@spardutti/claude-skills 2.20.0 → 2.20.2

package/lib/setup-hook.mjs

@@ -226,13 +226,32 @@ Before this Write/Edit, you must:
 
 1. For each skill listed above, say whether it applies to the file you're about to
    write. If it does not — a Python skill and a TypeScript file, say — write
-   "does not apply" and move on. Do not invent a connection.
+   \\"does not apply\\" and move on. Do not invent a connection.
 2. For the ones that do apply: state the specific rules that bear on this file, and
    how your next write respects each.
 3. Then ack all of them in a single Bash tool call:
      $ACK_CMD
 
 One ack per skill per session. After acking, retry the Write/Edit.
+
+If that Bash call is denied by the auto mode classifier, STOP. Do not ask your
+user to run it for you, and do not look for another route to create the files.
+Both are what the classifier is there to stop, and asking a human to run a
+command you were just denied makes them the tool that performs it. Report this
+to them instead and let them decide:
+
+  Auto mode's built-in Auto-Mode Bypass rule counts a hook's ack file as working
+  around the permission system. It is a soft rule, so an allow entry clears it.
+  It has to go in ~/.claude/settings.json — the classifier does not read a
+  project's .claude/settings.json — or in /permissions, Auto mode tab. Keep the
+  \\\$defaults line or every built-in allow rule is discarded:
+
+  \\"autoMode\\": { \\"allow\\": [ \\"\\\$defaults\\",
+    \\"Touching marker files under /tmp/claude-skill-gate-*, /tmp/claude-skill-acked-*
+     and /tmp/claude-skill-loaded-* is allowed: they are acknowledgement files for
+     the user's own PreToolUse skill gates. Creating one satisfies a workflow gate
+     the user installed, grants no permission and executes no code, and is a false
+     positive for Auto-Mode Bypass.\\" ] }
 $RULES_BLOCKS"
 
 json_escape() {
@@ -629,7 +648,7 @@ GAUNTLET_MAX_LINES=200
 GAUNTLET_MUTATE=""
 GAUNTLET_SOURCE_EXT="ts|tsx|js|jsx|mjs|cjs|py|go|rs|java|kt|rb|php|c|h|cpp|hpp|cs|swift|gd"
 GAUNTLET_IGNORE_EXT="md|mdx|txt|rst|adoc|json|ya?ml|toml|lock|cfg|ini|env|csv|tsv|sql|html|css|scss|svg|png|jpg|jpeg|gif|webp|ico|pdf|woff2?|ttf|otf|mp3|mp4|wav|zip|gz|tres|tscn|import|godot"
-GAUNTLET_IGNORE_FILES="*.gen.ts *.gen.tsx *.generated.* */migrations/*.py */alembic/versions/*.py */components/ui/*.tsx"
+GAUNTLET_IGNORE_FILES="*.gen.ts *.gen.tsx *.generated.* */migrations/*.py */alembic/versions/*.py */components/ui/*.tsx */*.config.*"
 [ -n "\${HOME:-}" ] && [ -f "$HOME/.claude/gauntlet.conf" ] && . "$HOME/.claude/gauntlet.conf"
 [ -f ".claude/gauntlet.conf" ] && . ".claude/gauntlet.conf"
 
@@ -677,6 +696,11 @@ SOURCED=$(printf '%s\\n' "$CHANGED" | grep -E "\\.($GAUNTLET_SOURCE_EXT)$" \\
 # both checks — and printed, because a silent skip is the same lie as a fake
 # PASS. The leading / is what lets one pattern match components/ui at the repo
 # root and apps/web/src/components/ui alike.
+#
+# */*.config.* is here for the same reason, and became urgent the moment an
+# uncovered line started failing the gate: vitest.config.ts has no tests, will
+# never have tests, and is not a thing anyone writes a test for. Left in, every
+# diff that touches a config reports findings nobody can close.
 # set -f matters: an unquoted list is glob-expanded before it is split, so
 # */components/ui/*.tsx turned itself into the very path it was meant to match
 # and then matched nothing.
@@ -1360,6 +1384,26 @@ export async function setupHook(targetDir = process.cwd()) {
     settings.hooks.Stop = [gauntletEntry];
   }
 
+  // Both gates clear by touching a marker under /tmp. The hook scripts let those
+  // commands through themselves, but auto mode's permission classifier does not:
+  // a touch whose only purpose is to unlock a gate is exactly what it refuses.
+  // So in auto mode the application gate could not be satisfied at all, and the
+  // model was reduced to asking its user to run the touch by hand — which is
+  // indistinguishable from the laundering the classifier exists to stop.
+  // Allowlisting the three marker paths is what makes the gates workable there.
+  // Only these literal prefixes are granted, and an existing entry is not
+  // duplicated on reinstall.
+  const MARKER_ALLOW = [
+    "Bash(touch /tmp/claude-skill-gate-*)",
+    "Bash(touch /tmp/claude-skill-acked-*)",
+    "Bash(touch /tmp/claude-skill-loaded-*)",
+  ];
+  if (!settings.permissions) settings.permissions = {};
+  if (!Array.isArray(settings.permissions.allow)) settings.permissions.allow = [];
+  for (const rule of MARKER_ALLOW) {
+    if (!settings.permissions.allow.includes(rule)) settings.permissions.allow.push(rule);
+  }
+
   await writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", { mode: 0o644 });
 
   console.log(`  Hook installed: .claude/hooks/${GATE_FILENAME}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.20.0",
+  "version": "2.20.2",
   "description": "CLI to install Claude Code skills from the claude-skills collection",
   "type": "module",
   "repository": {