@gobing-ai/spur 0.3.47 → 0.3.49

package/plugins/sp/commands/dev-run.md

@@ -1,5 +1,6 @@
 ---
 description: Run a task — full pipeline (precheck→implement→test→review→approve→verify→record→done) or single-step (implement)
+role: coder
 argument-hint: "<wbs> [--mode <full|implement>] [--agent <inline|auto|name>] [--auto] [--next] [--wrap] [--continue]"
 allowed-tools: ["Bash", "Read", "Write", "Edit", "Skill"]
 ---
@@ -14,7 +15,7 @@ Wraps the **sp:spur-dev** and **sp:code-implementation** skills.
 | --- | --- | --- |
 | `<wbs>` | Task WBS to run. | required |
 | `--mode` `<full\|implement>` | Full pipeline or single implement step. | full |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. In an interactive session, omit/`inline` keeps the controller in the host session (non-subprocess); eligible full-mode `agent.run` stages may dispatch once to a native subagent, with host fallback (task 0508). `auto` or a name keeps subprocess dispatch. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. In an interactive session, omit/`inline` keeps the controller in the host session (non-subprocess) — **omit**'s eligible full-mode `agent.run` stages may dispatch once to a native subagent, with host fallback (task 0508); explicit `--agent inline` is the zero-dispatch carve-out (every stage executes in the invoking session, never a native subagent). `auto` or a name keeps subprocess dispatch. | omit |
 | `--auto` | Skip objective HITL confirmations. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--wrap` | Run the wrap hop after the main step. The `--agent` selector is preserved into the `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. The wrap hop is workflow-backed and reports its trigger-3 subprocess override. | off |
@@ -37,7 +38,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 **Flags:**
 
-- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, where eligible `agent.run` stages may dispatch once to a native subagent and otherwise run in the host (task 0508). It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, where **omitted** `--agent`'s eligible `agent.run` stages may dispatch once to a native subagent and otherwise run in the host (task 0508); explicit `--agent inline` is the zero-dispatch carve-out — every stage executes in the invoking session. It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 
 **Mode split (load-bearing — bug-742)**
 

package/plugins/sp/commands/dev-runall.md

@@ -1,5 +1,6 @@
 ---
 description: Run a batch of tasks through their pipelines in dependency-correct order — resolve a set, topo-sort, run each via task-pipeline.yaml, emit a batch report
+role: planner
 argument-hint: "--tasks <selector> [--feature <id>] [--mode <sequential|parallel>] [--keep-going] [--auto] [--agent <inline|auto|name>] [--json] [--wrap] [--next] [--continue] [--worktree [<name>]]"
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
@@ -17,7 +18,7 @@ Wraps the **sp:spur-dev** skill.
 | `--mode` `<sequential\|parallel>` | Batch execution order. | sequential |
 | `--keep-going` | Continue past per-task failures. | off |
 | `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver — host-controlled, eligible `agent.run` stages may use a native subagent (task 0508); `auto`, a name, parallel mode, and headless invocation use subprocesses. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver — host-controlled; **omit**'s eligible `agent.run` stages may use a native subagent (task 0508); explicit `--agent inline` is the zero-dispatch carve-out (every stage executes in the invoking session). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
 | `--json` | Emit structured JSON. | off |
 | `--wrap` | Run the wrap hop per task. The `--agent` selector is preserved into each `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
@@ -80,6 +81,6 @@ full distinction.
 
 ## Implementation
 
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); eligible `agent.run` stages may dispatch once to a native subagent with host fallback (task 0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
+- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); **omitted** `--agent`'s eligible `agent.run` stages may dispatch once to a native subagent with host fallback (task 0508); explicit `--agent inline` is the zero-dispatch carve-out. `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
 - Interactive sequential omit/inline: `Skill(skill="sp:spur-dev", args="runall-inline $ARGUMENTS")`.
 - Explicit executor or parallel mode: `Skill(skill="sp:spur-dev", args="runall $ARGUMENTS")` → `sp:super-planner` agent.

package/plugins/sp/commands/dev-simplify.md

@@ -1,5 +1,6 @@
 ---
 description: Simplify code for clarity without changing behavior — reduce complexity in recent changes (or a given scope), preserving behavior exactly
+role: coder
 argument-hint: "[<path-or-scope>] [--scope <recent|all|path>] [--check <cmd>] [--agent <inline|auto|name>] [--auto]"
 allowed-tools: ["Bash", "Read", "Edit", "Skill"]
 ---
@@ -15,7 +16,7 @@ Wraps the **sp:code-simplification** skill.
 | `[<path-or-scope>]` | Path or scope to simplify. | recent |
 | `--scope` `<recent\|all\|path>` | Scope of the simplification pass. | recent |
 | `--check` `<cmd>` | Validation command to iterate against. | project gate |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing simplification. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing simplification. | omit |
 | `--auto` | Skip objective HITL gates (taste gates: over-engineering removal & cross-file utility extraction still require approval). | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).

package/plugins/sp/commands/dev-unit.md

@@ -1,5 +1,6 @@
 ---
 description: Generate or extend tests until the unit target is met
+role: coder
 argument-hint: "<target> [--coverage <n>] [--agent <inline|auto|name>] [--auto]"
 allowed-tools: ["Bash", "Read", "Write", "Edit", "Skill"]
 ---
@@ -14,7 +15,7 @@ Wraps the **sp:code-testing** skill.
 | --- | --- | --- |
 | `<target>` | File / module / path to generate tests for. | required |
 | `--coverage` `<n>` | Coverage percentage target. | configured |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing test work. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing test work. | omit |
 | `--auto` | Skip objective HITL gates. | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).

package/plugins/sp/commands/dev-verify.md

@@ -1,5 +1,6 @@
 ---
 description: Verify a task against its requirements and Acceptance Criteria — traceability check producing a PASS/PARTIAL/FAIL verdict with evidence
+role: reviewer
 argument-hint: "<wbs> [--agent <inline|auto|name>] [--fix <none|blockers-first|all>] [--focus <lens>] [--bdd] [--auto] [--force] [--next] [--skip-shippable]"
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
@@ -13,7 +14,7 @@ Wraps the **sp:code-verification** skill.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<wbs>` | Task WBS to verify. | required |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing verification. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing verification. | omit |
 | `--fix` `<none\|blockers-first\|all>` | Auto-fix policy on findings. | none |
 | `--focus` `<lens>` | Verification lens. | omitted |
 | `--bdd` | Run BDD scenarios. | off |

package/plugins/sp/commands/dev-verifyall.md

@@ -1,5 +1,6 @@
 ---
 description: Verify a batch of tasks against their requirements and Acceptance Criteria — batch traceability check producing per-task verdicts and a summary report
+role: reviewer
 argument-hint: "--tasks <selector> [--feature <id>] [--agent <inline|auto|name>] [--fix <none|blockers-first|all>] [--focus <lens>] [--bdd] [--auto] [--force] [--next] [--json] [--skip-shippable] [--worktree [<name>]]"
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
@@ -14,7 +15,7 @@ Wraps the **sp:spur-dev** and **sp:code-verification** skills.
 | --- | --- | --- |
 | `--tasks` `<selector>` | Task selector to verify. | required |
 | `--feature` `<id>` | Restrict to a feature. | omitted |
-| `--agent` `<inline\|auto\|name>` | Who runs each verification. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs each verification. | omit |
 | `--fix` `<none\|blockers-first\|all>` | Auto-fix policy on findings. | none |
 | `--focus` `<lens>` | Verification lens. | omitted |
 | `--bdd` | Run BDD scenarios. | off |

package/plugins/sp/commands/dev-wrap.md

@@ -1,5 +1,6 @@
 ---
 description: Wrap up a single completed task — learnings, metrics, doc-sync, optional feature transition and branch cleanup
+role: coder
 argument-hint: "<wbs> [--agent <inline|auto|name>] [--auto] [--merge] [--dry-run]"
 allowed-tools: ["Bash", "Read", "AskUserQuestion"]
 ---
@@ -13,7 +14,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<wbs>` | Task WBS to wrap. | required |
-| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed: omit/`inline` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); explicit `--agent inline` is rejected with the stable special error — a headless workflow surface cannot host a session; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge the wrap branch. | off |
 | `--dry-run` | Render the wrap without writing. | off |
@@ -31,13 +32,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
-  - omit/`--agent inline` → resolve to `agent.default` (the documented headless resolution of `inline`).
+  - omit → resolve to `agent.default`; explicit `--agent inline` → rejected with the stable special error (headless surface — no dispatch, no `agent.default` fallback).
 - Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
-  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>`, `executor: agent.default|<resolved-name>`.
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` rejects before dispatch — no executor resolves), `executor: agent.default|<resolved-name>`.
 - The wrap workflow still creates its durable run record (task_run_links / trace) — the notice reports the override, it does not change the workflow.
 
 ```bash
-AGENT=… # resolved above: agent.default for inline/omitted, tier-resolved for auto, unchanged for <name>
+AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, unchanged for <name>; explicit inline errors (headless)
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "[\"$WBS\"]" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, agent:$agent, profile:$profile, merge:$merge}')
@@ -45,4 +46,5 @@ spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
-the resolved name (`agent.default` for omit/`inline`).
+the resolved name (`agent.default` for omitted `--agent`; explicit `--agent inline` is rejected
+before dispatch).

package/plugins/sp/commands/dev-wrapall.md

@@ -1,5 +1,6 @@
 ---
 description: Wrap up a batch of completed tasks — learnings, metrics, doc-sync, feature transition, optional branch cleanup
+role: coder
 argument-hint: "[--since <iso-date>] [--feature <id>] [--status <s>] [--agent <inline|auto|name>] [--auto] [--merge] [--dry-run]"
 allowed-tools: ["Bash", "Read", "AskUserQuestion"]
 ---
@@ -15,7 +16,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | `--since` `<iso-date>` | Wrap tasks completed since a date. | configured |
 | `--feature` `<id>` | Wrap tasks in a feature. | omitted |
 | `--status` `<s>` | Only wrap tasks in a status. | done |
-| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed: omit/`inline` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); explicit `--agent inline` is rejected with the stable special error — a headless workflow surface cannot host a session; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge wrap branches. | off |
 | `--dry-run` | Render wraps without writing. | off |
@@ -33,13 +34,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
-  - omit/`--agent inline` → resolve to `agent.default` (the documented headless resolution of `inline`).
+  - omit → resolve to `agent.default`; explicit `--agent inline` → rejected with the stable special error (headless surface — no dispatch, no `agent.default` fallback).
 - Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
-  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>`, `executor: agent.default|<resolved-name>`.
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` rejects before dispatch — no executor resolves), `executor: agent.default|<resolved-name>`.
 - The wrap workflow still creates its durable run record — the notice reports the override, it does not change the workflow.
 
 ```bash
-AGENT=… # resolved above: agent.default for inline/omitted, tier-resolved for auto, unchanged for <name>
+AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, unchanged for <name>; explicit inline errors (headless)
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "$TASKS" --arg feature "$FEATURE" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, feature:$feature, agent:$agent, profile:$profile, merge:$merge}')
@@ -47,5 +48,6 @@ spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
-the resolved name (`agent.default` for omit/`inline`).
+the resolved name (`agent.default` for omitted `--agent`; explicit `--agent inline` is rejected
+before dispatch).
 

package/plugins/sp/commands/rule-add.md

@@ -1,5 +1,6 @@
 ---
 description: Author a validated, smoke-tested constraint rule
+role: scribe
 argument-hint: "\"<description>\" [--file <path>] [--preset <target>]"
 allowed-tools: ["Bash", "Read", "Write", "Skill"]
 ---

package/plugins/sp/commands/rule-refine.md

@@ -1,5 +1,6 @@
 ---
 description: Refine a constraint rule or preset, then re-verify it
+role: scribe
 argument-hint: "<rule-file-or-preset> [--intent \"<goal>\"] [--severity <sev>] [--scope <glob>] [--exempt <path>] [--disable <id>] [--override <id>] [--dry-run]"
 allowed-tools: ["Bash", "Read", "Edit", "Skill"]
 ---

package/plugins/sp/commands/rule-scan.md

@@ -1,5 +1,6 @@
 ---
 description: Discover recurring anti-patterns worth codifying as rules
+role: reviewer
 argument-hint: "[<path-or-glob>]"
 allowed-tools: ["Bash", "Read", "Grep", "Glob", "Skill"]
 ---

package/plugins/sp/commands/spur-init.md

@@ -1,5 +1,6 @@
 ---
 description: Initialize a new Spur project — scaffold config + docs, then customize for this project's stack and scope
+role: scribe
 argument-hint: "[--name <name>] [--minimal] [--force]"
 allowed-tools: ["Bash", "Read", "Write", "Skill"]
 ---

package/plugins/sp/commands/workflow-add.md

@@ -1,5 +1,6 @@
 ---
 description: Author a validated, dry-run-verified workflow in the right execution mode
+role: scribe
 argument-hint: "\"<description>\" [--kind <state-machine|transition-flow>] [--file <path>]"
 allowed-tools: ["Bash", "Read", "Write", "Skill"]
 ---

package/plugins/sp/commands/workflow-refine.md

@@ -1,5 +1,6 @@
 ---
 description: Refine an existing workflow, then re-validate and re-dry-run it
+role: scribe
 argument-hint: "<workflow-file> [--intent \"<goal>\"] [--dry-run]"
 allowed-tools: ["Bash", "Read", "Edit", "Skill"]
 ---

package/plugins/sp/hooks/careful-guard.ts

@@ -16,8 +16,13 @@
  * emits an `allow` decision. A broken guard must never wedge an agent tool call.
  *
  * **Escape hatch:** `SPUR_CAREFUL=off` short-circuits to allow.
+ *
+ * Classification itself lives in `destructive-policy.ts` — one policy, every platform
+ * adapter. This file owns the Claude Code payload/decision shape only.
  */
 
+import { classifyCommand } from './destructive-policy';
+
 interface ToolPayload {
     tool_name?: string;
     tool_input?: { command?: string };
@@ -37,86 +42,6 @@ function preToolUseDecision(decision: Decision, reason?: string): never {
     process.exit(0);
 }
 
-/** Well-known rebuildable caches a `rm -rf` may target without a warning. */
-const SAFE_RM_TARGET =
-    /^(?:\.?\/)?(?:[\w.@-]+\/)*(?:node_modules|dist|\.next|coverage|build|\.turbo|\.cache|\.parcel-cache|out)\/?\*?$/;
-
-/**
- * Expand an argument string into the set of flags it sets, splitting short-flag
- * clusters into their individual letters: `-Rf --force` → `{R, f, --force}`.
- *
- * Matching flags with ad-hoc regexes per call site is what let `rm -R` through —
- * `-\w*r` only ever matched the lowercase spelling, even though `man rm` defines
- * `-r` as "Equivalent to -R". Parsing once, case-preserved, makes that class of
- * miss unrepresentable: a caller names every spelling it cares about explicitly.
- */
-function parseFlags(args: string): Set<string> {
-    const flags = new Set<string>();
-    for (const token of args.trim().split(/\s+/)) {
-        if (token.length < 2 || !token.startsWith('-') || token === '--') continue;
-        if (token.startsWith('--')) {
-            flags.add(token.split('=')[0] as string); // `--force=x` → `--force`
-            continue;
-        }
-        for (const ch of token.slice(1)) flags.add(ch);
-    }
-    return flags;
-}
-
-/** True when a `rm` invocation is both recursive and forced (any flag spelling). */
-function isRecursiveForceRm(args: string): boolean {
-    const flags = parseFlags(args);
-    // POSIX rm accepts -r and -R interchangeably; --recursive is the GNU long form.
-    const recursive = flags.has('r') || flags.has('R') || flags.has('--recursive');
-    const force = flags.has('f') || flags.has('--force');
-    return recursive && force;
-}
-
-/** True when every non-flag target of a `rm` invocation is a known-safe cache path. */
-function rmTargetsAllSafe(args: string): boolean {
-    const targets = args
-        .trim()
-        .split(/\s+/)
-        .filter((t) => t.length > 0 && !t.startsWith('-'));
-    if (targets.length === 0) return false;
-    return targets.every((t) => SAFE_RM_TARGET.test(t));
-}
-
-/** Always-warn destructive patterns (no safe exception). */
-const DESTRUCTIVE: Array<{ label: string; re: RegExp }> = [
-    {
-        label: 'a SQL DROP/TRUNCATE (DROP TABLE/DATABASE, TRUNCATE)',
-        re: /\b(?:DROP\s+(?:TABLE|DATABASE)|TRUNCATE(?:\s+TABLE)?)\b/i,
-    },
-    { label: 'a force push (git push --force / -f)', re: /\bgit\s+push\b[^\n]*(?:--force(?!-with-lease)|\s-f\b)/i },
-    {
-        // `git push origin +main` forces that ref without any --force flag.
-        label: 'a force push via a + refspec (git push … +ref)',
-        re: /\bgit\s+push\b[^\n]*\s\+[\w./-]+/i,
-    },
-    { label: 'a hard reset (git reset --hard)', re: /\bgit\s+reset\b[^\n]*--hard\b/i },
-    {
-        label: 'a working-tree discard (git checkout . / git restore .)',
-        re: /\bgit\s+(?:checkout|restore)\s+(?:--\s+)?\.(?:\s|$)/i,
-    },
-    { label: 'a cluster delete (kubectl delete)', re: /\bkubectl\s+delete\b/i },
-    { label: 'a docker prune (docker system prune)', re: /\bdocker\s+system\s+prune\b/i },
-];
-
-/** Return a human label for the destructive command, or null when the command is safe. */
-function classifyCommand(command: string): string | null {
-    for (const rmMatch of command.matchAll(/\brm\b([^\n&|;]*)/g)) {
-        const args = rmMatch[1] ?? '';
-        if (isRecursiveForceRm(args) && !rmTargetsAllSafe(args)) {
-            return 'a recursive force remove (rm -rf)';
-        }
-    }
-    for (const { label, re } of DESTRUCTIVE) {
-        if (re.test(command)) return label;
-    }
-    return null;
-}
-
 async function main(): Promise<void> {
     if (process.env.SPUR_CAREFUL === 'off') preToolUseDecision('allow');
 

package/plugins/sp/hooks/destructive-policy.ts

@@ -0,0 +1,146 @@
+/**
+ * destructive-policy — the single destructive-command classifier shared by every
+ * platform guard (task 0215 R3; extracted from `careful-guard.ts`).
+ *
+ * **Why this module exists.** The policy used to live inline in `careful-guard.ts`
+ * (Claude Code) and was re-implemented with hand-rolled regexes in
+ * `pi/guard-extension.ts` (Pi). The two drifted: the Pi copy allowed
+ * `rm -rf node_modules /etc/nginx`, `rm -R --force /var/data`, `git push -f`, and
+ * `git push origin +main` — all of which the Claude matrix pins as `ask` — while
+ * warning on `git push --force-with-lease` and `rm -f config.json`, which it pins as
+ * `allow`. Seven of ten pinned cases diverged. A safety control with one
+ * implementation per platform is a safety control that is wrong on all but one of
+ * them, so the policy is defined once, here, and every adapter imports it.
+ *
+ * Adapters own **I/O only** (payload shape, how a prompt is raised). They must not
+ * re-derive classification.
+ */
+
+/**
+ * Well-known rebuildable caches a `rm -rf` may target without a warning.
+ *
+ * Project-relative only — the leading `/` this used to accept made the exception
+ * match by *basename anywhere on the filesystem*, so `rm -rf /Users/me/dist` was
+ * treated as routine. Escaping targets are rejected by {@link escapesProject}
+ * before this is consulted; keeping the anchor tight is belt-and-braces.
+ */
+const SAFE_RM_TARGET =
+    /^(?:\.\/)?(?:[\w.@-]+\/)*(?:node_modules|dist|\.next|coverage|build|\.turbo|\.cache|\.parcel-cache|out)\/?\*?$/;
+
+/**
+ * True when a target points outside the project tree: an absolute path, a `~`
+ * home path, or one that walks out via `..`.
+ *
+ * Recursive deletion inside the project is routine (build caches, scratch dirs) and
+ * recoverable from git; recursive deletion *outside* it is neither, whatever the
+ * directory happens to be named. This is the axis that decides a bare `rm -r`,
+ * which is otherwise unguarded — `rm -r ./tmpdir` stays routine while
+ * `rm -r /Users/me/photos` prompts.
+ */
+function escapesProject(target: string): boolean {
+    const t = target.replace(/^['"]|['"]$/g, '');
+    if (t.startsWith('/') || t.startsWith('~')) return true;
+    if (t.startsWith('$')) return true; // `$HOME/...`, `"$HOME"/...` — unknown expansion
+    return t.split('/').includes('..');
+}
+
+/**
+ * Expand an argument string into the set of flags it sets, splitting short-flag
+ * clusters into their individual letters: `-Rf --force` → `{R, f, --force}`.
+ *
+ * Matching flags with ad-hoc regexes per call site is what let `rm -R` through —
+ * `-\w*r` only ever matched the lowercase spelling, even though `man rm` defines
+ * `-r` as "Equivalent to -R". Parsing once, case-preserved, makes that class of
+ * miss unrepresentable: a caller names every spelling it cares about explicitly.
+ */
+export function parseFlags(args: string): Set<string> {
+    const flags = new Set<string>();
+    for (const token of args.trim().split(/\s+/)) {
+        if (token.length < 2 || !token.startsWith('-') || token === '--') continue;
+        if (token.startsWith('--')) {
+            flags.add(token.split('=')[0] as string); // `--force=x` → `--force`
+            continue;
+        }
+        for (const ch of token.slice(1)) flags.add(ch);
+    }
+    return flags;
+}
+
+/** True when a `rm` invocation is both recursive and forced (any flag spelling). */
+export function isRecursiveForceRm(args: string): boolean {
+    const flags = parseFlags(args);
+    // POSIX rm accepts -r and -R interchangeably; --recursive is the GNU long form.
+    const recursive = flags.has('r') || flags.has('R') || flags.has('--recursive');
+    const force = flags.has('f') || flags.has('--force');
+    return recursive && force;
+}
+
+/**
+ * True when **every** non-flag target of a `rm` invocation is a known-safe cache
+ * path. Every, not some: `rm -rf node_modules /etc/nginx` must still warn, and a
+ * substring test over the whole argument string (the Pi copy's approach) let one
+ * cache path whitelist every other target in the same command.
+ */
+export function rmTargetsAllSafe(args: string): boolean {
+    const targets = rmTargets(args);
+    if (targets.length === 0) return false;
+    return targets.every((t) => SAFE_RM_TARGET.test(t));
+}
+
+/** Non-flag targets of a `rm` invocation. */
+function rmTargets(args: string): string[] {
+    return args
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0 && !t.startsWith('-'));
+}
+
+/** Always-warn destructive patterns (no safe exception). */
+const DESTRUCTIVE: Array<{ label: string; re: RegExp }> = [
+    {
+        label: 'a SQL DROP/TRUNCATE (DROP TABLE/DATABASE, TRUNCATE)',
+        re: /\b(?:DROP\s+(?:TABLE|DATABASE)|TRUNCATE(?:\s+TABLE)?)\b/i,
+    },
+    { label: 'a force push (git push --force / -f)', re: /\bgit\s+push\b[^\n]*(?:--force(?!-with-lease)|\s-f\b)/i },
+    {
+        // `git push origin +main` forces that ref without any --force flag.
+        label: 'a force push via a + refspec (git push … +ref)',
+        re: /\bgit\s+push\b[^\n]*\s\+[\w./-]+/i,
+    },
+    { label: 'a hard reset (git reset --hard)', re: /\bgit\s+reset\b[^\n]*--hard\b/i },
+    {
+        label: 'a working-tree discard (git checkout . / git restore .)',
+        re: /\bgit\s+(?:checkout|restore)\s+(?:--\s+)?\.(?:\s|$)/i,
+    },
+    {
+        // `git clean` destroys UNTRACKED files — nothing in git to recover them from,
+        // which makes it the least recoverable command in this family. `-n`/`--dry-run`
+        // only lists, so the prompt is gated on the force flag git itself requires.
+        label: 'an untracked-file delete (git clean -f)',
+        re: /\bgit\s+clean\b[^\n]*(?:\s-[a-zA-Z]*f|\s--force\b)/i,
+    },
+    { label: 'a cluster delete (kubectl delete)', re: /\bkubectl\s+delete\b/i },
+    { label: 'a docker prune (docker system prune)', re: /\bdocker\s+system\s+prune\b/i },
+];
+
+/** Return a human label for the destructive command, or null when the command is safe. */
+export function classifyCommand(command: string): string | null {
+    for (const rmMatch of command.matchAll(/\brm\b([^\n&|;]*)/g)) {
+        const args = rmMatch[1] ?? '';
+        const flags = parseFlags(args);
+        const recursive = flags.has('r') || flags.has('R') || flags.has('--recursive');
+        // A recursive delete reaching outside the project prompts whether or not
+        // `--force` was passed: `rm -r` deletes a whole tree without prompting for
+        // any writable file, and nothing outside the project is recoverable from git.
+        if (recursive && rmTargets(args).some(escapesProject)) {
+            return 'a recursive remove outside the project (rm -r on an absolute, ~, or ../ path)';
+        }
+        if (isRecursiveForceRm(args) && !rmTargetsAllSafe(args)) {
+            return 'a recursive force remove (rm -rf)';
+        }
+    }
+    for (const { label, re } of DESTRUCTIVE) {
+        if (re.test(command)) return label;
+    }
+    return null;
+}