@spardutti/claude-skills 2.12.1 → 2.13.0

package/README.md

@@ -142,8 +142,20 @@ After installing skills, the CLI offers to set up a hook that **guarantees** Cla
 It installs four hooks and appends a rule to your `CLAUDE.md`. Three guard the
 **front** — nothing is written until your skills are considered:
 
-- `skill-gate.sh` — a `PreToolUse` gate on `Write|Edit|MultiEdit`
+- `skill-gate.sh` — a `PreToolUse` gate on `Write|Edit|MultiEdit|Bash`
 - `skill-application-gate.sh` — a second `PreToolUse` gate requiring each loaded skill to be applied, not just read
+
+Both cover **Bash**, not only the file-writing tools. A session that edits through
+`python3 - <<'PY'` in Bash walked past the old matcher entirely — twelve source files, not
+one prompt — and some harnesses actively tell the model to prefer Bash for edits. Only
+commands that can write are gated (a redirect, `tee`, `sed -i`, `cp`/`mv`, or an
+interpreter given inline code or a heredoc); `git status` and a redirect to `/dev/null`
+pass untouched, and the command that clears the gate is never gated against itself.
+
+Neither gate fires on **prose** — `.md`, `.mdx`, `.txt`, `.rst`, `.adoc`, images. Skills
+are about code, and a repo full of `PLAN_*.md` otherwise hits the gate on every write.
+Config files (`.json`, `.yml`, `.toml`) stay gated, because skills do have rules about
+`tsconfig`, `package.json`, and Compose.
 - `skill-gate-automark.sh` — a `PostToolUse` hook on `Skill` that clears the gate
 
 The last two guard the **back** — nothing finishes or ships until the code passes:
@@ -164,9 +176,9 @@ It registers in `.claude/settings.json`:
 {
   "hooks": {
     "PreToolUse": [
-      { "matcher": "Write|Edit|MultiEdit", "hooks": [
+      { "matcher": "Write|Edit|MultiEdit|Bash", "hooks": [
         { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/skill-gate.sh" } ] },
-      { "matcher": "Write|Edit|MultiEdit", "hooks": [
+      { "matcher": "Write|Edit|MultiEdit|Bash", "hooks": [
         { "type": "command", "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/skill-application-gate.sh" } ] }
     ],
     "PostToolUse": [

package/lib/setup-hook.mjs

@@ -34,6 +34,56 @@ if [ -f "$MARKER" ]; then
   exit 0
 fi
 
+# Write|Edit|MultiEdit is not the only way to change a file. A session that edits
+# through \`python3 - <<'PY'\` in Bash walked past this gate entirely — twelve
+# source files, not one prompt — and some harnesses actively tell the model to
+# prefer Bash for edits. So Bash is gated too, but only for commands that can
+# write, and only until the gate is cleared once for the session.
+
+# Skills are about code. Blocking a plan document to ask how the React rules
+# apply is pure noise, and a repo full of PLAN_*.md hits it on every write.
+# Config files stay gated — skills do have rules about tsconfig and compose.
+PROSE_EXT='md|mdx|txt|rst|adoc|png|jpg|jpeg|gif|svg|webp|ico'
+CODE_EXT='ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|rb|php|c|h|cpp|hpp|cs|swift|sql|sh|json|ya?ml|toml'
+
+TOOL=$(printf '%s' "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | sed 's/.*:"//; s/"$//')
+
+if [ "$TOOL" != "Bash" ]; then
+  # The structured tools name their target outright.
+  TARGET=$(printf '%s' "$INPUT" | grep -o '"file_path":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"//; s/"$//')
+  case "$TARGET" in
+    *.*) printf '%s' "$TARGET" | grep -qiE "\.($PROSE_EXT)$" && exit 0 ;;
+  esac
+fi
+if [ "$TOOL" = "Bash" ]; then
+  CMD=$(printf '%s' "$INPUT" | grep -o '"command":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"//; s/"$//')
+
+  # Never gate the command that clears the gate, or this deadlocks.
+  case "$CMD" in
+    *claude-skill-gate-*|*claude-skill-acked-*|*claude-skill-loaded-*) exit 0 ;;
+  esac
+
+  # /dev/null redirects are not file writes; drop them before looking for one.
+
+  # A command that names a prose file and no code file is writing prose.
+  if printf '%s' "$CMD" | grep -qiE "\.($PROSE_EXT)([^A-Za-z0-9]|$)" \
+     && ! printf '%s' "$CMD" | grep -qiE "\.($CODE_EXT)([^A-Za-z0-9]|$)"; then
+    exit 0
+  fi
+  STRIPPED=$(printf '%s' "$CMD" | sed 's![12]*>>*[[:space:]]*/dev/null!!g')
+  WRITES=""
+  case "$STRIPPED" in
+    *">"*|*"tee "*|*"sed -i"*|*"cp "*|*"mv "*|*"truncate "*|*"dd "*) WRITES=1 ;;
+  esac
+  # An interpreter given inline code or a heredoc can write anything, and the
+  # shell shows no redirect at all — this is the shape that got past the gate.
+  case "$CMD" in
+    *"<<"*|*python*" -c"*|*node*" -e"*|*perl*" -e"*|*ruby*" -e"*) WRITES=1 ;;
+  esac
+  [ -z "$WRITES" ] && exit 0
+fi
+
+
 cat <<EOF
 {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"BLOCKED: skill evaluation required before file edits in this session.\\n\\nStep 1 — evaluate every available skill as ACTIVATE or SKIP with a one-line reason.\\n\\nStep 2 — you MUST take EXACTLY ONE of these tool actions to clear the gate. Listing skills in text is NOT enough; retrying the edit without doing one of these will be denied again:\\n  (a) If any skill is ACTIVATE → call Skill(name) for it. This auto-clears the gate.\\n  (b) If ALL skills are SKIP → run this Bash tool call: touch /tmp/claude-skill-gate-$SESSION_ID\\n\\nStep 3 — only after Step 2 completes, retry the file edit."}}
 EOF
@@ -90,6 +140,47 @@ if [ ! -f "/tmp/claude-skill-gate-$SESSION_ID" ]; then
   exit 0
 fi
 
+# Same reason as the loading gate: Bash can write files, and a heredoc into an
+# interpreter shows no redirect at all.
+
+# Skills are about code. Blocking a plan document to ask how the React rules
+# apply is pure noise, and a repo full of PLAN_*.md hits it on every write.
+# Config files stay gated — skills do have rules about tsconfig and compose.
+PROSE_EXT='md|mdx|txt|rst|adoc|png|jpg|jpeg|gif|svg|webp|ico'
+CODE_EXT='ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|rb|php|c|h|cpp|hpp|cs|swift|sql|sh|json|ya?ml|toml'
+
+TOOL=$(printf '%s' "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | sed 's/.*:"//; s/"$//')
+
+if [ "$TOOL" != "Bash" ]; then
+  # The structured tools name their target outright.
+  TARGET=$(printf '%s' "$INPUT" | grep -o '"file_path":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"//; s/"$//')
+  case "$TARGET" in
+    *.*) printf '%s' "$TARGET" | grep -qiE "\.($PROSE_EXT)$" && exit 0 ;;
+  esac
+fi
+if [ "$TOOL" = "Bash" ]; then
+  CMD=$(printf '%s' "$INPUT" | grep -o '"command":[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"//; s/"$//')
+  case "$CMD" in
+    *claude-skill-gate-*|*claude-skill-acked-*|*claude-skill-loaded-*) exit 0 ;;
+  esac
+
+  # A command that names a prose file and no code file is writing prose.
+  if printf '%s' "$CMD" | grep -qiE "\.($PROSE_EXT)([^A-Za-z0-9]|$)" \
+     && ! printf '%s' "$CMD" | grep -qiE "\.($CODE_EXT)([^A-Za-z0-9]|$)"; then
+    exit 0
+  fi
+  STRIPPED=$(printf '%s' "$CMD" | sed 's![12]*>>*[[:space:]]*/dev/null!!g')
+  WRITES=""
+  case "$STRIPPED" in
+    *">"*|*"tee "*|*"sed -i"*|*"cp "*|*"mv "*|*"truncate "*|*"dd "*) WRITES=1 ;;
+  esac
+  case "$CMD" in
+    *"<<"*|*python*" -c"*|*node*" -e"*|*perl*" -e"*|*ruby*" -e"*) WRITES=1 ;;
+  esac
+  [ -z "$WRITES" ] && exit 0
+fi
+
+
 # Collect every loaded-but-unacked skill so a single ack clears them all.
 UNACKED=""
 for marker in /tmp/claude-skill-loaded-$SESSION_ID-*; do
@@ -133,8 +224,11 @@ MSG="BLOCKED: loaded skills not yet applied to your work: $NAMES
 
 Before this Write/Edit, you must:
 
-1. For each skill listed above, state the specific rules that apply to the file you're about to write.
-2. State how your next write respects each rule.
+1. For each skill listed above, say whether it applies to the file you're about to
+   write. If it does not — a Python skill and a TypeScript file, say — write
+   "does not apply" and move on. Do not invent a connection.
+2. For the ones that do apply: state the specific rules that bear on this file, and
+   how your next write respects each.
 3. Then ack all of them in a single Bash tool call:
      $ACK_CMD
 
@@ -907,7 +1001,7 @@ export async function setupHook(targetDir = process.cwd()) {
   // Register PreToolUse gate.
   const gateCommand = `$CLAUDE_PROJECT_DIR/.claude/hooks/${GATE_FILENAME}`;
   const gateEntry = {
-    matcher: "Write|Edit|MultiEdit",
+    matcher: "Write|Edit|MultiEdit|Bash",
     hooks: [{ type: "command", command: gateCommand }],
   };
 
@@ -923,7 +1017,7 @@ export async function setupHook(targetDir = process.cwd()) {
   // Register PreToolUse application gate (after the loading gate).
   const applicationCommand = `$CLAUDE_PROJECT_DIR/.claude/hooks/${APPLICATION_GATE_FILENAME}`;
   const applicationEntry = {
-    matcher: "Write|Edit|MultiEdit",
+    matcher: "Write|Edit|MultiEdit|Bash",
     hooks: [{ type: "command", command: applicationCommand }],
   };
   const applicationAlreadyRegistered = settings.hooks.PreToolUse.some((entry) =>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.12.1",
+  "version": "2.13.0",
   "description": "CLI to install Claude Code skills from the claude-skills collection",
   "type": "module",
   "bin": {