@khoavu882/doflow 0.0.0-stage → 2.0.0-beta.3

package/core/harnesses/shared/hooks/adapters/antigravity.js

@@ -0,0 +1,111 @@
+'use strict';
+
+/**
+ * Antigravity payload/decision adapter for the Cross-Harness Hook Runner (design.md C2's
+ * Payload Adapter / Decision Adapter seam, D2).
+ *
+ * Antigravity's own native contracts — evidenced by core/harnesses/antigravity/hooks/*.sh (the
+ * shims src/adapters/antigravity/index.js actually projects today) and
+ * src/adapters/antigravity/index.js's own GATE_MATCHER/hookGroups — are NOT uniform across
+ * events. Only PreToolUse and Stop are wired live there today:
+ *
+ *   PreToolUse : stdin  { toolCall: { name, args }, conversationId, workspacePaths, stepIdx }
+ *                stdout { decision: "allow"|"deny"|"ask"|"force_ask", reason?, overwrite? }
+ *   Stop       : stdin  { executionNum, terminationReason, fullyIdle, transcriptPath }
+ *                stdout { decision: "continue", reason } to block the stop; NO positive field at
+ *                all (silence) to let it proceed — confirmed by
+ *                core/harnesses/antigravity/hooks/stop-check.sh's own header ("FAIL-OPEN
+ *                DOCTRINE... silence lets the session end"). This is a different decision
+ *                vocabulary than PreToolUse's allow/deny/ask/force_ask, not an oversight.
+ *
+ * SessionStart and PostToolUse have no dedicated Antigravity-native shim in
+ * src/adapters/antigravity/index.js's live projection; core/.antigravity-plugin/hooks.json (a
+ * separate, read-only-to-this-task artifact) documents both routed directly to the *Gemini*
+ * session-start.sh / post-edit-lint.sh scripts, which read the Claude/Gemini-style
+ * session_id/cwd/tool_name/tool_input field names, not the toolCall envelope above — this
+ * adapter honors that evidence for those two events rather than guessing at a toolCall shape
+ * with no corroborating source. No Phase A canonical policy owns PostToolUse today (only
+ * session-context, pre-implementation-gate, mcp-tool-guard, stop-check, pre-bash-guard exist),
+ * so its native shape is an ack passthrough either way.
+ */
+
+const { FILE_PATH_ARG_FIELDS, COMMAND_ARG_FIELDS, firstArgField } = require('./arg-fields');
+
+function toCanonical(event, payload) {
+  const safePayload = payload && typeof payload === 'object' ? payload : {};
+
+  switch (event) {
+    case 'SessionStart':
+      return { session_id: safePayload.session_id || '', cwd: safePayload.cwd || '' };
+
+    case 'PreToolUse': {
+      const toolCall = safePayload.toolCall || {};
+      const args = toolCall.args || {};
+      return {
+        tool_name: toolCall.name || '',
+        tool_input: {
+          file_path: firstArgField(args, FILE_PATH_ARG_FIELDS),
+          command: firstArgField(args, COMMAND_ARG_FIELDS),
+        },
+      };
+    }
+
+    case 'PostToolUse':
+      // No Phase A policy consumes this event — canonical shape kept for symmetry only.
+      return {
+        tool_name: safePayload.tool_name || '',
+        session_id: safePayload.session_id || '',
+        tool_input: { file_path: (safePayload.tool_input && safePayload.tool_input.file_path) || '' },
+      };
+
+    case 'Stop':
+      return {
+        session_id: safePayload.session_id || '',
+        transcript_path: safePayload.transcriptPath || safePayload.transcript_path || '',
+      };
+
+    case 'PreInvocation':
+      // No Phase A policy — ack only (injectSteps handled entirely in toNative).
+      return {};
+
+    default:
+      return safePayload;
+  }
+}
+
+function toNative(event, decision) {
+  const safeDecision = decision || { decision: 'allow' };
+
+  switch (event) {
+    case 'PreToolUse':
+      if (safeDecision.decision === 'deny') {
+        return { decision: 'deny', reason: safeDecision.reason };
+      }
+      return { decision: 'allow' };
+
+    case 'PostToolUse':
+      // Preserve the existing empty-ack contract — no policy decision to report.
+      return {};
+
+    case 'Stop':
+      if (safeDecision.decision === 'deny') {
+        return { decision: 'continue', reason: safeDecision.reason };
+      }
+      // Silence (no positive field) lets the session stop, per Antigravity's own documented
+      // Stop contract — not the allow/deny vocabulary PreToolUse uses.
+      return {};
+
+    case 'PreInvocation':
+      return { injectSteps: [] };
+
+    case 'SessionStart':
+      // Side-effect-only event; Antigravity's own SessionStart routing writes no structured
+      // stdout today (routed directly to bash, which produces none).
+      return {};
+
+    default:
+      return { decision: 'allow' };
+  }
+}
+
+module.exports = { toCanonical, toNative };

package/core/harnesses/shared/hooks/adapters/arg-fields.js

@@ -0,0 +1,19 @@
+'use strict';
+
+/**
+ * Shared toolCall.args field-name lookup for the toolCall/args envelope adapters
+ * (antigravity.js, gemini.js's fallback path) both read when mapping to canonical
+ * file_path/command. Extracted because both adapters carried an identical copy.
+ */
+
+const FILE_PATH_ARG_FIELDS = ['AbsolutePath', 'TargetFile', 'Path', 'file_path', 'path'];
+const COMMAND_ARG_FIELDS = ['CommandLine', 'command'];
+
+function firstArgField(args, fields) {
+  for (const field of fields) {
+    if (args && args[field]) return args[field];
+  }
+  return '';
+}
+
+module.exports = { FILE_PATH_ARG_FIELDS, COMMAND_ARG_FIELDS, firstArgField };

package/core/harnesses/shared/hooks/adapters/gemini.js

@@ -0,0 +1,114 @@
+'use strict';
+
+/**
+ * Gemini CLI payload/decision adapter for the Cross-Harness Hook Runner (design.md C2's
+ * Payload Adapter / Decision Adapter seam, D2).
+ *
+ * Gemini's own native contract — evidenced by core/harnesses/gemini/hooks/*.sh and
+ * core/harnesses/gemini/hooks/hooks.json, all currently invoked directly by bash rather than
+ * through this runner — already speaks field names close to Claude/Codex/Kiro's, NOT
+ * Antigravity's toolCall/args envelope:
+ *
+ *   SessionStart           : stdin  { session_id, cwd }                          (session-start.sh)
+ *   BeforeTool (~PreToolUse): stdin  { tool_name, tool_input: { file_path, command } }
+ *                             stdout { decision: "allow"|"deny", reason } — TOP-LEVEL, not
+ *                             nested under hookSpecificOutput.permissionDecision like
+ *                             Claude/Codex (confirmed in gemini/hooks/pre-bash-guard.sh's header).
+ *   AfterTool (~PostToolUse): stdin { tool_name, tool_input: { file_path }, session_id }
+ *                             (post-edit-lint.sh) — stdout {} (ack; no Phase A policy owns this
+ *                             event, post-edit-lint.sh's collector role is out of FR-001's scope)
+ *   Stop                    : NOT a documented Gemini lifecycle event — gemini/hooks/
+ *                             post-edit-lint.sh's own comment states "Gemini has no
+ *                             Stop-equivalent event," and no stop-check.sh ships under
+ *                             gemini/hooks/ today. Handled defensively below (same field-name
+ *                             union stop-check.sh itself accepts) in case a future Gemini
+ *                             version adds one, or in case core/harnesses/shared/hooks/hooks.json's
+ *                             existing (currently dangling) Stop entry is corrected to a real target.
+ *
+ * NFR-002 note: core/harnesses/shared/hooks/hooks.json has historically routed PreToolUse through
+ * this runner using Antigravity's { toolCall: { name, args } } envelope — inherited from this
+ * runner's original Antigravity-only design (see the runner's own prior header comment), not
+ * verified against Gemini's own documented schema above. toCanonical() below reads the
+ * tool_name/tool_input shape first (Gemini's own evidenced contract) and falls back to the
+ * toolCall envelope only if that shape isn't present, so this adapter is correct once that
+ * wiring is corrected without silently breaking before it is.
+ */
+
+const { FILE_PATH_ARG_FIELDS, COMMAND_ARG_FIELDS, firstArgField } = require('./arg-fields');
+
+function toCanonical(event, payload) {
+  const safePayload = payload && typeof payload === 'object' ? payload : {};
+
+  switch (event) {
+    case 'SessionStart':
+      return { session_id: safePayload.session_id || '', cwd: safePayload.cwd || '' };
+
+    case 'PreToolUse': {
+      if (safePayload.tool_name !== undefined || safePayload.tool_input !== undefined) {
+        const toolInput = safePayload.tool_input || {};
+        return {
+          tool_name: safePayload.tool_name || '',
+          tool_input: {
+            file_path: toolInput.file_path || '',
+            command: toolInput.command || '',
+          },
+        };
+      }
+      // Defensive fallback: Antigravity-shaped envelope (see header note).
+      const toolCall = safePayload.toolCall || {};
+      const args = toolCall.args || {};
+      return {
+        tool_name: toolCall.name || '',
+        tool_input: {
+          file_path: firstArgField(args, FILE_PATH_ARG_FIELDS),
+          command: firstArgField(args, COMMAND_ARG_FIELDS),
+        },
+      };
+    }
+
+    case 'PostToolUse':
+      return {
+        tool_name: safePayload.tool_name || '',
+        session_id: safePayload.session_id || '',
+        tool_input: { file_path: (safePayload.tool_input && safePayload.tool_input.file_path) || '' },
+      };
+
+    case 'Stop':
+      return {
+        session_id: safePayload.session_id || '',
+        transcript_path: safePayload.transcript_path || safePayload.transcriptPath || '',
+      };
+
+    default:
+      return safePayload;
+  }
+}
+
+function toNative(event, decision) {
+  const safeDecision = decision || { decision: 'allow' };
+
+  switch (event) {
+    case 'PreToolUse':
+      if (safeDecision.decision === 'deny') {
+        return { decision: 'deny', reason: safeDecision.reason };
+      }
+      return { decision: 'allow' };
+
+    case 'PostToolUse':
+      return {};
+
+    case 'Stop':
+      if (safeDecision.decision === 'deny') {
+        return { decision: 'deny', reason: safeDecision.reason };
+      }
+      return { decision: 'allow' };
+
+    case 'SessionStart':
+      return {};
+
+    default:
+      return { decision: 'allow' };
+  }
+}
+
+module.exports = { toCanonical, toNative };

package/core/harnesses/shared/hooks/hooks.json

@@ -0,0 +1,47 @@
+{
+  "description": "DoFlow shared lifecycle hooks schema for Antigravity, Gemini, and Claude.",
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$DOFLOW_PROJECT_DIR/.gemini/hooks/session-start.sh\""
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "^(run_command|run_shell_command|replace_file_content|write_to_file|multi_replace_file_content|edit_file|Edit|Write)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$DOFLOW_PROJECT_DIR/.doflow/scripts/stream-hook-runner.js\""
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "^(replace_file_content|write_to_file|multi_replace_file_content|edit_file|Edit|Write)$",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$DOFLOW_PROJECT_DIR/.gemini/hooks/post-edit-lint.sh\""
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash \"$DOFLOW_PROJECT_DIR/.gemini/hooks/stop-check.sh\""
+          }
+        ]
+      }
+    ]
+  }
+}

package/core/harnesses/shared/hooks/policies/blocked-patterns.conf

@@ -0,0 +1,91 @@
+# blocked-patterns.conf — Dangerous command patterns for pre-bash-guard.sh
+#
+# Format (TAB-separated):
+#   regex<TAB>reason shown to the harness<TAB>exclude_regex (optional)
+#
+# Rules:
+#   - Lines beginning with # are comments (skipped)
+#   - Empty lines are skipped
+#   - Regex is POSIX Extended Regular Expression (ERE, as used by `grep -E`),
+#     matched case-insensitively against the full command string (RM and GIT run
+#     on a case-insensitive filesystem such as the macOS default), which
+#     includes any expanded heredocs or -m "..." arguments. Git and rm
+#     patterns use a command-context anchor:
+#       (^|[[:space:]]*(&&|\|\||;)[[:space:]]*)
+#     so they only fire when the dangerous text is an actual invocation,
+#     not when it appears as text inside a commit message or other argument.
+#   - Anchored patterns (those beginning with "(^|") are matched against the
+#     command with quoted text blanked out (pre-bash-guard.sh scrub_quotes),
+#     so echo "x && rm -rf /" or git commit -m "git reset --hard" is not a
+#     command. The argument of sh -c, bash -c, zsh -c and eval is NOT blanked
+#     (it executes). Every other pattern is matched against the full text.
+#   - The rm lines use a wider command position than the others: start of a
+#     line or after ; & | ( or a backtick, then optional sudo/command/time/
+#     nohup/exec/env (with options, VAR=x and, per wrapper, the options that take
+#     a separate argument: sudo -u/-g/-C/-h/-p/-r/-t/-U/-D/-R and --user/--group
+#     root, xargs -n/-I/-L/-P/-s/-d/-E/-a, env -u/-C/-S)/xargs/eval/then/do/else, then rm,
+#     \rm, /bin/rm or /usr/bin/rm. "git rm" and "echo rm -rf /" are therefore
+#     not matched. pre-bash-guard.sh's hardcoded floor uses the same rule.
+#     Matching is case-insensitive, so an uppercase flag-only option that shares a
+#     letter with a value-taking one (sudo -H beside -h, xargs -p beside -P) is
+#     treated as value-taking: a false deny, the fail-safe direction.
+#   - The git patterns accept git's global options before the subcommand
+#     (git -C dir push, git -c k=v push). The force-push rules block -f (also
+#     inside a flag cluster such as -uf), --force and a +refspec; the
+#     --force-with-lease form stays allowed, as the reason text advises, but a
+#     +refspec still blocks next to a lease (git push --force-with-lease origin +main).
+#   - The find rule blocks -delete, and -exec rm, off the root, a home directory
+#     or a system directory (among other start paths, find or \find or
+#     /usr/bin/find) when only -type, -maxdepth/-mindepth N, -mount, -xdev,
+#     -depth, -noleaf, -follow or -ignore_readdir_race follow the path: none of
+#     those narrows what is deleted. Any other predicate (-name, -path, -newer,
+#     -mtime, -size, -user, -empty ...) counts as scoping, so
+#     find ~ -name '*.pyc' -delete is allowed.
+#   - SQL patterns are intentionally NOT anchored — DROP/DELETE/TRUNCATE
+#     inside heredoc-to-psql pipelines are real execution and must be caught.
+#   - The optional third column is an exclude_regex: when present and the
+#     command ALSO matches it, the pattern line is skipped (not blocked).
+#     This is how negative-lookahead behavior (unsupported in POSIX ERE) is
+#     approximated — e.g. "git push --force" blocks force pushes, but the
+#     exclude_regex "--force-with-lease" lets that safer variant through.
+#   - First matching pattern wins — order matters
+#   - A malformed regex on any line is skipped (guard continues safely)
+#
+# Add project-specific patterns at the bottom of this file.
+
+# ── Dangerous git operations ──────────────────────────────────────────────────
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(--force|-[a-zA-Z]*f[a-zA-Z]*)([^-[:alnum:]]|$)	Force push blocked — use --force-with-lease or confirm with user first
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+push([[:space:]]+[^[:space:];&|]+)*[[:space:]]+\+[^[:space:];&|]+	Force push blocked — use --force-with-lease or confirm with user first
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+reset --hard	Destructive reset blocked — commit or stash changes before resetting
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--(git-dir|work-tree|namespace|exec-path)[[:space:]]+[^[:space:];&|]+|-[^[:space:];&|]+))*[[:space:]]+clean -fd	Irreversible clean blocked — use --dry-run to preview what would be deleted
+
+# ── Filesystem catastrophes ───────────────────────────────────────────────────
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/+\*{0,2})([[:space:];&|)`]|$)|(/+\*{0,2})([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the root directory (/)
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:];&|)`]|$)|((~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of the home directory
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?rm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+((-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:];&|)`]|$)|(/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:];&|)`]|$))	Catastrophic delete blocked — recursive rm of a system directory
+(^|[;&|(`])[[:space:]]*((sudo([[:space:]]+(-[ugChprtUDR][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|--(user|group|host|prompt|role|type|chdir)[[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|xargs([[:space:]]+(-[nILPsdEa][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|env([[:space:]]+(-[uCS][[:space:]]+[^-[:space:];&|][^[:space:];&|]*|-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*|(command|time|nohup|exec|eval|then|do|else)([[:space:]]+(-[^[:space:];&|]*|[A-Za-z_][A-Za-z0-9_]*=[^[:space:];&|]*))*)[[:space:]]+)*(\\|/(usr/)?bin/)?find([[:space:]]+-[HLP])*([[:space:]]+[^-[:space:];&|][^[:space:];&|]*)*[[:space:]]+(/+\*{0,2}|(~[A-Za-z_][A-Za-z0-9_.-]*|~|\$HOME|\$\{HOME\})(/\*{0,2})?|/(Users|home|etc|usr|bin|sbin|var|opt|System|Library|Applications|Volumes|private|root|boot|lib|dev|proc)(/\*{0,2})?)([[:space:]]+([^-[:space:];&|][^[:space:];&|]*|-(mount|xdev|depth|noleaf|follow|ignore_readdir_race)|-(type|maxdepth|mindepth)[[:space:]]+[^[:space:];&|]+))*[[:space:]]+(-delete([[:space:];&|)`]|$)|-exec(dir)?[[:space:]]+(\\|/(usr/)?bin/)?rm([[:space:];&|)`]|$))	Catastrophic delete blocked — find -delete or -exec rm from the root, home or a system directory with no name, path or time predicate to scope it
+
+# ── SQL destructive statements (no anchor — must catch inside psql heredocs) ──
+DROP[[:space:]]+(TABLE|DATABASE|SCHEMA)[[:space:]]	Destructive DDL blocked — confirm with user before dropping
+DELETE[[:space:]]+FROM[[:space:]]+[[:alnum:]_]+[[:space:]]*;	Unscoped DELETE blocked — this would affect all rows, add a WHERE clause
+TRUNCATE[[:space:]]+TABLE	Irreversible truncate blocked — confirm with user before truncating
+
+# ── Code execution from untrusted network sources ─────────────────────────────
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)(curl|wget)[[:space:]]+[^[:space:]]+.*\|[[:space:]]*(ba)?sh	Pipe-to-shell blocked — download and review the script before executing
+
+# ── Broad permission grants ───────────────────────────────────────────────────
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)chmod[[:space:]]+-R[[:space:]]+777	chmod -R 777 blocked — grants world-write access recursively; use targeted permissions (e.g. chmod 755) instead
+
+# ── Disk device operations ────────────────────────────────────────────────────
+(^|[[:space:]]*(&&|\|\||;)[[:space:]]*)dd[[:space:]]+if=/dev/	dd from block device blocked — can wipe or clone disks; confirm with user before any raw device operation
+
+# ── Known limitation (not a pattern — comment only) ──────────────────────────
+# eval-based indirection (e.g. CMD="git push --force"; eval "$CMD") bypasses all
+# static pattern matching above. This is an inherent limitation of text-based
+# guards. For high-security environments, supplement with branch protection
+# rules and code review rather than relying solely on this guard.
+#
+# Variables other than HOME ($B, "$DIR") are not blocked: an empty or unset
+# variable cannot be known statically, so rm -rf "$B"/ is allowed. Only the
+# literal targets in the rm rule above are judged (root, home, and the system
+# directories listed; subpaths such as /tmp/x or /Users/kai/x are allowed).

package/core/harnesses/shared/hooks/policies/capture-failure.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# capture-failure.sh — Canonical Policy Library: failure capture helper (feature 046, IC-018, DEC-032)
+#
+# Defines doflow_capture_failure <policy> <point>, which appends one IC-011 line to the machine-wide
+# DoFlow failure list when a guard policy fails open because DoFlow's own install is broken (for
+# example its pattern file is missing). It exists only to be sourced, in a subshell with all output
+# discarded, from inside a branch where the policy already fails open:
+#
+#   ( . "$(dirname "$0")/capture-failure.sh"; doflow_capture_failure pre-bash-guard patterns-missing ) >/dev/null 2>&1 || true
+#
+# The subshell keeps anything this file does away from the policy, which runs with `set -uo pipefail`,
+# does not source lib.sh and would change exit codes under `set -e`. So this file:
+#   - sets no shell option and installs no trap (DEC-018), and is written to be safe under the
+#     caller's `set -u` and `pipefail`;
+#   - reads no stdin and writes nothing to stdout or stderr;
+#   - never rotates the file (rotation is done by the Node writers only, DEC-019);
+#   - never blocks, never changes the policy's decision, and swallows every error.
+# The line holds only the policy name and the point name from DoFlow's own code, the working
+# directory, the harness name and the install version: never the tool call, its arguments or stdin.
+# It is a no-op when no failure home can be resolved (HOME unset, or XDG_CONFIG_HOME relative) and
+# while capture is off (the `off` sentinel file wins; DOFLOW_FAILURE_CAPTURE=off|0|false|no also
+# turns it off), the same rules the Node writer follows (IC-011, IC-014).
+
+doflow_capture_failure() {
+  local policy="${1:-}" point="${2:-}"
+  local LC_ALL=C   # byte-wise lengths and cuts; scoped to this function
+  local home="" setting="" version="" harness="" project="" cwd="" hp="" at="" line="" here="" dir=""
+
+  if [ -n "${XDG_CONFIG_HOME:-}" ]; then
+    case "$XDG_CONFIG_HOME" in
+      /*) home="$XDG_CONFIG_HOME/doflow/failures" ;;
+      *) return 0 ;;
+    esac
+  else
+    case "${HOME:-}" in
+      /*) home="$HOME/.config/doflow/failures" ;;
+      *) return 0 ;;
+    esac
+  fi
+
+  # Case-insensitive, whitespace trimmed at the ends only: the same reading the Node writer has.
+  setting="$(printf '%s' "${DOFLOW_FAILURE_CAPTURE:-}" | tr '[:upper:]' '[:lower:]')" || return 0
+  setting="${setting#"${setting%%[![:space:]]*}"}"
+  setting="${setting%"${setting##*[![:space:]]}"}"
+  case "$setting" in
+    off|0|false|no) return 0 ;;
+  esac
+  [ -f "$home/off" ] && return 0
+
+  [[ "$policy" =~ ^[a-z][a-z0-9-]{0,39}$ ]] || policy="unknown"
+  [[ "$point" =~ ^[A-Za-z][A-Za-z0-9._:-]{0,39}$ ]] || return 0
+
+  harness="${DOFLOW_AGENT:-}"
+  [[ "$harness" =~ ^[A-Za-z0-9._-]{1,40}$ ]] || harness="none"
+
+  # script_version of the nearest install manifest: walking up from this file, then the global one.
+  here="$(cd "$(dirname "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P)" || here=""
+  dir="$here"
+  while [ -n "$dir" ] && [ -z "$version" ]; do
+    if [ -f "$dir/.doflow/.install-manifest.json" ]; then
+      version="$(sed -n 's/^[[:space:]]*"script_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$dir/.doflow/.install-manifest.json" | head -n 1)" || version=""
+    fi
+    [ "$dir" = "/" ] && break
+    dir="$(dirname "$dir")"
+  done
+  if [ -z "$version" ] && [ -f "${HOME:-}/.doflow/.install-manifest.json" ]; then
+    version="$(sed -n 's/^[[:space:]]*"script_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$HOME/.doflow/.install-manifest.json" | head -n 1)" || version=""
+  fi
+  [[ "$version" =~ ^[A-Za-z0-9._+-]{1,40}$ ]] || version="unknown"
+
+  # The working directory with the home prefix as `~`, cut to 200 bytes, control characters turned
+  # into spaces and every quote and backslash escaped, so the line stays one valid JSON string.
+  cwd="$(pwd 2>/dev/null)" || cwd=""
+  hp="${HOME:-}"
+  hp="${hp%/}"
+  if [ -n "$hp" ]; then
+    case "$cwd" in
+      "$hp") cwd="~" ;;
+      "$hp"/*) cwd="~${cwd#"$hp"}" ;;
+    esac
+  fi
+  project="$(printf '%s' "${cwd:0:200}" | tr '\001-\037\177' ' ')" || project=""
+  project="${project//\\/\\\\}"
+  project="${project//\"/\\\"}"
+
+  at="$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" || return 0
+  line="{\"v\":1,\"at\":\"$at\",\"source\":\"hook\",\"command\":\"$policy\",\"harness\":\"$harness\",\"version\":\"$version\",\"project\":\"$project\",\"kind\":\"$point\",\"message\":\"\",\"frame\":null,\"exit\":null}"
+  if [ "${#line}" -gt 999 ]; then
+    line="{\"v\":1,\"at\":\"$at\",\"source\":\"hook\",\"command\":\"$policy\",\"harness\":\"$harness\",\"version\":\"$version\",\"project\":\"\",\"kind\":\"$point\",\"message\":\"\",\"frame\":null,\"exit\":null}"
+  fi
+
+  (umask 077; mkdir -p "$home") || return 0
+  # Only ever append to a regular file: opening a FIFO for append would block forever.
+  [ ! -e "$home/events.jsonl" ] || [ -f "$home/events.jsonl" ] || return 0
+  ( umask 077; printf '%s\n' "$line" >>"$home/events.jsonl" ) || return 0
+  return 0
+}

package/core/harnesses/shared/hooks/policies/deny-json.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# deny-json.sh — shared PreToolUse deny-JSON emitters for front-door dispatchers.
+#
+# Deliberately carries no `set` directive (unlike lib.sh, which sets -euo
+# pipefail on source): a front door needs `set -e` OFF while it captures a
+# policy script's exit code via `REASON=$(bash "$POLICY" ...); CODE=$?` — under
+# `set -e` that assignment's own nonzero exit status (the deny case) would abort
+# the front door right there, before it ever reached the code below that emits
+# the deny JSON. Sourcing this file must never change the caller's shell options.
+#
+# Usage: source "$(dirname "$0")/../../shared/hooks/policies/deny-json.sh"
+
+# Claude/Codex shape: nested under hookSpecificOutput.permissionDecision.
+emit_pretooluse_deny_nested() {
+  local reason="$1"
+  jq -n --arg reason "$reason" '{
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: $reason
+    }
+  }'
+}
+
+# Gemini shape: flat {decision, reason} (packages/core/src/hooks/types.ts).
+emit_pretooluse_deny_flat() {
+  local reason="$1"
+  jq -n --arg reason "$reason" '{decision: "deny", reason: $reason}'
+}