@mutmutco/cursor-plugin 4.2.7 → 4.3.0

package/scripts/pretooluse-shell-gates.mjs

@@ -1,720 +0,0 @@
-// Consolidated PreToolUse shell gates (#2600): one Node boot for the Bash/PowerShell hook pair.
-// #3630 trimmed bundle: env-write-lint first, secret-echo second (Codex-only by default — Claude's
-// PostToolUse redaction masks an echoed value, Codex cannot), the narrow Windows operator-input guard,
-// then command-ladder. The broad shell-dialect advisory remains retired.
-import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { isAbsolute, resolve } from 'node:path';
-import { analyze as analyzeSecretEcho } from './secret-echo-lint.mjs';
-import { analyze as analyzeEnvWrite } from './env-write-lint.mjs';
-import { decide as decideCommandLadder, matchedVerb } from './command-ladder-gate.mjs';
-import { handleGateCrash, handleMissingHookInput, recordGateSuccess } from './deny-gate-crash.mjs';
-import { readHookInput } from './hook-io.mjs';
-import { appendHookActivity } from './hook-trace.mjs';
-import { evaluateTestCommandPolicy, isShallowRepository, isTestPath, readOverride } from './test-command-policy-core.mjs';
-
-// Secret echoes are blocked before execution on every active host.
-const SECRET_ECHO_MODE = process.env.MMI_SECRET_ECHO_LINT || 'block';
-const ENV_WRITE_MODE = process.env.MMI_ENV_WRITE_MODE ?? 'block';
-const WINDOWS_OPERATOR_GUARD_ON = !/^(?:0|false|no|off)$/i.test(process.env.MMI_WINDOWS_OPERATOR_GUARD ?? 'on');
-const GATE_NAME = 'command-ladder';
-const OPERATOR_GATE_NAME = 'windows-operator-input';
-const TEST_COMMAND_GATE_NAME = 'test-command-policy';
-const NUL_REDIRECT_GATE_NAME = 'nul-redirect';
-const MAX_SEGMENT_CHARS = 32_768;
-
-// #3121 fast-path: trivially-safe read-only commands that need no gate evaluation.
-// Any chaining/substitution character anywhere in the command disqualifies the fast path.
-const SHELL_META_CHARS = /[|&;`]|\$\(|[<>]|\|\||&&/;
-const FAST_PATH_COMMANDS = new Set([
-  'git status',
-  'git log',
-  'git diff',
-  'ls',
-  'Get-ChildItem',
-  'dir',
-]);
-
-function preToolUseDeny(reason) {
-  return JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: 'deny',
-      permissionDecisionReason: reason,
-    },
-  });
-}
-
-/** Commands whose heredoc body IS executed, so its text must stay under analysis. Deliberately a
- *  small allowlist matched by executable NAME: anything unrecognised counts as an interpreter and
- *  keeps its body scanned, so an unknown consumer can never become a bypass (#5266). */
-const HEREDOC_DATA_CONSUMERS = new Set(['git', 'cat', 'tee', 'mmi-cli', 'jerv-cli', 'gh', 'jq', 'grep', 'sed', 'diff', 'sort', 'wc', 'head', 'tail']);
-
-/** Blank out heredoc BODIES that are data rather than script (#5266).
- *
- *  Segmentation splits on `;|&` and newlines, so a heredoc body — a commit message, a PR body, an
- *  issue report — was chopped into pseudo-segments and analysed as if it were a command. Prose that
- *  merely QUOTED a test runner was therefore refused as an attempt to run tests, which penalised
- *  writing accurate evidence about test behaviour: the exact opposite of what #5264 was fixing.
- *
- *  Bodies are replaced with equal-length blanks, never deleted, so every offset the analysers and
- *  the segment-ordinal reporting depend on is preserved. A body is only blanked when the command
- *  introducing it is a known data consumer; `sh <<EOF … EOF` genuinely executes its body and stays
- *  fully analysed. */
-function maskHeredocData(source) {
-  const lines = source.split('\n');
-  const out = [...lines];
-  for (let i = 0; i < lines.length; i += 1) {
-    const intro = /<<-?\s*(?:'([^']+)'|"([^"]+)"|([A-Za-z_][A-Za-z0-9_]*))/.exec(lines[i]);
-    if (!intro) continue;
-    const delimiter = intro[1] ?? intro[2] ?? intro[3];
-    // The consumer is the command the redirection attaches to — the LAST one before `<<`, not the
-    // first on the line. `cd <dir> && git commit -F - <<EOF` is consumed by git, not by cd.
-    const consumer = /(?:^|[;|&])\s*([^\s;|&]+)[^;|&]*$/.exec(lines[i].slice(0, intro.index));
-    if (!HEREDOC_DATA_CONSUMERS.has(executableName(consumer?.[1]))) continue;
-    for (let j = i + 1; j < lines.length; j += 1) {
-      if (lines[j].trim() === delimiter) { i = j; break; }
-      out[j] = ' '.repeat(lines[j].length);
-      if (j === lines.length - 1) i = j;
-    }
-  }
-  return out.join('\n');
-}
-
-/** Split only on unquoted compound-command operators. Text is retained solely for analyzers and is never surfaced. */
-function boundedShellSegments(command) {
-  const source = maskHeredocData(String(command ?? ''));
-  const segments = [];
-  let start = 0;
-  let quote = null;
-  const push = (end) => {
-    const text = source.slice(start, end).trim();
-    if (text) segments.push({ ordinal: segments.length + 1, text: text.slice(0, MAX_SEGMENT_CHARS) });
-  };
-  for (let i = 0; i < source.length; i += 1) {
-    const ch = source[i];
-    if (quote === "'") {
-      if (ch === "'" && source[i + 1] === "'") i += 1;
-      else if (ch === "'") quote = null;
-      continue;
-    }
-    if (quote === '"') {
-      if (ch === '`') i += 1;
-      else if (ch === '"') quote = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"') {
-      quote = ch;
-      continue;
-    }
-    if (ch === ';' || ch === '|' || ch === '&' || ch === '\r' || ch === '\n') {
-      push(i);
-      if ((ch === '|' || ch === '&') && source[i + 1] === ch) i += 1;
-      if (ch === '\r' && source[i + 1] === '\n') i += 1;
-      start = i + 1;
-    }
-  }
-  push(source.length);
-  return segments;
-}
-
-function locateBlockedSegment(command, analyzer, semanticClass) {
-  for (const segment of boundedShellSegments(command)) {
-    const result = analyzer(segment.text);
-    if (result?.block) return { ordinal: segment.ordinal, semanticClass: semanticClass(result) };
-  }
-  return { ordinal: 1, semanticClass: semanticClass(null) };
-}
-
-function expectedProtectionReason(original, input, analyzer, semanticClass) {
-  const located = locateBlockedSegment(input?.tool_input?.command, analyzer, semanticClass);
-  const recovery = located.semanticClass === 'environment enumeration'
-    ? 'Query only the required variables by explicit non-secret name, in a separate tool call.'
-    : located.semanticClass === 'secret-value output'
-      ? 'Use a verifier or consumer that returns status without values; when its contract requires vault injection, invoke it through `mmi-cli vault secrets use`.'
-      : 'Use the vault-native route named above, and run any safe sibling diagnostics as separate tool calls.';
-  return `${original} Entire compound tool call was cancelled before execution; safe sibling diagnostics did not run. `
-    + `This is an expected safety refusal, not a tool defect. Rejected segment ${located.ordinal}: `
-    + `${located.semanticClass}. ${recovery}`;
-}
-
-function tokenizePowerShell(segment) {
-  const matches = [...segment.matchAll(/"(?:`.|[^"])*"|'(?:''|[^'])*'|[^\s'"]+/g)];
-  if (!matches.length) return [];
-  // Adjacent lexical pieces mean mixed quoting (`foo"bar"`); unmatched text means malformed quoting.
-  // Both are ambiguous, so the operator guard fails open.
-  let end = 0;
-  for (const match of matches) {
-    const gap = segment.slice(end, match.index);
-    if (end > 0 && gap.length === 0) return null;
-    if (gap.trim()) return null;
-    end = (match.index ?? 0) + match[0].length;
-  }
-  if (segment.slice(end).trim()) return null;
-  const tokens = [];
-  for (const match of matches) {
-    const raw = match[0];
-    const quote = raw[0];
-    const fullyQuoted = (quote === '"' || quote === "'") && raw.endsWith(quote);
-    let value = fullyQuoted ? raw.slice(1, -1) : raw;
-    if (quote === '"') value = value.replace(/`(.)/g, '$1');
-    if (quote === "'") value = value.replace(/''/g, "'");
-    tokens.push({
-      value,
-      raw,
-      fullyDoubleQuoted: quote === '"' && fullyQuoted,
-    });
-  }
-  return tokens;
-}
-
-function executableName(token) {
-  return String(token ?? '').replace(/\\/g, '/').split('/').pop()?.toLowerCase() ?? '';
-}
-
-const RG_VALUE_OPTIONS = {
-  '-e': 'pattern', '--regexp': 'pattern', '-f': 'pattern', '--file': 'pattern',
-  '-g': 'glob', '--glob': 'glob', '--iglob': 'glob', '-t': 'type', '--type': 'type', '--type-add': 'type',
-};
-const RG_SAFE_FLAGS = new Set((
-  '--files --hidden --no-ignore --line-number -n --fixed-strings -F --word-regexp -w --case-sensitive -s '
-  + '--ignore-case -i --smart-case -S --multiline -U --pcre2 -P --text -a --count -c '
-  + '--files-with-matches -l --files-without-match --no-messages --quiet -q --json'
-).split(' '));
-
-function analyzeRgWildcard(tokens) {
-  if (!tokens?.length || !['rg', 'rg.exe'].includes(executableName(tokens[0].value))) return null;
-  const positional = [];
-  let explicitPattern = false;
-  let filesMode = false;
-  let afterOptions = false;
-  for (let i = 1; i < tokens.length; i += 1) {
-    const arg = tokens[i].value;
-    if (!afterOptions && arg === '--') {
-      afterOptions = true;
-      continue;
-    }
-    if (!afterOptions) {
-      const longEquals = arg.match(/^(--(?:regexp|file|glob|iglob|type|type-add))=(.*)$/);
-      if (longEquals) {
-        if (['--regexp', '--file'].includes(longEquals[1])) explicitPattern = true;
-        continue;
-      }
-      const optionKind = RG_VALUE_OPTIONS[arg];
-      if (optionKind) {
-        if (i + 1 >= tokens.length) return null;
-        if (optionKind === 'pattern') explicitPattern = true;
-        i += 1;
-        continue;
-      }
-      const shortAttached = arg.match(/^-(e|f|g|t)(.+)$/);
-      if (shortAttached) {
-        if (shortAttached[1] === 'e' || shortAttached[1] === 'f') explicitPattern = true;
-        continue;
-      }
-      if (RG_SAFE_FLAGS.has(arg)) {
-        if (arg === '--files') filesMode = true;
-        continue;
-      }
-      // Unknown options may consume the next token. Shell parsing is undecidable; fail open on ambiguity.
-      if (arg.startsWith('-')) return null;
-    }
-    positional.push(arg);
-  }
-  const paths = explicitPattern || filesMode ? positional : positional.slice(1);
-  return paths.some((path) => /[*?\[]/.test(path))
-    ? { reasonId: 'operator_input_rg_wildcard_path', semanticClass: 'unresolved wildcard path argument' }
-    : null;
-}
-
-const SSH_VALUE_OPTIONS = new Set('-b -c -D -E -e -F -I -i -J -L -l -m -O -o -P -p -Q -R -S -W -w'.split(' '));
-const SSH_SAFE_FLAGS = new Set('-4 -6 -A -a -C -f -G -g -K -k -M -N -n -s -T -t -V -v -X -x -Y -y'.split(' '));
-
-function hasUnescapedPowerShellVariable(text) {
-  for (const match of text.matchAll(/\$(?:\{)?([A-Za-z_][A-Za-z0-9_]*)/g)) {
-    const index = match.index ?? 0;
-    let backticks = 0;
-    for (let i = index - 1; i >= 0 && text[i] === '`'; i -= 1) backticks += 1;
-    if (backticks % 2 === 1) continue;
-    if (/^\$env:/i.test(text.slice(index))) continue;
-    return true;
-  }
-  return false;
-}
-
-function analyzeSshInterpolation(tokens) {
-  if (!tokens?.length || !['ssh', 'ssh.exe'].includes(executableName(tokens[0].value))) return null;
-  let hostAt = -1;
-  for (let i = 1; i < tokens.length; i += 1) {
-    const arg = tokens[i].value;
-    if (arg === '--') {
-      hostAt = i + 1;
-      break;
-    }
-    if (SSH_VALUE_OPTIONS.has(arg)) {
-      if (i + 1 >= tokens.length) return null;
-      i += 1;
-      continue;
-    }
-    if (SSH_SAFE_FLAGS.has(arg) || /^-[bcDEeFIiJLMmOoPpQRSWw].+/.test(arg)) continue;
-    if (arg.startsWith('-')) return null;
-    hostAt = i;
-    break;
-  }
-  if (hostAt < 0 || hostAt + 1 >= tokens.length) return null;
-  for (const token of tokens.slice(hostAt + 1)) {
-    if (!token.fullyDoubleQuoted) continue;
-    const remote = token.raw.slice(1, -1);
-    if (hasUnescapedPowerShellVariable(remote)) {
-      return { reasonId: 'operator_input_ssh_powershell_interpolation', semanticClass: 'PowerShell-interpolated remote program' };
-    }
-  }
-  return null;
-}
-
-/**
- * Recognize test execution only as a shell command, never as prose in an argument. The small
- * command vocabulary deliberately covers the package-manager spellings agents actually emit and
- * the direct runners they use when no package script exists.
- */
-function testCommandInSegment(segment) {
-  const tokens = tokenizePowerShell(segment);
-  if (!tokens?.length) return false;
-  const values = tokens.map((token) => token.value);
-  let commandAt = 0;
-  while (/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(values[commandAt] ?? '')) commandAt += 1;
-  if (values[commandAt] === 'command') commandAt += 1;
-  if (values[commandAt] === 'env') {
-    commandAt += 1;
-    while (/^(?:-[A-Za-z]+|[A-Za-z_][A-Za-z0-9_]*=.*)$/.test(values[commandAt] ?? '')) commandAt += 1;
-  }
-  const executable = executableName(values[commandAt]);
-  const args = values.slice(commandAt + 1);
-  const isTestScript = (value) => /^test(?:$|[:._-])/.test(value ?? '');
-  const positional = (items, valueOptions = new Set()) => {
-    const valuesOnly = [];
-    for (let i = 0; i < items.length; i += 1) {
-      if (valueOptions.has(items[i])) { i += 1; continue; }
-      if (items[i].startsWith('-')) continue;
-      valuesOnly.push(items[i]);
-    }
-    return valuesOnly;
-  };
-  const packageRunner = new Set(['npm', 'npm.cmd', 'pnpm', 'pnpm.cmd', 'yarn', 'yarn.cmd', 'bun', 'bun.exe']);
-  if (packageRunner.has(executable)) {
-    const words = positional(args, new Set(['--prefix', '--workspace', '-w', '--dir', '-C']));
-    if (isTestScript(words[0]) || executableName(words[0]) === 'vitest') return true;
-    if (words[0] === 'run') return isTestScript(words[1]);
-    if (words[0] === 'exec' || words[0] === 'dlx') return executableName(words[1]) === 'vitest';
-  }
-  if (executable === 'npx' || executable === 'npx.cmd' || executable === 'pnpx' || executable === 'bunx') {
-    return executableName(positional(args, new Set(['--package', '-p']))[0]) === 'vitest';
-  }
-  if (['vitest', 'vitest.cmd', 'vitest.exe', 'pytest', 'pytest.exe'].includes(executable)) return true;
-  if (executable === 'node' && args[0] === '--test') return true;
-  if (executable === 'python' || executable === 'python3' || executable === 'py') return args[0] === '-m' && args[1] === 'pytest';
-  if (executable === 'cargo' || executable === 'go' || executable === 'dotnet') return args[0] === 'test';
-  if (executable === 'mvn' || executable === 'mvnw' || executable === 'gradle' || executable === 'gradlew') return args.some((arg) => /(?:^|:)test$/i.test(arg));
-  return false;
-}
-
-function requestedTestCommand(command) {
-  return boundedShellSegments(command).some((segment) => testCommandInSegment(segment.text));
-}
-
-function git(root, args) {
-  return execFileSync('git', ['-C', root, ...args], {
-    encoding: 'utf8',
-    windowsHide: true,
-    stdio: ['ignore', 'pipe', 'ignore'],
-    maxBuffer: 4 * 1024 * 1024,
-  });
-}
-
-/** The directory the COMMAND will run in, when it names one itself (#5264).
- *
- *  A compound command routinely opens with `cd <path> && …`, and the host's `cwd` is the session's,
- *  not the command's. Judging `cd <other-repo-worktree> && npm test` by the session cwd evaluates a
- *  DIFFERENT repository — its test-policy.json and its (typically clean) diff — and then states a
- *  conclusion about the repo it never looked at. Reuses the same bounded segmentation the gate
- *  already trusts, and only ever feeds a read-only `git -C` probe. */
-function commandWorkingDirectory(command, base) {
-  const [first] = boundedShellSegments(command);
-  const match = /^(?:cd|Set-Location)\s+(?!-)(?:"([^"]+)"|'([^']+)'|([^\s;&|]+))\s*$/i.exec(first?.text ?? '');
-  const target = match?.[1] ?? match?.[2] ?? match?.[3];
-  if (!target || target.startsWith('~')) return null;
-  const resolved = isAbsolute(target) ? target : (typeof base === 'string' && base ? resolve(base, target) : null);
-  return resolved && existsSync(resolved) ? resolved : null;
-}
-
-function repositoryRoot(input) {
-  const candidates = [commandWorkingDirectory(input?.tool_input?.command, input?.cwd), input?.cwd, process.cwd()]
-    .filter((cwd, index, values) => typeof cwd === 'string' && cwd && values.indexOf(cwd) === index);
-  for (const cwd of candidates) {
-    try {
-      return git(resolve(cwd), ['rev-parse', '--show-toplevel']).trim();
-    } catch {
-      // A host may launch the plugin from its own installation directory; try the next valid cwd.
-    }
-  }
-  return null;
-}
-
-function policyMandatoryEntries(root) {
-  const path = resolve(root, 'test-policy.json');
-  if (!existsSync(path)) return null;
-  const parsed = JSON.parse(readFileSync(path, 'utf8'));
-  if (!Array.isArray(parsed.mandatory) || !parsed.mandatory.every((entry) => entry && typeof entry.glob === 'string')) {
-    throw new Error('test-policy.json mandatory entries are invalid');
-  }
-  return parsed.mandatory;
-}
-
-function taskDiffBase(root) {
-  const base = ['origin/development', 'origin/main'].find((ref) => {
-    try {
-      git(root, ['rev-parse', '--verify', `${ref}^{commit}`]);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-  if (!base) throw new Error('neither origin/development nor origin/main resolves');
-  return base;
-}
-
-function lines(output) {
-  return output.split(/\r?\n/).map((path) => path.trim()).filter(Boolean);
-}
-
-/**
- * The task diff's paths, and the subset of them this diff CREATED (#5842).
- *
- * Both come from the same four reads, so the added set can never describe a different diff than the
- * paths it qualifies. Untracked files are added by definition; the tracked side asks git directly
- * with `--diff-filter=AR` — a rename's new name did not exist at the base either, so it is created
- * work for this purpose.
- */
-function taskDiffPaths(root) {
-  const base = taskDiffBase(root);
-  const untracked = lines(git(root, ['ls-files', '--others', '--exclude-standard']));
-  const paths = [...new Set([
-    ...lines(git(root, ['diff', '--name-only', `${base}...HEAD`])),
-    ...lines(git(root, ['diff', '--name-only', '--cached'])),
-    ...lines(git(root, ['diff', '--name-only'])),
-    ...untracked,
-  ])];
-  // The added set only ever changes the verdict when a test file is in the diff at all, and it costs
-  // three more git children. On the ordinary refusal path — a diff with no test in it — those reads
-  // would be pure latency in front of every shell command the agent runs.
-  if (!paths.some(isTestPath)) return { paths, addedPaths: untracked };
-  const addedPaths = [...new Set([
-    ...lines(git(root, ['diff', '--name-only', '--diff-filter=AR', `${base}...HEAD`])),
-    ...lines(git(root, ['diff', '--name-only', '--diff-filter=AR', '--cached'])),
-    ...lines(git(root, ['diff', '--name-only', '--diff-filter=AR'])),
-    ...untracked,
-  ])];
-  return { paths, addedPaths };
-}
-
-/**
- * The waiver the gate may honour for this diff's range, or null (#5804).
- *
- * `mmi-cli tests policy` honours a valid `Test-Policy-Override` trailer on the findings layer while
- * this gate refused the same diff's focused test — one policy, two answers, and the agent that wrote
- * the audited trailer to run ONE focused test was then blocked from running exactly that test. The
- * reader is the SHARED one, so the gate cannot drift from the CLI's verdict on what a waiver is.
- *
- * Two fail-closed guards mirror what the CLI reports before it honours anything:
- *  - a SHALLOW clone's `base..HEAD` is unbounded (#3628) — nothing is honoured from a range the gate
- *    cannot trust;
- *  - refusals newer than the winning trailer (malformed shape, unknown scope) block the CLI's run,
- *    so they block here too — no honouring a waiver the reporting layer just refused.
- */
-function taskOverride(root, baseRef) {
-  if (isShallowRepository(root)) return null;
-  const base = git(root, ['merge-base', 'HEAD', baseRef]).toString().trim();
-  const { override, refusals } = readOverride(base, root);
-  return refusals.length === 0 ? override : null;
-}
-
-function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
-  if (!requestedTestCommand(input?.tool_input?.command)) return { denied: false };
-  const root = repositoryRoot(input);
-  let mandatory;
-  try {
-    // No declaration is the estate default: this hook does not regulate test execution there.
-    if (!root || (mandatory = policyMandatoryEntries(root)) === null) return { denied: false };
-    // #5519: same evaluator `mmi-cli tests policy` attaches to its OK summary — matched globs and
-    // command classes cannot disagree with the CLI on the same path set.
-    // #5804: and the same waiver, read from the same range this diff was computed against, feeds the
-    // evaluator — an honoured override for out-of-zone test work permits the matching focused test.
-    const base = taskDiffBase(root);
-    const { paths, addedPaths } = taskDiffPaths(root);
-    const decision = evaluateTestCommandPolicy({
-      paths,
-      addedPaths,
-      mandatory,
-      regulated: true,
-      override: taskOverride(root, base),
-    });
-    if (decision.testCommandsAllowed) return { denied: false, decision };
-  } catch (error) {
-    // #5726: the deny aborts the ENTIRE tool call, so say so first — see the matching note below.
-    const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-policy-unresolvable]: '
-      + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other non-test step batched into the same call was NOT applied — re-run those steps separately. '
-      + `a test-policy.json applies but its repository, policy, or task diff could not be established (${error.message}). `
-      + 'Do not run tests; use policy-approved non-test verification, or repair the repository/base reference before retrying.';
-    appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-policy-unresolvable', tool: input?.tool_name });
-    stdout.write(preToolUseDeny(reason) + '\n');
-    return { denied: true };
-  }
-  // #5264: name the repository this verdict was computed from. The refusal text is authoritative and
-  // gets pasted into PR bodies as verification, so a bare "the current diff" — with no statement of
-  // WHICH diff — reads as a claim about the repo the author is working in even when the gate resolved
-  // a different one. Naming the root makes a wrong resolution self-evident instead of quotable.
-  // #5726: a PreToolUse deny aborts the ENTIRE tool call before execution, but this refusal used to
-  // read as a verdict on the test segment alone. An agent that batched `<edit> && <test runner>` kept
-  // working believing the edit had landed when the deny had discarded it with the rest. Lead with the
-  // abort fact, mirroring the operator-input guard's "entire compound tool call was cancelled" wording.
-  const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-outside-mandatory-zone]: '
-    + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other non-test step batched into the same call was NOT applied — re-run those steps separately. '
-    + `no path in ${root}'s task diff matches a mandatory glob in its test-policy.json, and it edits no test file that already existed. `
-    + 'Verify that is the repository you meant before quoting this: it is resolved from a leading `cd` or `Set-Location` with a literal path, then the host cwd. '
-    + 'Do not run tests; use policy-approved non-test verification, '
-    + 'or touch and run mandatory-zone coverage only when the diff actually requires it. '
-    + 'A diff that EDITS a test file already in the tree may run tests (#5842); one that CREATES an out-of-zone test still needs an honoured `Test-Policy-Override` (#5804).';
-  appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-outside-mandatory-zone', tool: input?.tool_name });
-  stdout.write(preToolUseDeny(reason) + '\n');
-  return { denied: true };
-}
-
-// --- `>nul` under Git Bash creates a FILE (#5845) ---------------------------------------------
-//
-// `nul` is a reserved DEVICE name to Win32, so `>nul` from cmd or PowerShell discards output and
-// leaves nothing behind. Bash does not honour that reservation on ANY platform — MSYS/Git Bash
-// resolves the path itself, and on Linux `nul` was never special to begin with — so the identical
-// redirect creates a real, empty, untracked file called `nul` in the working directory, usually the
-// repository root, since that is where agents run. In bash `>nul` therefore never means "discard",
-// which is why the deny needs no platform test: only the SHELL decides what the word means.
-//
-// It then breaks every recursive search over that tree: `rg` and `grep` ask Windows to open `nul`,
-// Windows hands back the device, and the read fails with `Incorrect function. (os error 1)`. The
-// error goes to stderr while the exit code can still be 0, so a sweep looks like it worked and is
-// quietly missing whatever the walker abandoned.
-//
-// Measured on MMI-Katip: one 0-byte `nul` sat in the repo root from 2026-08-22 until 2026-08-29,
-// erroring on every recursive search in between. An audit of that repo's own scripts and CI found no
-// `>nul` at all — the file came from an ad-hoc agent command, which is exactly why the fix belongs
-// in the gate every agent shell passes through rather than in any one repo.
-//
-// Gitignoring `nul` was considered and rejected: `rg` would then skip it silently, so the artifact
-// would keep landing and the only signal that it had would be gone.
-const NUL_REDIRECT_RE = /(?:^|\s)\d*>>?\s*(?:\.[\\/])?nul(?=$|\s)/i;
-
-/** Bash-shaped tools only. `>nul` from PowerShell or cmd hits the device and creates nothing, so
- *  denying it there would refuse a correct command. */
-function isBashShapedTool(toolName) {
-  const tool = String(toolName ?? '').trim();
-  return tool === 'Bash' || tool === 'bash';
-}
-
-function runNulRedirectGuard(input, { stdout = process.stdout } = {}) {
-  if (!isBashShapedTool(input?.tool_name)) return { denied: false };
-  const offending = boundedShellSegments(input?.tool_input?.command)
-    .find((segment) => NUL_REDIRECT_RE.test(segment.text));
-  if (!offending) return { denied: false };
-  const reason = 'NUL REDIRECT REFUSED [bash-nul-redirect-creates-a-file]: '
-    + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other step batched into the same call was NOT applied — re-run those steps separately. '
-    + `segment ${offending.ordinal} redirects to \`nul\`, which bash treats as a PATH rather than the Windows null device — it would create an empty, untracked \`nul\` file here. On Windows every later recursive \`rg\`/\`grep\` over this tree then fails on it with "Incorrect function. (os error 1)", on stderr and often with exit 0, so the sweep looks fine while silently missing files. `
-    + 'Write `2>/dev/null` (or `>/dev/null`) in a bash command; `2>$null` is the PowerShell form. '
-    + 'To discard both streams, use `>/dev/null 2>&1`.';
-  appendHookActivity({ event: 'PreToolUse', script: NUL_REDIRECT_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'bash-nul-redirect-creates-a-file', tool: input?.tool_name });
-  stdout.write(preToolUseDeny(reason) + '\n');
-  return { denied: true };
-}
-
-function isPowerShellShapedTool(toolName) {
-  const tool = String(toolName ?? '').trim();
-  return tool === 'PowerShell' || (process.platform === 'win32' && (tool === 'shell' || tool === 'local_shell'));
-}
-
-function analyzeOperatorInput(input) {
-  if (!WINDOWS_OPERATOR_GUARD_ON || !isPowerShellShapedTool(input?.tool_name)) return null;
-  for (const segment of boundedShellSegments(input?.tool_input?.command)) {
-    const tokens = tokenizePowerShell(segment.text);
-    if (!tokens) continue;
-    const hit = analyzeRgWildcard(tokens) ?? analyzeSshInterpolation(tokens);
-    if (hit) return { ...hit, ordinal: segment.ordinal };
-  }
-  return null;
-}
-
-
-function runEnvWriteLint(input, { stdout = process.stdout, stderr = process.stderr } = {}) {
-  const result = analyzeEnvWrite({ toolName: input?.tool_name, command: input?.tool_input?.command });
-
-  appendHookActivity({
-    event: 'PreToolUse',
-    script: 'env-write-lint',
-    outcome: result?.block ? (ENV_WRITE_MODE === 'observe' ? 'observe' : 'deny') : 'ran',
-    action: result?.block ? result.reason : 'clean',
-    reasonId: result?.reasonId,
-    tool: input?.tool_name,
-  });
-
-  if (!result?.block) return { denied: false };
-
-  if (ENV_WRITE_MODE === 'observe') {
-    stderr.write(`[mmi-env-write] would-block: ${result.reason}\n`);
-    return { denied: false };
-  }
-
-  const reason = expectedProtectionReason(
-    result.reason,
-    input,
-    (segment) => analyzeEnvWrite({ toolName: input?.tool_name, command: segment }),
-    (segmentResult) => segmentResult?.reasonId === 'env_write_apply_patch'
-      ? 'environment-file patch write'
-      : 'environment-file write',
-  );
-  stdout.write(preToolUseDeny(reason) + '\n');
-  return { denied: true };
-}
-
-function runSecretEchoLint(input, { stdout = process.stdout, stderr = process.stderr } = {}) {
-  if (SECRET_ECHO_MODE === 'off') return { denied: false };
-  const result = analyzeSecretEcho(input?.tool_input?.command);
-
-  appendHookActivity({
-    event: 'PreToolUse',
-    script: 'secret-echo-lint',
-    outcome: result?.block ? (SECRET_ECHO_MODE === 'block' ? 'deny' : 'observe') : 'ran',
-    action: result?.block ? result.reason : 'clean',
-    tool: input?.tool_name,
-  });
-
-  if (!result?.block) return { denied: false };
-
-  if (SECRET_ECHO_MODE !== 'block') {
-    stderr.write(`[mmi-secret-echo-lint] would-block: ${result.reason}\n`);
-    return { denied: false };
-  }
-
-  const reason = expectedProtectionReason(
-    result.reason,
-    input,
-    analyzeSecretEcho,
-    (segmentResult) => /dumps all environment variables/i.test(segmentResult?.reason ?? '')
-      ? 'environment enumeration'
-      : 'secret-value output',
-  );
-  stdout.write(preToolUseDeny(reason) + '\n');
-  return { denied: true };
-}
-
-function runOperatorInputGuard(input, { stdout = process.stdout } = {}) {
-  const result = analyzeOperatorInput(input);
-  if (!result) return { denied: false };
-  const recovery = result.reasonId === 'operator_input_rg_wildcard_path'
-    ? 'Discover candidates with `rg --files`, then pass resolved literal paths or move wildcard selection to `-g`/`--glob`; do not guess a path, and keep recursive queries and output bounded.'
-    : 'Put the remote program in a temporary literal script and pipe it to `ssh host bash -s`; select the intended remote runtime explicitly, and verify the inner program exit and output.';
-  const reason = `Entire compound tool call was cancelled before execution; safe sibling segments did not run. `
-    + `This is an expected operator-input refusal, not a tool defect. Rejected segment ${result.ordinal}: `
-    + `${result.semanticClass}. ${recovery}`;
-  appendHookActivity({
-    event: 'PreToolUse',
-    script: OPERATOR_GATE_NAME,
-    outcome: 'deny',
-    action: reason,
-    reasonId: result.reasonId,
-    tool: input?.tool_name,
-  });
-  stdout.write(preToolUseDeny(reason) + '\n');
-  return { denied: true };
-}
-
-function runCommandLadder(input, { stdout = process.stdout, stderr = process.stderr } = {}) {
-  recordGateSuccess(GATE_NAME);
-
-  const decision = decideCommandLadder({ toolName: input?.tool_name, command: input?.tool_input?.command });
-
-  appendHookActivity({
-    event: 'PreToolUse',
-    script: GATE_NAME,
-    outcome: decision.action === 'allow' ? 'ran' : decision.action,
-    action: decision.reason ?? 'clean',
-    reasonId: decision.reasonId,
-    tool: input?.tool_name,
-  });
-
-  if (decision.action === 'bypass') {
-    stderr.write(
-      `[mmi-ladder] BYPASS ${new Date().toISOString()} ${matchedVerb(decision.reasonId)} ` +
-        `(covered by ${decision.replacement}); MMI_ALLOW_RAW_GH set — allowing raw gh\n`,
-    );
-  } else if (decision.action === 'observe') {
-    stderr.write(`[mmi-ladder] would-block: ${decision.reason}\n`);
-  } else if (decision.action === 'deny') {
-    stdout.write(preToolUseDeny(decision.reason) + '\n');
-  }
-}
-
-/** #4118: exported as `runHookGate` too — the uniform in-process entry hook-run.mjs imports instead of
- *  booting a second node. `input` is the buffered payload when the runner already drained stdin. */
-export async function runPreToolUseShellGates({ input: buffered, stdout = process.stdout, stderr = process.stderr } = {}) {
-  let input;
-  try {
-    input = await readHookInput(buffered);
-  } catch {
-    // Unreadable/absent payload = out-of-contract host (Cursor's Claude-plugin import, #2992):
-    // fail open without counting a crash. Post-parse crashes below stay fail-closed (#2598).
-    const res = handleMissingHookInput(GATE_NAME);
-    if (res.stdout) stdout.write(res.stdout);
-    if (res.stderr) stderr.write(res.stderr);
-    return;
-  }
-
-  const command = input?.tool_input?.command;
-  if (typeof command === 'string' && command.length > 0 && !SHELL_META_CHARS.test(command)) {
-    const trimmed = command.trim();
-    if (FAST_PATH_COMMANDS.has(trimmed)) {
-      recordGateSuccess(GATE_NAME);
-      appendHookActivity({
-        event: 'PreToolUse',
-        script: GATE_NAME,
-        outcome: 'ran',
-        action: 'fast-path allow (trivially-safe read-only)',
-        tool: input?.tool_name,
-      });
-      return;
-    }
-  }
-
-  const envWrite = runEnvWriteLint(input, { stdout, stderr });
-  if (envWrite.denied) return;
-  const echo = runSecretEchoLint(input, { stdout, stderr });
-  if (echo.denied) return;
-  const operatorInput = runOperatorInputGuard(input, { stdout });
-  if (operatorInput.denied) return;
-  const nulRedirect = runNulRedirectGuard(input, { stdout });
-  if (nulRedirect.denied) return;
-  const testCommandPolicy = runTestCommandPolicy(input, { stdout });
-  if (testCommandPolicy.denied) return;
-  runCommandLadder(input, { stdout, stderr });
-
-}
-
-export { runPreToolUseShellGates as runHookGate };
-
-if (
-  process.argv[1] &&
-  (process.argv[1].endsWith('pretooluse-shell-gates.mjs') ||
-    process.argv[1].replace(/\\/g, '/').endsWith('scripts/pretooluse-shell-gates.mjs'))
-) {
-  runPreToolUseShellGates().catch(() => {
-    const res = handleGateCrash(GATE_NAME);
-    if (res.stdout) process.stdout.write(res.stdout);
-    if (res.stderr) process.stderr.write(res.stderr);
-  }).finally(() => process.exit(0));
-}