bigpowers 2.91.0 → 2.91.1

package/extensions/omp-hooks.ts

@@ -18,15 +18,152 @@ import { fileURLToPath } from "node:url";
 // only truly foreign entries (e.g. a stray node_modules symlink) need exclusion.
 const EXCLUDED_DIRS = new Set([".git", "node_modules"]);
 
-const DANGEROUS_PATTERNS = [
-  /git\s+reset\s+--hard/,
-  /git\s+clean\s+-f/,
-  /git\s+branch\s+-D/,
-  /git\s+checkout\s+\./,
-  /git\s+restore\s+\./,
-  /push\s+--force/,
-  /push\s+-f(?:\s|$)/,
-];
+// ---------------------------------------------------------------------------
+// Git argv normalization (BUG-2026-11-03-guard-git-flag-normalize, #184).
+//
+// Literal substring patterns cannot see a global flag in front of the
+// subcommand (`git -C repo reset --hard`), a flag between the subcommand and the
+// destructive option (`git reset -q --hard`), or an alternative spelling of the
+// same act (`git checkout -- .`, `git branch --delete --force`). Tokenize the
+// command, drop the global options, then judge (subcommand, arguments).
+//
+// scripts/lib/git-argv.py is the same rule table in Python for the shell hooks;
+// scripts/test-guard-git-normalize.sh fails if the two disagree on any fixture.
+// ---------------------------------------------------------------------------
+
+/** Quote-aware split; a quoting error degrades to whitespace splitting, never to eval. */
+export function tokenizeArgs(command: string): string[] {
+  const tokens: string[] = [];
+  let current = "";
+  let quote: '"' | "'" | null = null;
+  let hasToken = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch as '"' | "'";
+      hasToken = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (hasToken) {
+        tokens.push(current);
+        current = "";
+        hasToken = false;
+      }
+      continue;
+    }
+    current += ch;
+    hasToken = true;
+  }
+  if (hasToken) tokens.push(current);
+  return tokens;
+}
+
+// Global options that consume the next token as their value.
+const GIT_VALUE_FLAGS = new Set([
+  "-C", "-c", "--exec-path", "--git-dir", "--work-tree", "--namespace",
+  "--super-prefix", "--config-env",
+]);
+
+// Global options that stand alone.
+const GIT_BARE_FLAGS = new Set([
+  "-p", "--paginate", "--no-pager", "--bare", "--no-replace-objects",
+  "--literal-pathspecs", "--glob-pathspecs", "--icase-pathspecs",
+  "--no-optional-locks", "--version", "--help",
+]);
+
+const SEPARATORS = new Set([";", "&&", "||", "|", "&", "(", ")", "\n"]);
+
+function shortFlagHas(args: string[], letter: string): boolean {
+  return args.some((a) => a.startsWith("-") && !a.startsWith("--") && a.slice(1).includes(letter));
+}
+
+/** Block reason for one normalized git invocation, or null. Mirror git-argv.py. */
+export function classifyGitInvocation(sub: string, args: string[]): string | null {
+  if (sub === "reset" && args.includes("--hard")) return "git reset --hard discards uncommitted work";
+  if (sub === "clean" && (shortFlagHas(args, "f") || args.includes("--force"))) {
+    return "git clean -f deletes untracked files";
+  }
+  if (sub === "branch") {
+    const forced =
+      args.includes("-D") ||
+      (args.includes("--delete") && (args.includes("--force") || shortFlagHas(args, "f")));
+    if (forced) return "git branch -D deletes an unmerged branch";
+  }
+  if (sub === "checkout") {
+    if (args.includes("-f") || args.includes("--force")) return "git checkout -f discards local changes";
+    if (args.includes(".")) return "git checkout . discards local changes";
+  }
+  if (sub === "restore" && (args.includes("--worktree") || args.includes("."))) {
+    return "git restore discards local changes";
+  }
+  if (sub === "push") {
+    const leased = args.some((a) => a === "--force-with-lease" || a.startsWith("--force-with-lease="));
+    const forced =
+      args.includes("-f") ||
+      args.includes("--force") ||
+      args.some((a) => a.startsWith("+") && !a.startsWith("++"));
+    if (forced && !leased) return "force push rewrites remote history";
+  }
+  return null;
+}
+
+/** Every (subcommand, args) pair in a command, with global options stripped. */
+export function gitInvocations(tokens: string[]): Array<{ sub: string; args: string[] }> {
+  const found: Array<{ sub: string; args: string[] }> = [];
+  let i = 0;
+  while (i < tokens.length) {
+    const token = tokens[i];
+    if (token.split("/").pop() !== "git") {
+      i += 1;
+      continue;
+    }
+    let j = i + 1;
+    while (j < tokens.length) {
+      const opt = tokens[j];
+      if (SEPARATORS.has(opt)) break;
+      const name = opt.split("=")[0];
+      if (GIT_VALUE_FLAGS.has(name)) {
+        j += opt.includes("=") ? 1 : 2;
+        continue;
+      }
+      if (GIT_BARE_FLAGS.has(name) || (opt.startsWith("-") && !opt.startsWith("--") && opt.length > 1)) {
+        j += 1;
+        continue;
+      }
+      break;
+    }
+    if (j >= tokens.length || SEPARATORS.has(tokens[j])) {
+      i = j + 1;
+      continue;
+    }
+    const sub = tokens[j];
+    const args: string[] = [];
+    let k = j + 1;
+    while (k < tokens.length && !SEPARATORS.has(tokens[k])) {
+      args.push(tokens[k]);
+      k += 1;
+    }
+    found.push({ sub, args });
+    i = k;
+  }
+  return found;
+}
+
+/** The normalized verdict for a whole shell command: a reason to block, or null. */
+export function dangerousGitCommand(command: string): string | null {
+  for (const { sub, args } of gitInvocations(tokenizeArgs(command))) {
+    const reason = classifyGitInvocation(sub, args);
+    if (reason) return reason;
+  }
+  return null;
+}
+
 
 // Conventional Commits specifies `type(scope)!:`, but many repositories write
 // `type!(scope):`. Accept both; the leading type is what matters.
@@ -224,6 +361,46 @@ function currentBranch(cwd: string): string {
   }
 }
 
+/** Everything the tool_call handler decides, as a pure function (testable). */
+export function evaluateBashCall(
+  command: string,
+  opts: {
+    landMode: boolean;
+    hasRepo: boolean;
+    branchFor: (upTo: number) => string | undefined;
+  },
+): string | null {
+  const gitReason = dangerousGitCommand(command);
+  if (gitReason) return `BLOCKED: ${gitReason}. Use a safer approach or ask the user.`;
+
+  if (!opts.hasRepo) return null;
+
+  const pushBranch = opts.branchFor(command.length) ?? "unknown";
+  if (/git\s+push/.test(command) && !opts.landMode && protectedPushTarget(command, pushBranch)) {
+    return "BLOCKED: Direct push to protected branch. Use kickoff-branch + release-branch.";
+  }
+
+  if (/git\s+commit/.test(command)) {
+    const commitBranches = [...command.matchAll(/\bgit\s+commit\b/g)].map(
+      (m) => opts.branchFor(m.index ?? 0) ?? "unknown",
+    );
+    const hit = commitBranches.find((b) => (PROTECTED_BRANCHES as readonly string[]).includes(b));
+    if (hit) {
+      return `BLOCKED: Direct commits to '${hit}' are forbidden. Use a feature branch.`;
+    }
+    const msg = extractCommitMessage(command);
+    if (msg) {
+      if (!CONVENTIONAL_RE.test(msg)) {
+        return `BLOCKED: Commit subject '${msg.split("\n")[0]}' must follow Conventional Commits: <type>(<scope>): <subject>.`;
+      }
+      if (msg.split("\n")[0].length > 72) {
+        return "BLOCKED: Commit subject line must be \u226472 characters.";
+      }
+    }
+  }
+  return null;
+}
+
 function protectedPushTarget(command: string, branch: string): boolean {
   if (PROTECTED_BRANCH_RE.test(command)) return true;
   const trimmed = command.trim();
@@ -414,55 +591,17 @@ export default function bigpowers(pi: ExtensionAPI) {
     const { command } = event.input as { command?: string };
     if (!command) return;
 
-    for (const pat of DANGEROUS_PATTERNS) {
-      if (pat.test(command)) {
-        return {
-          block: true,
-          reason: `BLOCKED: '${command}' matches dangerous pattern '${pat}'.`,
-        };
-      }
-    }
-
     const sessionRoot = process.cwd();
-    if (!inGitRepo(sessionRoot)) return;
-    const pushBranch = currentBranch(commandGitCwd(command, command.length, sessionRoot));
-
-    if (/git\s+push/.test(command) && protectedPushTarget(command, pushBranch)) {
-      return {
-        block: true,
-        reason:
-          "BLOCKED: Direct push to protected branch. Use kickoff-branch + release-branch.",
-      };
-    }
-
-    if (/git\s+commit/.test(command)) {
-      const commitBranches = [...command.matchAll(/\bgit\s+commit\b/g)].map((m) =>
-        currentBranch(commandGitCwd(command, m.index ?? 0, sessionRoot)),
-      );
-      const hit = commitBranches.find((b) =>
-        (PROTECTED_BRANCHES as readonly string[]).includes(b),
-      );
-      if (hit) {
-        return {
-          block: true,
-          reason: `BLOCKED: Direct commits to '${hit}' are forbidden. Use a feature branch.`,
-        };
-      }
-      const msg = extractCommitMessage(command);
-      if (msg) {
-        if (!CONVENTIONAL_RE.test(msg)) {
-          return {
-            block: true,
-            reason: `BLOCKED: Commit subject '${msg.split("\n")[0]}' must follow Conventional Commits: <type>(<scope>): <subject>.`,
-          };
-        }
-        if (msg.split("\n")[0].length > 72) {
-          return {
-            block: true,
-            reason: "BLOCKED: Commit subject line must be ≤72 characters.",
-          };
-        }
-      }
-    }
+    const verdict = evaluateBashCall(command, {
+      landMode: process.env.GIT_BIGPOWERS_LAND === "1",
+      // `undefined` means "there is no repo here"; the guard then only judges
+      // the argv rules, which need no branch.
+      branchFor: (upTo: number) =>
+        inGitRepo(sessionRoot)
+          ? currentBranch(commandGitCwd(command, upTo, sessionRoot))
+          : undefined,
+      hasRepo: inGitRepo(sessionRoot),
+    });
+    if (verdict) return { block: true, reason: verdict };
   });
 }

package/hooks/pre/bash.sh

@@ -11,7 +11,8 @@ INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.command // .tool_input.command // empty' 2>/dev/null || true)
 [ -z "$COMMAND" ] && exit 0
 
-DANGEROUS_PATTERNS=(
+# Last-resort literals, used only when the normalizer is unreachable.
+LEGACY_DANGEROUS=(
   "git reset --hard"
   "git clean -f"
   "git branch -D"
@@ -19,18 +20,64 @@ DANGEROUS_PATTERNS=(
   "push -f"
 )
 PROTECTED_BRANCHES=("main" "master")
+COMMIT_MSG_RE='-m[[:space:]]+"([^"]+)"'
 CONVENTIONAL_RE='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([^)]+\))?!?:[[:space:]].+'
 
-for p in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$COMMAND" | grep -qE "$p"; then
-    printf '{"decision":"block","reason":"BLOCKED: dangerous pattern %q"}\n' "$p"
-    exit 0
+# --- Normalized git argv (BUG-2026-11-03-guard-git-flag-normalize, #184) ------
+# Literal substring matching cannot see a global flag in front of the subcommand
+# or a flag between the subcommand and the destructive option: the destructive
+# tokens are all still there, only their position changed. The rules live in
+# scripts/lib/git-argv.py and are mirrored in extensions/omp-hooks.ts;
+# scripts/test-guard-git-normalize.sh fails if the two disagree on any fixture.
+SELF_PATH="${BASH_SOURCE[0]}"
+# Only pay for realpath when the hook actually is a symlink (installed copies).
+# This hook runs on every tool call, so a spawn per invocation is real latency.
+if [ -L "$SELF_PATH" ] && command -v python3 >/dev/null 2>&1; then
+  SELF_PATH="$(python3 -c 'import os,sys;print(os.path.realpath(sys.argv[1]))' "$SELF_PATH" 2>/dev/null || echo "$SELF_PATH")"
+fi
+GUARD_ROOT="$(cd "$(dirname "$SELF_PATH")/.." 2>/dev/null && pwd -P || true)"
+GIT_ARGV="$GUARD_ROOT/scripts/lib/git-argv.py"
+
+# classify_git_argv <command>: echoes "block: <reason>" or nothing.
+# Fast path: a command with no "git" token cannot contain a git invocation, so
+# the helper (a python start) is skipped. Falls back to the legacy literal
+# patterns when the helper is unreachable (hook symlinked outside the package).
+classify_git_argv() {
+  local cmd="$1" out=""
+  case "$cmd" in
+    *git*) ;;
+    *) return 0 ;;
+  esac
+  if command -v python3 >/dev/null 2>&1 && [ -f "$GIT_ARGV" ]; then
+    out="$(python3 "$GIT_ARGV" --command "$cmd" 2>/dev/null || true)"
+    case "$out" in
+      block:*) printf '%s' "$out"; return 0 ;;
+      *) return 0 ;;
+    esac
   fi
-done
+  return 0
+}
+
+GIT_VERDICT="$(classify_git_argv "$COMMAND")"
+if [ -n "$GIT_VERDICT" ]; then
+  printf '{"decision":"block","reason":"BLOCKED: %s"}\n' "${GIT_VERDICT#block: }"
+  exit 0
+fi
+if [ ! -f "$GIT_ARGV" ]; then
+  for p in "${LEGACY_DANGEROUS[@]}"; do
+    if echo "$COMMAND" | grep -qE "$p"; then
+      printf '{"decision":"block","reason":"BLOCKED: dangerous pattern %q"}\n' "$p"
+      exit 0
+    fi
+  done
+fi
 
 if [[ "$COMMAND" =~ git[[:space:]]+commit ]]; then
   MSG=""
-  if [[ "$COMMAND" =~ -m[[:space:]]+"([^"]+)" ]]; then MSG="${BASH_REMATCH[1]}"; fi
+  # Parentheses inside [[ =~ ]] must come from a variable, not the literal
+  # pattern: bash parses `([^"]+)` as a syntax error (pre-existing since #118,
+  # so this fallback hook never ran; BUG-2026-11-03-guard-git-flag-normalize).
+  if [[ "$COMMAND" =~ $COMMIT_MSG_RE ]]; then MSG="${BASH_REMATCH[1]}"; fi
   if [ -n "$MSG" ] && [[ ! "$MSG" =~ $CONVENTIONAL_RE ]]; then
     echo '{"decision":"block","reason":"BLOCKED: Conventional Commits required"}'
     exit 0

package/hooks/pre-tool-use.sh

@@ -11,16 +11,13 @@ set -euo pipefail
 
 # Configuration
 PROTECTED_BRANCHES=("main" "master")
-DANGEROUS_PATTERNS=(
+# Last-resort literals, used only when the normalizer is unreachable.
+LEGACY_DANGEROUS=(
   "git reset --hard"
-  "git clean -fd"
   "git clean -f"
   "git branch -D"
-  "git checkout \\."
-  "git restore \\."
   "push --force"
   "push -f"
-  "reset --hard"
 )
 CONVENTIONAL_COMMITS_REGEX='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?:[[:space:]].+'
 LAND_MODE="${GIT_BIGPOWERS_LAND:-}"
@@ -29,6 +26,41 @@ LAND_MODE="${GIT_BIGPOWERS_LAND:-}"
 # GIT_GUARDRAILS_MODE: claude (default) | cursor | gemini
 MODE="${GIT_GUARDRAILS_MODE:-claude}"
 
+# --- Normalized git argv (BUG-2026-11-03-guard-git-flag-normalize, #184) ------
+# Literal substring matching cannot see a global flag in front of the subcommand
+# or a flag between the subcommand and the destructive option: the destructive
+# tokens are all still there, only their position changed. The rules live in
+# scripts/lib/git-argv.py and are mirrored in extensions/omp-hooks.ts;
+# scripts/test-guard-git-normalize.sh fails if the two disagree on any fixture.
+SELF_PATH="${BASH_SOURCE[0]}"
+# Only pay for realpath when the hook actually is a symlink (installed copies).
+# This hook runs on every tool call, so a spawn per invocation is real latency.
+if [ -L "$SELF_PATH" ] && command -v python3 >/dev/null 2>&1; then
+  SELF_PATH="$(python3 -c 'import os,sys;print(os.path.realpath(sys.argv[1]))' "$SELF_PATH" 2>/dev/null || echo "$SELF_PATH")"
+fi
+GUARD_ROOT="$(cd "$(dirname "$SELF_PATH")/.." 2>/dev/null && pwd -P || true)"
+GIT_ARGV="$GUARD_ROOT/scripts/lib/git-argv.py"
+
+# classify_git_argv <command>: echoes "block: <reason>" or nothing.
+# Fast path: a command with no "git" token cannot contain a git invocation, so
+# the helper (a python start) is skipped. Falls back to the legacy literal
+# patterns when the helper is unreachable (hook symlinked outside the package).
+classify_git_argv() {
+  local cmd="$1" out=""
+  case "$cmd" in
+    *git*) ;;
+    *) return 0 ;;
+  esac
+  if command -v python3 >/dev/null 2>&1 && [ -f "$GIT_ARGV" ]; then
+    out="$(python3 "$GIT_ARGV" --command "$cmd" 2>/dev/null || true)"
+    case "$out" in
+      block:*) printf '%s' "$out"; return 0 ;;
+      *) return 0 ;;
+    esac
+  fi
+  return 0
+}
+
 deny() {
   local reason="$1"
   if [ "$MODE" = "gemini" ]; then
@@ -72,12 +104,18 @@ if [ -z "$COMMAND" ]; then
   exit 0
 fi
 
-# 1. Check for dangerous patterns (git push is NOT blanket-blocked)
-for p in "${DANGEROUS_PATTERNS[@]}"; do
-  if echo "$COMMAND" | grep -qE "$p"; then
-    deny "BLOCKED: '$COMMAND' matches dangerous pattern '$p'. Use a safer approach or ask the user."
-  fi
-done
+# 1. Normalized git argv (git push is NOT blanket-blocked)
+GIT_VERDICT="$(classify_git_argv "$COMMAND")"
+if [ -n "$GIT_VERDICT" ]; then
+  deny "BLOCKED: ${GIT_VERDICT#block: }. Use a safer approach or ask the user."
+fi
+if [ ! -f "$GIT_ARGV" ]; then
+  for p in "${LEGACY_DANGEROUS[@]}"; do
+    if echo "$COMMAND" | grep -qE "$p"; then
+      deny "BLOCKED: '$COMMAND' matches dangerous pattern '$p'. Use a safer approach or ask the user."
+    fi
+  done
+fi
 
 # 2. Check for git commit / git push
 if [[ "$COMMAND" =~ git[[:space:]]+commit ]] || [[ "$COMMAND" =~ git[[:space:]]+push ]]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.91.0",
+  "version": "2.91.1",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/lib/git-argv.py

@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""Normalize git argv before applying the guard-git deny rules (#184).
+
+The old guard matched literal substrings, so `git -C repo reset --hard`,
+`git reset -q --hard` and `git checkout -- .` all slipped through: the
+destructive tokens are still there, only their position or a global flag
+changed. Matching on the raw command string cannot see that.
+
+This module tokenizes the command (quote-aware), finds every `git` invocation,
+strips the global options that precede the subcommand (`-C <path>`,
+`--no-pager`, `-c k=v`, `--git-dir=…`, …), and then decides on the
+(subcommand, arguments) pair. `extensions/omp-hooks.ts` implements the same
+rules in TypeScript; `scripts/test-guard-git-normalize.sh` fails if the two
+disagree on any fixture row.
+
+Rule table (keep in sync with the TS port):
+
+  reset     block when any argument is --hard
+  clean     block when any short flag carries `f` (-f, -fd, -fdx) or --force
+  branch    block on -D, or on --delete together with --force/-f
+  checkout  block on -f/--force, or on a `.` pathspec (with or without --)
+  restore   block on --worktree, or on a `.` pathspec
+  push      block on -f/--force/+refspec, unless --force-with-lease is given
+
+CLI:  git-argv.py --command "<shell command>"   → prints `block: <reason>` or `allow`
+Exit: 0 allow, 10 block, 2 usage error.
+"""
+from __future__ import annotations
+
+import shlex
+import sys
+
+# Global options that consume the next token as their value.
+VALUE_FLAGS = {
+    "-C",
+    "-c",
+    "--exec-path",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--super-prefix",
+    "--config-env",
+}
+
+# Global options that stand alone.
+BARE_FLAGS = {
+    "-p",
+    "--paginate",
+    "--no-pager",
+    "--bare",
+    "--no-replace-objects",
+    "--literal-pathspecs",
+    "--glob-pathspecs",
+    "--icase-pathspecs",
+    "--no-optional-locks",
+    "--version",
+    "--help",
+}
+
+# Command separators: the guard judges each git invocation on its own.
+SEPARATORS = {";", "&&", "||", "|", "&", "(", ")", "\n"}
+
+
+def tokenize(command: str) -> list[str]:
+    """Quote-aware split. Bad quoting degrades to whitespace splitting, never to eval."""
+    try:
+        return shlex.split(command, comments=False, posix=True)
+    except ValueError:
+        return command.split()
+
+
+def git_invocations(tokens: list[str]) -> list[tuple[str, list[str], int]]:
+    """Yield (subcommand, args, index) for every git call in the token stream."""
+    found: list[tuple[str, list[str], int]] = []
+    i = 0
+    while i < len(tokens):
+        token = tokens[i]
+        if token.rsplit("/", 1)[-1] != "git":
+            i += 1
+            continue
+        start = i
+        j = i + 1
+        # Skip global options between `git` and the subcommand.
+        while j < len(tokens):
+            opt = tokens[j]
+            if opt in SEPARATORS:
+                break
+            name = opt.split("=", 1)[0]
+            if name in VALUE_FLAGS:
+                j += 2 if "=" not in opt else 1
+                continue
+            if name in BARE_FLAGS or (opt.startswith("-") and not opt.startswith("--") and len(opt) > 1):
+                j += 1
+                continue
+            break
+        if j >= len(tokens) or tokens[j] in SEPARATORS:
+            i = j + 1
+            continue
+        sub = tokens[j]
+        args: list[str] = []
+        k = j + 1
+        while k < len(tokens) and tokens[k] not in SEPARATORS:
+            args.append(tokens[k])
+            k += 1
+        found.append((sub, args, start))
+        i = k
+    return found
+
+
+def _short_flag_has(args: list[str], letter: str) -> bool:
+    for arg in args:
+        if arg.startswith("-") and not arg.startswith("--") and letter in arg[1:]:
+            return True
+    return False
+
+
+def classify_git(sub: str, args: list[str]) -> str | None:
+    """Return a block reason, or None to allow."""
+    if sub == "reset" and "--hard" in args:
+        return "git reset --hard discards uncommitted work"
+    if sub == "clean" and (_short_flag_has(args, "f") or "--force" in args):
+        return "git clean -f deletes untracked files"
+    if sub == "branch":
+        forced = "-D" in args or ("--delete" in args and ("--force" in args or _short_flag_has(args, "f")))
+        if forced:
+            return "git branch -D deletes an unmerged branch"
+    if sub == "checkout":
+        if "-f" in args or "--force" in args:
+            return "git checkout -f discards local changes"
+        if "." in args:
+            return "git checkout . discards local changes"
+    if sub == "restore":
+        if "--worktree" in args or "." in args:
+            return "git restore discards local changes"
+    if sub == "push":
+        leased = any(a == "--force-with-lease" or a.startswith("--force-with-lease=") for a in args)
+        forced = (
+            "-f" in args
+            or "--force" in args
+            or any(a.startswith("+") and not a.startswith("++") for a in args)
+        )
+        if forced and not leased:
+            return "force push rewrites remote history"
+    return None
+
+
+def classify(command: str) -> str | None:
+    for sub, args, _idx in git_invocations(tokenize(command)):
+        reason = classify_git(sub, args)
+        if reason:
+            return reason
+    return None
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) == 3 and argv[1] == "--command":
+        reason = classify(argv[2])
+        if reason:
+            print(f"block: {reason}")
+            return 10
+        print("allow")
+        return 0
+    print(__doc__, file=sys.stderr)
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))

package/scripts/lib/golden-suite-gates.sh

@@ -76,6 +76,8 @@ GOLDEN_GATES=(
   "import-boundaries:bash scripts/check-import-boundaries.sh:false"
   "security-dashboard-render:node tests/security/dashboard-render.cjs:false"
   "skill-catalog:bash scripts/validate-skill-catalog.sh:false"
+  # Guard-git judges git argv, not substrings; shell and TS must agree (#184).
+  "guard-git-normalize:bash scripts/test-guard-git-normalize.sh:false"
   "specs-parse:bash scripts/validate-specs-yaml.sh:false"
   # The runner itself: failing output is shown, skips are named and reasoned.
   "golden-gate-runner:bash scripts/test-golden-gate-runner.sh:false"