@dougharness/cli 1.0.1

package/node_modules/@dougharness/gates/lib/block-ledger.mjs

@@ -0,0 +1,127 @@
+// The block ledger (card stop-gate-block-ledger): one JSON line per Stop/SubagentStop block or stand-down,
+// appended to .doug/.state/blocks.jsonl, so a later report (hand-report-schema) can read what the gate did
+// without relying on the lead's own memory of it. `classifyFinalBlock` only LABELS a block for that report -
+// it never decides whether the gate itself blocks or lets a stop through; that call is stop-gate.mjs's alone,
+// made before classification ever runs. `appendBlockLine` never throws (a hook reader must never throw,
+// CLAUDE.md gotchas): a failed write just skips the line, leaving the gate's own decision unchanged.
+// The race class has a known limit: a check command that leaves unignored untracked output behind makes every block read 'race', and a content change to an already-dirty file is not seen.
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { changedFiles } from "./baseline.mjs";
+
+export const BLOCKS_RELPATH = ".doug/.state/blocks.jsonl";
+
+// A leading "./" is not part of a path token's identity (same normalisation stop-gate.mjs's own claim
+// matching uses).
+function stripLeadingDotSlash(f) {
+  return typeof f === "string" && f.startsWith("./") ? f.slice(2) : f;
+}
+
+// Test files a failed verification command's output names: every path token ending in ".test.<ext>" or
+// ".spec.<ext>" (ext = letters) on a line containing "FAIL" or "failed", deduplicated, normalised to a
+// repository-relative path when absolute under `dir`. Moved here from stop-gate.mjs (card
+// stop-gate-block-ledger) so the classifier below and stop-gate.mjs's own tests_red_by_design coverage check
+// share one implementation instead of two that could drift. Never throws: a parse failure reads as no files
+// named.
+export function failingTestFilesFrom(output, dir) {
+  try {
+    const files = new Set();
+    const tokenRe = /[^\s"'`]+\.(?:test|spec)\.[A-Za-z]+/g;
+    for (const line of String(output || "").split("\n")) {
+      if (!line.includes("FAIL") && !line.includes("failed")) continue;
+      for (const m of line.matchAll(tokenRe)) {
+        let f = m[0];
+        f = f.replace(/^[([<"'`]+/, "");
+        f = stripLeadingDotSlash(f);
+        if (typeof dir === "string" && dir && f.startsWith(dir + "/")) f = f.slice(dir.length + 1);
+        files.add(f);
+      }
+    }
+    return [...files];
+  } catch {
+    return [];
+  }
+}
+
+// The final verification block's class (brief Rules, first match wins):
+// 1. 'expected-red' — the only problems are failed commands (no pre-verification problem, no evidence
+//    problem, no budget-dropped command: the same precondition stop-gate.mjs's own honoured-claim path
+//    uses), EVERY failed command's output names at least one test file (review pass 2, item 1 MAJOR: the
+//    same per-command precondition redByDesignCoverage in stop-gate.mjs already enforces for honouring a
+//    claim — a second, unrelated command that names no test file at all must not be waved through just
+//    because the one command the claim does cover is also failing), and every named file across all of
+//    them is in the standing tests_red_by_design claim (`redByDesignClaimFiles`).
+// 2. 'load-timeout' — at least one command timed out or was dropped for budget, and no failed command's
+//    captured output names a failing test file.
+// 3. 'race' — the working tree (`changedFiles(dir)`, as a set) differs now from `changedAtStart`. Either
+//    side being unknown (null: no git, or git unavailable) is never a race. Skipped entirely once
+//    `budgetDeadline` (the gate's own hook-timeout deadline, gateBudget() in stop-gate.mjs) has already
+//    passed (review pass 2, item 4): a second `git status` here is exactly the kind of extra work that
+//    could push a slow gate past the platform's own hook timeout, discarding its block message (F1) — a
+//    deadline already blown is not worth spending on a label, so this falls through to 'real' instead.
+// 4. 'real' — otherwise.
+//
+// Never throws (review pass 2, item 2 MAJOR): this call sits between the gate's decision to block and the
+// blockStop call that carries it out (stop-gate.mjs), so an unguarded throw here would fail the *whole gate*
+// open — the one outcome every hook reader must never risk (CLAUDE.md gotchas). Any failure classifies as
+// 'real', the least specific label, rather than ever propagating.
+export function classifyFinalBlock({ preVerificationProblems, evidenceProblemAdded, commandFailures, postCommandProblems, results, redByDesignClaimFiles, changedAtStart, dir, budgetDeadline }) {
+  try {
+    const failures = Array.isArray(commandFailures) ? commandFailures : [];
+    const namedByCommand = failures.map((cf) => failingTestFilesFrom(cf.output, dir));
+    const allNamed = [...new Set(namedByCommand.flat())];
+
+    const onlyFailedCommands =
+      preVerificationProblems === 0 &&
+      !evidenceProblemAdded &&
+      failures.length > 0 &&
+      postCommandProblems - preVerificationProblems === failures.length;
+    const everyCommandNamedAFile = failures.length > 0 && namedByCommand.every((files) => files.length > 0);
+    if (onlyFailedCommands && everyCommandNamedAFile && Array.isArray(redByDesignClaimFiles) && redByDesignClaimFiles.length > 0) {
+      const claimSet = new Set(redByDesignClaimFiles);
+      if (allNamed.every((f) => claimSet.has(f))) return "expected-red";
+    }
+
+    const timedOutOrDropped = (Array.isArray(results) ? results : []).some((r) => r.timedOut || r.skipped === "budget");
+    if (timedOutOrDropped && allNamed.length === 0) return "load-timeout";
+
+    if (Array.isArray(changedAtStart) && !(typeof budgetDeadline === "number" && Date.now() >= budgetDeadline)) {
+      const changedNow = changedFiles(dir);
+      if (Array.isArray(changedNow)) {
+        const before = new Set(changedAtStart);
+        const after = new Set(changedNow);
+        const same = before.size === after.size && [...before].every((f) => after.has(f));
+        if (!same) return "race";
+      }
+    }
+
+    return "real";
+  } catch {
+    return "real";
+  }
+}
+
+// Appends one line to .doug/.state/blocks.jsonl: { hook, at, agent, reason, class, session }. `reason` is
+// reduced to its own first line here (message.split("\n")[0]) whatever the caller passes, so a multi-line
+// block message never leaks past its headline into the ledger. Call synchronously, right before each
+// blockStop/systemMessage in stop-gate.mjs — those each call process.exit(0) themselves, so anything queued
+// after them never runs. Never throws: an unwritable .doug/.state, or a blocks.jsonl path that is itself a
+// directory, just skips the line silently; the gate's own decision is unaffected either way.
+export function appendBlockLine(dir, { hook, agent, reason, class: cls, session }) {
+  try {
+    const line =
+      JSON.stringify({
+        hook,
+        at: new Date().toISOString(),
+        agent: agent ?? null,
+        reason: String(reason).split("\n")[0],
+        class: cls,
+        session: session ?? null,
+      }) + "\n";
+    mkdirSync(join(dir, ".doug/.state"), { recursive: true });
+    appendFileSync(join(dir, BLOCKS_RELPATH), line);
+  } catch {
+    // a ledger write must never turn a block into a pass (a hook reader must never throw)
+  }
+}

package/node_modules/@dougharness/gates/lib/checkpoint.mjs

@@ -0,0 +1,97 @@
+// Checkpoint on green: when the stop gate passes with changes present, record the working tree so a
+// later regression can be undone with git instead of by memory. Off by default (config key
+// `checkpoint`). Two modes:
+//   commit  stage every change (except Claude Code's worktrees) and commit on the current branch
+//   tag     build a commit from a temporary index and tag it doug/checkpoint/<utc time>; the branch,
+//           the index, and the working tree are untouched. Restore with `git checkout <tag> -- .`
+// Never runs while a protected path is dirty, even one the Stop scan ignores (a lockfile), because a
+// checkpoint must never quietly commit what a person is supposed to look at. Never throws.
+
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { matchAny } from "./glob.mjs";
+
+export const MODES = ["commit", "tag"];
+export const DEFAULT_MESSAGE = "doug: checkpoint";
+// Claude Code keeps subagent worktrees inside the repo, untracked and unignored. Never stage them,
+// nor the per-session hook state (doug init ignores it, but a checkpoint must not depend on that).
+const STAGE_PATHSPEC = [".", ":(exclude).claude/worktrees", ":(exclude).doug/.state"];
+
+function git(args, cwd, env) {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 60000,
+    env: env ? { ...process.env, ...env } : process.env,
+  }).trim();
+}
+
+function tryGit(args, cwd, env) {
+  try {
+    return git(args, cwd, env);
+  } catch {
+    return null;
+  }
+}
+
+export function refName(at = new Date()) {
+  return "doug/checkpoint/" + at.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+
+export function commitMessage(cfg, gateResults) {
+  const head = (cfg.checkpoint && cfg.checkpoint.message) || DEFAULT_MESSAGE;
+  const gate = (gateResults || []).map((r) => `${r.name} ${r.ok ? "ok" : "failed"}`).join(", ");
+  return gate ? `${head}\n\ngate: ${gate}` : head;
+}
+
+// Returns one of: { skipped }, { error }, { mode, ref, sha }.
+export function checkpoint({ dir, cfg, changed, gateResults, at = new Date() }) {
+  const c = cfg.checkpoint || {};
+  if (!c.enabled) return { skipped: "disabled" };
+  const mode = c.mode || "commit";
+  if (!MODES.includes(mode)) return { error: `checkpoint.mode must be one of ${MODES.join(", ")}, got ${JSON.stringify(c.mode)}` };
+  if (!Array.isArray(changed)) return { skipped: "not a git repository" };
+  if (changed.length === 0) return { skipped: "no changes" };
+  const dirtyProtected = changed.filter((f) => matchAny(cfg.protectedPaths || [], f));
+  if (dirtyProtected.length) return { skipped: `protected path dirty: ${dirtyProtected.join(", ")}` };
+  const message = commitMessage(cfg, gateResults);
+
+  try {
+    if (mode === "commit") {
+      const branch = tryGit(["symbolic-ref", "--short", "-q", "HEAD"], dir);
+      if (!branch) return { skipped: "detached HEAD; a checkpoint commit needs a branch" };
+      git(["add", "-A", "--", ...STAGE_PATHSPEC], dir);
+      git(["commit", "-q", "-m", message], dir); // the repo's own commit hooks run; never bypassed
+      return { mode, ref: branch, sha: git(["rev-parse", "--short", "HEAD"], dir) };
+    }
+    const tmp = mkdtempSync(join(tmpdir(), "doug-checkpoint-"));
+    try {
+      const env = { GIT_INDEX_FILE: join(tmp, "index") };
+      const parent = tryGit(["rev-parse", "--verify", "-q", "HEAD"], dir);
+      if (parent) git(["read-tree", "HEAD"], dir, env);
+      git(["add", "-A", "--", ...STAGE_PATHSPEC], dir, env);
+      const tree = git(["write-tree"], dir, env);
+      const args = ["commit-tree", tree, "-m", message];
+      if (parent) args.push("-p", parent);
+      const full = git(args, dir);
+      const ref = refName(at);
+      git(["tag", ref, full], dir);
+      return { mode, ref, sha: full.slice(0, 7) };
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  } catch (err) {
+    const text = (err && (err.stderr || err.message)) || String(err);
+    return { error: String(text).trim().split("\n").slice(-3).join("\n") };
+  }
+}
+
+export function describeCheckpoint(ck) {
+  if (ck.error) return `[doug] Checkpoint failed: ${ck.error}`;
+  if (ck.skipped) return `[doug] Checkpoint skipped: ${ck.skipped}.`;
+  if (ck.mode === "commit") return `[doug] Checkpoint committed as ${ck.sha} on ${ck.ref}.`;
+  return `[doug] Checkpoint tagged ${ck.ref} (${ck.sha}); branch, index, and working tree untouched. Restore with: git checkout ${ck.ref} -- .`;
+}

package/node_modules/@dougharness/gates/lib/config.mjs

@@ -0,0 +1,168 @@
+// Loads .doug/config.json from the project directory and merges defaults.
+// The installer writes this file; hooks only read it. No network, no LLM.
+
+import { readFileSync, existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+
+export const CONFIG_RELPATH = ".doug/config.json";
+
+export const DEFAULTS = Object.freeze({
+  version: 1,
+  packageManager: null,
+  commands: {},
+  formatter: null,
+  protectedPaths: [".env", ".env.*", ".git/**", "node_modules/**", ".doug/config.json"],
+  // Written only through an approved proposal diff (card memory-decisions): a new ADR, an ADR amendment, or a
+  // rules file is rendered by decisions.mjs and applied with `learn.mjs apply` after the user approves it.
+  // protect-paths.mjs refuses the Edit/Write/MultiEdit/NotebookEdit tools on these, and the Stop gate flags a
+  // Bash-written change to them whose content is not recorded in the applied-proposal ledger
+  // (.doug/.state/proposals/applied.jsonl). Set to [] to turn this off.
+  proposalPaths: ["docs/decisions/**", ".claude/rules/**"],
+  // Paths outside the project directory (protect-paths.mjs) that an Edit/Write/MultiEdit/NotebookEdit may still
+  // touch: each entry is an absolute or ~-prefixed file or directory path (lib/paths.mjs isAllowedOutside).
+  // Empty by default so an existing project's behavior is unchanged.
+  allowedOutsidePaths: [],
+  bash: {
+    denyNoVerify: true,
+    denyForcePushTo: ["main", "master"],
+    denyDestructive: true,
+    packageManagerGuard: true,
+  },
+  // Deny secrets in edits/commands (lib/secret-rules.mjs): an AWS key id, a PEM private-key header,
+  // a GitHub/Slack token, or an inline password/secret/api_key/token assignment with a literal value.
+  secrets: {
+    enabled: true,
+    rules: { awsKeyId: true, pemPrivateKey: true, githubToken: true, slackToken: true, inlineAssignment: true },
+    placeholders: ["your_", "your-", "xxx", "placeholder", "example", "changeme", "dummy", "fake", "sample", "redacted"],
+    ignorePaths: [],
+  },
+  editLoop: { threshold: 6, windowMinutes: 30 },
+  stopGate: {
+    commands: [],
+    onlyIfEdited: true,
+    timeoutMs: 300000,
+    // Card stop-gate-budget-under-hook-timeout: the platform's own Stop/SubagentStop hook `timeout`
+    // (plugins/doug-gates/hooks/hooks.json and .claude/settings.json, seconds), the gate reads this
+    // to bound its own wait-plus-commands under it — a hook the platform kills is cancelled, fails
+    // open, and its output is discarded. Must equal that hook's declared `timeout`; nothing else keeps
+    // them in step (vendored-copies.test.mjs pins it). A non-number or non-positive value reads as 600.
+    hookTimeoutSec: 600,
+    maxBlocks: 3,
+    // Card stop-gate-deferral-cap: consecutive main Stops a subagent-in-flight deferral (D3 below) may skip
+    // before the gate runs the full verification anyway. A non-number, non-finite, or below-1 value (0,
+    // negative, a string, null, an object) reads as the default, 10 (stop-gate.mjs's normaliser).
+    maxDeferrals: 10,
+    // Protected paths that tools other than Edit may legitimately change (lockfiles via the package manager;
+    // .doug/config.json, written by `doug init`). They stay protected from hand edits — protect-paths.mjs still
+    // refuses the Edit/Write tool on them, and that refusal is the control that matters — but the Stop scan,
+    // which only catches Bash-originated writes after the fact, does not flag them. .doug/config.json needs this
+    // for the same reason a lockfile does: the installer's own first-run output must not block the very first
+    // Stop.
+    ignoreChangedPaths: [".doug/config.json"],
+    // With an approved or done .doug/plan.json, block the stop when a changed file is outside the
+    // files the plan's tasks own (lib/scope.mjs). ignoreChangedPaths applies here too.
+    planScope: true,
+    // Block the stop while this session has run no test or verify command itself (lib/evidence.mjs): the gate
+    // commands, any other configured command, a known test runner, or one of evidencePatterns (regular expressions).
+    requireEvidence: true,
+    evidencePatterns: [],
+  },
+  // Checkpoint on green (lib/checkpoint.mjs): when the stop gate passes with changes present, commit
+  // on the current branch ("commit") or tag a commit built off a temporary index ("tag"). Off by default.
+  checkpoint: { enabled: false, mode: "commit", message: "doug: checkpoint" },
+  // Run trace (lib/trace.mjs): one JSONL line per subagent start/stop and tool call under .doug/.state/trace/.
+  trace: { enabled: true },
+  budget: { maxTurns: null },
+  anchor: [],
+  // Context-window handoff (card context-window-handoff): the status line records context_window.used_percentage
+  // into session state when enabled, and the Stop gate advises (never compacts) at a green boundary once pct
+  // reaches threshold. Off by default so an existing project is unchanged. repeatAfter is the points of growth
+  // required before the Stop-gate notice repeats. Requires trace.enabled (on by default): the notice's "no
+  // subagent running" claim reads the run trace, so it stays silent while the trace is off rather than guess.
+  contextWindow: { enabled: false, threshold: 80, repeatAfter: 5 },
+  // Per-subagent cap on WebSearch plus WebFetch calls (scripts/research-cap.mjs, card research-fetch-cap): null
+  // or 0 turns it off. The main session is never capped.
+  research: { maxFetches: 6 },
+});
+
+export function projectDir(input) {
+  return resolve(process.env.CLAUDE_PROJECT_DIR || (input && input.cwd) || process.cwd());
+}
+
+function deepMerge(base, over) {
+  if (Array.isArray(base) || Array.isArray(over)) return over ?? base;
+  if (typeof base !== "object" || base === null) return over ?? base;
+  const out = { ...base };
+  for (const [k, v] of Object.entries(over || {})) {
+    out[k] = k in base && typeof base[k] === "object" && !Array.isArray(base[k]) ? deepMerge(base[k], v) : v;
+  }
+  return out;
+}
+
+// Card gates-config-shape-check (decision, option a), widened by card gates-config-shape-all-arrays: every
+// array-typed value in DEFAULTS (nested objects included) — the keys the gates iterate directly (matchAny's
+// `for (const raw of patterns)` in lib/glob.mjs, or an unguarded `for (const entry of ...)`) — must never reach a
+// gate as anything but an array. deepMerge's own ternary only recurses into an object base, so an array-typed
+// default's raw override (of any shape, including null) is assigned straight through. Fold that back to the
+// default here: a non-null, non-array value (a number, string, object, or boolean) warns once on stderr naming
+// the dotted path and falls back to its default, the way memory.embeddings already does
+// (plugins/doug-flow/lib/embeddings.mjs:48). An explicit null falls back to the default silently: for these keys
+// deepMerge's object branch (`out[k] = ... deepMerge(base[k], v) : v`) assigns v straight through, so a null
+// override already reached the gates as null before ddcc165 — the fallback here now covers that case too,
+// without a warning, matching the rest of loadConfig's `over ?? base` convention. A valid array, including [],
+// passes through unchanged. Array entries of the wrong type are out of scope. Derived by walking DEFAULTS itself
+// (not a hand list), so a new array-typed default is covered automatically. A parent object replaced by a
+// non-object in the user file (e.g. `stopGate: [1]`) is walked against DEFAULTS's shape, not the user's, so it
+// never throws; that parent's own shape is otherwise unchanged from HEAD behaviour (no new parent normalisation).
+function arrayShapePaths(defaults, prefix = []) {
+  let out = [];
+  for (const [k, v] of Object.entries(defaults)) {
+    const path = [...prefix, k];
+    if (Array.isArray(v)) out.push(path);
+    else if (v && typeof v === "object") out = out.concat(arrayShapePaths(v, path));
+  }
+  return out;
+}
+
+function normaliseArrayShapes(cfg) {
+  for (const path of arrayShapePaths(DEFAULTS)) {
+    // Walk cfg alongside path, stopping (leaving cfg as-is) if a parent along the way is not a plain object —
+    // covers a parent replaced by a non-object (stopGate: [1], secrets: "x") without throwing.
+    let parent = cfg;
+    let ok = true;
+    for (let i = 0; i < path.length - 1; i++) {
+      const next = parent[path[i]];
+      if (next === null || typeof next !== "object" || Array.isArray(next)) {
+        ok = false;
+        break;
+      }
+      parent = next;
+    }
+    if (!ok) continue;
+    const key = path[path.length - 1];
+    const v = parent[key];
+    if (v === undefined || Array.isArray(v)) continue;
+    const def = path.reduce((o, k) => o[k], DEFAULTS);
+    if (v === null) {
+      parent[key] = def;
+      continue;
+    }
+    process.stderr.write(`[doug] ${CONFIG_RELPATH} ${path.join(".")} is not an array; using the default\n`);
+    parent[key] = def;
+  }
+}
+
+export function loadConfig(dir) {
+  const file = join(dir, CONFIG_RELPATH);
+  if (!existsSync(file)) return { ...DEFAULTS, _present: false };
+  try {
+    const raw = JSON.parse(readFileSync(file, "utf8"));
+    const merged = { ...deepMerge(DEFAULTS, raw), _present: true };
+    normaliseArrayShapes(merged);
+    return merged;
+  } catch (err) {
+    // A broken config must never silently disable gates. Fall back to defaults and say so.
+    process.stderr.write(`[doug] ${CONFIG_RELPATH} is unreadable (${err.message}); using defaults\n`);
+    return { ...DEFAULTS, _present: false, _error: String(err.message) };
+  }
+}

package/node_modules/@dougharness/gates/lib/evidence.mjs

@@ -0,0 +1,59 @@
+// Verification evidence (proposal B, card verification-evidence): did this session itself run a test or verify
+// command? guard-bash records every allowed Bash command in the session state; the stop gate asks here whether any
+// of them is one of the gate commands, another configured project command, a known test runner, or a pattern
+// from stopGate.evidencePatterns. The gate's own run says whether verification passes; this says whether the
+// agent ever looked, so "ran and failed" and "never ran" get different messages.
+
+export const RUNNER_PATTERNS = [
+  /\bvitest\b/,
+  /\bjest\b/,
+  /\bmocha\b/,
+  /\bnode\s+--test\b/,
+  /\bpytest\b/,
+  /\bpython3?\s+-m\s+unittest\b/,
+  /(^|[\s;&|(])tsc(\s|$)/,
+  /\bcargo\s+test\b/,
+  /\bgo\s+test\b/,
+  /\bswift\s+test\b/,
+  /\bxcodebuild\b.*\btest\b/,
+  /\bmvn\b.*\btest\b/,
+  /\bgradle\w*\b.*\btest\b/,
+  /\bdotnet\s+test\b/,
+  /\bmake\s+(test|check)\b/,
+];
+
+// The commands the stop gate runs, by name, plus every other configured project command except install.
+export function evidenceCommands(cfg) {
+  const out = [];
+  for (const entry of (cfg.stopGate && cfg.stopGate.commands) || []) {
+    if (typeof entry !== "string") continue;
+    const named = cfg.commands && cfg.commands[entry];
+    out.push(typeof named === "string" ? named : entry);
+  }
+  for (const [name, command] of Object.entries(cfg.commands || {})) {
+    if (name === "install" || typeof command !== "string" || out.includes(command)) continue;
+    out.push(command);
+  }
+  return out;
+}
+
+// { ran: the recorded commands that count as verification, looked: what counts }.
+export function verificationEvidence(commands, cfg) {
+  const looked = evidenceCommands(cfg);
+  const extra = ((cfg.stopGate && cfg.stopGate.evidencePatterns) || []).flatMap((p) => {
+    try {
+      return [new RegExp(p)];
+    } catch {
+      return [];
+    }
+  });
+  const ran = (commands || []).filter((c) => typeof c === "string" && (looked.some((g) => g && c.includes(g)) || RUNNER_PATTERNS.some((r) => r.test(c)) || extra.some((r) => r.test(c))));
+  return { ran, looked };
+}
+
+export function describeMissingEvidence(looked, gatePassed) {
+  const named = looked.length ? looked.map((c) => `\`${c}\``).join(", ") + ", " : "";
+  return gatePassed
+    ? `No test or verify command ran in this session (looked for ${named}or a test runner such as vitest, jest, or pytest). The gate ran them here and they pass, but run the test command yourself and report its result before finishing; do not report work as verified that you did not verify.`
+    : `This session never ran a test or verify command itself (looked for ${named}or a test runner). Run it, read the failure above, and fix it before finishing.`;
+}

package/node_modules/@dougharness/gates/lib/glob.mjs

@@ -0,0 +1,86 @@
+// Minimal glob matching with no dependencies.
+// Supports **, *, ?, {a,b}, and leading "!" negation in matchAny.
+// Paths are matched as forward-slash relative paths.
+
+const cache = new Map();
+
+export function globToRegExp(glob) {
+  if (cache.has(glob)) return cache.get(glob);
+  let re = "";
+  let i = 0;
+  while (i < glob.length) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        // "**/" matches zero or more directories; "**" at end matches everything
+        if (glob[i + 2] === "/") {
+          re += "(?:.*/)?";
+          i += 3;
+        } else {
+          re += ".*";
+          i += 2;
+        }
+      } else {
+        re += "[^/]*";
+        i += 1;
+      }
+    } else if (c === "?") {
+      re += "[^/]";
+      i += 1;
+    } else if (c === "{") {
+      const end = glob.indexOf("}", i);
+      if (end === -1) {
+        re += "\\{";
+        i += 1;
+      } else {
+        const alts = glob
+          .slice(i + 1, end)
+          .split(",")
+          .map((s) => s.replace(/[.+^$()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*"));
+        re += "(?:" + alts.join("|") + ")";
+        i = end + 1;
+      }
+    } else if (/[.+^$()|[\]\\]/.test(c)) {
+      re += "\\" + c;
+      i += 1;
+    } else {
+      re += c;
+      i += 1;
+    }
+  }
+  const compiled = new RegExp("^" + re + "$");
+  cache.set(glob, compiled);
+  return compiled;
+}
+
+export function normalizePath(p) {
+  return p.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+
+export function matchGlob(glob, path) {
+  const n = normalizePath(path);
+  const g = normalizePath(glob);
+  if (globToRegExp(g).test(n)) return true;
+  // A bare directory-ish pattern like "dist" also matches "dist/anything"
+  if (!g.includes("*") && !g.includes("?") && n.startsWith(g + "/")) return true;
+  // Patterns without a slash match a basename anywhere (like .gitignore)
+  if (!g.includes("/")) {
+    const base = n.split("/").pop();
+    if (globToRegExp(g).test(base)) return true;
+  }
+  return false;
+}
+
+// Returns the first matching pattern, or null. Negations ("!x") exclude.
+export function matchAny(patterns, path) {
+  let hit = null;
+  for (const raw of patterns) {
+    const negated = raw.startsWith("!");
+    const pat = negated ? raw.slice(1) : raw;
+    if (matchGlob(pat, path)) {
+      if (negated) return null;
+      hit = hit ?? raw;
+    }
+  }
+  return hit;
+}

package/node_modules/@dougharness/gates/lib/io.mjs

@@ -0,0 +1,91 @@
+// Hook I/O against the Claude Code hook contract (Sept 2026).
+// - Input: one JSON object on stdin.
+// - Output: exit 0 with a JSON decision on stdout. Exit 2 with stderr only as a last resort.
+// Every hook fails OPEN on its own bugs, but visibly: a systemMessage names the hook and the error.
+
+export async function readInput(timeoutMs = 3000) {
+  const chunks = [];
+  const done = new Promise((resolve) => {
+    process.stdin.on("data", (c) => chunks.push(c));
+    process.stdin.on("end", resolve);
+    process.stdin.on("error", resolve);
+    setTimeout(resolve, timeoutMs).unref();
+  });
+  await done;
+  const text = Buffer.concat(chunks).toString("utf8").trim();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return {};
+  }
+}
+
+// Field-name compatibility across doc revisions.
+export function toolResponse(input) {
+  return input.tool_response ?? input.tool_output ?? null;
+}
+export function userPrompt(input) {
+  return input.prompt ?? input.user_prompt ?? "";
+}
+export function sessionStartReason(input) {
+  return input.source ?? input.session_start_reason ?? "";
+}
+
+function emit(obj) {
+  process.stdout.write(JSON.stringify(obj) + "\n");
+}
+
+export function allow() {
+  process.exit(0);
+}
+
+export function denyTool(reason) {
+  emit({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: reason,
+    },
+  });
+  process.exit(0);
+}
+
+export function askTool(reason) {
+  emit({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "ask",
+      permissionDecisionReason: reason,
+    },
+  });
+  process.exit(0);
+}
+
+export function addContext(hookEventName, text, extra = {}) {
+  emit({ ...extra, hookSpecificOutput: { hookEventName, additionalContext: text } });
+  process.exit(0);
+}
+
+export function blockStop(reason) {
+  emit({ decision: "block", reason });
+  process.exit(0);
+}
+
+export function systemMessage(message) {
+  emit({ systemMessage: message });
+  process.exit(0);
+}
+
+// Wraps a hook main() so that an unexpected exception never silently blocks or silently passes.
+export function runHook(name, main) {
+  readInput()
+    .then((input) => main(input))
+    .then(() => process.exit(0))
+    .catch((err) => {
+      const msg = `[doug:${name}] hook error, failing open: ${err && err.stack ? err.stack.split("\n")[0] : String(err)}`;
+      process.stderr.write(msg + "\n");
+      emit({ systemMessage: msg });
+      process.exit(0);
+    });
+}