@devrik-tools/claude-gates 0.7.2 → 0.9.0

package/plugins/gates/hooks/doctor.mjs

@@ -15,7 +15,7 @@
 // Fail-safe: every check is wrapped so a doctor bug never blocks a session from
 // starting — worst case it silently skips a check rather than throwing.
 
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -29,6 +29,14 @@ const HOOKS_DIRECTORY = dirname(fileURLToPath(import.meta.url));
 const REPOSITORY_ROOT = join(HOOKS_DIRECTORY, '..', '..', '..');
 const PACKAGE_JSON_PATH = join(REPOSITORY_ROOT, 'package.json');
 const REGISTRY_PATH = join(REPOSITORY_ROOT, 'registry.json');
+const PLUGIN_MANIFEST_PATH = join(
+  HOOKS_DIRECTORY,
+  '..',
+  '.claude-plugin',
+  'plugin.json',
+);
+const PLUGIN_CACHE = join(homedir(), '.claude', 'plugins', 'cache');
+const PLUGIN_NAME = 'gates';
 
 // Same config lookup as the other session hooks (see session-tasks.mjs / register-requests.mjs):
 // kept local and dependency-free so this plugin works standalone.
@@ -126,6 +134,41 @@ function minNodeVersionRequired(configuredMin) {
   return token ?? DEFAULT_MIN_NODE_VERSION;
 }
 
+function directoriesIn(path) {
+  try {
+    return readdirSync(path, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
+      .map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+
+/** A newer gates version sitting in Claude Code's plugin cache means this session runs a
+ * stale install (the marketplace still points at an old package path). */
+function staleInstallProblem() {
+  const running = readJson(PLUGIN_MANIFEST_PATH)?.version;
+  if (!parseVersion(running)) return null;
+  let newest = running;
+  let marketplace = null;
+  for (const marketplaceName of directoriesIn(PLUGIN_CACHE)) {
+    for (const version of directoriesIn(
+      join(PLUGIN_CACHE, marketplaceName, PLUGIN_NAME),
+    )) {
+      if (parseVersion(version) && !versionAtLeast(newest, version)) {
+        newest = version;
+        marketplace = marketplaceName;
+      }
+    }
+  }
+  if (newest === running) return null;
+  return (
+    `the gates plugin running in this session is ${running} but ${newest} is installed in the ` +
+    `plugin cache (${marketplace}). Run \`claude plugin update ${PLUGIN_NAME}@${marketplace}\` or ` +
+    '`claude-gates init --global --defaults --yes` from the newer package, then restart the session.'
+  );
+}
+
 function checkNodeVersion(minVersion) {
   if (versionAtLeast(process.version, minVersion)) return null;
   return (
@@ -184,6 +227,9 @@ function main() {
   const versionProblem = checkNodeVersion(minVersion);
   if (versionProblem) problems.push(versionProblem);
 
+  const staleInstall = staleInstallProblem();
+  if (staleInstall) problems.push(staleInstall);
+
   const missingScripts = missingFolderGateScripts();
   if (missingScripts.length > 0) {
     problems.push(

package/plugins/gates/hooks/gates/atomic-commit/index.mjs

@@ -1,51 +1,38 @@
-// atomic-commit — denies a `git commit` that is not atomic: one that mixes too many distinct
-// NATURES of change (code + tests + deps + config in one shot) or stages more reviewable files
-// than a commit should carry. It never commits or groups for you (that is a tool, not a gate,
-// and the user already has guard-autocommit for it); it only OBJECTS when the staged set is not
-// a cohesive, reviewable unit, so the split happens before the commit lands.
-//
-// justification: no existing gate covers this. lint-commit/staged-lint run the linter on a
-// commit; no-coauthor reads the message; none look at the SHAPE of the staged set. This is the
-// first gate that judges whether a commit is atomic.
-//
-// ── How it decides (deterministic) ───────────────────────────────────────────────────
-// On a real `git commit`, it lists the staged files and classifies each by nature (deps,
-// generated, assets, docs, config, types, tests, tooling, or code). Docs/assets/generated do
-// NOT count toward the size or the mix — they are legitimately committed alongside anything and
-// are not reviewed line by line (same rule guard-autocommit uses). Among the files that DO
-// count, it blocks when either:
-//   · the number of distinct counted natures exceeds `maxNatures` (default 2 — e.g. code+tests
-//     is fine, but code+tests+deps+config in one commit is not atomic), or
-//   · the number of counted files exceeds `maxFiles` (default 12) — too large to review.
-// A commit that is already scoped (`--amend`, a merge, or the escape hatch) is left alone.
-//
-// ── What a project can configure (params) ───────────────────────────────────────────
-//   maxFiles     max counted files in one commit. Default 12.
-//   maxNatures   max distinct counted natures in one commit. Default 2.
-//   escapeHatch  substring in the command that allows one deliberately broad commit.
-//                Default '[wip]'.
-//   natures      the classification table (name + regex source + counts flag). Replaces the
-//                built-in list wholesale.
-//
-// ── Fail-safe shape ──────────────────────────────────────────────────────────────────
-// Not a commit, an --amend, or nothing staged: allow (silent). git not queryable: allow (the
-// gate cannot judge and must not block a legitimate commit on a git error). Otherwise: deny
-// with the offending mix/size and how to split.
-
-import { spawnSync } from 'node:child_process';
-import { runGate, deny, toolInGroups } from '../../lib/hook-io.mjs';
+// atomic-commit — denies a `git commit` that is not atomic: one mixing more distinct NATURES
+// of change (code + tests + deps + config) than `maxNatures`, or carrying more reviewable
+// files than `maxFiles`. It judges what the commit WILL contain (the staged set, plus what a
+// `git add …` in the same command line or `-a` stages, plus staged deletions); docs, assets
+// and generated files count toward neither. An `--amend` reshapes an existing commit and is
+// left alone, as is a `--dry-run`. Only a command segment that RUNS git commit counts. git
+// not queryable: allow — the gate cannot judge and must not block on a git error.
+
+import { projectRootOf } from '../../lib/config.mjs';
+import {
+  effectiveCommitFiles,
+  isAmendCommit,
+  isDryRunCommit,
+  isGitCommit,
+  normalizeGitCommand,
+  stagedFiles,
+} from '../../lib/git.mjs';
+import {
+  compileRegex,
+  deny,
+  runGate,
+  shellCommandOf,
+  toolInGroups,
+} from '../../lib/hook-io.mjs';
 
 const GATE_ID = 'atomic-commit';
 const CONFIG_KEY = 'blockNonAtomicCommits';
 
-const SHELL_GROUPS = ['shell'];
 const DEFAULT_MAX_FILES = 12;
 const DEFAULT_MAX_NATURES = 2;
 const DEFAULT_ESCAPE_HATCH = '[wip]';
 
-// Nature table, evaluated in order (first match wins), mirroring guard-autocommit's catalog so
-// a project that uses both sees the same grouping. `counts:false` = committed alongside anything
-// and not counted toward size/mix (docs, assets, generated artifacts).
+// First match wins. `counts:false` = committed alongside anything, never reviewed line by
+// line. A `hooks/` or `models/` folder is application code (React hooks, MVC models), not
+// tooling or types: types are `*.d.ts` and `types/` folders only.
 const DEFAULT_NATURES = [
   {
     name: 'deps',
@@ -74,7 +61,7 @@ const DEFAULT_NATURES = [
   },
   {
     name: 'types',
-    source: String.raw`(^|/)(types?|interfaces?|models?|schemas?)/|\.d\.ts$`,
+    source: String.raw`(^|/)types?/|\.d\.ts$`,
     counts: true,
   },
   {
@@ -84,84 +71,66 @@ const DEFAULT_NATURES = [
   },
   {
     name: 'tooling',
-    source: String.raw`(^|/)(scripts|hooks|\.ai|\.claude|\.github)/`,
+    source: String.raw`(^|/)(scripts|\.ai|\.claude|\.github)/`,
     counts: true,
   },
 ];
 const DEFAULT_NATURE = { name: 'code', counts: true };
 
-// git-global-option normalization, shared with the other commit gates.
-const GIT_OPTION_WITH_VALUE = String.raw`(?:-[Cc]|--git-dir|--work-tree|--namespace|--exec-path|--config-env)(?:\s+|=)\S+`;
-const GIT_FLAG_OPTION = String.raw`--(?:paginate|no-pager|bare|no-optional-locks)|-p`;
-const GIT_GLOBAL_OPTION_PATTERN = new RegExp(
-  String.raw`\bgit\s+(?:${GIT_OPTION_WITH_VALUE}|${GIT_FLAG_OPTION})\s+`,
-  'i',
-);
-const GIT_COMMIT_PATTERN = /\bgit\s+commit\b/i;
-// An --amend or a merge commit is a deliberate, already-scoped operation — not this gate's.
-const EXEMPT_COMMIT_PATTERN = /--amend\b|\bgit\s+merge\b/i;
-
-function normalizeGitOptions(command) {
-  let previous;
-  let normalized = command;
-  do {
-    previous = normalized;
-    normalized = normalized.replace(GIT_GLOBAL_OPTION_PATTERN, 'git ');
-  } while (normalized !== previous);
-  return normalized;
-}
-
-function isPlainCommit(command) {
-  const normalized = normalizeGitOptions(command);
-  return (
-    GIT_COMMIT_PATTERN.test(normalized) &&
-    !EXEMPT_COMMIT_PATTERN.test(normalized)
-  );
-}
-
-function commandTextFrom(toolInput) {
-  return String(toolInput.CommandLine ?? toolInput.command ?? '');
+// ── The commit segment ──────────────────────────────────────────────────────────────
+const SEGMENT_SEPARATOR = /;|&&|\|\||\||\n/;
+const ARGUMENT_PATTERN = /"([^"]*)"|'([^']*)'|(\S+)/g;
+const GIT_BINARY_TOKEN = /(?:^|[\\/])git(?:\.exe)?$/i;
+const WRAPPER_TOKEN = /^(?:\w+=\S*|command|sudo|env)$/i;
+
+function runsGit(segment) {
+  const tokens = [];
+  for (const match of segment.matchAll(ARGUMENT_PATTERN))
+    tokens.push(match[1] ?? match[2] ?? match[3]);
+  while (tokens.length > 0 && WRAPPER_TOKEN.test(tokens[0])) tokens.shift();
+  return tokens.length > 0 && GIT_BINARY_TOKEN.test(tokens[0]);
 }
 
-/** The staged files (added/copied/modified/renamed), or [] when git cannot be queried. */
-function stagedFiles(cwd) {
-  const result = spawnSync(
-    'git',
-    ['diff', '--cached', '--name-only', '--diff-filter=ACMR'],
-    { cwd, encoding: 'utf8' },
-  );
-  if (result.status !== 0 || !result.stdout) return [];
-  return result.stdout
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter((line) => line.length > 0)
-    .map((line) => line.replace(/\\/g, '/'));
+function runsJudgedCommit(command) {
+  return String(command)
+    .split(SEGMENT_SEPARATOR)
+    .some((segment) => {
+      if (!runsGit(segment)) return false;
+      const normalized = normalizeGitCommand(segment);
+      return (
+        isGitCommit(normalized) &&
+        !isDryRunCommit(normalized) &&
+        !isAmendCommit(normalized)
+      );
+    });
 }
 
+// ── Natures ─────────────────────────────────────────────────────────────────────────
 function compileNatures(natures) {
-  return natures.map((nature) => ({
-    name: nature.name,
-    counts: nature.counts !== false,
-    pattern: (() => {
-      try {
-        return new RegExp(nature.source, 'i');
-      } catch {
-        return null;
-      }
-    })(),
-  }));
+  const compiled = [];
+  for (const nature of natures) {
+    if (!nature || typeof nature !== 'object') continue;
+    if (typeof nature.name !== 'string' || typeof nature.source !== 'string')
+      continue;
+    const pattern = compileRegex(nature.source);
+    if (!pattern) continue;
+    compiled.push({
+      name: nature.name,
+      counts: nature.counts !== false,
+      pattern,
+    });
+  }
+  return compiled;
 }
 
 function natureOf(filePath, compiledNatures) {
-  for (const nature of compiledNatures) {
-    if (nature.pattern && nature.pattern.test(filePath)) return nature;
-  }
-  return DEFAULT_NATURE;
+  return (
+    compiledNatures.find((nature) => nature.pattern.test(filePath)) ??
+    DEFAULT_NATURE
+  );
 }
 
-/** Classifies the staged files: the counted (reviewable) ones and the distinct natures among
- * them. Docs/assets/generated (counts:false) are excluded from both. */
-function classifyStaged(files, compiledNatures) {
+function classify(files, compiledNatures) {
   const counted = [];
   const countedNatures = new Set();
   for (const file of files) {
@@ -173,6 +142,13 @@ function classifyStaged(files, compiledNatures) {
   return { counted, countedNatures };
 }
 
+function commitFiles(root, command) {
+  const files = effectiveCommitFiles(root, command);
+  if (files === null) return null;
+  const deletions = stagedFiles(root, { filter: 'D' }) ?? [];
+  return [...new Set([...files, ...deletions])];
+}
+
 runGate(
   {
     id: GATE_ID,
@@ -185,26 +161,23 @@ runGate(
       natures: DEFAULT_NATURES,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    if (!toolInGroups(toolName, SHELL_GROUPS)) return;
+  ({ toolName, toolInput, parameters, cwd }) => {
+    if (!toolInGroups(toolName, ['shell'])) return;
 
-    const command = commandTextFrom(toolInput);
-    if (!isPlainCommit(command)) return;
+    const command = shellCommandOf(toolInput);
+    if (!runsJudgedCommit(command)) return;
 
-    const escapeHatch = parameters.escapeHatch ?? DEFAULT_ESCAPE_HATCH;
+    const escapeHatch = String(parameters.escapeHatch ?? '');
     if (escapeHatch && command.includes(escapeHatch)) return;
 
-    const cwd = process.cwd();
-    const files = stagedFiles(cwd);
-    if (files.length === 0) return; // nothing staged (or git unqueryable): nothing to judge
+    const files = commitFiles(projectRootOf(cwd) ?? cwd, command);
+    if (!files || files.length === 0) return;
 
-    const compiledNatures = compileNatures(
-      parameters.natures ?? DEFAULT_NATURES,
+    const { counted, countedNatures } = classify(
+      files,
+      compileNatures(parameters.natures),
     );
-    const { counted, countedNatures } = classifyStaged(files, compiledNatures);
-
-    const maxFiles = parameters.maxFiles ?? DEFAULT_MAX_FILES;
-    const maxNatures = parameters.maxNatures ?? DEFAULT_MAX_NATURES;
+    const { maxFiles, maxNatures } = parameters;
 
     if (countedNatures.size > maxNatures) {
       deny(
@@ -220,7 +193,7 @@ runGate(
     if (counted.length > maxFiles) {
       deny(
         CONFIG_KEY,
-        `This commit stages ${counted.length} reviewable files (max ${maxFiles}) — too large ` +
+        `This commit carries ${counted.length} reviewable files (max ${maxFiles}) — too large ` +
           `to review as one unit. Split it into smaller, cohesive commits (docs/assets/` +
           `generated files are not counted). Add "${escapeHatch}" for one deliberately broad commit.`,
       );

package/plugins/gates/hooks/gates/audit-before-build/index.mjs

@@ -1,5 +1,24 @@
+// audit-before-build — creating a new executable tool (a file under a tool folder, or a
+// delegation asking to build one) must state that existing tools were audited. Editing an
+// existing file is never a build; the exemption is what lets the gates maintain themselves.
+
 import { existsSync } from 'node:fs';
-import { runGate, deny, TOOL_GROUPS } from '../../lib/hook-io.mjs';
+import { isAbsolute, join } from 'node:path';
+import { projectRootOf } from '../../lib/config.mjs';
+import {
+  runGate,
+  deny,
+  toolInGroups,
+  writtenPathOf,
+  writtenContentOf,
+  delegationPromptOf,
+} from '../../lib/hook-io.mjs';
+import { isBuildIntent } from '../../lib/signals.mjs';
+import {
+  AUDIT_DONE_PATTERN,
+  hasAuditEvidence,
+  isToolPath,
+} from '../../lib/tools.mjs';
 
 const GATE_ID = 'audit-before-build';
 const CONFIG_KEY = 'requireAuditBeforeBuilding';
@@ -13,87 +32,103 @@ const DEFAULT_EXECUTABLE_EXTENSIONS = [
   '.sh',
   '.ps1',
 ];
-const DEFAULT_TOOL_FOLDERS = ['scripts/', 'hooks/', 'tools/'];
+const DEFAULT_TOOL_FOLDERS = ['scripts', 'hooks', 'tools'];
+// Vendored or VCS-internal trees are never the project's own new tool.
+const FOREIGN_SEGMENTS = new Set(['.git', 'node_modules']);
+const AUDIT_EXAMPLE_PHRASE = 'no existing tool covers this';
 
-// A verb ("create", "escribir", ...) followed within 60 non-period characters by a tool noun
-// ("script", "gate", ...) signals intent to build a new tool. Split into two smaller patterns
-// (checked one after the other, within a bounded window) instead of one combined alternation:
-// the single-regex form crossed sonarjs's regex-complexity budget, and this reads easier too.
-const NEW_TOOL_VERB_PATTERN =
-  /\b(?:create|write|build|add|cre[aá]r?|escrib(?:e|ir|í)|constru(?:ye|ir)|agreg[aá]r?)\b/giu;
-const NEW_TOOL_NOUN_PATTERN =
-  /\b(?:script|verifier|checker|gate|hook|linter|tool|verificador|chequeador|herramienta)\b/iu;
-const NEW_TOOL_NOUN_WINDOW = 60;
+// "the build script" is a noun phrase, and "add tests for the gate" builds a test, not a
+// gate; both would otherwise read as creation verb + tool noun.
+const BUILD_AS_NOUN_PATTERN =
+  /\b(?:the|a|an|this|that|our|your|my|el|la|un|una|este|esta)\s+build\b/giu;
+const CREATION_VERBS = [
+  'write',
+  'create',
+  'build',
+  'implement',
+  'add',
+  'make',
+  'escribe',
+  'escribi',
+  'escribir',
+  'crea',
+  'construye',
+  'construir',
+  'implementa',
+  'implementar',
+  'agrega',
+  'arma',
+  'hace',
+  'genera',
+  'generar',
+  'armá',
+  'hacé',
+  'creá',
+  'agregá',
+  'generá',
+  'escribí',
+  'construí',
+];
+const OBJECT_QUALIFIERS =
+  'a|the|some|new|more|unos|unas|los|las|más|nuevos|nuevas';
+const TEST_OBJECT_NOUNS = 'tests?|specs?|pruebas?';
+const TEST_OBJECT_PATTERN = new RegExp(
+  String.raw`\b(?:${CREATION_VERBS.join('|')})\s+(?:(?:${OBJECT_QUALIFIERS})\s+){0,2}(?:${TEST_OBJECT_NOUNS})\b`,
+  'giu',
+);
 
-function hasNewToolIntent(text) {
-  NEW_TOOL_VERB_PATTERN.lastIndex = 0;
-  let match;
-  while ((match = NEW_TOOL_VERB_PATTERN.exec(text)) !== null) {
-    const afterVerb = match.index + match[0].length;
-    let window = text.slice(afterVerb, afterVerb + NEW_TOOL_NOUN_WINDOW);
-    const dotIndex = window.indexOf('.');
-    if (dotIndex !== -1) window = window.slice(0, dotIndex);
-    if (NEW_TOOL_NOUN_PATTERN.test(window)) return true;
-    if (match.index === NEW_TOOL_VERB_PATTERN.lastIndex)
-      NEW_TOOL_VERB_PATTERN.lastIndex += 1;
-  }
-  return false;
+function hasNewToolIntent(prompt) {
+  const masked = prompt
+    .replace(BUILD_AS_NOUN_PATTERN, 'it')
+    .replace(TEST_OBJECT_PATTERN, 'tests');
+  return isBuildIntent(masked);
 }
 
-const AUDIT_EVIDENCE_PATTERN =
-  /already exists|no existing tool|no plugin|audited and|justification:|no existe una herramienta|no existe la herramienta|no hay plugin|ya existe|busque? si ya existe|verifiqu[eé] que no (hay|existe)|audit[eé] herramientas|justificacion:|justificaci[oó]n:/i;
-
-const INLINE_JUSTIFICATION_PATTERN =
-  /justification:|no-reinvent|audit:|justificacion:|justificaci[oó]n:/i;
-
 function checkDelegation(toolInput) {
-  const prompt = toolInput?.prompt;
-  if (typeof prompt !== 'string') return;
+  const prompt = delegationPromptOf(toolInput);
   if (!hasNewToolIntent(prompt)) return;
-  if (AUDIT_EVIDENCE_PATTERN.test(prompt)) return;
+  if (hasAuditEvidence(prompt)) return;
 
   deny(
     CONFIG_KEY,
     'Blocked: this delegation prompt asks to create a new script/checker/gate/hook/linter/' +
       'tool, and nothing in the prompt shows a prior audit. No filesystem exploration is ' +
-      'needed to fix this — add ONE phrase to the prompt matching ' +
-      `/${AUDIT_EVIDENCE_PATTERN.source}/i, e.g.: "audited and no existing tool covers this" ` +
-      '(this exact phrase is guaranteed to match). Then relaunch the same delegation.',
+      `needed to fix this — add ONE phrase to the prompt such as "${AUDIT_EXAMPLE_PHRASE}" ` +
+      `(any phrase matching /${AUDIT_DONE_PATTERN.source}/iu works). Then relaunch the same delegation.`,
   );
 }
 
-function isNewToolFile(filePath, parameters) {
-  if (!filePath) return false;
-  const inToolFolder = parameters.toolFolders.some((folder) =>
-    filePath.includes(folder),
-  );
-  if (!inToolFolder) return false;
-  return parameters.executableExtensions.some((extension) =>
-    filePath.endsWith(extension),
-  );
+function stripTrailingSlash(folder) {
+  let name = String(folder);
+  while (name.endsWith('/') || name.endsWith('\\')) name = name.slice(0, -1);
+  return name;
 }
 
-function checkWrite(toolInput, parameters) {
-  const rawPath = toolInput?.file_path ?? '';
-  const filePath = rawPath.replace(/\\/g, '/');
-  if (!isNewToolFile(filePath, parameters)) return;
-
-  // Editing an EXISTING file is not building a new tool — only creation needs the audit.
-  // A file already on disk (any tool that carries file_path) is an edit, so it is allowed.
-  // This is what makes maintaining the gates themselves possible with the gates active.
-  if (rawPath && existsSync(rawPath)) return;
+function isForeignPath(filePath) {
+  return filePath
+    .split('/')
+    .some((segment) => FOREIGN_SEGMENTS.has(segment.toLowerCase()));
+}
 
-  const content = toolInput?.content ?? toolInput?.new_string;
-  if (typeof content !== 'string') return;
-  if (INLINE_JUSTIFICATION_PATTERN.test(content)) return;
+function checkWrite(toolInput, parameters, root) {
+  const rawPath = writtenPathOf(toolInput);
+  const filePath = rawPath.replace(/\\/g, '/');
+  if (!filePath || isForeignPath(filePath)) return;
+  const isTool = isToolPath(filePath, {
+    folders: parameters.toolFolders.map(stripTrailingSlash),
+    extensions: parameters.executableExtensions,
+    namePatterns: [],
+  });
+  if (!isTool) return;
+  if (existsSync(isAbsolute(rawPath) ? rawPath : join(root, rawPath))) return;
+  if (hasAuditEvidence(writtenContentOf(toolInput))) return;
 
   deny(
     CONFIG_KEY,
-    `Blocked: '${filePath}' is a new executable tool with no justification comment in its ` +
-      'content. No filesystem exploration is needed to fix this — add ONE line to the ' +
-      `file's content matching /${INLINE_JUSTIFICATION_PATTERN.source}/i, e.g.: ` +
-      '"// justification: no existing tool covers this" (this exact phrase is guaranteed ' +
-      'to match). Then retry the exact same write.',
+    `Blocked: '${filePath}' is a new executable tool with no audit statement in its ` +
+      'content. No filesystem exploration is needed to fix this — add ONE comment line ' +
+      `such as "// justification: ${AUDIT_EXAMPLE_PHRASE}" (any phrase matching ` +
+      `/${AUDIT_DONE_PATTERN.source}/iu works). Then retry the exact same write.`,
   );
 }
 
@@ -107,12 +142,12 @@ runGate(
       toolFolders: DEFAULT_TOOL_FOLDERS,
     },
   },
-  ({ toolName, toolInput, parameters }) => {
-    if (TOOL_GROUPS.delegation.includes(toolName)) {
+  ({ toolName, toolInput, parameters, cwd }) => {
+    if (toolInGroups(toolName, ['delegation'])) {
       checkDelegation(toolInput);
       return;
     }
-    if (!TOOL_GROUPS.write.includes(toolName)) return;
-    checkWrite(toolInput, parameters);
+    if (!toolInGroups(toolName, ['write'])) return;
+    checkWrite(toolInput, parameters, projectRootOf(cwd) ?? cwd);
   },
 );

package/plugins/gates/hooks/gates/autonomous-mode/index.mjs

@@ -28,14 +28,14 @@ const CONFIG_KEY = 'autonomousMode';
 const QUESTION_GROUPS = ['question'];
 
 const DENY_MESSAGE =
-  'Autonomous mode is ON for this project: do not ask the user, decide instead. The question ' +
-  'popup was intercepted and never shown. Now, in your VISIBLE reply, leave a one-line trace ' +
-  'so the user sees what was suppressed and what you chose — e.g. "[autonomous] I was going ' +
-  'to ask <the question>; I decided <choice>, assuming <reversible assumption>." Then take ' +
-  'that best, goal-aligned decision and proceed. Only a genuinely irreversible or dangerous ' +
-  'choice (deleting data, money, production) justifies stopping — and then stop in prose ' +
-  'saying exactly what and why, do not reach for the popup again. To let questions through, ' +
-  'set "autonomousMode": false in .ai/config.json.';
+  'Autonomous mode is ON. Do not ask the user. Decide and proceed. ' +
+  'Use this order: existing project decisions > existing patterns > requirements > project goals > your judgment. ' +
+  'Keep decisions consistent with the project. Do not invent new patterns or technologies unless needed. ' +
+  'When several choices work, pick the one best for the project. Make reasonable reversible assumptions instead of asking. ' +
+  'In your visible reply, leave one line: "[autonomous] I was going to ask <question>; I chose <decision>, assuming <assumption>." ' +
+  'Only stop for genuinely irreversible or dangerous actions (data deletion, money, destructive production changes). ' +
+  'If stopping, explain what and why. Never ask the popup again. ' +
+  'To enable questions, set "autonomousMode": false in .ai/config.json.';
 
 runGate(
   {