@mutmutco/pi-plugin 4.1.15 → 4.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/pi-plugin",
-  "version": "4.1.15",
+  "version": "4.1.17",
   "description": "MMI workflow skills and org gates delivery.",
   "author": {
     "name": "MMI Future",

package/scripts/pretooluse-shell-gates.mjs

@@ -339,7 +339,7 @@ function git(root, args) {
  *  already trusts, and only ever feeds a read-only `git -C` probe. */
 function commandWorkingDirectory(command, base) {
   const [first] = boundedShellSegments(command);
-  const match = /^cd\s+(?!-)(?:"([^"]+)"|'([^']+)'|([^\s;&|]+))\s*$/.exec(first?.text ?? '');
+  const match = /^(?:cd|Set-Location)\s+(?!-)(?:"([^"]+)"|'([^']+)'|([^\s;&|]+))\s*$/i.exec(first?.text ?? '');
   const target = match?.[1] ?? match?.[2] ?? match?.[3];
   if (!target || target.startsWith('~')) return null;
   const resolved = isAbsolute(target) ? target : (typeof base === 'string' && base ? resolve(base, target) : null);
@@ -404,7 +404,9 @@ function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
     });
     if (decision.testCommandsAllowed) return { denied: false, decision };
   } catch (error) {
+    // #5726: the deny aborts the ENTIRE tool call, so say so first — see the matching note below.
     const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-policy-unresolvable]: '
+      + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other non-test step batched into the same call was NOT applied — re-run those steps separately. '
       + `a test-policy.json applies but its repository, policy, or task diff could not be established (${error.message}). `
       + 'Do not run tests; use policy-approved non-test verification, or repair the repository/base reference before retrying.';
     appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-policy-unresolvable', tool: input?.tool_name });
@@ -415,9 +417,14 @@ function runTestCommandPolicy(input, { stdout = process.stdout } = {}) {
   // gets pasted into PR bodies as verification, so a bare "the current diff" — with no statement of
   // WHICH diff — reads as a claim about the repo the author is working in even when the gate resolved
   // a different one. Naming the root makes a wrong resolution self-evident instead of quotable.
+  // #5726: a PreToolUse deny aborts the ENTIRE tool call before execution, but this refusal used to
+  // read as a verdict on the test segment alone. An agent that batched `<edit> && <test runner>` kept
+  // working believing the edit had landed when the deny had discarded it with the rest. Lead with the
+  // abort fact, mirroring the operator-input guard's "entire compound tool call was cancelled" wording.
   const reason = 'TEST-POLICY TEST COMMAND REFUSED [test-command-outside-mandatory-zone]: '
+    + 'the ENTIRE command was aborted before execution; no segment ran, so any edit or other non-test step batched into the same call was NOT applied — re-run those steps separately. '
     + `no path in ${root}'s task diff matches a mandatory glob in its test-policy.json. `
-    + 'Verify that is the repository you meant before quoting this: it is resolved from the command\'s own `cd`, then the host cwd. '
+    + 'Verify that is the repository you meant before quoting this: it is resolved from a leading `cd` or `Set-Location` with a literal path, then the host cwd. '
     + 'Do not run tests; use policy-approved non-test verification, '
     + 'or touch and run mandatory-zone coverage only when the diff actually requires it.';
   appendHookActivity({ event: 'PreToolUse', script: TEST_COMMAND_GATE_NAME, outcome: 'deny', action: reason, reasonId: 'test-command-outside-mandatory-zone', tool: input?.tool_name });