@tech-leads-club/harness-toolkit 0.15.3 → 0.15.4

package/docs/log.md

@@ -16,6 +16,7 @@ newest first. For what landed in which npm release, see `CHANGELOG.md` at the re
 ## 2026-09-12
 
 - **AD-139** — lessonsView joins ProviderPort, closing the one dispatcher that bypassed it ([/decisions/ad-139.md](/decisions/ad-139.md))
+- **AD-140** — an unrecognized shell wrapper can no longer hide a forced push ([/decisions/ad-140.md](/decisions/ad-140.md))
 
 ## 2026-09-11
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tech-leads-club/harness-toolkit",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "type": "module",
   "description": "Multi-provider agent steering: gates, follow-up, handoff, policy",
   "keywords": [

package/src/core/floor/floor.service.ts

@@ -145,6 +145,26 @@ function pathArgs(args: ShellWord[]): ShellWord[] {
   return args.filter((word) => !word.text.startsWith("-") && word.text !== "");
 }
 
+// hazard: `verbOf` strips a path down to its basename before comparing (`/usr/bin/git` → `git`) — a
+// literal-text scan that skips the same normalization would deny `git push --force` but allow the identical
+// command run as `/usr/bin/git push --force`, which is exactly the shape a path-qualifying wrapper produces.
+function namesGit(text: string): boolean {
+  return (text.split("/").pop() ?? text) === "git";
+}
+
+// why: `verbOf` only sees through a wrapper this gate already knows by name, and `WRAPPERS` cannot list
+// every proxy or shim an operator's shell might inject ahead of the real command — discovered live when one
+// such wrapper carried a force push straight past this rule. Matching the whole segment, not the resolved
+// head verb, means an unrecognized wrapper can delay `git` but not hide it.
+function forcedGitPush(segment: ShellSegment): boolean {
+  const texts = segment.words.map((word) => word.text);
+  return (
+    texts.some(namesGit) &&
+    texts.includes("push") &&
+    texts.some((text) => text === "--force" || text === "-f")
+  );
+}
+
 function checkShell(input: FloorInput): Decision {
   const command = input.command;
   if (!command) {
@@ -165,6 +185,17 @@ function checkShell(input: FloorInput): Decision {
   }
 
   for (const segment of segments) {
+    // why: checked before `verbOf` resolves anything — a wrapper this gate does not recognize can delay
+    // which word `verbOf` treats as the head, or exhaust the segment before a head is ever found, but it
+    // cannot remove `git`/`push`/`--force` from the segment's own words.
+    if (forcedGitPush(segment)) {
+      return denial(
+        "history-rewrite",
+        "`git push --force` discards remote commits that are not in your history. Use --force-with-lease, which refuses when the remote moved.",
+        "force push",
+      );
+    }
+
     const head = verbOf(segment.words);
     if (!head) {
       continue;
@@ -187,17 +218,6 @@ function checkShell(input: FloorInput): Decision {
       return denial("machine-control", `\`${verb}\` controls the machine, not the project.`, verb);
     }
 
-    if (verb === "git" && args.some((word) => word.text === "push")) {
-      const forced = args.some((word) => word.text === "--force" || word.text === "-f");
-      if (forced) {
-        return denial(
-          "history-rewrite",
-          "`git push --force` discards remote commits that are not in your history. Use --force-with-lease, which refuses when the remote moved.",
-          "force push",
-        );
-      }
-    }
-
     const destructive = DESTRUCTIVE_VERBS.has(verb) || isMkfs(verb);
     if (!destructive) {
       continue;