@opengsd/gsd-core 1.7.0-rc.5 → 1.7.0

package/hooks/gsd-statusline.js

@@ -6,6 +6,9 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+// Namespace (not destructured) so tests can inject spawn failures by
+// monkeypatching childProcess.execFileSync.
+const childProcess = require('child_process');
 const { isSemverNewer } = require('../gsd-core/bin/lib/semver-compare.cjs');
 const { PACKAGE_NAME, updateCacheFileName } = require('../gsd-core/bin/lib/package-identity.cjs');
 
@@ -286,6 +289,129 @@ function formatGsdState(s) {
   return parts.join(' · ');
 }
 
+// --- Context token count (opt-in) ---------------------------------------------
+
+/**
+ * Format a token count compactly: 156342 → '156k', 1234567 → '1.2M'.
+ */
+function formatTokens(tokens) {
+  // Promote to the M branch when k-rounding would reach 1000 (999,500-999,999
+  // must render "1.0M", never "1000k").
+  if (tokens >= 1000000 || Math.round(tokens / 1000) >= 1000) {
+    return (tokens / 1000000).toFixed(1) + 'M';
+  }
+  if (tokens >= 1000) return Math.round(tokens / 1000) + 'k';
+  return String(tokens);
+}
+
+/**
+ * Pure function: build the token-count suffix for the context meter from the
+ * hook input's context_window.current_usage block. Sums input, cache-creation,
+ * cache-read, and output tokens (the same total Claude Code's /context shows).
+ * Returns ' (156k)' or '' when usage is absent/empty.
+ */
+function contextTokenSuffix(currentUsage) {
+  if (!currentUsage || typeof currentUsage !== 'object') return '';
+  const total = (Number(currentUsage.input_tokens) || 0) +
+    (Number(currentUsage.cache_creation_input_tokens) || 0) +
+    (Number(currentUsage.cache_read_input_tokens) || 0) +
+    (Number(currentUsage.output_tokens) || 0);
+  return total > 0 ? ` (${formatTokens(total)})` : '';
+}
+
+// --- Model name --------------------------------------------------------------
+
+/**
+ * Collapse the verbose " (… context)" model-name suffix Claude Code sends for
+ * long-context sessions (e.g. "Sonnet 4.5 (1M context)") to a compact badge
+ * (" (1M)"). The signal is preserved; the width isn't. Tolerant by design
+ * (issue #2160 approval condition): any trailing parenthesized token ending
+ * in "context" is collapsed — a future "(500K context)" becomes "(500K)"
+ * rather than silently no-opping. The token's own casing is preserved.
+ * Any other display name passes through unchanged.
+ */
+function compactModelName(name) {
+  if (typeof name !== 'string') return name;
+  return name.replace(/\s*\(([^)]+?)\s+(?:context|ctx)\)$/i, ' ($1)');
+}
+
+// --- Git segment (opt-in) ------------------------------------------------------
+//
+// Opt-in via `statusline.show_git: true` in .planning/config.json. Renders the
+// current branch plus compact work-state markers after the directory segment:
+//   " │ main+2~1?3↑1"  (staged / unstaged / untracked / ahead / behind)
+//   " │ main✓"         (clean, in sync)
+// One `git status --porcelain=v2 --branch` spawn per render — no shell, args
+// are a fixed array, and the workspace dir is passed via -C. Fails silently
+// (segment absent) outside a repo, without git, or on timeout.
+
+const GIT_STATUS_TIMEOUT_MS = 1500;
+
+/**
+ * Run `git status --porcelain=v2 --branch` in dir.
+ * Returns raw stdout, or null when git is missing, dir isn't a repo, or the
+ * call times out. Never throws.
+ */
+function readGitStatus(dir) {
+  try {
+    // 8 MiB maxBuffer (default 1 MiB) headroom for repos with very many changed
+    // or untracked files; overflow still degrades safely to segment-absent via
+    // the catch below.
+    return childProcess.execFileSync('git', ['-C', dir, 'status', '--porcelain=v2', '--branch'],
+      { encoding: 'utf8', timeout: GIT_STATUS_TIMEOUT_MS, maxBuffer: 8 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Pure function: parse `git status --porcelain=v2 --branch` output.
+ *
+ * Returns { branch, ahead, behind, staged, unstaged, untracked } or null when
+ * the text carries no branch header (not a repo / unparseable). Detached HEAD
+ * reports branch "(detached)" — porcelain v2's literal spelling, shown as-is.
+ * Unmerged (conflict) entries count as unstaged: they're pending work either way.
+ */
+function parseGitStatus(text) {
+  if (typeof text !== 'string') return null;
+  const info = { branch: null, ahead: 0, behind: 0, staged: 0, unstaged: 0, untracked: 0 };
+  for (const line of text.split('\n')) {
+    if (line.startsWith('# branch.head ')) {
+      info.branch = line.slice('# branch.head '.length).trim() || null;
+    } else if (line.startsWith('# branch.ab ')) {
+      const m = line.match(/\+(\d+) -(\d+)/);
+      if (m) { info.ahead = parseInt(m[1], 10); info.behind = parseInt(m[2], 10); }
+    } else if (line.startsWith('1 ') || line.startsWith('2 ')) {
+      // Changed / renamed entries: XY pair at cols 2-3, '.' = unmodified side
+      const xy = line.slice(2, 4);
+      if (xy[0] !== '.') info.staged++;
+      if (xy[1] !== '.') info.unstaged++;
+    } else if (line.startsWith('u ')) {
+      info.unstaged++;
+    } else if (line.startsWith('? ')) {
+      info.untracked++;
+    }
+  }
+  return info.branch ? info : null;
+}
+
+/**
+ * Pure function: format parsed git info into the statusline segment, divider
+ * included (mirrors lastCmdSuffix). Branch is dimmed to match the directory
+ * segment; markers keep their own colors. Returns '' when info is absent.
+ */
+function buildGitSegment(info) {
+  if (!info || !info.branch) return '';
+  const markers = [];
+  if (info.staged) markers.push(`\x1b[32m+${info.staged}\x1b[0m`);
+  if (info.unstaged) markers.push(`\x1b[33m~${info.unstaged}\x1b[0m`);
+  if (info.untracked) markers.push(`\x1b[31m?${info.untracked}\x1b[0m`);
+  if (info.ahead) markers.push(`\x1b[32m↑${info.ahead}\x1b[0m`);
+  if (info.behind) markers.push(`\x1b[31m↓${info.behind}\x1b[0m`);
+  const state = markers.length ? markers.join('') : '\x1b[32m✓\x1b[0m';
+  return ` │ \x1b[2m${info.branch}\x1b[0m${state}`;
+}
+
 // --- stdin ------------------------------------------------------------------
 
 function runStatusline() {
@@ -299,11 +425,16 @@ function runStatusline() {
   clearTimeout(stdinTimeout);
   try {
     const data = JSON.parse(input);
-    const model = data.model?.display_name || 'Claude';
+    const model = compactModelName(data.model?.display_name || 'Claude');
     const dir = data.workspace?.current_dir || process.cwd();
     const session = data.session_id || '';
     const remaining = data.context_window?.remaining_percentage;
 
+    // Read .planning config once — used by the context meter (token suffix)
+    // and the last-command/position block below. Fail-soft to {}.
+    let cfg = {};
+    try { cfg = readGsdConfig(dir); } catch (e) {}
+
     // Context window display (shows USED percentage scaled to usable context)
     // Claude Code reserves a buffer for autocompact. By default this is ~16.5%
     // of the total window, but users can override it via CLAUDE_CODE_AUTO_COMPACT_WINDOW
@@ -349,15 +480,21 @@ function runStatusline() {
       const filled = Math.floor(used / 10);
       const bar = '█'.repeat(filled) + '░'.repeat(10 - filled);
 
+      // Opt-in absolute token count after the percentage (statusline.show_context_tokens)
+      let tokenSuffix = '';
+      if (getConfigValue(cfg, 'statusline.show_context_tokens') === true) {
+        tokenSuffix = contextTokenSuffix(data.context_window?.current_usage);
+      }
+
       // Color based on usable context thresholds
       if (used < 50) {
-        ctx = ` \x1b[32m${bar} ${used}%\x1b[0m`;
+        ctx = ` \x1b[32m${bar} ${used}%${tokenSuffix}\x1b[0m`;
       } else if (used < 65) {
-        ctx = ` \x1b[33m${bar} ${used}%\x1b[0m`;
+        ctx = ` \x1b[33m${bar} ${used}%${tokenSuffix}\x1b[0m`;
       } else if (used < 80) {
-        ctx = ` \x1b[38;5;208m${bar} ${used}%\x1b[0m`;
+        ctx = ` \x1b[38;5;208m${bar} ${used}%${tokenSuffix}\x1b[0m`;
       } else {
-        ctx = ` \x1b[5;31m💀 ${bar} ${used}%\x1b[0m`;
+        ctx = ` \x1b[5;31m💀 ${bar} ${used}%${tokenSuffix}\x1b[0m`;
       }
     }
 
@@ -421,8 +558,8 @@ function runStatusline() {
     // Failure here must never break the statusline — wrap the entire lookup.
     let lastCmdSuffix = '';
     let position = 'end';
+    let gitSuffix = '';
     try {
-      const cfg = readGsdConfig(dir);
       if (getConfigValue(cfg, 'statusline.show_last_command') === true) {
         const transcriptPath = data.transcript_path;
         const lastCmd = readLastSlashCommand(transcriptPath);
@@ -432,8 +569,11 @@ function runStatusline() {
       }
       const cfgPos = getConfigValue(cfg, 'statusline.context_position');
       if (cfgPos != null) position = cfgPos;
+      if (getConfigValue(cfg, 'statusline.show_git') === true) {
+        gitSuffix = buildGitSegment(parseGitStatus(readGitStatus(dir)));
+      }
     } catch (e) {
-      // Never break the statusline on config/transcript errors
+      // Never break the statusline on config/transcript/git errors
     }
 
     // Output
@@ -444,7 +584,7 @@ function runStatusline() {
         ? `\x1b[2m${gsdStateStr}\x1b[0m`
         : null;
 
-    process.stdout.write(composeStatusline({ gsdUpdate, model, ctx, middle, dirname, lastCmdSuffix, position }));
+    process.stdout.write(composeStatusline({ gsdUpdate, model, ctx, middle, dirname, lastCmdSuffix, gitSuffix, position }));
   } catch (e) {
     // Silent fail - don't break statusline on parse errors
   }
@@ -463,6 +603,7 @@ function runStatusline() {
  * @param {string|null} [opts.middle=null]  - middle segment (todo task or GSD state), null = absent
  * @param {string} opts.dirname             - project directory basename (dim styling applied here)
  * @param {string} [opts.lastCmdSuffix='']  - last-command suffix, e.g. ' │ last: /foo'
+ * @param {string} [opts.gitSuffix='']      - git branch/status segment, e.g. ' │ main✓' (after dirname)
  * @param {'end'|'front'} [opts.position='end']
  *   - 'end'   (default): ctx appended after dirname — preserved byte-for-byte
  *   - 'front': ctx immediately after model name so the meter stays visible in narrow terminals
@@ -478,6 +619,7 @@ function composeStatusline({
   middle = null,
   dirname,
   lastCmdSuffix = '',
+  gitSuffix = '',
   position = 'end',
 } = {}) {
   const modelSeg = `\x1b[2m${model}\x1b[0m`;
@@ -486,12 +628,12 @@ function composeStatusline({
   const pos = position === 'front' ? 'front' : 'end';
 
   if (pos === 'front') {
-    if (middle) return `${gsdUpdate}${modelSeg}${ctx} │ ${middle} │ ${dirSeg}${lastCmdSuffix}`;
-    return `${gsdUpdate}${modelSeg}${ctx} │ ${dirSeg}${lastCmdSuffix}`;
+    if (middle) return `${gsdUpdate}${modelSeg}${ctx} │ ${middle} │ ${dirSeg}${gitSuffix}${lastCmdSuffix}`;
+    return `${gsdUpdate}${modelSeg}${ctx} │ ${dirSeg}${gitSuffix}${lastCmdSuffix}`;
   }
   // 'end' — preserved byte-for-byte relative to original inline templates
-  if (middle) return `${gsdUpdate}${modelSeg} │ ${middle} │ ${dirSeg}${ctx}${lastCmdSuffix}`;
-  return `${gsdUpdate}${modelSeg} │ ${dirSeg}${ctx}${lastCmdSuffix}`;
+  if (middle) return `${gsdUpdate}${modelSeg} │ ${middle} │ ${dirSeg}${gitSuffix}${ctx}${lastCmdSuffix}`;
+  return `${gsdUpdate}${modelSeg} │ ${dirSeg}${gitSuffix}${ctx}${lastCmdSuffix}`;
 }
 
 function isInstalledAheadOfLatest(installed, latest) {
@@ -531,6 +673,10 @@ module.exports = {
   composeStatusline,
   isInstalledAheadOfLatest,
   evaluateUpdateCache,
+  formatTokens,
+  contextTokenSuffix,
+  compactModelName,
+  readGitStatus, parseGitStatus, buildGitSegment,
 };
 
 /**
@@ -538,12 +684,13 @@ module.exports = {
  * testing without feeding stdin. Returns the rendered string.
  */
 function renderStatusline(data) {
-  const model = data.model?.display_name || 'Claude';
+  const model = compactModelName(data.model?.display_name || 'Claude');
   const dir = data.workspace?.current_dir || process.cwd();
   const dirname = path.basename(dir);
 
   let lastCmdSuffix = '';
   let position = 'end';
+  let gitSuffix = '';
   try {
     const cfg = readGsdConfig(dir);
     if (getConfigValue(cfg, 'statusline.show_last_command') === true) {
@@ -554,11 +701,14 @@ function renderStatusline(data) {
     }
     const cfgPos = getConfigValue(cfg, 'statusline.context_position');
     if (cfgPos != null) position = cfgPos;
+    if (getConfigValue(cfg, 'statusline.show_git') === true) {
+      gitSuffix = buildGitSegment(parseGitStatus(readGitStatus(dir)));
+    }
   } catch (e) { /* swallow */ }
 
   const gsdStateStr = formatGsdState(readGsdState(dir) || {});
   const middle = gsdStateStr ? `\x1b[2m${gsdStateStr}\x1b[0m` : null;
-  return composeStatusline({ model, ctx: '', middle, dirname, lastCmdSuffix, position });
+  return composeStatusline({ model, ctx: '', middle, dirname, lastCmdSuffix, gitSuffix, position });
 }
 
 module.exports.renderStatusline = renderStatusline;

package/hooks/gsd-windsurf-pre-command.js

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+// gsd-hook-version: {{GSD_VERSION}}
+// gsd-windsurf-pre-command.js — Windsurf/Cascade pre_run_command hook (ADR-1239 / #2100)
+//
+// Cascade (Windsurf's agent) invokes this script before each shell-command
+// tool call executes, via the workspace/global hooks.json hook bus.
+//
+// Input schema (Cascade pre_run_command envelope, JSON on stdin):
+//   { agent_action_name: 'pre_run_command', trajectory_id, execution_id,
+//     timestamp, model_name,
+//     tool_info: { command_line } }
+//
+// Decision protocol — DISTINCT from Cursor's stdout-JSON form:
+//   - exit 0  -> allow the command to run (no stdout contract)
+//   - exit 2  -> BLOCK the command; the printed stderr text is the reason
+//                shown to the agent/user
+//
+// Behaviour: blocks a small, CONSERVATIVE, well-scoped, BEST-EFFORT deny-list
+// of obviously destructive commands. This is intentionally not exhaustive —
+// a broad deny-list would false-positive on legitimate agent/tooling work,
+// and Cascade honors exit 2 unconditionally, so a false positive blocks the
+// user's real work. When in doubt, this script allows:
+//   - a fork-bomb pattern
+//   - `rm -rf` (or equivalent combined/long flags), including through common
+//     prefixed forms (`sudo rm -rf /`, `/bin/rm -rf /`, `env FOO=1 rm -rf /`),
+//     targeting the filesystem root, the user's home directory, or a Windows
+//     drive root/profile root
+//   - `git push` with a force flag (`-f`/`--force`/`--force-with-lease`) or a
+//     `+`-prefixed refspec, explicitly targeting a protected branch
+//     (main / master / next) as the push destination — not merely mentioning
+//     that name elsewhere in a longer branch name or a trailing comment
+// Everything else — including force-pushes to feature branches and `rm -rf`
+// against ordinary project subdirectories — is intentionally left alone.
+// Fails OPEN on any error, timeout, or unrecognized shape — a hook bug must
+// never wedge Cascade.
+//
+// Classification is TOKENIZE-based (split into shell segments, then
+// whitespace-split tokens), not a single mega-regex over the raw string —
+// this keeps every check linear in input length. `command_line` longer than
+// MAX_COMMAND_LENGTH is allowed outright before any pattern matching runs:
+// no realistic destructive command is anywhere near that long, so the cap
+// both fails open on pathological input and bounds the worst-case cost of
+// every classifier below (defense-in-depth against regex-based DoS).
+//
+// Cascade hooks docs (reference): https://docs.windsurf.com/llms-full.txt ,
+//                                  https://docs.devin.ai/desktop/cascade/hooks
+
+'use strict';
+
+// No realistic destructive command comes anywhere close to this length.
+const MAX_COMMAND_LENGTH = 4096;
+
+// Classic bash fork bomb: `:(){ :|:& };:`
+const FORK_BOMB_RE = /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/;
+
+// Command-prefix wrappers to look through when locating the "real" command at
+// the head of a segment: `sudo rm -rf /`, `/bin/rm -rf /` (basename strip),
+// `env FOO=1 rm -rf /` (env's leading VAR=val args are skipped too).
+const CMD_PREFIXES = new Set(['sudo', 'env', 'command', 'nice', 'nohup', 'time', 'doas']);
+
+// Bare filesystem-root-class tokens for `rm`'s target. Ordinary paths like
+// `/tmp/foo` or `/home/user/project` never match this set.
+const ROOT_SENTINELS = new Set(['/', '/*', '~', '~/', '$HOME', '${HOME}']);
+
+const PROTECTED_BRANCHES = new Set(['main', 'master', 'next']);
+
+// ---------------------------------------------------------------------------
+// Tokenizing helpers
+// ---------------------------------------------------------------------------
+
+// Split a command line into shell segments on `;`, `&&`, `||`, `|`, newline —
+// each segment is classified independently.
+function splitSegments(cmd) {
+  return cmd.split(/\|\||&&|[;\n|]/);
+}
+
+// A `#` starts a bash comment when it's the first character of a "word"
+// (preceded by whitespace, or at the very start of the segment). Strip it
+// before classifying, so a comment mentioning a protected branch name never
+// counts as a real command argument.
+function stripBashComment(segment) {
+  const m = segment.match(/(^|\s)#/);
+  if (!m) return segment;
+  const idx = m.index + m[1].length;
+  return segment.slice(0, idx).replace(/\s+$/, '');
+}
+
+function tokenize(segment) {
+  return segment.split(/\s+/).filter(Boolean);
+}
+
+// Strip any directory path from a token: `/bin/rm` -> `rm`.
+function basename(tok) {
+  const parts = tok.split(/[\\/]/);
+  return parts[parts.length - 1] || tok;
+}
+
+// Find the index of the "real" command token in a token list, skipping past
+// known command-prefix wrappers (and, for `env`, its leading VAR=val args).
+function indexOfCommandAfterPrefixes(tokens) {
+  let i = 0;
+  while (i < tokens.length) {
+    const base = basename(tokens[i]).toLowerCase();
+    if (!CMD_PREFIXES.has(base)) return i;
+    const wasEnv = base === 'env';
+    i++;
+    if (wasEnv) {
+      while (i < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i])) i++;
+    }
+  }
+  return i;
+}
+
+// True if `tokens` contains a flag matching either the exact long form, or a
+// combined/short `-xyz` cluster containing `shortChar` (e.g. `-rf`, `-fr`,
+// `-r`). A single `[a-zA-Z]+` quantifier with no nested ambiguity — linear,
+// no catastrophic backtracking regardless of token length.
+function hasFlag(tokens, shortChar, longFlag) {
+  return tokens.some((t) => {
+    if (t === longFlag) return true;
+    if (t.length > 1 && t[0] === '-' && t[1] !== '-' && /^[a-zA-Z]+$/.test(t.slice(1))) {
+      return t.slice(1).toLowerCase().includes(shortChar);
+    }
+    return false;
+  });
+}
+
+function isRootSentinel(tok) {
+  if (ROOT_SENTINELS.has(tok)) return true;
+  // Bare Windows drive root: `C:\` or `C:/`.
+  if (/^[A-Za-z]:[\\/]$/.test(tok)) return true;
+  return false;
+}
+
+// ---------------------------------------------------------------------------
+// Classifiers (each operates on one already comment-stripped segment)
+// ---------------------------------------------------------------------------
+
+// `rm` (any flag order/spelling, optionally through `sudo`/`env FOO=1`/an
+// absolute path/etc.) with BOTH a recursive flag and a force flag, targeting
+// a bare filesystem-root-class token.
+function isDestructiveRmRf(segment) {
+  const tokens = tokenize(segment);
+  const cmdIdx = indexOfCommandAfterPrefixes(tokens);
+  if (cmdIdx >= tokens.length) return null;
+  if (basename(tokens[cmdIdx]) !== 'rm') return null;
+  const args = tokens.slice(cmdIdx + 1);
+  const hasRecursive = hasFlag(args, 'r', '--recursive');
+  const hasForce = hasFlag(args, 'f', '--force');
+  if (!hasRecursive || !hasForce) return null;
+  const rootTok = args.find(isRootSentinel);
+  if (rootTok) return `rm -rf targeting the filesystem root or home directory ('${rootTok}')`;
+  return null;
+}
+
+function isWindowsRootSentinel(tok) {
+  if (/^[A-Za-z]:\\?$/.test(tok)) return true;
+  if (/^\$env:userprofile\\?$/i.test(tok)) return true;
+  if (/^~\\?$/.test(tok)) return true;
+  return false;
+}
+
+function isWindowsDriveRoot(tok) {
+  return /^[A-Za-z]:\\?$/.test(tok);
+}
+
+// Windows equivalents: `Remove-Item -Recurse -Force <drive-root|profile-root>`
+// and `rd /s /q <drive-root>` / `rmdir /s /q <drive-root>`.
+function isDestructiveWindowsRmRf(segment) {
+  const tokens = tokenize(segment);
+  if (tokens.length === 0) return null;
+  const first = basename(tokens[0]).toLowerCase();
+  const rest = tokens.slice(1);
+  if (first === 'remove-item') {
+    const hasRecurse = rest.some((t) => t.toLowerCase() === '-recurse');
+    const hasForce = rest.some((t) => t.toLowerCase() === '-force');
+    if (hasRecurse && hasForce && rest.some(isWindowsRootSentinel)) {
+      return 'Remove-Item -Recurse -Force targeting a drive root or user-profile root';
+    }
+    return null;
+  }
+  if (first === 'rd' || first === 'rmdir') {
+    const hasS = rest.some((t) => t.toLowerCase() === '/s');
+    const hasQ = rest.some((t) => t.toLowerCase() === '/q');
+    if (hasS && hasQ) {
+      const rootTok = rest.find(isWindowsDriveRoot);
+      if (rootTok) return `rd /s /q targeting drive root '${rootTok}'`;
+    }
+    return null;
+  }
+  return null;
+}
+
+function isForceToken(tok) {
+  if (tok === '--force' || tok === '-f') return true;
+  if (/^--force-with-lease(=.*)?$/i.test(tok)) return true;
+  if (tok.startsWith('+')) return true;
+  return false;
+}
+
+// Resolve the branch a push-argument token targets, honoring `+<dst>` and
+// `<src>:<dst>` refspec forms and an optional `refs/heads/` prefix. Returns
+// the lower-cased protected branch name, or null. Whole-token comparison
+// only — `feature/main-fix` never matches `main`.
+function protectedTargetFromToken(tok) {
+  let t = tok;
+  if (t.startsWith('+')) t = t.slice(1);
+  const colonIdx = t.lastIndexOf(':');
+  const candidate = colonIdx !== -1 ? t.slice(colonIdx + 1) : t;
+  const stripped = candidate.replace(/^refs\/heads\//i, '');
+  const lower = stripped.toLowerCase();
+  return PROTECTED_BRANCHES.has(lower) ? lower : null;
+}
+
+// `git push` with a force flag/refspec AND an explicit protected-branch push
+// target (main / master / next — see scripts/setup-branch-protection.sh).
+function isProtectedBranchForcePush(segment) {
+  const tokens = tokenize(segment);
+  for (let i = 0; i < tokens.length - 1; i++) {
+    if (tokens[i].toLowerCase() === 'git' && tokens[i + 1].toLowerCase() === 'push') {
+      const rest = tokens.slice(i + 2);
+      if (!rest.some(isForceToken)) return null;
+      for (const tok of rest) {
+        const target = protectedTargetFromToken(tok);
+        if (target) return `git push --force targeting protected branch '${target}'`;
+      }
+      return null;
+    }
+  }
+  return null;
+}
+
+function destructiveReason(cmd) {
+  if (FORK_BOMB_RE.test(cmd)) return 'fork-bomb pattern';
+  for (const rawSegment of splitSegments(cmd)) {
+    const segment = stripBashComment(rawSegment).trim();
+    if (!segment) continue;
+    const reason = isDestructiveRmRf(segment)
+      || isDestructiveWindowsRmRf(segment)
+      || isProtectedBranchForcePush(segment);
+    if (reason) return reason;
+  }
+  return null;
+}
+
+function block(reason) {
+  process.stderr.write(`GSD windsurf pre_run_command guard: ${reason}\n`);
+  process.exit(2);
+}
+
+function allow() {
+  process.exit(0);
+}
+
+let input = '';
+const stdinTimeout = setTimeout(() => process.exit(0), 10000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => { input += chunk; });
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    const data = JSON.parse(input || '{}');
+    const toolInfo = (data && typeof data.tool_info === 'object' && data.tool_info) || {};
+    const commandLine = typeof toolInfo.command_line === 'string' ? toolInfo.command_line : '';
+    if (!commandLine) { allow(); return; }
+    if (commandLine.length > MAX_COMMAND_LENGTH) { allow(); return; }
+
+    const reason = destructiveReason(commandLine);
+    if (reason) { block(reason); return; }
+    allow();
+  } catch {
+    // Silent fail-open — never block a valid tool call due to a hook bug.
+    allow();
+  }
+});