@mutmutco/claude-plugin 4.0.3 → 4.0.5

package/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "mmi",
   "displayName": "MMI",
-  "version": "4.0.3",
-  "mmiCompat": "3.x",
+  "version": "4.0.5",
+  "mmiCompat": "4.x",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/claude-plugin",
-  "version": "4.0.3",
+  "version": "4.0.5",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/pretooluse-shell-gates.mjs

@@ -4,7 +4,7 @@
 // then command-ladder. The broad shell-dialect advisory remains retired.
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { isAbsolute, resolve } from 'node:path';
 import { analyze as analyzeSecretEcho } from './secret-echo-lint.mjs';
 import { analyze as analyzeEnvWrite } from './env-write-lint.mjs';
 import { decide as decideCommandLadder, matchedVerb } from './command-ladder-gate.mjs';
@@ -43,9 +43,45 @@ function preToolUseDeny(reason) {
   });
 }
 
+/** Commands whose heredoc body IS executed, so its text must stay under analysis. Deliberately a
+ *  small allowlist matched by executable NAME: anything unrecognised counts as an interpreter and
+ *  keeps its body scanned, so an unknown consumer can never become a bypass (#5266). */
+const HEREDOC_DATA_CONSUMERS = new Set(['git', 'cat', 'tee', 'mmi-cli', 'jerv-cli', 'gh', 'jq', 'grep', 'sed', 'diff', 'sort', 'wc', 'head', 'tail']);
+
+/** Blank out heredoc BODIES that are data rather than script (#5266).
+ *
+ *  Segmentation splits on `;|&` and newlines, so a heredoc body — a commit message, a PR body, an
+ *  issue report — was chopped into pseudo-segments and analysed as if it were a command. Prose that
+ *  merely QUOTED a test runner was therefore refused as an attempt to run tests, which penalised
+ *  writing accurate evidence about test behaviour: the exact opposite of what #5264 was fixing.
+ *
+ *  Bodies are replaced with equal-length blanks, never deleted, so every offset the analysers and
+ *  the segment-ordinal reporting depend on is preserved. A body is only blanked when the command
+ *  introducing it is a known data consumer; `sh <<EOF … EOF` genuinely executes its body and stays
+ *  fully analysed. */
+function maskHeredocData(source) {
+  const lines = source.split('\n');
+  const out = [...lines];
+  for (let i = 0; i < lines.length; i += 1) {
+    const intro = /<<-?\s*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/.exec(lines[i]);
+    if (!intro) continue;
+    const delimiter = intro[1] ?? intro[2] ?? intro[3];
+    // The consumer is the command the redirection attaches to — the LAST one before `<<`, not the
+    // first on the line. `cd <dir> && git commit -F - <<EOF` is consumed by git, not by cd.
+    const consumer = /(?:^|[;|&])\s*([^\s;|&]+)[^;|&]*$/.exec(lines[i].slice(0, intro.index));
+    if (!HEREDOC_DATA_CONSUMERS.has(executableName(consumer?.[1]))) continue;
+    for (let j = i + 1; j < lines.length; j += 1) {
+      if (lines[j].trim() === delimiter) { i = j; break; }
+      out[j] = ' '.repeat(lines[j].length);
+      if (j === lines.length - 1) i = j;
+    }
+  }
+  return out.join('\n');
+}
+
 /** Split only on unquoted compound-command operators. Text is retained solely for analyzers and is never surfaced. */
 function boundedShellSegments(command) {
-  const source = String(command ?? '');
+  const source = maskHeredocData(String(command ?? ''));
   const segments = [];
   let start = 0;
   let quote = null;
@@ -293,8 +329,24 @@ function git(root, args) {
   });
 }
 
+/** The directory the COMMAND will run in, when it names one itself (#5264).
+ *
+ *  A compound command routinely opens with `cd <path> && …`, and the host's `cwd` is the session's,
+ *  not the command's. Judging `cd <other-repo-worktree> && npm test` by the session cwd evaluates a
+ *  DIFFERENT repository — its test-policy.json and its (typically clean) diff — and then states a
+ *  conclusion about the repo it never looked at. Reuses the same bounded segmentation the gate
+ *  already trusts, and only ever feeds a read-only `git -C` probe. */
+function commandWorkingDirectory(command, base) {
+  const [first] = boundedShellSegments(command);
+  const match = /^cd\s+(?!-)(?:"([^"]+)"|'([^']+)'|([^\s;&|]+))\s*$/.exec(first?.text ?? '');
+  const target = match?.[1] ?? match?.[2] ?? match?.[3];
+  if (!target || target.startsWith('~')) return null;
+  const resolved = isAbsolute(target) ? target : (typeof base === 'string' && base ? resolve(base, target) : null);
+  return resolved && existsSync(resolved) ? resolved : null;
+}
+
 function repositoryRoot(input) {
-  const candidates = [input?.cwd, process.cwd()]
+  const candidates = [commandWorkingDirectory(input?.tool_input?.command, input?.cwd), input?.cwd, process.cwd()]
     .filter((cwd, index, values) => typeof cwd === 'string' && cwd && values.indexOf(cwd) === index);
   for (const cwd of candidates) {
     try {
@@ -372,8 +424,14 @@ function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
     stdout.write(preToolUseDeny(reason) + '\n');
     return { denied: true };
   }
+  // #5264: name the repository this verdict was computed from. The refusal text is authoritative and
+  // gets pasted into PR bodies as verification, so a bare "the current diff" — with no statement of
+  // WHICH diff — reads as a claim about the repo the author is working in even when the gate resolved
+  // a different one. Naming the root makes a wrong resolution self-evident instead of quotable.
   const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-outside-mandatory-zone]: '
-    + 'the current diff does not touch any test-policy.json mandatory glob. Do not run tests; use policy-approved non-test verification, '
+    + `no path in ${root}'s task diff matches a mandatory glob in its test-policy.json. `
+    + 'Verify that is the repository you meant before quoting this: it is resolved from the command\'s own `cd`, then the host cwd. '
+    + 'Do not run tests; use policy-approved non-test verification, '
     + 'or touch and run mandatory-zone coverage only when the diff actually requires it.';
   appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-outside-mandatory-zone', tool: input?.tool_name });
   stdout.write(preToolUseDeny(reason) + '\n');