@r1z4x/tezgah 1.7.0 → 1.8.2

package/hosts/opencode/plugins/tezgah.js

@@ -228,6 +228,48 @@ const SECRET_SINK =
 // message about the rule rather than a credential in a write. `|` is NOT a
 // boundary here but a carrier, and the split is read off the masked text.
 const SEGMENT = /\|\||&&|[;&\n]/g
+// Plan 096, as hooks/tezgah_gate reads it (SECRET_PREFIX, SECRET_RUNNER, ...,
+// _secret_runner): a token held only by a program's leading `NAME=value` words
+// is in that program's env, so its redirected output carries no key - but only
+// for a script runner named by itself, given a script file, with no option that
+// runs its own text, stdin or a preload, or traces. Any other program holds.
+const SECRET_PREFIX =
+  /^[\s;&|]*(?:env\s+)?(?:[A-Za-z_]\w*=(?:'[^']*'|"(?:\\.|[^"\\])*"|\$\([^()]*\)|`[^`]*`|\\.|[^\s;&|()<>'"`\\])*\s+)+/
+// the sinks that carry a program's output and nothing but it (SECRET_OUTPUT)
+const SECRET_OUTPUT = />>?(?![&=])|\|\s*tee\b/g
+const SECRET_RUNNER = /^(?:python[\d.]*|node|bun|deno|bash|sh|zsh)$/
+const SECRET_SCRIPT = /^[^$`\s]+\.(?:py|js|mjs|ts|sh)$/
+const SECRET_INLINE = {python: /^-[A-Za-z]*[cmi]/,
+  sh: /^(?:-[A-Za-z]*[csxv]|-o$|--(?:verbose|debugger))/,
+  js: /^(?:-[A-Za-z]*[epri]|--(?:eval|print|require|import|loader|experimental-loader|preload|interactive)(?:=|$))/}
+// the line holds (SECRET_ENVIRON, SECRET_STARTUP, SECRET_TRACE, SECRET_FUNCTION)
+const SECRET_ENVIRON = /\/proc\/[^/\s]*\/environ/
+const SECRET_STARTUP =
+  /(?<![\w$])(?:SHELLOPTS|BASHOPTS|BASH_ENV|ENV|PS4|ZDOTDIR|NODE_OPTIONS|PYTHONSTARTUP|PYTHONINSPECT|PERL5OPT|PERL5DB|RUBYOPT|LD_PRELOAD|DYLD_\w*)=/
+const SECRET_TRACE = /(?:^|[\s;&|(])set\s+(?:-[A-Za-z]*[xv]|-o\s+(?:xtrace|verbose))/
+const SECRET_FUNCTION =
+  /(?:^|[\s;&|(])(?:function\s+[^\s(){};&|]+|[^\s(){};&|$=]+\s*\(\s*\))/
+const SECRET_UNEXPANDED = /\$[A-Za-z_{(]|`/
+// the programs a carried name is printed by when they own a sink
+const SECRET_PRINTERS = new Set(["echo", "printf", "cat", "eval", "awk", "perl",
+  "ruby"])
+// a versioned python is read by /^python[\d.]+$/: only pythonBin() spells the
+// interpreter's name (tests/test_interpreter.py)
+const SECRET_INTERPRETERS = new Set(["python", "sh", "bash", "zsh", "dash"])
+const SECRET_KEYWORDS = new Set(["if", "then", "elif", "else", "do", "while",
+  "until", "!", "{", "time"])
+// the wrappers `_program` reads past, with the options that take a value
+const SECRET_WRAPPERS = new Map([
+  ["sudo", ["-u", "-g", "-h", "-p", "-C", "-D", "-r", "-t", "-U"]],
+  ["env", ["-u", "--unset", "-C", "--chdir"]], ["nice", ["-n", "--adjustment"]],
+  ["nohup", []], ["exec", ["-a"]], ["time", ["-f", "-o"]], ["command", []],
+  ["timeout", ["-s", "--signal", "-k", "--kill-after"]], ["stdbuf", ["-i", "-o", "-e"]]])
+const SECRET_INTERPRETER_OPTS = ["-X", "-W", "-o", "+o", "-O"]
+// `NAME=value` at a word start, and the `$NAME`/`${NAME}` a later word reads
+// (hooks/tezgah_gate.SHELL_ASSIGN, SHELL_VAR)
+const SECRET_ASSIGN =
+  /(?:^|(?<=[\s;&|(]))([A-Za-z_][A-Za-z0-9_]*)=((?:'[^']*'|"[^"]*"|[^\s;&|)'"])*)/g
+const SECRET_VAR = /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g
 const SECRET_DENY =
   "Credential write denied: this command would land a credential in a file " +
   "(`>`/`>>`, `tee`, `git add` or a curl trace). Record the credential's " +
@@ -1941,23 +1983,148 @@ function realPath(p) {
 // The refusal when this command would write a credential into a file, or null.
 // Reading an env var or running a tool with a key in its env is the normal work
 // this must not touch, so a token only counts next to a write sink, and a sink
-// only carries the text of its own simple command.
+// only carries the text of its own simple command. A token held only by the
+// leading `NAME=value` words of an allowlisted program is in that program's env
+// (envPrefixOnly), unless the line reads /proc's environ or defines a function.
+// A name an earlier command assigned a token is carried, and a printer owning a
+// sink that reads it still writes it (printerOwnsSink; plan 096).
 function secretCommand(command) {
   const c = String(command || "")
   if (!c || !SECRET_TOKEN.test(c)) return null
   const masked = maskText(c)
+  const relax = !(SECRET_ENVIRON.test(c) || SECRET_STARTUP.test(c)
+                  || SECRET_FUNCTION.test(masked) || SECRET_TRACE.test(masked))
   let start = 0
+  const carried = new Set()
   const ends = [...masked.matchAll(SEGMENT)].map((m) => m.index)
   for (const end of ends.concat(c.length)) {
-    if (SECRET_TOKEN.test(c.slice(start, end))
-        && SECRET_SINK.test(masked.slice(start, end))) {
-      return SECRET_DENY
+    const text = c.slice(start, end)
+    if (SECRET_SINK.test(masked.slice(start, end))) {
+      if (SECRET_TOKEN.test(text) && !(relax && envPrefixOnly(text))) return SECRET_DENY
+      if ([...text.matchAll(SECRET_VAR)].some((v) => carried.has(v[1] || v[2]))
+          && printerOwnsSink(text, masked.slice(start, end))) {
+        return SECRET_DENY
+      }
+    }
+    for (const a of text.matchAll(SECRET_ASSIGN)) {
+      if (SECRET_TOKEN.test(a[0])) carried.add(a[1])
     }
     start = end
   }
   return null
 }
 
+// True when every token in this simple command's text sits in its leading
+// `NAME=value` words, no sink runs inside them, the sinks after them carry only
+// the program's output (a `git add` or a curl trace holds), and the program is
+// on the allowlist (hooks/tezgah_gate._env_prefix_only).
+function envPrefixOnly(text) {
+  const m = text.match(SECRET_PREFIX)
+  if (!m) return false
+  const rest = text.slice(m[0].length)
+  return !(SECRET_TOKEN.test(rest) || SECRET_SINK.test(m[0])
+           || SECRET_SINK.test(rest.replace(SECRET_OUTPUT, " "))
+           || !secretRunner(rest))
+}
+
+// the words of the first command `text` runs, a `$( )` body skipped
+function firstCommand(text) {
+  const first = shellCommands(text.replace(/^[ \t\n;&|]+/, ""))
+    .find((cmd) => cmd[1] !== "$)")
+  return first ? first[0] : []
+}
+
+// True when the first program `text` runs, past the wrappers, is a script
+// runner named by itself (a path could be any program) given a script file,
+// with no `-` or inline, stdin, preload, interactive or trace option before it
+// (hooks/tezgah_gate._secret_runner).
+function secretRunner(text) {
+  const words = secretPastWrappers(firstCommand(text))
+  if (!words.length || !SECRET_RUNNER.test(words[0])) return false
+  const name = words[0]
+  let args = words.slice(1)
+  if (name === "deno") {
+    if (args[0] !== "run") return false
+    args = args.slice(1)
+  }
+  const inline = SECRET_INLINE[name.startsWith("python") ? "python"
+    : ["node", "bun", "deno"].includes(name) ? "js" : "sh"]
+  for (let i = 0; i < args.length;) {
+    const arg = args[i]
+    if (arg === "-" || inline.test(arg)) return false
+    if (!/^[-+]/.test(arg)) return SECRET_SCRIPT.test(arg)
+    i += SECRET_INTERPRETER_OPTS.includes(arg) ? 2 : 1
+  }
+  return false
+}
+
+// True when a pipeline stage that owns a file sink - a `>` to a file other than
+// /dev/null, or a pipe into `tee` - is a printer
+// (hooks/tezgah_gate._printer_owns_sink).
+function printerOwnsSink(text, masked) {
+  const cuts = [...masked.matchAll(/(?<!>)\|/g)].map((m) => m.index)
+  const starts = [0, ...cuts.map((k) => k + 1)]
+  const stops = [...cuts, text.length]
+  for (let k = 0; k < starts.length; k++) {
+    const a = starts[k], b = stops[k]
+    let owns = [...masked.slice(a, b).matchAll(/>>?(?![&=])/g)].some((m) =>
+      text.slice(a + m.index + m[0].length, b).trim().split(/\s+/)[0] !== "/dev/null")
+    if (k + 1 < starts.length && /^\s*tee\b/.test(masked.slice(starts[k + 1]))) owns = true
+    if (owns && secretPrinter(text.slice(a, b))) return true
+  }
+  return false
+}
+
+// True when the first program `text` runs prints a carried name
+// (hooks/tezgah_gate._secret_printer).
+function secretPrinter(text) {
+  const program = secretProgram(firstCommand(text))[0]
+  return SECRET_PRINTERS.has(program) || SECRET_INTERPRETERS.has(program)
+    || /^python[\d.]+$/.test(program) || SECRET_UNEXPANDED.test(program)
+}
+
+// `words` past keywords, env assignments and the wrappers
+// (hooks/tezgah_gate._past_wrappers)
+function secretPastWrappers(words) {
+  let i = 0
+  while (i < words.length) {
+    const word = words[i]
+    if (/^[A-Za-z_]\w*=/.test(word) || SECRET_KEYWORDS.has(word)) { i += 1; continue }
+    const wrapper = basename(word)
+    const opts = SECRET_WRAPPERS.get(wrapper)
+    if (!opts) break
+    i += 1
+    while (i < words.length && words[i].startsWith("-")) i += opts.includes(words[i]) ? 2 : 1
+    if (wrapper === "timeout" && i < words.length) i += 1
+  }
+  return words.slice(i)
+}
+
+// [program basename without `.py`, its arguments] for one simple command, past
+// the wrappers and an interpreter's options before its script
+// (hooks/tezgah_gate._program).
+function secretProgram(words) {
+  words = secretPastWrappers(words)
+  if (words[0] === "[") {
+    const close = words.indexOf("]")
+    words = words.slice(close < 0 ? words.length : close + 1)
+  }
+  if (!words.length) return ["", []]
+  let name = basename(words[0])
+  if (SECRET_INTERPRETERS.has(name) || /^python[\d.]+$/.test(name)) {
+    const own = name.startsWith("python") ? /^-[A-Za-z]*[cm]$/ : /^-[A-Za-z]*c[A-Za-z]*$/
+    let j = 1
+    while (j < words.length && /^[-+]/.test(words[j]) && words[j] !== "-") {
+      if (own.test(words[j])) { j = words.length + 1; break }
+      j += SECRET_INTERPRETER_OPTS.includes(words[j]) ? 2 : 1
+    }
+    if (j < words.length) words = words.slice(j)
+  }
+  if (!words.length) return ["", []]
+  name = basename(words[0])
+  return [name.endsWith(".py") ? name.slice(0, -3) : name, words.slice(1)]
+}
+
 // --- untrusted content: the channel and the label ---------------------------
 // The two halves the Python hosts get from
 // hooks/tezgah_integrity.untrusted_source and hooks/tezgah_untrusted.marks,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r1z4x/tezgah",
-  "version": "1.7.0",
+  "version": "1.8.2",
   "description": "One shared working contract for every AI coding assistant you run: Claude Code, Codex, Cursor, opencode, dsh and oh-my-pi (omp).",
   "license": "MIT",
   "repository": {

package/skills/plan-add/SKILL.md

@@ -72,9 +72,15 @@ Input: `$ARGUMENTS` (free text describing the work). Run these steps in order.
 9. Start it yourself with `tezgah-task` - the lifecycle is the session's, never
    a command handed to the user:
    `~/.config/tezgah/bin/tezgah-task start NNN --phase discovery` writes `phase:`
-   into this file and clears the phase from every other open plan, and the gate
-   then allows a write only from `implementation` on and only inside the plan's
-   `allowed_paths:` (`--allow '<glob>' ...` replaces them). Entering
+   into this file and clears the phase from every other open plan. To run two
+   plans at once, give each its own worktree on its own branch (`branch:`, or
+   `plan/NNN-slug`) before `start`: a plan held by its worktree keeps its phase
+   when the plan being started is held by one too and their `allowed_paths:`
+   share no prefix, and the gate holds a write in each worktree to that plan's
+   record. The gate then allows a write only from `implementation` on and only
+   inside the plan's `allowed_paths:` (`--allow '<glob>' ...` replaces them);
+   `phase`, `allow` and `stop` run inside a plan's worktree act on that plan,
+   and `allow` refuses a scope another running plan's worktree holds. Entering
    `implementation` or `verification` with no allowlist is refused unless
    `--any-path` is passed, so keep the plan's scope and never drop it to get
    through. Three more refusals land at the same moment, and you fix them in the
@@ -90,9 +96,14 @@ Input: `$ARGUMENTS` (free text describing the work). Run these steps in order.
    the scope with `tezgah-task allow <glob> ... --why "<reason>"`, which records the reason. Never retype the record:
    the gate refuses a write to it, because the CLI's checks would be skipped.
    Tick an Acceptance box with `tezgah-task tick NNN <n>` (`--undo` unticks),
-   and rewrite State or Next with `tezgah-task note NNN state|next "<text>"`.
+   rewrite State or Next with `tezgah-task note NNN state|next "<text>"`, and
+   record the spike's answer with `tezgah-task spike NNN "<answer>"`, which
+   writes `spike_recorded:` on the plan, active or not. These three work from
+   the main checkout or from any of its worktrees.
    After the merge, `tezgah-task close NNN done` deactivates the plan,
-   moves it to done and removes every merged worktree.
+   moves it to done and removes every merged worktree. It refuses while an
+   Acceptance box is open: tick it, or, only when the owner accepted the item
+   as not met, end it with `UNMET: <reason, who accepted it>`.
 
 10. If the work settles a decision that is hard to reverse, spans components, or
     keeps being re-explained, record it as an ADR under `.tezgah/decisions/` with
@@ -133,14 +144,16 @@ after:
 
 `allowed_paths:` is written here, at creation (step 5): the scope the task's
 writes have to stay inside, one glob per `- ` line. `tezgah-task` adds the rest:
-`phase:` - `discovery`, `implementation` or `verification`, at most one open plan
-carrying it - is the activation key the gate reads, set when the session starts
+`phase:` - `discovery`, `implementation` or `verification`, on one open plan, or
+on one plan per worktree when their scopes share no prefix (step 9) - is the
+activation key the gate reads, set when the session starts
 the task itself (step 9); `allowed_from:` records where a scope the CLI replaced came from.
 `tezgah-task phase verification` lists what the plan owes before it is done: its
 acceptance commands run unpiped, and a fresh reviewer (the host's
 `tezgah-reviewer` subagent) reading the diff, whose verdict
 `tezgah-task review NNN <reviewer> approve|changes` records as `review:`.
-`tezgah-task close NNN done` (plan-sync) refuses without an `approve`.
+`tezgah-task close NNN done` (plan-sync) refuses without an `approve`, and on an
+unticked Acceptance item with no `UNMET: <reason>`; `discarded` needs neither.
 
 `after:` names the plans that must be done before this one starts - a `- NNN`
 block or `after: 012, 015`. `tezgah-task status` reads it: each open plan's
@@ -160,7 +173,8 @@ return to is what a large refactor has instead of 200 per-file snapshots
 The four `spike:` keys are optional and go together, on a plan that must answer
 one question before it can be built: `spike:` is that question, `spike_box:` the
 time box (minutes, or one focused session), `spike_recorded:` where the answer
-is recorded - empty until it is, which is what refuses `implementation` - and
+is recorded (`tezgah-task spike NNN "<answer>"` writes it) - empty until it is,
+which is what refuses `implementation` - and
 `spike_throwaway:` whether the code is thrown away once it has answered. Nothing
 enforces the throwaway half, because `allowed_paths:` already does: a spike pins
 its scope to a scratch path and is never merged, and the knowledge, not the

package/skills/plan-add/render_table.py

@@ -1,12 +1,12 @@
 #!/usr/bin/env python3
-"""Rewrite the status table in <git root>/.tezgah/plans/README.md from .tezgah/plans/open/*.md.
+"""Rewrite the status table in <main checkout>/.tezgah/plans/README.md from .tezgah/plans/open/*.md.
 Usage: python3 render_table.py [--pr-info 'NNN=text' ...]  (extra text appended to the pr cell)
        python3 render_table.py --acceptance  (the acceptance items that name no
        command, with the counts it read; a report, not a gate - always exit 0)
        python3 render_table.py --acceptance --strict  (the same report, and exit 1
        when an item still under .tezgah/plans/open names no command either)
 Creates .tezgah/plans/README.md, or appends the marker block to it, when either is missing."""
-import glob, os, re, subprocess, sys
+import glob, os, re, sys
 # The one reader of a plan file lives in the module that owns the record, so the
 # table and the acceptance report cannot disagree about what a plan says. Three
 # dirnames up from skills/plan-add/render_table.py is the tree that holds hooks/,
@@ -14,7 +14,12 @@ import glob, os, re, subprocess, sys
 HERE = os.path.dirname(os.path.dirname(os.path.dirname(os.path.realpath(__file__))))
 sys.path.insert(0, os.path.join(HERE, "hooks"))
 import tezgah_task as tt  # noqa: E402
-root = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], text=True).strip()
+# The project's main checkout, the one that keeps `.tezgah/plans`: git's own
+# top-level answered `.tezgah` from inside it (its private repository) and a
+# worktree from a linked checkout, and the table was written there instead.
+root = tt.main_repo(os.getcwd())
+if not root:
+    sys.exit("render_table: %s is not inside a git checkout" % os.getcwd())
 
 
 def acceptance(strict):

package/skills/tezgah-contract/SKILL.md

@@ -258,9 +258,9 @@ Routing: `~/.config/tezgah/bin/tezgah-route "<brief>"` names the worker - tezgah
 -frontier, or the specialist whose whole job the brief is (tezgah-tester,
 -docs, -security, -ui, -researcher, -reviewer) - and the spawn uses that name,
 never the host's generic task agent (overrides for stored data, credentials,
-security first; then a Jev judgement; the static phase table with no key). A worker that answers
-`ESCALATE:` is restarted on tezgah-frontier with the original brief, never
-continued; the main thread never switches model (the cache is per model). A
+security first; then a Jev judgement; the static phase table with no key). A report missing an output field, or an
+`ESCALATE:`, gets one narrower re-brief of the same role naming that field or judgement; only a second miss is
+restarted on tezgah-frontier with the original brief, never continued; the main thread never switches model (the cache is per model). A
 code-discovery brief names codegraph's tools (`codegraph callers`, `callees`,
 `impact`, `node`, `files`, `codegraph_explore`) and says "answer from
 the graph, grep only for literal text"; never a grep-only explorer (observed).