claude-code-arcane 2.11.0 → 2.13.0

package/docs/USER-GUIDE.md

@@ -2,7 +2,7 @@
 
 ## What is Arcane?
 
-Arcane is a configuration harness for [Claude Code](https://docs.anthropic.com/en/docs/claude-code). It provides a curated library of **437 skills**, **115 agents**, **17 hooks**, and **33 rules** that you selectively deploy into any project. Instead of shipping everything to every project (wasting tokens and degrading performance), you pick a **profile** that matches your stack and only the relevant tools get installed.
+Arcane is a configuration harness for [Claude Code](https://docs.anthropic.com/en/docs/claude-code). It provides a curated library of **437 skills**, **115 agents**, **16 hooks**, and **36 rules** that you selectively deploy into any project. Instead of shipping everything to every project (wasting tokens and degrading performance), you pick a **profile** that matches your stack and only the relevant tools get installed.
 
 ## Table of Contents
 
@@ -238,10 +238,10 @@ Every installation automatically loads `core.yaml` first:
 | Category | Contents |
 |----------|----------|
 | **Skills (21)** | commit, create-pr, changelog, check, code-review, context-prime, help, start, fix-issue, hotfix, brainstorm, scope-check, reverse-document, skill-improve, skill-test, tech-debt, arcane-status, arcane-list, arcane-add, arcane-remove, arcane-clean |
-| **Rules (3)** | data-files, prototype-code, test-standards |
-| **Hooks (15)** | session-start, detect-division, detect-gaps, validate-commit, validate-push, validate-secrets, validate-assets, validate-skill-change, notify, pre-compact, post-compact, session-stop, log-agent, log-agent-stop |
+| **Rules (8)** | data-files, prototype-code, test-standards, implementation-workflow, code-comments, verification, agent-delegation, git-worktrees |
+| **Hooks (15)** | session-start, detect-division, detect-unreal, detect-gaps, check-update, guard, validate-commit, validate-assets, validate-skill-change, notify, pre-compact, post-compact, session-stop, log-agent, log-agent-stop |
 | **Agents (1 dir)** | quality |
-| **Permissions** | 9 allow (git, ls, gh, curl) + 14 deny (rm -rf, force push, sudo, .env, etc.) |
+| **Permissions** | 15 allow (git, ls, gh pr/issue/run and read-only gh, curl) + 13 deny (force push, reset --hard, clean -f, sudo, .env, etc.) |
 
 ---
 

package/docs/directory-structure.md

@@ -122,11 +122,16 @@ Los eventos los define `src/installer.ts` al generar `settings.json`, no los pro
 | Evento | Hooks |
 |--------|-------|
 | SessionStart | `session-start.sh` → `detect-division.sh` → `detect-unreal.sh` → `detect-gaps.sh` → `check-update.sh` |
-| PreToolUse (`Bash`) | `validate-commit.sh`, `validate-push.sh`, `validate-secrets.sh` |
+| PreToolUse (`Bash`) | `guard.sh` → `validate-commit.sh` |
+| PreToolUse (`Write\|Edit\|MultiEdit\|NotebookEdit`) | `guard.sh` |
 | PostToolUse (`Write\|Edit`) | `validate-assets.sh`, `validate-skill-change.sh` |
 | Notification | `notify.sh` |
 | PreCompact / PostCompact | `pre-compact.sh` / `post-compact.sh` |
 | Stop | `session-stop.sh` |
 | SubagentStart / SubagentStop | `log-agent.sh` / `log-agent-stop.sh` |
 
+Cada comando es `bash "$CLAUDE_PROJECT_DIR/.claude/hooks/<script>"`: dentro de un worktree los hooks corren parados en el worktree, que puede no tener `.claude/hooks/` commiteado, y la variable siempre apunta al proyecto donde arrancó la sesión. `arcane update` migra las instalaciones que tenían la ruta relativa.
+
+`guard.sh` corre `guard.py` (Python stdlib): deniega lo que el usuario ejecuta a mano (force push, `--no-verify`, `sudo`, escribir `.env`), pregunta antes de lo destructivo (`rm -rf` fuera de carpetas regenerables, borrar datos, una dependencia nueva) y al editar CI, infra, migraciones existentes, manifests o configs de lint. Sin Python no hace nada y quedan solo los permisos estáticos.
+
 La statusline (`statusline.sh`) se configura aparte, solo con el profile `statusline`.

package/hooks/guard.py

@@ -0,0 +1,445 @@
+#!/usr/bin/env python3
+"""PreToolUse guard for Bash and file-writing tools.
+
+Reads the hook payload on stdin and answers with a permission decision:
+  deny - actions the user runs by hand if they really want them (force push,
+         bypassing git hooks, sudo, writing .env files ...)
+  ask  - destructive or supply-chain-sensitive actions (rm -rf outside build
+         output, dropping data, a new dependency, editing CI or lint configs ...)
+  none - everything else; the normal permission rules decide.
+
+The command is parsed quote-aware and split on && || ; | so a chained or
+quoted command cannot hide a match the old grep-based hooks missed. This is a
+guard against mistakes, not a sandbox: a script or an interpreter one-liner
+can still do anything.
+
+It replaces validate-push.sh and validate-secrets.sh, whose substring checks
+also fired on text inside arguments. `guard.py --command` only prints the Bash
+command from the payload; validate-commit.sh uses it instead of a regex.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import shlex
+import sys
+from fnmatch import fnmatch
+
+DENY, ASK, NONE = "deny", "ask", None
+RANK = {DENY: 2, ASK: 1, NONE: 0}
+
+# Build output that a command regenerates; rm -rf on these alone never asks.
+REGENERABLE = {
+    "node_modules", "dist", "build", ".next", "out", "coverage",
+    "__pycache__", ".pytest_cache", "Library", "Temp", "obj",
+    "Binaries", "Intermediate", "DerivedDataCache",
+}
+
+SEPARATORS = {"&&", "||", ";", "|", "&", "(", ")", "|&", ";;"}
+WRAPPERS = {"command", "exec", "time", "nohup", "env", "builtin", "nice"}
+DB_CLIENTS = {
+    "psql", "mysql", "mariadb", "sqlite3", "sqlcmd", "mongo", "mongosh",
+    "redis-cli", "cockroach", "clickhouse-client", "duckdb",
+}
+DATA_LOSS_SQL = [
+    (r"\bDROP\s+(TABLE|DATABASE|SCHEMA)\b", "drops a table, database or schema"),
+    (r"\bTRUNCATE\b", "truncates a table"),
+    (r"\bFLUSH(ALL|DB)\b", "flushes Redis"),
+    (r"\.dropDatabase\s*\(", "drops a MongoDB database"),
+]
+# (programs that run it, pattern over the segment, reason). Scoped to the program so
+# a commit message that merely mentions "terraform destroy" does not match.
+TEXT_RULES = [
+    ({"prisma"}, r"\bmigrate\s+reset\b", "resets the database (prisma migrate reset)"),
+    ({"supabase"}, r"\bdb\s+reset\b", "resets the database (supabase db reset)"),
+    ({"dotnet"}, r"\bef\s+database\s+drop\b", "drops the database (dotnet ef database drop)"),
+    ({"php", "rails", "rake", "bundle", "knex", "sequelize", "sequelize-cli"},
+     r"\b(migrate|db):(rollback|reset|fresh|undo|drop)\b|\bdb:migrate:undo\b", "rolls back or drops the database"),
+    ({"alembic"}, r"\bdowngrade\b", "rolls back migrations (alembic downgrade)"),
+    ({"goose", "migrate"}, r"\sdown\b", "rolls back migrations"),
+    ({"docker"}, r"\bsystem\s+prune\b", "deletes Docker data (system prune)"),
+    ({"docker"}, r"\bvolume\s+(rm|prune)\b", "deletes Docker volumes"),
+    ({"docker", "docker-compose"}, r"\bdown\b.*\s(-v|--volumes)\b", "deletes the compose volumes (database data)"),
+    ({"terraform", "tofu", "pulumi"}, r"\bdestroy\b", "destroys infrastructure"),
+    ({"kubectl"}, r"\bdelete\b", "deletes Kubernetes resources"),
+    ({"helm"}, r"\b(uninstall|delete)\b", "uninstalls a Helm release"),
+    ({"npm", "pnpm", "yarn"}, r"^\S+\s+(publish|unpublish)\b", "publishes or unpublishes a package"),
+]
+# Launchers whose first argument is the real program (npx prisma ..., pnpm exec knex ...).
+LAUNCHERS = {"npx", "pnpx", "bunx", "pnpm", "yarn", "npm", "bun", "uv", "uvx", "poetry"}
+
+ENV_FILE = re.compile(r"^\.env(\..+)?$")
+READERS = {"cat", "type", "less", "more", "head", "tail", "bat", "nl", "strings", "grep", "rg"}
+ENV_SAFE_SUFFIXES = (".example", ".sample", ".template", ".dist")
+
+# Write/Edit targets, matched against the path relative to the project root.
+ASK_ALWAYS = [
+    (".github/workflows/*", "edits a CI workflow, which runs with the repo's secrets"),
+    ("infra/*", "edits infrastructure code"),
+    ("terraform/*", "edits infrastructure code"),
+    ("*.tf", "edits infrastructure code"),
+    ("*.tfvars", "edits infrastructure variables"),
+]
+ASK_IF_EXISTS = [
+    ("migrations/*", "edits an existing migration; shipped migrations are immutable"),
+    ("*/migrations/*", "edits an existing migration; shipped migrations are immutable"),
+    ("alembic/versions/*", "edits an existing migration; shipped migrations are immutable"),
+    ("db/migrate/*", "edits an existing migration; shipped migrations are immutable"),
+]
+MANIFESTS = {
+    "package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lockb",
+    "requirements.txt", "pyproject.toml", "poetry.lock", "uv.lock", "Pipfile", "Pipfile.lock",
+    "go.mod", "go.sum", "Cargo.toml", "Cargo.lock", "Gemfile", "Gemfile.lock",
+    "composer.json", "composer.lock", "packages.lock.json",
+}
+MANIFEST_GLOBS = ["requirements*.txt", "*.csproj", "Directory.Packages.props", "Packages/manifest.json"]
+CHECK_CONFIGS = [
+    ".eslintrc*", "eslint.config.*", ".prettierrc*", "prettier.config.*", "tsconfig*.json",
+    "biome.json", "biome.jsonc", ".golangci.y*ml", ".golangci.toml", "ruff.toml", ".ruff.toml",
+    ".flake8", ".stylelintrc*", "stylelint.config.*", ".editorconfig",
+]
+
+
+# --- command parsing -------------------------------------------------------
+
+def strip_heredoc_bodies(command: str) -> str:
+    """Drop heredoc bodies: their text is data (a commit message), not commands."""
+    return re.sub(
+        r"<<-?\s*(['\"]?)(\w+)\1([^\n]*)\n.*?\n\s*\2\s*(?=\n|$|\))",
+        r"<<\2\3",
+        command,
+        flags=re.S,
+    )
+
+
+def newlines_to_separators(command: str) -> str:
+    out, quote = [], None
+    for ch in command:
+        if quote:
+            if ch == quote:
+                quote = None
+        elif ch in "'\"":
+            quote = ch
+        elif ch == "\n":
+            ch = ";"
+        out.append(ch)
+    return "".join(out)
+
+
+def tokenize(command: str) -> list[str]:
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        return list(lexer)
+    except ValueError:  # unbalanced quotes: fall back to a plain split
+        return re.findall(r"&&|\|\||[;|&()]|[^\s;|&()]+", command)
+
+
+def segments(command: str) -> list[list[str]]:
+    command = newlines_to_separators(strip_heredoc_bodies(command))
+    result, current = [], []
+    for token in tokenize(command):
+        if token in SEPARATORS:
+            if current:
+                result.append(current)
+            current = []
+        else:
+            current.append(token)
+    if current:
+        result.append(current)
+    return result
+
+
+def nested_commands(tokens: list[str]) -> list[str]:
+    """Command strings run by this segment: bash -c "...", eval "...", $(...)."""
+    found = []
+    for i, token in enumerate(tokens):
+        if os.path.basename(token) in ("bash", "sh", "zsh") and i + 2 < len(tokens) and tokens[i + 1] == "-c":
+            found.append(tokens[i + 2])
+        if token == "eval" and i + 1 < len(tokens):
+            found.append(" ".join(tokens[i + 1:]))
+        found.extend(re.findall(r"\$\(([^()]*)\)", token))
+        found.extend(re.findall(r"`([^`]*)`", token))
+    return found
+
+
+def program(tokens: list[str]) -> tuple[str, list[str]]:
+    """Strip env assignments and wrappers; return (basename, args)."""
+    i = 0
+    while i < len(tokens):
+        token = tokens[i]
+        if re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", token) or os.path.basename(token) in WRAPPERS:
+            i += 1
+            continue
+        break
+    if i >= len(tokens):
+        return "", []
+    name = os.path.basename(tokens[i]).lower()
+    if name.endswith(".exe"):
+        name = name[:-4]
+    return name, tokens[i + 1:]
+
+
+def effective_program(name: str, args: list[str]) -> str:
+    """`npx prisma migrate reset` runs prisma; `php artisan migrate:fresh` runs php."""
+    if name not in LAUNCHERS:
+        return name
+    rest = [a for a in args if not a.startswith("-")]
+    if rest[:1] and rest[0] in ("exec", "dlx", "run", "x"):
+        rest = rest[1:]
+    return os.path.basename(rest[0]).lower() if rest else name
+
+
+def short_flags(args: list[str]) -> set[str]:
+    letters = set()
+    for arg in args:
+        if arg.startswith("-") and not arg.startswith("--") and len(arg) > 1:
+            letters.update(arg[1:])
+    return letters
+
+
+def positional(args: list[str], takes_value: set[str] = frozenset()) -> list[str]:
+    out, skip = [], False
+    for arg in args:
+        if skip:
+            skip = False
+            continue
+        if arg in takes_value:
+            skip = True
+            continue
+        if not arg.startswith("-"):
+            out.append(arg)
+    return out
+
+
+# --- rules -----------------------------------------------------------------
+
+def check_git(args: list[str]) -> tuple[str | None, str]:
+    i = 0
+    while i < len(args) and args[i].startswith("-"):
+        if args[i] == "-c" and i + 1 < len(args):
+            if args[i + 1].lower().startswith("core.hookspath"):
+                return DENY, "git -c core.hooksPath= bypasses the repository's git hooks"
+            i += 2
+        elif args[i] in ("-C", "--git-dir", "--work-tree") and i + 1 < len(args):
+            i += 2
+        else:
+            i += 1
+    if i >= len(args):
+        return NONE, ""
+    sub, rest = args[i], args[i + 1:]
+    flags = short_flags(rest)
+
+    if "--no-verify" in rest and sub in ("commit", "push", "merge", "rebase", "cherry-pick", "am"):
+        return DENY, "--no-verify skips the git hooks; fix what they report instead"
+    if sub == "commit" and "n" in flags:
+        return DENY, "git commit -n skips the git hooks; fix what they report instead"
+    if sub == "push":
+        forced = any(a == "--force" or a.startswith("--force-") for a in rest) or "f" in flags
+        if forced or any(a.startswith("+") for a in rest):
+            return DENY, ("Force push is blocked. If it is really needed, ask the user to run it "
+                          "themselves: `! git push --force-with-lease`")
+        if "--delete" in rest or "d" in flags or any(a.startswith(":") and len(a) > 1 for a in rest):
+            return ASK, "deletes a remote branch or tag"
+    if sub == "reset" and "--hard" in rest:
+        return DENY, "git reset --hard throws away uncommitted work; the user runs it by hand"
+    if sub == "clean" and ("f" in flags or "--force" in rest):
+        return DENY, "git clean -f deletes untracked files; the user runs it by hand"
+    whole_tree = any(a in (".", ":/", "*", ":/*") for a in rest)
+    if sub == "checkout" and (whole_tree or "f" in flags or "--force" in rest):
+        return ASK, "discards uncommitted changes (git checkout)"
+    if sub == "restore" and whole_tree and not ("--staged" in rest and "--worktree" not in rest):
+        return ASK, "discards uncommitted changes (git restore)"
+    if sub == "stash" and rest[:1] and rest[0] in ("drop", "clear"):
+        return ASK, "deletes stashed work"
+    if sub == "branch" and ("D" in flags or ("--delete" in rest and "--force" in rest)):
+        return ASK, "force-deletes a branch without checking it is merged"
+    if sub == "tag" and ("d" in flags or "--delete" in rest):
+        return ASK, "deletes a tag"
+    if sub in ("filter-repo", "filter-branch"):
+        return ASK, "rewrites the repository history"
+    return NONE, ""
+
+
+def check_rm(args: list[str]) -> tuple[str | None, str]:
+    flags = short_flags(args)
+    recursive = bool(flags & {"r", "R"}) or "--recursive" in args
+    force = "f" in flags or "--force" in args
+    if not (recursive and force):
+        return NONE, ""
+    targets = positional(args)
+    safe = targets and all(
+        not t.startswith(("/", "~")) and not re.match(r"^[A-Za-z]:", t)
+        and ".." not in re.split(r"[/\\]", t) and "*" not in t
+        and os.path.basename(t.rstrip("/\\")) in REGENERABLE
+        for t in targets
+    )
+    if safe:
+        return NONE, ""
+    return ASK, f"recursively force-deletes {', '.join(targets) or 'files'}"
+
+
+def check_new_dependency(name: str, args: list[str]) -> tuple[str | None, str]:
+    packages: list[str] = []
+    if name in ("npm", "pnpm", "yarn", "bun") and args:
+        sub, rest = args[0], args[1:]
+        if sub in ("add",) or (name in ("npm", "pnpm") and sub in ("install", "i", "in", "ins")):
+            packages = positional(rest)
+    elif name in ("pip", "pip3") and args[:1] == ["install"]:
+        packages = pip_packages(args[1:])
+    elif name in ("python", "python3", "py") and args[:3] == ["-m", "pip", "install"]:
+        packages = pip_packages(args[3:])
+    elif name == "uv" and args[:2] == ["pip", "install"]:
+        packages = pip_packages(args[2:])
+    elif name in ("uv", "poetry", "cargo") and args[:1] == ["add"]:
+        packages = positional(args[1:])
+    elif name == "go" and args[:1] == ["get"]:
+        packages = [p for p in positional(args[1:]) if not p.startswith(".")]
+    elif name == "dotnet" and args[:2] == ["add", "package"]:
+        packages = positional(args[2:])
+    if not packages:
+        return NONE, ""
+    return ASK, (f"adds a new dependency: {', '.join(packages)}. Check the exact name before "
+                 "installing: a one-letter typo can install a malicious package")
+
+
+def pip_packages(args: list[str]) -> list[str]:
+    takes_value = {"-r", "--requirement", "-c", "--constraint", "-e", "--editable", "-i",
+                   "--index-url", "--extra-index-url", "-t", "--target", "--prefix", "-f", "--find-links"}
+    return [p for p in positional(args, takes_value)
+            if not (p.startswith((".", "/")) or p.endswith((".whl", ".tar.gz", ".zip")))]
+
+
+def writes_env_file(tokens: list[str]) -> bool:
+    targets = []
+    for i, token in enumerate(tokens):
+        if token in (">", ">>") and i + 1 < len(tokens):
+            targets.append(tokens[i + 1])
+    name, args = program(tokens)
+    if name == "tee":
+        targets.extend(positional(args))
+    return any(is_env_file(t) for t in targets)
+
+
+def is_env_file(path: str) -> bool:
+    base = os.path.basename(path.replace("\\", "/"))
+    return bool(ENV_FILE.match(base)) and not base.endswith(ENV_SAFE_SUFFIXES)
+
+
+def check_segment(tokens: list[str], depth: int = 0) -> tuple[str | None, str]:
+    name, args = program(tokens)
+    text = " ".join(tokens)
+    decisions = []
+
+    if name == "sudo":
+        decisions.append((DENY, "sudo is blocked; the user runs privileged commands by hand"))
+    if name == "chmod" and any(a in ("777", "0777") for a in args):
+        decisions.append((DENY, "chmod 777 makes files writable by everyone"))
+    if writes_env_file(tokens):
+        decisions.append((DENY, "writing a .env file is blocked; the user edits secrets by hand"))
+    if name in READERS and any(is_env_file(a) for a in positional(args)):
+        decisions.append((DENY, "reading a .env file would put its secrets in the conversation"))
+    if name == "git":
+        decisions.append(check_git(args))
+    if name == "rm":
+        decisions.append(check_rm(args))
+    if name == "gh":
+        if args[:2] in (["repo", "delete"], ["release", "delete"], ["secret", "delete"], ["secret", "remove"]):
+            decisions.append((ASK, f"gh {' '.join(args[:2])} deletes data on GitHub"))
+        if args[:1] == ["api"] and re.search(r"(-X|--method)[ =]?\s*DELETE\b", text, re.I):
+            decisions.append((ASK, "gh api DELETE request"))
+    decisions.append(check_new_dependency(name, args))
+    if DB_CLIENTS & {os.path.basename(t).lower() for t in tokens}:
+        for pattern, reason in DATA_LOSS_SQL:
+            if re.search(pattern, text, re.I):
+                decisions.append((ASK, reason))
+        if re.search(r"\bDELETE\s+FROM\b", text, re.I) and not re.search(r"\bWHERE\b", text, re.I):
+            decisions.append((ASK, "DELETE without WHERE removes every row"))
+    runs = {name, effective_program(name, args)}
+    for programs, pattern, reason in TEXT_RULES:
+        if runs & programs and re.search(pattern, text, re.I):
+            decisions.append((ASK, reason))
+    if depth < 3:
+        for inner in nested_commands(tokens):
+            decisions.append(check_command(inner, depth + 1))
+    return worst(decisions)
+
+
+def check_command(command: str, depth: int = 0) -> tuple[str | None, str]:
+    return worst([check_segment(seg, depth) for seg in segments(command)])
+
+
+def worst(decisions: list[tuple[str | None, str]]) -> tuple[str | None, str]:
+    best = (NONE, "")
+    for decision in decisions:
+        if RANK[decision[0]] > RANK[best[0]]:
+            best = decision
+    return best
+
+
+def check_file(path: str, root: str) -> tuple[str | None, str]:
+    if not path:
+        return NONE, ""
+    absolute = os.path.abspath(os.path.join(root, path))
+    rel = os.path.relpath(absolute, root).replace("\\", "/")
+    if rel.startswith("../"):
+        return NONE, ""
+    rel = re.sub(r"^\.claude/worktrees/[^/]+/", "", rel)
+    base = os.path.basename(rel)
+
+    if is_env_file(base):
+        return DENY, "writing a .env file is blocked; the user edits secrets by hand"
+    for pattern, reason in ASK_ALWAYS:
+        if fnmatch(rel, pattern):
+            return ASK, reason
+    if not os.path.exists(absolute):
+        return NONE, ""
+    for pattern, reason in ASK_IF_EXISTS:
+        if fnmatch(rel, pattern):
+            return ASK, reason
+    if base in MANIFESTS or any(fnmatch(rel, g) or fnmatch(base, g) for g in MANIFEST_GLOBS):
+        return ASK, "edits a dependency manifest or lockfile"
+    if any(fnmatch(base, g) for g in CHECK_CONFIGS):
+        return ASK, "edits a lint, format or type-check config; fix the code instead of loosening the check"
+    return NONE, ""
+
+
+# --- entry point -----------------------------------------------------------
+
+def decide(payload: dict) -> tuple[str | None, str]:
+    tool = payload.get("tool_name", "")
+    tool_input = payload.get("tool_input") or {}
+    if tool == "Bash":
+        return check_command(tool_input.get("command", ""))
+    if tool in ("Write", "Edit", "MultiEdit", "NotebookEdit"):
+        root = os.environ.get("CLAUDE_PROJECT_DIR") or payload.get("cwd") or os.getcwd()
+        return check_file(tool_input.get("file_path") or tool_input.get("notebook_path", ""), root)
+    return NONE, ""
+
+
+def main() -> int:
+    try:
+        payload = json.loads(sys.stdin.read() or "{}")
+    except ValueError:
+        return 0
+    if "--command" in sys.argv[1:]:
+        print((payload.get("tool_input") or {}).get("command", ""))
+        return 0
+    decision, reason = decide(payload)
+    if decision:
+        print(json.dumps({
+            "hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": decision,
+                "permissionDecisionReason": f"Arcane guard: {reason}.",
+            }
+        }))
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    except Exception:  # a guard bug must never break the user's tool call
+        sys.exit(0)

package/hooks/guard.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# PreToolUse guard (Bash, Write, Edit): see guard.py for the rules.
+#
+# Runs guard.py with the first Python that actually starts. On Windows `python3`
+# can be the Microsoft Store stub, which exits non-zero instead of running, so
+# each candidate is tried in turn. With no working Python the guard does nothing
+# and the static permission rules in settings.json remain the only check.
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+INPUT=$(cat)
+
+for PY in python3 python py; do
+  command -v "$PY" >/dev/null 2>&1 || continue
+  if OUT=$(printf '%s' "$INPUT" | "$PY" "$DIR/guard.py" "$@" 2>/dev/null); then
+    printf '%s' "$OUT"
+    exit 0
+  fi
+done
+exit 0

package/hooks/validate-commit.sh

@@ -5,12 +5,20 @@ main() {
   local INPUT
   INPUT=$(cat 2>/dev/null) || true
 
-  local COMMAND
-  COMMAND=$(echo "$INPUT" | grep -oE '"command"\s*:\s*"[^"]*"' | head -1 | sed 's/.*"command"\s*:\s*"//;s/"$//') || true
+  local COMMAND GUARDED=1
+  # guard.sh parses the JSON properly; the regex is only a fallback without Python
+  # and stops at the first escaped quote.
+  COMMAND=$(printf '%s' "$INPUT" | bash "$(dirname "${BASH_SOURCE[0]}")/guard.sh" --command 2>/dev/null) || true
+  if [[ -z "$COMMAND" ]]; then
+    GUARDED=0
+    COMMAND=$(echo "$INPUT" | grep -oE '"command"\s*:\s*"[^"]*"' | head -1 | sed 's/.*"command"\s*:\s*"//;s/"$//') || true
+  fi
 
   [[ -z "$COMMAND" || "$COMMAND" != *"git commit"* ]] && return 0
 
-  if [[ "$COMMAND" == *"--no-verify"* ]]; then
+  # With Python the guard denies --no-verify on the parsed command; this substring
+  # check would also fire on a commit message that only mentions the flag.
+  if [[ "$GUARDED" == 0 && "$COMMAND" == *"--no-verify"* ]]; then
     echo "BLOCK: --no-verify is not allowed. Fix the underlying issue instead of bypassing hooks." >&2
     exit 2
   fi

package/output-styles/arcane.md

@@ -1,6 +1,6 @@
 ---
 name: arcane
-description: Respuestas compactas, tablas para comparar, lenguaje literal y estructura legible — pensado para lectura con TEA y dislexia.
+description: Respuestas compactas, tablas para comparar, lenguaje literal y estructura legible — pensado para lectura con TEA, TDAH y dislexia.
 ---
 
 # Arcane
@@ -11,8 +11,8 @@ autorizan entregar menos.
 
 ## Largo
 
-- **La respuesta primero.** Primera línea: qué pasó o qué contestás. El detalle va después,
-  para quien lo quiera.
+- **La respuesta o la acción primero.** Primera línea: qué pasó, qué contestás o, si hay algo
+  para hacer, esa acción (un comando, un archivo, una decisión). El detalle va después.
 - **Sin preámbulo.** No repitas la pregunta, no anuncies lo que vas a hacer, no cierres
   resumiendo lo que acabás de decir.
 - **Un tema por párrafo, tres líneas como máximo.** Si un párrafo crece, partilo o pasalo a
@@ -27,12 +27,19 @@ autorizan entregar menos.
 - **Tabla siempre que compares.** Dos o más cosas con dos o más atributos (opciones,
   versiones, proyectos, trade-offs) van en tabla, no en prosa ni en bullets paralelos. Una
   columna por atributo, una fila por cosa.
-- **Listas para pasos y hallazgos.** Prosa solo para el razonamiento que une las cosas.
+- **Pasos numerados, una acción por paso.** La menor cantidad de pasos que funcione; ningún
+  paso dice "y después" dos veces. Prosa solo para el razonamiento que une las cosas.
+- **Cinco ítems como máximo por lista o tabla visible.** Si hay más, agrupalos en secciones
+  con lo más relevante primero. Es solo presentación: nunca descartes un ítem relevante.
 - **Títulos cuando hay más de un tema.** Que se pueda saltar a la parte que importa sin
   leer todo.
 - **`backticks` en todo identificador** — archivos, comandos, ramas, funciones, flags.
 - **Bold para lo importante**, no italics: es más fácil de decodificar. Nunca MAYÚSCULAS
   para enfatizar, deforman la silueta de la palabra.
+- **Página HTML solo para lo que se entiende mejor dibujado.** Si está instalada
+  `answer-me-with-html`, usala para explicar cómo funciona algo, un flujo o una
+  arquitectura, o cuando el usuario pida "dibujalo". Para comparar o listar, alcanza una
+  tabla en la respuesta.
 
 ## Lenguaje
 
@@ -46,8 +53,48 @@ autorizan entregar menos.
   de prosa condicional que deja al lector adivinando el nivel de confianza.
 - **Decí explícitamente qué esperás del otro.** Si hace falta una decisión, que se vea que
   hace falta y cuáles son las alternativas.
+- **Errores sin dramatismo.** Causa y arreglo: "falla en `auth.spec.ts:42`, falta el
+  header", no "uy, algo salió mal".
 
 ## Números y datos
 
 - **El dato antes que el adjetivo.** "62 commits atrás" en vez de "bastante atrasado".
 - **Unidad y fecha completas.** `2026-09-04`, no "ayer"; `312 KB`, no "poco".
+- **El tamaño en unidades contables.** "3 archivos, 2 pasos, 1 PR", no "rápido" ni "un
+  rato". Nada de estimar minutos.
+
+## Seguimiento
+
+- **Decí el estado en tareas de varios pasos.** "Paso 3 de 5 hecho: X. Sigue: Y." Si hay
+  herramienta de tareas, la lista de tareas reemplaza esa narración.
+- **Que lo terminado se vea.** "El login ya funciona: probá `npm run dev` y entrá a
+  `/login`", no "hice algunos cambios".
+- **Sin desvíos.** Si aparece un segundo tema, cerrá el actual y ofrecé el otro aparte, al
+  final. Una duda que surge en el medio, resolvela vos si podés.
+- **Cerrá con una sola acción concreta** que el usuario pueda hacer en poco tiempo, si
+  queda algo abierto.
+
+## Cuándo se rompen estas reglas
+
+1. **"Explicame".** Se explica completo, con títulos. Sigue sin preámbulo ni cierre.
+2. **Algo destructivo por delante.** Confirmá antes de actuar: la seguridad gana a la
+   brevedad.
+3. **Espiral de debug.** Si los últimos 3 turnos fueron "sigue roto", dejá de tocar código.
+   Nombrá la suposición que puede estar mal y hacé una sola pregunta de diagnóstico.
+4. **Pedido ambiguo.** Una pregunta corta antes que adivinar.
+5. **"¿Qué opciones tengo?"** De 2 a 4 opciones con la recomendada primero: las opciones
+   son la respuesta.
+6. **El trabajo del agente lo hace el agente.** No preguntes "¿querés que lo haga?" por algo
+   que te toca hacer. Las decisiones que son del usuario siguen siendo preguntas.
+
+## Antes de enviar
+
+Borrá:
+
+1. La primera oración, si anuncia lo que vas a hacer.
+2. La última, si pregunta "¿algo más?" o resume lo que pasó.
+3. Los "por cierto".
+4. Las dudas de relleno ("quizás", "podría"). Las que expresan incertidumbre real quedan.
+5. Los modismos.
+
+Prueba final: leyendo solo la primera y la última línea, ¿se sabe qué pasó y qué sigue?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-arcane",
-  "version": "2.11.0",
+  "version": "2.13.0",
   "description": "Skills, agents, hooks and rules for Claude Code — installable via npx claude-code-arcane",
   "type": "module",
   "bin": {

package/profiles/audio.yaml

@@ -41,5 +41,4 @@ permissions:
     - "Glob(*)"
     - "Grep(*)"
   deny:
-    - "Bash(rm -rf *)"
     - "Bash(git push --force*)"