task
     .command('add <title>')
-    .description('Register a new open task.')
+    .description(
+      'Register a new open task (requires a verification criterion).',
+    )
     .option('--id <id>', 'explicit task id (default: a generated uuid)')
     .option('--description <text>', 'longer description of the task')
     .option('--size <size>', 'rough size estimate (e.g. trivial, small, large)')
+    .option(
+      '--verify-command <command>',
+      'shell command that must exit 0 when the task is done',
+    )
+    .option(
+      '--verify-expect <text>',
+      'text the --verify-command output must contain',
+    )
+    .option(
+      '--verify-path <path>',
+      'file or directory that must exist when the task is done',
+    )
+    .option(
+      '--verify-contains <text>',
+      'text the --verify-path file must contain',
+    )
+    .option('--parent <id>', 'parent task id (makes this a sub-task)')
     .action((title, options) => taskAdd(title, options));
 
   task
@@ -117,10 +200,20 @@ export function registerTaskCommand(program) {
 
   task
     .command('close <id>')
-    .description('Close a task as done. Requires --evidence.')
+    .description(
+      'Close a task as done. Requires verified evidence: --check or --exists.',
+    )
+    .option(
+      '--check <command>',
+      'command that must exit 0 (run at the project root)',
+    )
+    .option('--expect <text>', 'text the --check output must contain')
+    .option('--exists <path>', 'file or directory that must exist')
+    .option('--contains <text>', 'text the --exists file must contain')
+    .option('--note <text>', 'free-text context stored with the evidence')
     .option(
       '--evidence <text>',
-      'proof the task was attended and resolved (required)',
+      'alias of --note (free text alone is not evidence)',
     )
     .option('--reason <text>', 'closing note')
     .action((id, options) => taskClose(id, options));

package/cli/toggle.mjs

@@ -0,0 +1,125 @@
+import { existsSync } from 'node:fs';
+import { readJsonOrNull } from '../plugins/gates/hooks/lib/config.mjs';
+import { SCOPES, configPathFor, readConfig, writeConfig } from './config.mjs';
+import { defaultParametersOf } from './materialize.mjs';
+import { allGates } from './registry.mjs';
+import { adoptionOf } from './selection.mjs';
+
+const ALL_TARGET = 'all';
+
+export function resolveTargets(registry, ids) {
+  const gates = allGates(registry);
+  const families = new Set(registry.families.map((family) => family.id));
+  const keys = new Set();
+  const unknown = [];
+  for (const id of ids) {
+    if (id === ALL_TARGET) {
+      for (const gate of gates) keys.add(gate.configKey);
+      continue;
+    }
+    if (families.has(id)) {
+      for (const gate of gates.filter((entry) => entry.family === id))
+        keys.add(gate.configKey);
+      continue;
+    }
+    const gate = gates.find(
+      (entry) => entry.id === id || entry.configKey === id,
+    );
+    if (gate) keys.add(gate.configKey);
+    else unknown.push(id);
+  }
+  if (unknown.length > 0)
+    throw new Error(
+      `Unknown gate, family or config key: ${unknown.join(', ')}. Run \`claude-gates registry --list\` to see the ids.`,
+    );
+  return [...keys];
+}
+
+export function enabledOf(entry, fallback) {
+  if (typeof entry === 'boolean') return entry;
+  if (entry && typeof entry === 'object')
+    return entry.enabled === undefined ? fallback : entry.enabled !== false;
+  return fallback;
+}
+
+function entryWithEnabled(gate, existing, enabled) {
+  if (existing && typeof existing === 'object') return { ...existing, enabled };
+  const hasParameters = Array.isArray(gate.params) && gate.params.length > 0;
+  if (!hasParameters) return enabled;
+  return { enabled, ...defaultParametersOf(gate) };
+}
+
+function adoptionFromGates(registry, gates) {
+  const map = {};
+  for (const gate of allGates(registry))
+    map[gate.configKey] = enabledOf(gates[gate.configKey], gate.default);
+  return adoptionOf(map);
+}
+
+export function toggleGates(path, registry, configKeys, enabled) {
+  const existing = readConfig(path);
+  if (existing.corrupt)
+    throw new Error(`${path} exists but is not valid JSON. Fix it first.`);
+  const gates = { ...(existing.data.gates ?? {}) };
+  const changed = [];
+  for (const gate of allGates(registry)) {
+    if (!configKeys.includes(gate.configKey)) continue;
+    const before = enabledOf(gates[gate.configKey], gate.default);
+    gates[gate.configKey] = entryWithEnabled(
+      gate,
+      gates[gate.configKey],
+      enabled,
+    );
+    if (before !== enabled) changed.push(gate.configKey);
+  }
+  const next = {
+    ...existing.data,
+    adopted: adoptionFromGates(registry, gates),
+    gateVersion: registry.gateVersion,
+    gates,
+  };
+  writeConfig(path, next);
+  return { path, changed, unchanged: configKeys.length - changed.length };
+}
+
+export function defaultScopeFor(cwd) {
+  if (existsSync(configPathFor(SCOPES.PROJECT, { cwd }))) return SCOPES.PROJECT;
+  if (existsSync(configPathFor(SCOPES.GLOBAL))) return SCOPES.GLOBAL;
+  return SCOPES.PROJECT;
+}
+
+function effectiveLayer(projectConfig, globalConfig) {
+  if (projectConfig)
+    return { name: SCOPES.PROJECT, gates: projectConfig.gates ?? {} };
+  if (globalConfig)
+    return { name: SCOPES.GLOBAL, gates: globalConfig.gates ?? {} };
+  return { name: 'default', gates: {} };
+}
+
+export function statusRows(registry, { cwd = process.cwd() } = {}) {
+  const projectPath = configPathFor(SCOPES.PROJECT, { cwd });
+  const globalPath = configPathFor(SCOPES.GLOBAL);
+  const projectConfig = readJsonOrNull(projectPath);
+  const globalConfig = readJsonOrNull(globalPath);
+  const layer = effectiveLayer(projectConfig, globalConfig);
+  return allGates(registry).map((gate) => {
+    const entry = layer.gates[gate.configKey];
+    const declared = entry !== undefined;
+    return {
+      id: gate.id,
+      configKey: gate.configKey,
+      family: gate.family,
+      enabled: enabledOf(entry, gate.default),
+      source: declared ? layer.name : 'default',
+    };
+  });
+}
+
+export function renderStatus(rows, layerLabel) {
+  const width = Math.max(...rows.map((row) => row.id.length));
+  const lines = rows.map(
+    (row) =>
+      `${row.enabled ? 'on ' : 'off'}  ${row.id.padEnd(width)}  ${row.configKey}  (${row.source})`,
+  );
+  return `${layerLabel}\n${lines.join('\n')}`;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@devrik-tools/claude-gates",
-  "version": "0.7.2",
-  "description": "Installable, deterministic gates (hooks) for Claude Code: block destructive commands, protected paths, and enforce delegation/spec/quality rules. Configurable per project.",
+  "version": "0.9.0",
+  "description": "49 installable, deterministic gates (hooks) for Claude Code: block destructive commands and protected paths, enforce delegation/spec/quality/research rules, and track tasks that only close with verified evidence. Configurable per project.",
   "keywords": [
     "claude-code",
     "hooks",
@@ -9,7 +9,8 @@
     "guardrails",
     "pretooluse",
     "policy-enforcement",
-    "ai-agent"
+    "ai-agent",
+    "task-tracking"
   ],
   "type": "module",
   "bin": {

package/plugins/gates/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gates",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "description": "Deterministic gates for Claude Code: destructive-command blocks, protected paths, delegation briefs, spec-driven flow and session-start validation. Selection lives in config, not in code.",
   "author": {
     "name": "Devrik"