@windyroad/voice-tone 0.5.6 → 0.5.7-preview.576

package/.claude-plugin/plugin.json

@@ -123,5 +123,5 @@
     }
   },
   "name": "wr-voice-tone",
-  "version": "0.5.6"
+  "version": "0.5.7"
 }

package/agents/agent.md

@@ -15,11 +15,24 @@ You are the Voice and Tone Lead. You review proposed copy changes against the pr
 
 ## Your Role
 
-1. Read `docs/VOICE-AND-TONE.md` in the project to load the current guide
+1. Read `docs/VOICE-AND-TONE.md` in the project to load the current guide. **If the file does not exist, see "Missing Guide Handling" below** — return PASS-with-advisory and stop. Do not proceed to step 2 in that case.
 2. Read the file(s) being edited to understand the existing copy and context
 3. Review proposed changes against every section of the guide
 4. Report: OK if compliant, or list specific violations with suggested fixes
 
+## Missing Guide Handling (P200)
+
+If `docs/VOICE-AND-TONE.md` does not exist in the project, the voice-tone gate is **inactive**. Return PASS with a one-line advisory — do NOT return FAIL on a blanket "guide is missing" basis. This mirrors the architect agent's graceful pattern ("If `docs/decisions/` itself does not exist, that is fine") and aligns with ADR-028's per-evaluator advisory-only fallback already implemented in `external-comms-gate.sh` (line 272 — "Advisory-only fallback when policy file is absent").
+
+Sibling-consistent reasoning: the project has opted not to install a voice-tone guide; the agent cannot review against rules that do not exist. The protective surface for projects that DO adopt voice-tone is `voice-tone-enforce-edit.sh` — which still blocks edits when the policy is missing (a separate concern; this agent does not override that hook). The agent's job is to review against the guide, and when the guide is absent there is nothing to review against.
+
+Output shape when the guide is absent:
+
+> **Voice & Tone Review: PASS**
+> voice-tone gate inactive — no `docs/VOICE-AND-TONE.md` present. Run `/wr-voice-tone:update-guide` to enable voice-tone reviews.
+
+Then `printf 'PASS' > /tmp/voice-tone-verdict` and stop.
+
 ## What You Check
 
 All review criteria come from `docs/VOICE-AND-TONE.md`. Read the guide first and apply its sections. Typical sections include:

package/agents/external-comms.md

@@ -24,7 +24,19 @@ The invoking skill (`/wr-voice-tone:assess-external-comms`) or the agent that hi
 
 Read `docs/VOICE-AND-TONE.md` (project root) to get the authoritative voice profile. Typical sections include voice principles, tone by context, banned patterns, word list / terminology, and language/locale conventions.
 
-If `docs/VOICE-AND-TONE.md` is absent, the gate will run in advisory-only mode (the canonical hook handles this before delegating to you). You should only be invoked when the policy file exists.
+## Missing Guide Handling (P200)
+
+If `docs/VOICE-AND-TONE.md` is absent, return a PASS verdict with a one-line advisory — do NOT return FAIL on a blanket "guide is missing" basis. The canonical `external-comms-gate.sh` hook handles this case by permitting with an advisory message (line 272), and your verdict must agree with that gate posture so the marker hook does not blanket-deny a session whose project has opted out of voice-tone enforcement.
+
+This aligns with ADR-028's per-evaluator advisory-only fallback ("if `docs/VOICE-AND-TONE.md` is absent, voice-tone review is advisory-only... its verdict file reads PASS unconditionally"). The fallback is sibling-consistent with the architect agent's graceful "no prior decisions are recorded" pattern.
+
+Output shape when the guide is absent — a terse note in prose followed by the structured verdict block:
+
+> voice-tone gate inactive — no `docs/VOICE-AND-TONE.md` present. Run `/wr-voice-tone:update-guide` to enable voice-tone reviews.
+>
+> EXTERNAL_COMMS_VOICE_TONE_VERDICT: PASS
+
+Stop after emitting that block — do NOT proceed with draft review when there is no policy to review against.
 
 ## Review process
 

package/hooks/external-comms-gate.sh

@@ -14,6 +14,14 @@
 #   - gh api .../comments                         (any REST surface accepting prose)
 #   - npm publish                                 (README / package metadata to npm)
 #   - PreToolUse:Write|Edit on .changeset/*.md    (P073 — gates author-time)
+#   - git commit -m / --message (incl. HEREDOC)   (P082 Phase 1 — commit message
+#                                                  body reaches every reader of git
+#                                                  log, PR commits tab, release-page
+#                                                  auto-notes, CHANGELOG. Editor
+#                                                  flow is out of scope per P082 SC1
+#                                                  — message is written to
+#                                                  .git/COMMIT_EDITMSG AFTER
+#                                                  PreToolUse, nothing to read.)
 #
 # Gate behaviour:
 #   1. BYPASS_RISK_GATE=1 short-circuits the gate (consistent with git-push-gate.sh).
@@ -144,20 +152,59 @@ except Exception:
             SURFACE="gh-api-comments"
         elif echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm publish(\s|$)'; then
             SURFACE="npm-publish"
+        elif echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*git commit(\s|$)'; then
+            # P082 Phase 1: gate `git commit -m / --message / HEREDOC` so commit
+            # message bodies are reviewed by the voice-tone + risk evaluators
+            # before they land in git log / PR commits tab / release notes /
+            # CHANGELOG. Editor flow (bare `git commit`) is out of scope per
+            # P082 SC1 — git writes .git/COMMIT_EDITMSG AFTER PreToolUse fires,
+            # so there's no body to extract at gate time. Skip silently when
+            # neither -m nor --message is present.
+            if echo "$COMMAND" | grep -qE '(\s|^)(-m|--message)(\s|=)'; then
+                SURFACE="git-commit-message"
+            else
+                exit 0
+            fi
         else
             exit 0
         fi
 
-        # Best-effort body extraction: --body 'TEXT' or --body "TEXT" or --field summary='TEXT'.
-        # When absent (npm publish, --body-file), DRAFT="" is acceptable: the agent will
-        # be invoked with command context and read whatever body source the call uses.
+        # Best-effort body extraction. Order matters — most-specific first.
+        #
+        #   HEREDOC first: `git commit -m "$(cat <<'EOF'\n...\nEOF\n)"` is the
+        #     AI-dominant form. Must precede --body "..." / -m "..." because
+        #     those would otherwise match the literal `$(cat <<'EOF'...EOF)`
+        #     text as the body, defeating the marker key match against the
+        #     subagent's <draft> body.
+        #   Then --body / --field for the gh + npm + security-advisories surfaces.
+        #   Then -m / --message for git commit (single-line literal forms).
+        #
+        # When absent (npm publish, --body-file, editor flow already filtered),
+        # DRAFT="" is acceptable: the agent will be invoked with command
+        # context and read whatever body source the call uses.
         DRAFT=$(printf '%s' "$COMMAND" | python3 -c "
 import sys, re
 cmd = sys.stdin.read()
-# Match --body '...' or --body \"...\" or --field summary='...'
-for pat in [r\"--body[= ]'([^']*)'\", r'--body[= ]\"([^\"]*)\"',
-            r\"--field [a-zA-Z_]+='([^']*)'\", r'--field [a-zA-Z_]+=\"([^\"]*)\"']:
-    m = re.search(pat, cmd)
+# (pattern, flags) — first match wins.
+patterns = [
+    # HEREDOC body — matches a here-doc with EOF delimiter (quoted or
+    # unquoted). The literal '<<' is written as the char-class pair
+    # [<][<] so bash's command-substitution parser does NOT mis-parse
+    # this regex as a real here-doc operator (P082 implementation note).
+    # DOTALL so the body can span newlines.
+    (r\"[<][<]\s*['\\\"]?EOF['\\\"]?\s*\n(.*?)\nEOF\", re.DOTALL),
+    # gh issue/pr + npm publish --body 'TEXT' / --body \"TEXT\" (existing).
+    (r\"--body[= ]'([^']*)'\", 0),
+    (r'--body[= ]\"([^\"]*)\"', 0),
+    # gh api --field summary='TEXT' / --field summary=\"TEXT\" (existing).
+    (r\"--field [a-zA-Z_]+='([^']*)'\", 0),
+    (r'--field [a-zA-Z_]+=\"([^\"]*)\"', 0),
+    # git commit -m / --message single-line literal forms (P082 Phase 1).
+    (r\"(?:-m|--message)[= ]'([^']*)'\", 0),
+    (r'(?:-m|--message)[= ]\"([^\"]*)\"', 0),
+]
+for pat, flags in patterns:
+    m = re.search(pat, cmd, flags)
     if m:
         print(m.group(1))
         break

package/hooks/test/external-comms-gate.bats

@@ -231,3 +231,94 @@ run_hook() {
   [ "$status" -eq 0 ]
   [ -z "$output" ]
 }
+
+# ---------------------------------------------------------------------------
+# P082 Phase 1 — git commit message surface (voice-tone evaluator).
+# Commit messages reach git log / PR commits tab / release notes / CHANGELOG;
+# voice-tone evaluator gates the message body for AI-tells, hedging,
+# em-dashes, banned-phrase drift before the commit lands. Editor flow
+# (bare `git commit`) is out of scope per P082 SC1 — the message is
+# written to .git/COMMIT_EDITMSG AFTER PreToolUse fires.
+# ---------------------------------------------------------------------------
+
+@test "P082: git commit -m with literal -m body denies and delegates to voice-tone evaluator" {
+  INPUT=$(build_bash_input "git commit -m \"I've implemented the feature\"")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"git-commit-message"* ]]
+  [[ "$output" == *"wr-voice-tone:external-comms"* ]]
+}
+
+@test "P082: git commit --message with literal body denies and delegates" {
+  INPUT=$(build_bash_input "git commit --message \"happy to help further with this fix\"")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"git-commit-message"* ]]
+}
+
+@test "P082: git commit --amend -m is intercepted (P082 SC2)" {
+  INPUT=$(build_bash_input "git commit --amend -m \"rewritten subject\"")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"git-commit-message"* ]]
+}
+
+@test "P082: git commit HEREDOC body is intercepted and the body becomes the marker key" {
+  # Build a HEREDOC-shaped command. The hook regex pulls the body BETWEEN
+  # the <<'EOF' opener and the closing EOF marker — the extracted DRAFT is
+  # the inner text, NOT the literal `$(cat <<'EOF' ... EOF)` wrapper.
+  BODY=$'feat(foo): add bar\n\nWe observed a build failure on Node 20.'
+  CMD=$'git commit -m "$(cat <<\'EOF\'\n'"$BODY"$'\nEOF\n)"'
+  INPUT=$(build_bash_input "$CMD")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"git-commit-message"* ]]
+
+  # Pre-place the per-evaluator marker keyed on the extracted HEREDOC body
+  # + the git-commit-message surface; the second run must permit silently.
+  SURFACE="git-commit-message"
+  KEY=$(printf '%s\n%s' "$BODY" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
+  touch "${RDIR}/external-comms-voice-tone-reviewed-${KEY}"
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "P082: bare git commit (editor flow) is silently allowed per SC1" {
+  # No -m / --message → .git/COMMIT_EDITMSG doesn't exist at PreToolUse
+  # time. Phase 1 skip is pragmatic; the editor flow has user-eyeballs.
+  INPUT=$(build_bash_input "git commit")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "P082: git merge is silently allowed (not a git commit verb)" {
+  INPUT=$(build_bash_input "git merge --no-ff feature-branch")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "P082: BYPASS_RISK_GATE=1 short-circuits the git commit gate" {
+  INPUT=$(build_bash_input "git commit -m \"I've implemented the feature\"")
+  run bash -c "cd '$TEST_PROJECT_DIR' && BYPASS_RISK_GATE=1 printf '%s' \"\$1\" | BYPASS_RISK_GATE=1 '$HOOK'" _ "$INPUT"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "P082: per-evaluator marker keyed on (body, git-commit-message) permits the call" {
+  BODY="docs(retro): close iter 3 ask-hygiene trail"
+  SURFACE="git-commit-message"
+  KEY=$(printf '%s\n%s' "$BODY" "$SURFACE" | shasum -a 256 | cut -d' ' -f1)
+  touch "${RDIR}/external-comms-voice-tone-reviewed-${KEY}"
+
+  INPUT=$(build_bash_input "git commit -m \"$BODY\"")
+  run_hook "$INPUT"
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/voice-tone",
-  "version": "0.5.6",
+  "version": "0.5.7-preview.576",
   "description": "Voice and tone enforcement for user-facing copy",
   "bin": {
     "windyroad-voice-tone": "./bin/install.mjs"