@techierathore/techieflow 1.0.4 → 1.1.1

package/.opencode/plugin/techieflow.js

@@ -21,7 +21,7 @@
 //   bash  {command}                        -> Bash  {command}            -> block-git.sh + guard-artifacts.sh + guard-verify-deps.sh
 //   edit  {filePath,oldString,newString}   -> Edit  {file_path,old_string,new_string}
 //   write {filePath,content}               -> Write {file_path,content}  -> guard-status.sh + guard-verify.sh
-//   session.idle (root session)            -> Stop  {stop_hook_active}   -> guard-status-html.sh
+//   session.idle (root session)            -> Stop  {stop_hook_active, last_assistant_message, turn_started} -> guard-status-html.sh
 //   session.created (first root session)   -> SessionStart              -> sweep-artifacts.sh
 // OpenCode has no blocking Stop hook, so the stale-PROJECT-STATUS.html guard
 // (_status-update-gate.md step 4) is bridged as a ONE-SHOT nudge: when the root
@@ -42,14 +42,25 @@
 // idles once). Records share session_id; consumers take the record with the
 // highest output_tokens (or latest ts) per session_id. SCHEMA.md §4 notes this.
 
+//
+// Two OpenCode plugin APIs, one file (2026-09-27). OpenCode 1.x (the design's 1.18.18; 1.18.32 is
+// the last 1.x) reads the default export's `server`; OpenCode 2 (checked on 2.0.18, 2026-09-28)
+// accepts only a default export with `id` and `setup`, and refused this file with "Plugin must export
+// a default definition with an id and an effect or setup function". The default export carries all
+// three; `setup` translates 2.x's hook and event API into the 1.x hooks below, so the guards, the
+// shell env and telemetry are the same code in both. What 2.x does not offer: `permission.ask` (YOLO
+// auto-approval; OpenCode 2's own `--auto` flag is the switch there) and the session's messages, so
+// the Stop nudge's owner-text check (guard-status-html.sh check 5) is skipped there; checks 1-4 run.
+
 import fs from "node:fs"
 import path from "node:path"
 import os from "node:os"
 import { spawnSync } from "node:child_process"
+import { fileURLToPath } from "node:url"
 
 const GUARD_TIMEOUT_MS = 10000
 
-export const TechieFlowPlugin = async ({ directory, client }) => {
+const TechieFlowPlugin = async ({ directory, client }) => {
   const root = directory
   const hooksDir = path.join(root, ".tfcore", "hooks")
   const tfEmit = path.join(root, ".tfcore", "utils", "tf-emit.sh")
@@ -85,6 +96,15 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
     }
   }
 
+  // A flag that expired or went away without `tf-yolo.sh off` leaves the never-ask permissions
+  // behind (the rewritten OpenCode config): put it back
+  // when the project opens and YOLO is off (tf-yolo.sh sync; owner, 2026-10-14).
+  try {
+    if (!yoloOn() && fs.existsSync(path.join(root, ".tfcore", ".session", "yolo-perms.json"))) {
+      spawnSync("bash", [path.join(root, ".tfcore", "utils", "tf-yolo.sh"), "sync"], { cwd: root, env: { ...process.env, TF_PROJECT_DIR: root }, timeout: 15000 })
+    }
+  } catch {}
+
   // Returns the guard's stderr when the guard BLOCKS (exit 2), else null.
   function guardBlocks(script, payload) {
     try {
@@ -110,8 +130,29 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
   const htmlNudged = Object.create(null) // rootID -> true once the stale-HTML nudge was sent
   let pointerWritten = false
 
+  // What Claude Code hands its Stop hook and OpenCode does not: the closing message, and when
+  // the turn began (the last prompt the owner typed). The guard checks the message the owner
+  // reads at the end of a command (tf-owner-text.sh). Empty on any failure: the check then skips.
+  async function closingTurn(rootID) {
+    try {
+      if (typeof client.session.messages !== "function") return {}
+      const res = await client.session.messages({ path: { id: rootID } })
+      const list = Array.isArray(res) ? res : (res && res.data) || []
+      const text = (m) => (m.parts || []).filter((x) => x.type === "text" && !x.synthetic).map((x) => x.text).join("\n")
+      let message = "", turn = null
+      for (const m of list) {
+        const info = m.info || {}
+        if (info.role === "user" && text(m).trim()) turn = (info.time || {}).created || turn
+        if (info.role === "assistant" && text(m).trim()) message = text(m)
+      }
+      return turn ? { last_assistant_message: message, turn_started: turn } : {}
+    } catch {
+      return {}
+    }
+  }
+
   // Stop-hook analogue for guard-status-html.sh (see header). Never throws.
-  function nudgeStaleStatusHtml(rootID) {
+  async function nudgeStaleStatusHtml(rootID) {
     try {
       if (!client || !client.session || typeof client.session.prompt !== "function") return
       const msg = guardBlocks("guard-status-html.sh", {
@@ -119,6 +160,7 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
         cwd: root,
         session_id: rootID,
         stop_hook_active: htmlNudged[rootID] === true,
+        ...(htmlNudged[rootID] === true ? {} : await closingTurn(rootID)),
       })
       if (!msg) return
       htmlNudged[rootID] = true
@@ -232,14 +274,16 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
       const args = output.args || {}
       let payload = null
       let scripts = []
-      if (input.tool === "bash") {
+      if (input.tool === "bash" || input.tool === "shell") {
+        // 1.x calls it bash; 2.x calls it shell (same `command` argument)
         payload = { tool_name: "Bash", tool_input: { command: String(args.command || ""), run_in_background: !!(args.background || args.run_in_background) } }
         scripts = ["block-git.sh", "guard-artifacts.sh", "guard-status.sh", "guard-metrics.sh", "guard-db.sh", "guard-build.sh", "guard-verify-deps.sh"]
       } else if (input.tool === "edit") {
+        // 1.x names the file filePath, 2.x names it path
         payload = {
           tool_name: "Edit",
           tool_input: {
-            file_path: String(args.filePath || ""),
+            file_path: String(args.filePath || args.path || ""),
             old_string: String(args.oldString || ""),
             new_string: String(args.newString || ""),
           },
@@ -248,7 +292,7 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
       } else if (input.tool === "write") {
         payload = {
           tool_name: "Write",
-          tool_input: { file_path: String(args.filePath || ""), content: String(args.content || "") },
+          tool_input: { file_path: String(args.filePath || args.path || ""), content: String(args.content || "") },
         }
         scripts = ["guard-status.sh", "guard-verify.sh", "guard-metrics.sh"]
       } else if (input.tool === "apply_patch") {
@@ -299,17 +343,16 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
       }
     },
 
-    // YOLO / goal mode (.tfcore/tasks/_yolo-mode.md): when the flag is on, the
-    // `rm * / rmdir * / sudo *` asks from the permission map are auto-approved so
-    // an unattended run never stalls on a delete. Git WRITES never reach this
-    // hook — they are `deny` in the map and exit-2 in block-git.sh. Fail-open:
-    // if the harness never calls permission.ask, nothing changes.
+    // YOLO / goal mode (.tfcore/tasks/_yolo-mode.md): when the flag is on, every
+    // ask is approved — a delete, an edit, a web fetch, a folder outside the project
+    // — so nothing asks (owner, 2026-10-14; it approved shell asks only until then).
+    // Git WRITES never reach this hook — they are `deny` in the map and exit-2 in
+    // block-git.sh. Fail-open: if the harness never calls permission.ask (OpenCode 2),
+    // the config tf-yolo.sh rewrites (every ask made allow) does the same job.
     "permission.ask": async (input, output) => {
       try {
         if (!active || !output) return
         if (!yoloOn()) return
-        const type = String((input && input.type) || "")
-        if (type && type !== "bash") return
         output.status = "allow"
       } catch {}
     },
@@ -367,7 +410,7 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
           if (!sid) return
           if (rootOf(sid) === sid) {
             emitSession(sid)
-            nudgeStaleStatusHtml(sid)
+            await nudgeStaleStatusHtml(sid)
           }
           return
         }
@@ -375,3 +418,140 @@ export const TechieFlowPlugin = async ({ directory, client }) => {
     },
   }
 }
+
+// ---- OpenCode 2.x: translate its API into the 1.x hooks above ----
+// The 2.x context names no project directory, and its background service does not run in the
+// project, so the root is where this file sits: <root>/.opencode/plugin/techieflow.js.
+function projectRoot() {
+  try {
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..")
+  } catch {
+    return process.cwd()
+  }
+}
+
+function eventTime(value) {
+  const n = typeof value === "number" ? value : Date.parse(String(value || ""))
+  return Number.isFinite(n) ? n : Date.now()
+}
+
+async function setupV2(context) {
+  const root = projectRoot()
+  // What the Stop nudge needs from a client: prompt a session. 2.x has no message listing, so
+  // closingTurn() finds no messages and the owner-text check is skipped (see the header).
+  const client = {
+    session: {
+      prompt: ({ path: p, body }) =>
+        context.session.prompt({
+          sessionID: p.id,
+          text: ((body && body.parts) || []).map((x) => x.text || "").join("\n"),
+        }),
+    },
+  }
+  const hooks = await TechieFlowPlugin({ directory: root, client })
+  const registrations = []
+
+  // Guards. A throw here stops the call, as in 1.x.
+  registrations.push(
+    await context.tool.hook("execute.before", async (event) => {
+      await hooks["tool.execute.before"]({ tool: event.tool, sessionID: event.sessionID, callID: event.id }, { args: event.input || {} })
+    }),
+  )
+
+  // TF_HARNESS, TF_PROJECT_DIR, TF_YOLO for the agent's shell commands.
+  registrations.push(
+    await context.shell.hook("create.before", async (event) => {
+      if (!event || !event.env) return
+      await hooks["shell.env"]({}, { env: event.env })
+    }),
+  )
+
+  // Telemetry and the Stop nudge: 2.x events rewritten as the 1.x events the handler reads.
+  // A step carries its own tokens and cost; each step is recorded once, under its own key.
+  // The session is created before this subscription starts, so no session.created arrives for
+  // it: a session is learned the first time an event of this project names it, and its parent
+  // is read with session.get (a root session has no parentID). A turn ends with
+  // session.execution.*, which carries no location, so only sessions learned here count.
+  const models = Object.create(null) // assistantMessageID -> {model, t0}
+  const known = Object.create(null) // sessionID -> true once learned
+  let stream = null
+  let stopped = false
+  const learn = async (sessionID) => {
+    if (!sessionID || known[sessionID]) return
+    known[sessionID] = true
+    let parentID = null
+    try {
+      const info = await context.session.get({ sessionID })
+      parentID = (info && info.parentID) || null
+    } catch {}
+    await hooks.event({ event: { type: "session.created", properties: { info: { id: sessionID, parentID } } } })
+  }
+  const translate = (ev) => {
+    const d = ev.data || {}
+    if (ev.type === "session.step.started") {
+      models[d.assistantMessageID] = { model: d.model || {}, t0: eventTime(ev.created) }
+      return null
+    }
+    if (ev.type === "session.step.ended") {
+      const started = models[d.assistantMessageID] || { model: {}, t0: eventTime(ev.created) }
+      const t = d.tokens || {}
+      return {
+        type: "message.updated",
+        properties: {
+          info: {
+            role: "assistant",
+            id: String(d.assistantMessageID) + ":" + String(ev.id),
+            sessionID: d.sessionID,
+            providerID: started.model.providerID,
+            modelID: started.model.id,
+            cost: d.cost,
+            tokens: { input: t.input, output: t.output, cache: t.cache || {} },
+            time: { created: started.t0, completed: eventTime(ev.created) },
+          },
+        },
+      }
+    }
+    const idle =
+      /^session\.execution\.(succeeded|failed|interrupted)$/.test(ev.type) ||
+      (ev.type === "session.status" && d.status && d.status.type === "idle") ||
+      ev.type === "session.idle"
+    if (idle && known[d.sessionID]) return { type: "session.idle", properties: { sessionID: d.sessionID } }
+    return null
+  }
+  ;(async () => {
+    try {
+      stream = context.event.subscribe()
+      for await (const ev of stream) {
+        if (stopped) break
+        try {
+          if (!ev) continue
+          if (ev.location && ev.location.directory) {
+            if (path.resolve(ev.location.directory) !== root) continue
+            if (ev.data && ev.data.sessionID) await learn(ev.data.sessionID)
+          }
+          const event = translate(ev)
+          if (event) await hooks.event({ event })
+        } catch {} // telemetry never blocks anything
+      }
+    } catch {}
+  })()
+
+  return async () => {
+    stopped = true
+    try {
+      if (stream && typeof stream.return === "function") await stream.return()
+    } catch {}
+    for (const r of registrations) {
+      try {
+        await r.dispose()
+      } catch {}
+    }
+  }
+}
+
+// OpenCode 1.x reads `server`; OpenCode 2.x reads `setup`. Each ignores the other.
+export default {
+  id: "techieflow",
+  server: TechieFlowPlugin,
+  setup: setupV2,
+}

package/.tfcore/agents/flow-master.md

@@ -17,6 +17,7 @@ Each rule lives in one place; these lines only point at it.
 - Run to completion in YOLO or goal mode: `.tfcore/tasks/_yolo-mode.md`. `*build-phase` is in it by default.
 - Run the application yourself and never ask the owner to boot or test anything: `.tfcore/tasks/_smoke-test-policy.md`, with `bash .tfcore/utils/tf-build.sh` for building on any host.
 - A smoke is not a verify. `Verified` is written only by an executed `*verify`; the hook refuses it otherwise. Your ceiling as a builder is `Implemented`.
+- A next command you name is the one `tf-status-facts.sh` printed, phase included. Rows waiting in another phase's checklist get `*verify {scope} {App} --phase N`, or `--phase all` when several phases wait; a bare `*verify` grades `appPhase` only.
 - Analyse is not fix. A bug reported without a request to fix it is `*triage-issues`, documents only. Code changes come only from `*build-phase` and `*fix-issues`.
 - A miss is a record. When the owner says something was missed, `*log-miss` writes it to the miss stream in seconds. Never argue, never guess who caused it; the emitter resolves that.
 - Git is manual and the hook refuses it. Evidence is the checklist and the files on disk.
@@ -25,6 +26,7 @@ Each rule lives in one place; these lines only point at it.
 
 | Command | What it does | Task file |
 |---|---|---|
+| `*develop-end-to-end {App} {brief}` | a new app from a brief to UAT, unattended: Day 1, build and verify, handoff; commits and pushes each phase; reports time and tokens per phase (greenfield only) | `develop-end-to-end.md` |
 | `*build-phase {App}` | builds every open row of the phase's checklist, smokes, chains the verifier, fixes what fails | `build-phase.md` |
 | `*fix-issues {App} {folder}` | reproduces reported bugs from screenshots and notes, fixes, re-verifies | `fix-issues.md` |
 | `*triage-issues {App} {evidence} [verify]` | reproduces and logs reported bugs; no code | `triage-issues.md` |

package/.tfcore/agents/verifier.md

@@ -7,7 +7,7 @@ Vidur, the TechieFlow verifier (icon 🔍): the one persona that proves whether
 - A command starts with `*`. `*verify` maps to `.tfcore/tasks/verify-phase.md`; read that file when the command is typed, not before. Read `.tfcore/core-config.yaml` first for the app name, size, kind and phase.
 - On activation, say who you are and print the command table below once. `*help` prints it again.
 - The task begins with `bash .tfcore/utils/tf-phase.sh start verify-phase <App>` and ends with the status gate (`.tfcore/tasks/_status-update-gate.md`) and one run record.
-- "verify the UI" is `*verify ui`, "check everything" is `*verify all`, "re-check these rows" is `*verify REQ-UI-004,REQ-FN-011`. When the scope is unclear, ask once.
+- "verify the UI" is `*verify ui`, "check everything" is `*verify all`, "re-check these rows" is `*verify REQ-UI-004,REQ-FN-011`, "verify phase 1" is `*verify all {App} --phase 1`, "every phase" is `--phase all`. When the scope is unclear, ask once.
 
 ## Standing rules
 
@@ -26,7 +26,7 @@ Each rule lives in one place; these lines only point at it.
 
 | Command | What it does | Task file |
 |---|---|---|
-| `*verify {scope} {App}` | boots the app, runs the seven checks on every row in scope, writes the verdicts and the telemetry | `verify-phase.md` |
+| `*verify {scope} {App} [--phase N\|all]` | boots the app, runs the seven checks on every row in scope of that phase's checklist (default `appPhase`; `all` is each phase in turn, phase 1 first), writes the verdicts and the telemetry | `verify-phase.md` |
 | `*report {scope} {App}` | prints the current Status and Remarks of the rows in scope from the checklist, without running anything | |
 | `*help` | prints this table | |
 | `*exit` | leaves the persona | |

package/.tfcore/core-config.yaml

@@ -54,4 +54,5 @@ slashPrefix: TechieFlow
 #       url: http://192.168.1.50:4723     # the LAN Mac (stable IP via DHCP reservation); Appium bound to 0.0.0.0
 #       simulator: "iPhone 15"
 #     maccatalyst:
-#       url: http://192.168.1.50:4723     # same Mac, mac2 driver
+#       url: http://localhost:4723        # this Mac (the default when unset); mac2 driver. tf-verify-boot.sh
+#                                         # starts a local Appium when none answers. A Blazor Hybrid Mac head is checked without control names.

package/.tfcore/hooks/block-git.sh

@@ -85,7 +85,9 @@ if ! command -v python3 >/dev/null 2>&1; then
 fi
 
 # Verdicts: ALLOW | ASK_RM | BLOCK_WRITE | BLOCK_READ
-VERDICT="$(TF_HOOK_INPUT="$INPUT" TF_YOLO_ON="$YOLO" python3 - <<'PY' 2>/dev/null
+# The program is read into a variable first: bash 3.2 (a stock Mac) cannot parse this program as a
+# here-document inside $( ), because it scans the text for quotes and brackets.
+IFS= read -r -d '' GIT_GUARD_PY <<'PY' || true
 import json, os, re, shlex, sys
 
 raw = os.environ.get("TF_HOOK_INPUT", "")
@@ -283,7 +285,7 @@ elif (found_rm[0] or found_sudo[0]) and not yolo:
 else:
     print("ALLOW")
 PY
-)"
+VERDICT="$(TF_HOOK_INPUT="$INPUT" TF_YOLO_ON="$YOLO" python3 -c "$GIT_GUARD_PY" 2>/dev/null </dev/null)"
 
 case "$VERDICT" in
   BLOCK_WRITE) block_git_msg; exit 2 ;;

package/.tfcore/hooks/guard-build.sh

@@ -59,8 +59,12 @@ if not re.search(BUILD, low):
     sys.exit(0)
 
 bg_flag = bool(ti.get("run_in_background"))
+# A quoted argument is data, not shell: `--screen "Scorecard & Portfolio=/x"` backgrounds nothing
+# (AppManager TF-025). A quoted string that itself names a build stays, so
+# `powershell.exe -Command "dotnet run &"` is still read.
+bare = re.sub(r"\"[^\"]*\"|'[^']*'", lambda m: m.group(0) if re.search(BUILD, m.group(0)) else '""', low)
 # `&` that is not `&&` and not inside `2>&1` / `>&2`
-inline_bg = bool(re.search(r"(?<![&>\d])&(?![&\d])", low)) or bool(re.search(r"\b(nohup|setsid|disown)\b", low))
+inline_bg = bool(re.search(r"(?<![&>\d])&(?![&\d])", bare)) or bool(re.search(r"\b(nohup|setsid|disown)\b", bare))
 if not (bg_flag or inline_bg):
     sys.exit(0)
 

package/.tfcore/hooks/guard-db.sh

@@ -9,11 +9,16 @@
 #     mongosh with INSERT / UPDATE / DELETE / CREATE / ALTER / DROP / TRUNCATE / GRANT /
 #     REPLACE / MERGE in the command text, a -f / -i script, or stdin redirected from a file
 #   - dropping or resetting a database
-# What it allows only while .tfcore/.session/phase.json says build-phase or fix-issues
+# What it allows only while .tfcore/.session/phase.json says build-phase, fix-issues or
+# triage-and-fix (whose step 3 runs the fix-issues steps)
 # (written by bash .tfcore/utils/tf-phase.sh start <command>, step 0 of every task):
 #   - a migration runner: dotnet ef database update, dotnet run --project <…Db|…Migration(s)…>,
 #     dbup, flyway migrate, liquibase update, alembic upgrade, prisma migrate, knex migrate,
 #     rails db:migrate, sequelize db:migrate
+#   - code a python / node / deno / bun / ruby / perl / pwsh run executes, inline or from a script
+#     file, that uses a database library and holds a SQL write, unless every database path it names
+#     is a throw-away (tests/.artifacts/, /tmp, :memory:) (Sevak TF-002)
+# A client or a SQL verb that is only mentioned (a grep pattern, a note written to a file) passes.
 # Reads (SELECT, \d, .tables, dumps to stdout) pass. YOLO does not relax this.
 #
 # Wired in .claude/settings.json → hooks.PreToolUse (matcher "Bash"); OpenCode via
@@ -54,17 +59,110 @@ def phase():
     except Exception:
         return None
 
-# Words inside an echo/printf string or a comment line are not commands: an echo naming the
-# migration tool refused a verify run's read on 2026-09-06 (MISS-TechieFlow-20260906-20).
-# Strip them before matching, so only a command that runs a migrator or writes through a
-# client is refused.
+# What counts is what RUNS, not what a command mentions (Sevak TF-002, 2026-10-06).
+#  - A client is a write only when it is the command word of a segment (after a start, ; & | ( or
+#    a backtick, past sudo / env / `exec <container>`), so a grep or a note naming a client and a
+#    SQL verb passes, while `<client> app.db "<write>"` does not.
+#  - A heredoc's body is SQL when it feeds a client, code when it feeds an interpreter, and data
+#    (dropped) when it feeds anything else (`cat > notes.md <<EOF`).
+#  - An interpreter (python, node, deno, bun, ruby, perl, pwsh) running inline code or a script
+#    file has that code read: a database library together with a SQL write is refused unless every
+#    database path it names is a throw-away one (tests/.artifacts/, /tmp, :memory:). A sub-agent's
+#    script deleted four owner settings from Sevak's app database because the guard saw only
+#    `python3 x.py`.
+# Words inside an echo/printf string or a comment line are not commands (MISS-TechieFlow-20260906-20),
+# unless the string is redirected into a file, which may then be run.
+SEG = (r"(?:^|[;&|(`\n]|\$\()\s*(?:sudo\s+(?:-\S+\s+)*)?(?:env\s+(?:\S+=\S*\s+)*)?"
+       r"(?:[\w./\\-]*\bexec\s+(?:-\S+\s+)*\S+\s+)?")
+CLIENT_AT = SEG + r"(?:\S*/)?" + CLIENTS
+INTERP = r"(?:python3?|py|node|deno|bun|ruby|perl|pwsh|powershell(?:\.exe)?|tsx|ts-node)"
+INTERP_AT = SEG + r"(?:\S*/)?" + INTERP + r"\b"
+DB_LIBS = (r"\bsqlite3\b|better-sqlite3|\bsql\.js\b|node:sqlite|\bpsycopg|\bpymysql\b|mysql\.connector|\bmysql2\b"
+           r"|require\(\s*['\"]pg['\"]\s*\)|from\s+['\"]pg['\"]|\bsqlalchemy\b|microsoft\.data\.sqlite|system\.data\.sqlite"
+           r"|\bpymongo\b|\bmongodb\b|\baiosqlite\b|\bduckdb\b|invoke-sqlcmd")
+SQL_WRITE = (r"\binsert\s+(?:or\s+\w+\s+)?into\b|\bupdate\s+[\w\"`\[\].]+\s+set\b|\bdelete\s+from\b"
+             r"|\bdrop\s+(?:table|index|view|database)\b|\bcreate\s+(?:table|index|view|trigger)\b|\balter\s+table\b"
+             r"|\btruncate\b|\breplace\s+into\b|\bexecutescript\b"
+             r"|\.(?:delete_many|delete_one|insert_one|insert_many|update_one|update_many|replace_one|drop)\s*\(")
+DB_PATH = r"['\"]([^'\"\n]*\.(?:db|sqlite3?|mdf)|:memory:)['\"]"
+SCRIPT_EXT = r"\.(?:py|js|mjs|cjs|ts|mts|rb|pl|ps1)\b"
+
+
+def throwaway(path):
+    q = path.replace("\\", "/").lower()
+    return q == ":memory:" or "tests/.artifacts/" in q or q.startswith("/tmp/") or "/tmp/" in q or q.startswith("tmp/")
+
+
+def code_writes(code):
+    """A database library and a SQL write in the same code, against a database that is not a throw-away."""
+    c = code.lower()
+    if not (re.search(DB_LIBS, c) and re.search(SQL_WRITE, c)):
+        return False
+    paths = re.findall(DB_PATH, c)
+    return not paths or not all(throwaway(x) for x in paths)
+
+
 low = cmd.lower()
 low = re.sub(r"(?m)^\s*#.*$", "", low)
-low = re.sub(r"\b(echo|printf)\s+(\"[^\"]*\"|'[^']*'|[^\n;|&]*)", r"\1", low)
-direct_write = (re.search(CLIENTS, low)
-                and (re.search(WRITE_VERBS, low)
-                     or re.search(r"\s-(f|i)\s+\S+\.sql\b", low)
-                     or re.search(r"<\s*\S+\.sql\b", low)))
+
+# heredocs first: keep the body only where it is SQL (fed to a client) or code (fed to an interpreter)
+code_bits, body_sql = [], []
+
+
+runs_code = bool(re.search(INTERP_AT, low))
+
+
+def _heredoc(m):
+    head, body = m.group(1), m.group(4)
+    if re.search(CLIENT_AT, head):
+        body_sql.append(body)
+    elif re.search(INTERP_AT, head) or runs_code:
+        # fed to an interpreter, or written to a file in a command that also runs one
+        # (`cat > s.py <<EOF … EOF; python3 s.py`): the file does not exist when this hook runs
+        code_bits.append(body)
+    return head + "\n"
+
+
+low = re.sub(r"(?ms)^([^\n]*?)<<-?\s*(['\"]?)(\w+)\2[^\n]*\n(.*?)^\s*\3\s*$", _heredoc, low)
+if runs_code:
+    code_bits.append(low)   # printf '…' > s.py && python3 s.py: the code is in the command itself
+# an echo/printf string is dropped unless it is redirected into a file
+low = re.sub(r"\b(echo|printf)\s+(?:\"[^\"]*\"|'[^']*'|[^\n;|&>]*)(?!\s*>)", r"\1", low)
+
+direct_write = bool(re.search(CLIENT_AT, low)
+                    and (re.search(WRITE_VERBS, low)
+                         or re.search(r"\s-(f|i)\s+\S+\.sql\b", low)
+                         or re.search(r"<\s*\S+\.sql\b", low))) or any(re.search(WRITE_VERBS, b) for b in body_sql)
+
+# inline code (-c / -e / --eval / -Command) and script files run by an interpreter
+script_write, script_name = False, ""
+if re.search(INTERP_AT, low) or code_bits:
+    for m in re.finditer(INTERP_AT + r"[^\n;|&]*?\s(?:-c|-e|--eval|-p|-command)\s+(\"(?:[^\"\\]|\\.)*\"|'[^']*')", low):
+        code_bits.append(m.group(1))
+    roots = [data.get("cwd") or "", os.environ.get("TF_ROOT", ".")]
+    # `cd tools && python3 seed.py`: the script is found from the folder the command moved to
+    for cdir in re.findall(r"(?:^|[;&|(]\s*)cd\s+(['\"]?)([^\s'\";&|]+)\1", cmd):
+        roots += [os.path.join(r, cdir[1]) for r in list(roots) if r] + [cdir[1]]
+    for seg in re.finditer(INTERP_AT + r"([^\n;|&]*)", cmd, flags=re.I):
+        for tok in re.findall(r"[^\s'\"]+" + SCRIPT_EXT, seg.group(1), flags=re.I):
+            for cand in [tok] + [os.path.join(r, tok) for r in roots if r]:
+                try:
+                    if os.path.isfile(cand) and os.path.getsize(cand) < 2_000_000:
+                        with open(cand, encoding="utf-8", errors="replace") as fh:
+                            if code_writes(fh.read()):
+                                script_write, script_name = True, tok
+                        break
+                except Exception:
+                    pass
+    script_write = script_write or any(code_writes(b) for b in code_bits)
+
+if script_write:
+    print("BLOCKED by TechieFlow policy: this runs code that writes to a database directly "
+          f"({script_name or 'inline code'}: a database library and an INSERT / UPDATE / DELETE / DROP / CREATE). "
+          "The app's database changes only through its migration path or through the app itself. For a "
+          "smoke or a seed, point the script at a throw-away copy whose path names tests/.artifacts/, /tmp "
+          "or :memory:, written literally in the script. Owner rule 2026-09-05; Sevak TF-002.", file=sys.stderr)
+    sys.exit(2)
 if direct_write or re.search(DROP_DB, low):
     print("BLOCKED by TechieFlow policy: a direct database write (SQL through a client, or dropping "
           "a database) is not allowed from any command. Schema and data changes go through the "
@@ -75,11 +173,12 @@ if direct_write or re.search(DROP_DB, low):
 
 if re.search(MIGRATORS, low):
     ph = phase()
-    if ph in ("build-phase", "fix-issues"):
+    # triage-and-fix step 3 is fix-issues steps 2 to 5 under its own marker (AppManager TF-027)
+    if ph in ("build-phase", "fix-issues", "triage-and-fix"):
         sys.exit(0)
     who = f"the marker says {ph}" if ph else "no command marker is set"
-    print("BLOCKED by TechieFlow policy: a database migration runs only from *build-phase or "
-          f"*fix-issues, and {who}. Day-1, mockups, split-brd, amend-docs, devguide, verify, "
+    print("BLOCKED by TechieFlow policy: a database migration runs only from *build-phase, "
+          f"*fix-issues or *triage-and-fix, and {who}. Day-1, mockups, split-brd, amend-docs, devguide, verify, "
           "triage and status commands write documents and records, never the database. If you are "
           "inside build-phase or fix-issues, step 0 was skipped: run "
           "bash .tfcore/utils/tf-phase.sh start <command> <App> and retry. Owner rule 2026-09-05.",