@toolu/opencode 6.8.0

package/plugins/toolu/hooks/post-tools/modules/push-waiver.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# Post-tool: turn "the user said yes" into a durable push-review waiver.
+#
+# push-review.sh (PreToolUse) can only ask; it never learns the answer. This
+# module is the other half: PostToolUse runs only when the tool actually ran,
+# so its presence IS the yes. It promotes the pending marker push-review left
+# behind into a waiver for that exact diff.
+#
+# Two guards keep a waiver honest:
+#   * the diff SHA must still match what was asked about — a pending marker
+#     from older code is never cashed in by a push of different code;
+#   * the push must have SUCCEEDED. PostToolUse fires when a tool ran, not when
+#     it worked, and a rejected non-fast-forward push has not been reviewed by
+#     anybody. On failure the pending marker survives for the retry.
+#
+# Inputs (from the parent dispatcher post-tools/mod.sh, via `export`):
+#   $tool_name - name of the tool being invoked
+#   $input     - raw JSON payload on stdin
+
+# pipefail for parity with the other gate modules (push-review.sh,
+# plan-ledger.sh, docs-sync.sh all use exactly this).
+#
+# Deliberately NOT -e and NOT -u, for the same underlying reason: both options
+# apply to the shared libraries this module SOURCES, which are written for the
+# shell they are sourced into rather than for a strict one.
+#
+#   -e: this module's control flow uses non-zero returns as signal —
+#       push_waiver_promote returns 1 whenever there is nothing to promote,
+#       which is the normal case on most pushes.
+#   -u: the libraries use the guard-then-assign idiom, reading a variable
+#       before it is ever assigned. hooks/lib/detect.sh:307 is one of several:
+#           [ -n "$root" ] || root=$(git rev-parse --show-toplevel 2>/dev/null)
+#       Under nounset that aborts with "root: unbound variable" before this
+#       module reaches its own work, so a real push silently fails to record
+#       its waiver. Verified: adding -u fails
+#       __tests__/push-waiver.bats "the module never writes to stdout".
+#
+# Making these strict is a repo-wide change to how the shared libraries are
+# written, not a per-module flag.
+set -o pipefail
+
+: "${tool_name:=}"
+: "${input:=}"
+
+# Cursor Agent uses tool_name "Shell"; Claude Code uses "Bash".
+[[ "$tool_name" != "Bash" && "$tool_name" != "Shell" ]] && exit 0
+
+command -v jq  >/dev/null 2>&1 || exit 0
+command -v git >/dev/null 2>&1 || exit 0
+
+_toolu_lib="${TOOLU_LIB_DIR:-${BASH_SOURCE%/*}/../../lib}"
+# shellcheck source=../../lib/detect.sh
+. "$_toolu_lib/detect.sh"
+# shellcheck source=../../lib/diff-sha.sh
+. "$_toolu_lib/diff-sha.sh"
+# shellcheck source=../../lib/push-waiver.sh
+. "$_toolu_lib/push-waiver.sh"
+
+command=$(echo "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")
+is_git_push "$command" || exit 0
+
+# Exit-code resolution mirrors post-tools/modules/gate-status.sh so both
+# modules read a host's response shape the same way.
+exit_code=$(echo "$input" | jq -r '.tool_response.metadata.exit_code // .tool_response.exit_code // .tool_output.exit_code // empty' 2>/dev/null || echo "")
+if [[ -z "$exit_code" || "$exit_code" == "null" ]]; then
+  tool_output_raw=$(echo "$input" | jq -r '.tool_output // empty' 2>/dev/null || echo "")
+  if [[ -n "$tool_output_raw" ]]; then
+    exit_code=$(echo "$tool_output_raw" | jq -r '.exitCode // .exit_code // empty' 2>/dev/null || echo "")
+  fi
+fi
+
+# A reported non-zero exit means the push did not land: leave the pending
+# marker alone so the retry still asks.
+if [[ -n "$exit_code" && "$exit_code" != "null" && "$exit_code" != "0" ]]; then
+  exit 0
+fi
+
+# An interrupted tool call did not complete either.
+interrupted=$(echo "$input" | jq -r '.tool_response.interrupted // false' 2>/dev/null || echo "false")
+[[ "$interrupted" == "true" ]] && exit 0
+
+# Same target-repo resolution as the pre-tool gate: `git -C <worktree> push`
+# is judged on the worktree's own branch and state.
+repo_root=$(push_target_root "$command")
+current_branch=$(git -C "$repo_root" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
+[[ -z "$current_branch" || "$current_branch" == "HEAD" ]] && exit 0
+slug=$(branch_slug "$current_branch")
+
+base_branch="${PUSH_REVIEW_BASE:-$(detect_base_branch "$repo_root")}"
+current_diff_sha=$(toolu_diff_sha "$repo_root" "$base_branch")
+[[ -z "$current_diff_sha" ]] && exit 0
+
+# Nothing pending, or pending for other code: promote is a no-op and says so
+# by returning non-zero. Either way this module has no output.
+push_waiver_promote "$repo_root" "$slug" "$current_diff_sha" || exit 0
+
+exit 0

package/plugins/toolu/hooks/pre-compact.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# PreCompact hook
+
+HOOK_DIR="$(dirname "$0")"
+
+# shellcheck source=lib/config.sh
+. "$HOOK_DIR/lib/config.sh"
+
+# Drain stdin with a shell builtin so Codex does not see EPIPE from a fast exit.
+while IFS= read -r; do :; done
+
+if ! toolu_enabled hooks pre-compact; then
+  exit 0
+fi
+
+# PreCompact has no shared context-output shape, so a successful no-op is silent.
+
+exit 0

package/plugins/toolu/hooks/pre-tools/agent-tier.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# Agent/Task model-tier telemetry + advisory. Standalone PreToolUse hook — NOT
+# under pre-tools/modules/ (mod.sh only dispatches that directory, so a
+# sibling script here is invisible to it and, like mcp-blocker.sh, must read
+# its own stdin instead of relying on the parent dispatcher's `export`s).
+#
+# Registered in hooks.json under matcher "spawn_agent|Agent|Task" — deliberately loose
+# (it also matches TaskCreate/TaskUpdate/etc.); the real guard is the exact
+# tool_name equality check below (resolves spec OQ-1).
+#
+# Behavior:
+#   - Anything but tool_name == "spawn_agent", "Agent", or "Task" -> no-op.
+#   - Always append a `delegation` telemetry event: {model, subagent_type,
+#     step_id, step_model}, all null when not applicable. The plan-ledger join
+#     (step_id/step_model) only happens when a ledger file for the current
+#     branch exists (cheap stat first): step_id is the running step's id, else
+#     the ledger's `next`; step_model is that step's declared `model` field.
+#   - Nudge/deny ONLY when the joined step names a non-null model AND the
+#     call supplied a `model` param AND they differ. A missing call `model`
+#     means tier-inherit and is always legitimate — never nudged, never
+#     denied. Controlled by `agentTier.mode`: advise (default, emits
+#     additionalContext) | block (deny) | off (silent).
+#   - All failure paths (no jq, unreadable/malformed ledger, no git repo)
+#     fail open (exit 0); a telemetry bug must never block a delegation.
+
+set -o pipefail
+
+_toolu_lib="${TOOLU_LIB_DIR:-${BASH_SOURCE%/*}/../lib}"
+# shellcheck source=../lib/detect.sh
+. "$_toolu_lib/detect.sh"
+# shellcheck source=../lib/config.sh
+. "$_toolu_lib/config.sh"
+# shellcheck source=../lib/telemetry.sh
+. "$_toolu_lib/telemetry.sh"
+# shellcheck source=../lib/gate-mode.sh
+. "$_toolu_lib/gate-mode.sh"
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+_input=$(cat 2>/dev/null || true)
+
+tool_name=$(jq -r '.tool_name // empty' <<<"$_input" 2>/dev/null || true)
+
+# Exact-equality self-filter: the hooks.json matcher is deliberately loose
+# (spawn_agent|Agent|Task), so everything else — including TaskCreate/TaskUpdate — must be
+# silently ignored here.
+case "$tool_name" in
+  Agent|Task|spawn_agent) ;;
+  *) exit 0 ;;
+esac
+
+command -v git >/dev/null 2>&1 || exit 0
+
+root=$(detect_project_root)
+[ -n "$root" ] || exit 0
+
+call_model=$(jq -r '.tool_input.model // empty' <<<"$_input" 2>/dev/null || true)
+subagent_type=$(jq -r '.tool_input.subagent_type // .tool_input.task_name // .tool_input.agent_type // empty' <<<"$_input" 2>/dev/null || true)
+reasoning_effort=$(jq -r '.tool_input.reasoning_effort // .tool_input.reasoningEffort // empty' <<<"$_input" 2>/dev/null || true)
+
+# Ledger join: cheap stat first, so a repo with no active plan pays no extra
+# jq cost. LEDGER_DIR mirrors pre-tools/modules/plan-ledger.sh's override.
+step_id="" step_model=""
+branch=$(git -C "$root" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
+if [ -n "$branch" ] && [ "$branch" != "HEAD" ]; then
+  slug=$(branch_slug "$branch")
+  ledger_dir="${LEDGER_DIR:-$(toolu_project_state_dir plan-ledger "$root")}"
+  ledger_file="$ledger_dir/${slug}.json"
+  if [ -f "$ledger_file" ]; then
+    ledger_json=$(cat "$ledger_file" 2>/dev/null || true)
+    if [ -n "$ledger_json" ] && jq -e . >/dev/null 2>&1 <<<"$ledger_json"; then
+      # Running step's id if one is running, else the ledger's `next`
+      # (already null when every step is fresh-green).
+      step_id=$(jq -r '
+        (first(.steps[]? | select(.status == "running") | .id)) // (.next // empty)
+      ' <<<"$ledger_json" 2>/dev/null || true)
+      if [ -n "$step_id" ]; then
+        step_model=$(jq -r --arg id "$step_id" \
+          '(first(.steps[]? | select(.id == $id) | .model)) // empty' \
+          <<<"$ledger_json" 2>/dev/null || true)
+      fi
+    fi
+  fi
+fi
+
+# Always record the delegation — join or not, nudge or not.
+extra=$(jq -n \
+  --arg model "$call_model" \
+  --arg subagent_type "$subagent_type" \
+  --arg reasoning_effort "$reasoning_effort" \
+  --arg step_id "$step_id" \
+  --arg step_model "$step_model" \
+  '{
+    model:         (if $model == ""         then null else $model end),
+    subagent_type: (if $subagent_type == "" then null else $subagent_type end),
+    reasoning_effort: (if $reasoning_effort == "" then null else $reasoning_effort end),
+    step_id:       (if $step_id == ""       then null else $step_id end),
+    step_model:    (if $step_model == ""    then null else $step_model end)
+  }')
+telemetry_append "$root" delegation "$extra"
+
+# Nudge/deny: only when the joined step declares a non-null model AND the
+# call supplied one AND they differ. A missing call model is tier-inherit —
+# always legitimate, never nudged or denied.
+if [ -n "$step_model" ] && [ -n "$call_model" ] && [ "$step_model" != "$call_model" ]; then
+  mode=$(toolu_gate_mode agentTier)
+  reason="plan step \"$step_id\" expects model tier \"$step_model\" but this delegation used \"$call_model\""
+  toolu_gate_emit "$mode" "$reason"
+fi
+
+exit 0

package/plugins/toolu/hooks/pre-tools/mod.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# Pre-tool-use hook dispatcher (entrypoint).
+# Runs all scripts in .claude/hooks/pre-tools/modules/*.sh sequentially.
+# Each script receives $input and $tool_name as env vars plus $input on stdin.
+#
+# Dispatch, decision short-circuit (permissionDecision:"deny"), advisory
+# merging, and module exit-code semantics live in lib/dispatch.sh.
+
+HOOK_LIB="$(cd "$(dirname "$0")/../lib" && pwd)"
+# shellcheck source=../lib/config.sh
+. "$HOOK_LIB/config.sh"
+# shellcheck source=../lib/dispatch.sh
+. "$HOOK_LIB/dispatch.sh"
+# shellcheck source=../lib/detect.sh
+. "$HOOK_LIB/detect.sh"
+# shellcheck source=../lib/registry.sh
+. "$HOOK_LIB/registry.sh"
+
+if ! toolu_enabled hooks pre-tools; then
+  cat > /dev/null 2>&1 || true
+  exit 0
+fi
+
+# Exported only once the hook is enabled, so disabled runs keep the env clean.
+export TOOLU_LIB_DIR="$HOOK_LIB"
+TOOLU_CONFIG_DIR="$(toolu_config_root)"
+export TOOLU_CONFIG_DIR
+
+input=$(cat)
+tool_name=$(jq -r '.tool_name // ""' <<<"$input" 2>/dev/null || echo "")
+
+export input tool_name
+
+HOOK_DIR="$(cd "$(dirname "$0")" && pwd)/modules"
+
+# Exits 2 if a module hard-blocks via exit code 2 (stderr forwarded).
+toolu_dispatch_hook "$HOOK_DIR" "PreToolUse" "$(toolu_registry_event_dir PreToolUse)"

package/plugins/toolu/hooks/pre-tools/modules/bash-commands.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# Pre-tool check: Bash/Shell command validation
+# Data-driven: loads allow/deny rules from $TOOLU_SETTINGS_DIR/bash-{allow,deny}list.txt.
+# Argv-aware: tokenizes the command and matches "<bin> <flag>" deny rules so
+# substring evasion is harder (e.g. `node -e "evil"` is rejected even if `node`
+# alone is allowed).
+#
+# Inputs (from parent dispatcher pre-tools/mod.sh, via `export`):
+#   $tool_name - name of the tool being invoked
+#   $input     - raw JSON payload on stdin
+
+: "${tool_name:=}"
+: "${input:=}"
+
+_toolu_lib="${TOOLU_LIB_DIR:-${BASH_SOURCE%/*}/../../lib}"
+# shellcheck source=../../lib/detect.sh
+. "$_toolu_lib/detect.sh"
+# shellcheck source=../../lib/gate-mode.sh
+. "$_toolu_lib/gate-mode.sh"
+
+[[ "$tool_name" != "Bash" && "$tool_name" != "Shell" ]] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+
+TOOLU_SETTINGS_DIR=$(toolu_settings_dir)
+
+# read_list + strip_heredocs are sourced from lib/detect.sh.
+
+# bash_tokenize <command>
+# Tokenize a shell command into argv tokens, respecting single and double quotes.
+# Echoes one token per line.
+bash_tokenize() {
+  local cmd="$1"
+  python3 - "$cmd" <<'PY' 2>/dev/null || printf '%s\n' "$cmd"
+import shlex, sys
+try:
+    for tok in shlex.split(sys.argv[1], posix=True):
+        print(tok)
+except ValueError:
+    # Unparseable (unbalanced quote etc) — print whole string so substring rules still fire.
+    print(sys.argv[1])
+PY
+}
+
+# tokens_contain_rule <rule> <token...>
+# Returns 0 if `tokens[0]` matches the first rule token AND every subsequent
+# rule token appears as a distinct later argv token. Substring matching is
+# never used here — that was the source of false-positives on commit messages
+# like `git commit -m "fix cargo test failure"`.
+tokens_contain_rule() {
+  local rule="$1"; shift
+  local -a tokens=("$@")
+  local -a rule_tokens
+  # shellcheck disable=SC2206  # intentional word-split on whitespace
+  rule_tokens=($rule)
+  [ ${#rule_tokens[@]} -eq 0 ] && return 1
+  [ "${tokens[0]:-}" = "${rule_tokens[0]}" ] || return 1
+  local i j want found
+  for ((i=1; i<${#rule_tokens[@]}; i++)); do
+    want="${rule_tokens[$i]}"
+    found=0
+    for ((j=1; j<${#tokens[@]}; j++)); do
+      if [ "${tokens[$j]}" = "$want" ]; then
+        found=1
+        break
+      fi
+    done
+    [ "$found" -eq 0 ] && return 1
+  done
+  return 0
+}
+
+# matches_deny <command> <denylist>
+# Returns 0 (match) if any deny rule fires against the command, else 1.
+# Rules containing whitespace (e.g. `node -e`, `cargo test`) use argv-aware
+# multi-token matching only (no substring fallback); single-token rules
+# (bare names like `biome`) substring-match anywhere on the command.
+matches_deny() {
+  local cmd="$1"
+  local denylist="$2"
+  local rule tokens _tok
+  tokens=(); while IFS= read -r _tok; do tokens+=("$_tok"); done < <(bash_tokenize "$cmd")
+  # Tokenizer yielded nothing (empty/whitespace-only command): fall back to
+  # the raw command as a single token — same shape bash_tokenize itself emits
+  # on a parse failure. Substring rules below never consult tokens, so this
+  # cannot bypass them.
+  [ ${#tokens[@]} -eq 0 ] && tokens=("$cmd")
+  while IFS= read -r rule; do
+    [ -z "$rule" ] && continue
+    if [[ "$rule" == *" "* ]]; then
+      if tokens_contain_rule "$rule" "${tokens[@]}"; then
+        echo "$rule"
+        return 0
+      fi
+    else
+      # Single-token rule: substring match against the command. Bare-name
+      # rules (`biome`) land here; rules with internal whitespace
+      # (`cargo test`) take the multi-token argv branch above.
+      if [[ "$cmd" == *"$rule"* ]]; then
+        echo "$rule"
+        return 0
+      fi
+    fi
+  done <<< "$denylist"
+  return 1
+}
+
+# matches_allow <command> <allowlist>
+# Returns 0 if any allow rule matches. Multi-token rules are argv-aware
+# (same shape as deny); single-token rules substring-match.
+matches_allow() {
+  local cmd="$1"
+  local allowlist="$2"
+  local rule tokens _tok
+  tokens=(); while IFS= read -r _tok; do tokens+=("$_tok"); done < <(bash_tokenize "$cmd")
+  # Same empty-tokenization fallback as matches_deny.
+  [ ${#tokens[@]} -eq 0 ] && tokens=("$cmd")
+  while IFS= read -r rule; do
+    [ -z "$rule" ] && continue
+    if [[ "$rule" == *" "* ]]; then
+      if tokens_contain_rule "$rule" "${tokens[@]}"; then
+        return 0
+      fi
+    else
+      if [[ "$cmd" == *"$rule"* ]]; then
+        return 0
+      fi
+    fi
+  done <<< "$allowlist"
+  return 1
+}
+
+# Public entry — invokable when the script is sourced (used by tests).
+#
+# Semantics: deny is evaluated FIRST so a deny result still carries the rule
+# that fired. The allowlist is an explicit override on top of deny, intended
+# for project-specific exemptions: deny + matching allow → allow; deny with
+# no allow match → deny; no deny match → allow (default-open).
+bash_commands_decide() {
+  local cmd="$1"
+  local allowlist denylist hit
+  allowlist=$(read_list "$TOOLU_SETTINGS_DIR/bash-allowlist.txt")
+  denylist=$(read_list "$TOOLU_SETTINGS_DIR/bash-denylist.txt")
+
+  # Strip heredoc bodies so we only check actual commands, not prose in commit messages.
+  cmd=$(printf '%s\n' "$cmd" | strip_heredocs)
+
+  if hit=$(matches_deny "$cmd" "$denylist"); then
+    if matches_allow "$cmd" "$allowlist"; then
+      echo "allow"
+    else
+      echo "deny:$hit"
+    fi
+    return 0
+  fi
+
+  echo "allow"
+  return 0
+}
+
+# When sourced (tests), return early.
+(return 0 2>/dev/null) && return 0
+
+command=$(echo "$input" | jq -r '.tool_input.command // ""')
+decision=$(bash_commands_decide "$command")
+
+case "$decision" in
+  deny:*)
+    rule="${decision#deny:}"
+    mode=$(toolu_gate_mode bashCommands)
+    case "$mode" in
+      ask)
+        reason=$(toolu_gate_guardrail_warning \
+          "Claude wants to run a command matching the deny rule \"$rule\"." \
+          "Rules in settings/bash-denylist.txt cover commands that execute arbitrary code from a string (node -e, bun -e) or that this project has ruled out. The command runs with your full shell privileges if you approve.")
+        ;;
+      advise)
+        reason="Command matches deny rule \"$rule\" (plugins/toolu/settings/bash-denylist.txt). The command was not stopped — gates.bashCommands.mode is 'advise'."
+        ;;
+      *)
+        reason="Command blocked by deny rule: $rule"
+        ;;
+    esac
+    toolu_gate_emit "$mode" "$reason"
+    ;;
+esac
+
+exit 0

package/plugins/toolu/hooks/pre-tools/modules/code-edit-rules.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Pre-tool check: Remind to read rules before editing code files.
+# Data-driven: loads $TOOLU_SETTINGS_DIR/code-edit-rules.json. Empty/missing → no-op.
+#
+# Inputs (from parent dispatcher pre-tools/mod.sh, via `export`):
+#   $tool_name - name of the tool being invoked
+#   $input     - raw JSON payload on stdin
+
+: "${tool_name:=}"
+: "${input:=}"
+
+_toolu_lib="${TOOLU_LIB_DIR:-${BASH_SOURCE%/*}/../../lib}"
+# shellcheck source=../../lib/detect.sh
+. "$_toolu_lib/detect.sh"
+
+# MultiEdit is in the PreToolUse matcher and carries .tool_input.file_path just
+# like Edit/Write — include it so rule reminders are not dropped for MultiEdit.
+[[ "$tool_name" != "Edit" && "$tool_name" != "Write" && "$tool_name" != "MultiEdit" ]] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+
+TOOLU_SETTINGS_DIR=$(toolu_settings_dir)
+RULES_FILE="$TOOLU_SETTINGS_DIR/code-edit-rules.json"
+
+[ -f "$RULES_FILE" ] || exit 0
+
+file_path=$(echo "$input" | jq -r '.tool_input.file_path // ""')
+[ -z "$file_path" ] && exit 0
+
+# Normalize abs → repo-relative so patterns in code-edit-rules.json match
+# the same way the user wrote them.
+file_path=$(to_relative_path "$file_path")
+
+# glob_match <pattern> <path> — bash-native glob check
+glob_match() {
+  local pattern="$1"
+  local path="$2"
+  shopt -s extglob globstar 2>/dev/null || true
+  # shellcheck disable=SC2053  # intentional glob match on RHS
+  [[ "$path" == $pattern ]]
+}
+
+# Iterate rules and accumulate docs whose match-glob fits.
+docs=""
+rule_count=$(jq '.rules | length' "$RULES_FILE" 2>/dev/null || echo 0)
+[ "$rule_count" = "null" ] && rule_count=0
+
+for ((i=0; i<rule_count; i++)); do
+  match=$(jq -r ".rules[$i].match // \"\"" "$RULES_FILE")
+  [ -z "$match" ] && continue
+  if glob_match "$match" "$file_path"; then
+    # Base docs
+    base=$(jq -r ".rules[$i].docs // [] | join(\" + \")" "$RULES_FILE")
+    [ -n "$base" ] && [ "$base" != "null" ] && docs="${docs}${docs:+ + }${base}"
+    # Conditional extra docs
+    extra_paths_count=$(jq -r ".rules[$i].when_path_matches // [] | length" "$RULES_FILE")
+    if [ "$extra_paths_count" -gt 0 ]; then
+      for ((j=0; j<extra_paths_count; j++)); do
+        cond=$(jq -r ".rules[$i].when_path_matches[$j]" "$RULES_FILE")
+        if glob_match "$cond" "$file_path"; then
+          extra=$(jq -r ".rules[$i].extra_docs // [] | join(\" + \")" "$RULES_FILE")
+          [ -n "$extra" ] && [ "$extra" != "null" ] && docs="${docs}${docs:+ + }${extra}"
+          break
+        fi
+      done
+    fi
+    break
+  fi
+done
+
+[ -z "$docs" ] && exit 0
+
+jq -n --arg msg "Apply these rules: $docs" --arg file "$file_path" '{
+  "hookSpecificOutput": {
+    "hookEventName": "PreToolUse",
+    "additionalContext": ("File: " + $file + "\n" + $msg)
+  }
+}'
+exit 0

package/plugins/toolu/hooks/pre-tools/modules/commit-gate.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Pre-commit gate — validates Conventional Commits prefix and reminds about
+# scope verification + memory save before commits.
+# Project-agnostic: prefixes come from settings/commit-prefixes.txt; base
+# branch is detected via detect_base_branch.
+
+: "${tool_name:=}"
+: "${input:=}"
+
+_toolu_lib="${TOOLU_LIB_DIR:-${BASH_SOURCE%/*}/../../lib}"
+# shellcheck source=../../lib/detect.sh
+. "$_toolu_lib/detect.sh"
+# shellcheck source=../../lib/gate-mode.sh
+. "$_toolu_lib/gate-mode.sh"
+
+[[ "$tool_name" != "Bash" ]] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+
+command=$(echo "$input" | jq -r '.tool_input.command // ""' 2>/dev/null || echo "")
+
+# Only match git commit commands. is_git_commit (lib/detect.sh) is used rather
+# than a literal prefix match so `git -C <path> commit` and a commit reached
+# through `&&` are seen too, and a heredoc body that merely mentions committing
+# is not.
+is_git_commit "$command" || exit 0
+
+mode=$(toolu_gate_mode commitGate)
+[ "$mode" = "off" ] && exit 0
+
+TOOLU_SETTINGS_DIR=$(toolu_settings_dir)
+PREFIX_FILE="$TOOLU_SETTINGS_DIR/commit-prefixes.txt"
+BASE_BRANCH=$(detect_base_branch)
+
+# read_list is sourced from lib/detect.sh.
+
+# Extract the message from -m "..." if present; else allow (it's editor-driven).
+# Double-quoted form honors backslash escapes (`-m "fix \"bug\""`) so an
+# escaped quote no longer truncates the message; single-quoted form cannot
+# contain escapes by shell rules. If neither form parses, msg stays empty and
+# the gate falls through gracefully (no deny, context message only).
+msg=""
+if [[ "$command" == *" -m "* ]]; then
+  msg=$(printf '%s' "$command" | sed -nE 's/.* -m[[:space:]]+"((\\.|[^"\\])*)".*/\1/p')
+  if [ -z "$msg" ]; then
+    msg=$(printf '%s' "$command" | sed -nE "s/.* -m[[:space:]]+'([^']*)'.*/\\1/p")
+  else
+    # Unescape so the subject parser sees the literal message (\" -> ").
+    msg=$(printf '%s' "$msg" | sed -E 's/\\(.)/\1/g')
+  fi
+fi
+
+prefixes=$(read_list "$PREFIX_FILE")
+if [ -n "$msg" ] && [ -n "$prefixes" ]; then
+  # Subject = first line up to first colon/space
+  subject_prefix=$(printf '%s' "$msg" | head -1 | sed -nE 's/^([a-z]+)(\(.*\))?:.*/\1/p')
+  if [ -n "$subject_prefix" ]; then
+    if ! echo "$prefixes" | grep -qFx "$subject_prefix"; then
+      toolu_gate_emit "$mode" "Unknown Conventional Commits prefix: \"$subject_prefix\". Allowed prefixes are in settings/commit-prefixes.txt. Base branch: $BASE_BRANCH"
+      exit 0
+    fi
+  fi
+fi
+
+jq -n --arg base "$BASE_BRANCH" '{
+  "hookSpecificOutput": {
+    "hookEventName": "PreToolUse",
+    "additionalContext": ("BEFORE COMMITTING:\n1. Verify diff covers only expected scope (git diff --stat against " + $base + ")\n2. Save memory of significant decisions before committing.\nSkip only if already done this task.")
+  }
+}'
+exit 0