@mutmutco/hermes-plugin 4.2.3 → 4.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/hermes-plugin",
-  "version": "4.2.3",
+  "version": "4.2.4",
   "description": "MMI canonical skills transported as a Hermes Agent native plugin.",
   "author": {
     "name": "MMI Future",

package/plugin.yaml

@@ -1,7 +1,7 @@
 {
   "manifest_version": 1,
   "name": "mmi",
-  "version": "4.2.3",
+  "version": "4.2.4",
   "description": "MMI canonical workflow skills and fail-closed pre-tool policy gates.",
   "provides_hooks": [
     "pre_tool_call"

package/scripts/pretooluse-shell-gates.mjs

@@ -11,7 +11,7 @@ import { decide as decideCommandLadder, matchedVerb } from './command-ladder-gat
 import { handleGateCrash, handleMissingHookInput, recordGateSuccess } from './deny-gate-crash.mjs';
 import { readHookInput } from './hook-io.mjs';
 import { appendHookActivity } from './hook-trace.mjs';
-import { evaluateTestCommandPolicy, isShallowRepository, readOverride } from './test-command-policy-core.mjs';
+import { evaluateTestCommandPolicy, isShallowRepository, isTestPath, readOverride } from './test-command-policy-core.mjs';
 
 // Secret echoes are blocked before execution on every active host.
 const SECRET_ECHO_MODE = process.env.MMI_SECRET_ECHO_LINT || 'block';
@@ -20,6 +20,7 @@ const WINDOWS_OPERATOR_GUARD_ON = !/^(?:0|false|no|off)$/i.test(process.env.MMI_
 const GATE_NAME = 'command-ladder';
 const OPERATOR_GATE_NAME = 'windows-operator-input';
 const TEST_COMMAND_GATE_NAME = 'test-command-policy';
+const NUL_REDIRECT_GATE_NAME = 'nul-redirect';
 const MAX_SEGMENT_CHARS = 32_768;
 
 // #3121 fast-path: trivially-safe read-only commands that need no gate evaluation.
@@ -382,15 +383,38 @@ function taskDiffBase(root) {
   return base;
 }
 
+function lines(output) {
+  return output.split(/\r?\n/).map((path) => path.trim()).filter(Boolean);
+}
+
+/**
+ * The task diff's paths, and the subset of them this diff CREATED (#5842).
+ *
+ * Both come from the same four reads, so the added set can never describe a different diff than the
+ * paths it qualifies. Untracked files are added by definition; the tracked side asks git directly
+ * with `--diff-filter=AR` — a rename's new name did not exist at the base either, so it is created
+ * work for this purpose.
+ */
 function taskDiffPaths(root) {
   const base = taskDiffBase(root);
-  const outputs = [
-    git(root, ['diff', '--name-only', `${base}...HEAD`]),
-    git(root, ['diff', '--name-only', '--cached']),
-    git(root, ['diff', '--name-only']),
-    git(root, ['ls-files', '--others', '--exclude-standard']),
-  ];
-  return [...new Set(outputs.flatMap((output) => output.split(/\r?\n/).map((path) => path.trim()).filter(Boolean)))];
+  const untracked = lines(git(root, ['ls-files', '--others', '--exclude-standard']));
+  const paths = [...new Set([
+    ...lines(git(root, ['diff', '--name-only', `${base}...HEAD`])),
+    ...lines(git(root, ['diff', '--name-only', '--cached'])),
+    ...lines(git(root, ['diff', '--name-only'])),
+    ...untracked,
+  ])];
+  // The added set only ever changes the verdict when a test file is in the diff at all, and it costs
+  // three more git children. On the ordinary refusal path — a diff with no test in it — those reads
+  // would be pure latency in front of every shell command the agent runs.
+  if (!paths.some(isTestPath)) return { paths, addedPaths: untracked };
+  const addedPaths = [...new Set([
+    ...lines(git(root, ['diff', '--name-only', '--diff-filter=AR', `${base}...HEAD`])),
+    ...lines(git(root, ['diff', '--name-only', '--diff-filter=AR', '--cached'])),
+    ...lines(git(root, ['diff', '--name-only', '--diff-filter=AR'])),
+    ...untracked,
+  ])];
+  return { paths, addedPaths };
 }
 
 /**
@@ -426,8 +450,10 @@ function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
     // #5804: and the same waiver, read from the same range this diff was computed against, feeds the
     // evaluator — an honoured override for out-of-zone test work permits the matching focused test.
     const base = taskDiffBase(root);
+    const { paths, addedPaths } = taskDiffPaths(root);
     const decision = evaluateTestCommandPolicy({
-      paths: taskDiffPaths(root),
+      paths,
+      addedPaths,
       mandatory,
       regulated: true,
       override: taskOverride(root, base),
@@ -453,15 +479,61 @@ function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
   // abort fact, mirroring the operator-input guard's "entire compound tool call was cancelled" wording.
   const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-outside-mandatory-zone]: '
     + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other non-test step batched into the same call was NOT applied — re-run those steps separately. '
-    + `no path in ${root}'s task diff matches a mandatory glob in its test-policy.json. `
+    + `no path in ${root}'s task diff matches a mandatory glob in its test-policy.json, and it edits no test file that already existed. `
     + 'Verify that is the repository you meant before quoting this: it is resolved from a leading `cd` or `Set-Location` with a literal path, then the host cwd. '
     + 'Do not run tests; use policy-approved non-test verification, '
-    + 'or touch and run mandatory-zone coverage only when the diff actually requires it.';
+    + 'or touch and run mandatory-zone coverage only when the diff actually requires it. '
+    + 'A diff that EDITS a test file already in the tree may run tests (#5842); one that CREATES an out-of-zone test still needs an honoured `Test-Policy-Override` (#5804).';
   appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-outside-mandatory-zone', tool: input?.tool_name });
   stdout.write(preToolUseDeny(reason) + '\n');
   return { denied: true };
 }
 
+// --- `>nul` under Git Bash creates a FILE (#5845) ---------------------------------------------
+//
+// `nul` is a reserved DEVICE name to Win32, so `>nul` from cmd or PowerShell discards output and
+// leaves nothing behind. Bash does not honour that reservation on ANY platform — MSYS/Git Bash
+// resolves the path itself, and on Linux `nul` was never special to begin with — so the identical
+// redirect creates a real, empty, untracked file called `nul` in the working directory, usually the
+// repository root, since that is where agents run. In bash `>nul` therefore never means "discard",
+// which is why the deny needs no platform test: only the SHELL decides what the word means.
+//
+// It then breaks every recursive search over that tree: `rg` and `grep` ask Windows to open `nul`,
+// Windows hands back the device, and the read fails with `Incorrect function. (os error 1)`. The
+// error goes to stderr while the exit code can still be 0, so a sweep looks like it worked and is
+// quietly missing whatever the walker abandoned.
+//
+// Measured on MMI-Katip: one 0-byte `nul` sat in the repo root from 2026-08-22 until 2026-08-29,
+// erroring on every recursive search in between. An audit of that repo's own scripts and CI found no
+// `>nul` at all — the file came from an ad-hoc agent command, which is exactly why the fix belongs
+// in the gate every agent shell passes through rather than in any one repo.
+//
+// Gitignoring `nul` was considered and rejected: `rg` would then skip it silently, so the artifact
+// would keep landing and the only signal that it had would be gone.
+const NUL_REDIRECT_RE = /(?:^|\s)\d*>>?\s*(?:\.[\\/])?nul(?=$|\s)/i;
+
+/** Bash-shaped tools only. `>nul` from PowerShell or cmd hits the device and creates nothing, so
+ *  denying it there would refuse a correct command. */
+function isBashShapedTool(toolName) {
+  const tool = String(toolName ?? '').trim();
+  return tool === 'Bash' || tool === 'bash';
+}
+
+function runNulRedirectGuard(input, { stdout = process.stdout } = {}) {
+  if (!isBashShapedTool(input?.tool_name)) return { denied: false };
+  const offending = boundedShellSegments(input?.tool_input?.command)
+    .find((segment) => NUL_REDIRECT_RE.test(segment.text));
+  if (!offending) return { denied: false };
+  const reason = 'NUL REDIRECT REFUSED [bash-nul-redirect-creates-a-file]: '
+    + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other step batched into the same call was NOT applied — re-run those steps separately. '
+    + `segment ${offending.ordinal} redirects to \`nul\`, which bash treats as a PATH rather than the Windows null device — it would create an empty, untracked \`nul\` file here. On Windows every later recursive \`rg\`/\`grep\` over this tree then fails on it with "Incorrect function. (os error 1)", on stderr and often with exit 0, so the sweep looks fine while silently missing files. `
+    + 'Write `2>/dev/null` (or `>/dev/null`) in a bash command; `2>$null` is the PowerShell form. '
+    + 'To discard both streams, use `>/dev/null 2>&1`.';
+  appendHookActivity({ event: 'PreToolUse', script: NUL_REDIRECT_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'bash-nul-redirect-creates-a-file', tool: input?.tool_name });
+  stdout.write(preToolUseDeny(reason) + '\n');
+  return { denied: true };
+}
+
 function isPowerShellShapedTool(toolName) {
   const tool = String(toolName ?? '').trim();
   return tool === 'PowerShell' || (process.platform === 'win32' && (tool === 'shell' || tool === 'local_shell'));
@@ -625,6 +697,8 @@ export async function runPreToolUseShellGates({ input: buffered, stdout = proces
   if (echo.denied) return;
   const operatorInput = runOperatorInputGuard(input, { stdout });
   if (operatorInput.denied) return;
+  const nulRedirect = runNulRedirectGuard(input, { stdout });
+  if (nulRedirect.denied) return;
   const testCommandPolicy = runTestCommandPolicy(input, { stdout });
   if (testCommandPolicy.denied) return;
   runCommandLadder(input, { stdout, stderr });

package/scripts/test-command-policy-core.mjs

@@ -51,6 +51,40 @@ export const WAIVABLE_KINDS = [
  *  "this test is requested" decision, so it — and only it — authorizes the `test` class. */
 const TEST_WORK_KIND = 'unrequested-test-file';
 
+/** What counts as a test FILE. Lives here with the verdict that reads it, and is re-imported by
+ *  cli/src/test-policy-core.ts, for the reason the module header gives: two copies of a predicate
+ *  both surfaces answer with is how #5519 and #5804 each started. */
+export const TEST_FILE_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+export const PY_TEST_FILE_RE = /(?:^|\/)test_[^/]*\.py$|_test\.py$/;
+
+/** Is this path a test file by name? JS/TS and Python, because the guard regulates both estates. */
+export function isTestPath(path) {
+  return typeof path === 'string' && (TEST_FILE_RE.test(path) || PY_TEST_FILE_RE.test(path));
+}
+
+/** Does this diff EDIT a test file that already existed at the base? (#5842)
+ *
+ *  A zone outside the mandatory globs means no test is REQUIRED there. It never meant no test may be
+ *  RUN. Those read the same to a guard that only looks at globs, and the difference is what the
+ *  refusal cost: a repo whose policy deliberately leaves `scripts/**` unmandated still runs
+ *  `scripts/*.test.mjs` in its REQUIRED gate, so a fix to one of those tests could go red in CI while
+ *  every local attempt to run that exact file was denied — a three-minute round trip per attempt,
+ *  with the file's own fixtures unverifiable any other way.
+ *
+ *  ADDED test files are deliberately excluded, and that exclusion is the whole reason this is not
+ *  simply "is a test file in the diff". An out-of-zone test the diff CREATES is precisely what
+ *  `unrequested-test-file` refuses and what a `Test-Policy-Override` waiver exists to authorize
+ *  (#5804). If writing one also bought permission to run it, the waiver would authorize nothing that
+ *  was not already free, and "tests are opt-in" would be enforced only at PR time. Editing a test
+ *  that is already in the tree asserts nothing about whether new test work was requested — the file
+ *  is there, the required gate already runs it, and the only question left is whether the author may
+ *  watch it pass. A rename counts as added: the new name did not exist at the base either. */
+export function editsExistingTest(paths, addedPaths = []) {
+  const added = new Set(Array.isArray(addedPaths) ? addedPaths : []);
+  const list = Array.isArray(paths) ? paths : [];
+  return list.some((path) => isTestPath(path) && !added.has(path));
+}
+
 /**
  * Glob body → regex body. Supports `**`, `*`, and `{a,b}` (including wildcards inside braces).
  * Kept byte-compatible with {@link globToRegExp} in cli/src/test-policy-core.ts so rule matching
@@ -115,8 +149,10 @@ export function matchedMandatoryGlobs(paths, mandatory) {
  *   A waiver whose kinds cover {@link TEST_WORK_KIND} authorizes the `test` class even with zero
  *   matched globs: reporting and enforcement then state ONE decision, because both feed this
  *   function the same receipt.
+ *   `addedPaths` — the subset of `paths` this diff CREATED. #5842: an edit to a test that already
+ *   existed authorizes the class; creating one does not — see {@link editsExistingTest}.
  */
-export function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null } = {}) {
+export function evaluateTestCommandPolicy({ paths, mandatory, regulated = true, override = null, addedPaths = [] } = {}) {
   const configuredMandatoryCount = mandatoryGlobList(mandatory).length;
   if (!regulated) {
     return {
@@ -124,18 +160,23 @@ export function evaluateTestCommandPolicy({ paths, mandatory, regulated = true,
       matchedMandatoryGlobs: [],
       matchedMandatoryCount: 0,
       testCommandsAllowed: true,
+      editsExistingTest: false,
       reasonId: null,
       commandClasses: { allowed: [TEST_COMMAND_CLASS], refused: [] },
     };
   }
   const matched = matchedMandatoryGlobs(paths, mandatory);
   const overrideAuthorizes = Array.isArray(override?.kinds) && override.kinds.includes(TEST_WORK_KIND);
-  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes;
+  const existingTestEdited = editsExistingTest(paths, addedPaths);
+  const testCommandsAllowed = matched.length > 0 || overrideAuthorizes || existingTestEdited;
   return {
     configuredMandatoryCount,
     matchedMandatoryGlobs: matched,
     matchedMandatoryCount: matched.length,
     testCommandsAllowed,
+    /** #5842: true when the diff edits a test file that already existed — one of the facts that can
+     *  authorize the class, named so a refusal can say what was missing. */
+    editsExistingTest: existingTestEdited,
     reasonId: testCommandsAllowed ? null : 'test-command-outside-mandatory-zone',
     commandClasses: {
       allowed: testCommandsAllowed ? [TEST_COMMAND_CLASS] : [],