jorgex-stack 1.0.11 → 1.0.13

package/dist/cli.js

@@ -492,6 +492,19 @@ function upsertNativeHooks(existing, canonical, scriptsDir, mapMatcher = (m) =>
   });
 }
 
+// src/lib/git-guard.ts
+var DESTRUCTIVE_GIT_DENY = [
+  "git reset*",
+  "git clean*",
+  "git checkout -- *",
+  "git restore*",
+  "git push*--force*",
+  // posición libre: caza "git push origin main --force[-with-lease]"
+  "git push -f*",
+  "git switch*--discard-changes*"
+];
+var GIT_GUARD_SCRIPT = "block-destructive-git.cjs";
+
 // src/adapters/opencode.ts
 function yamlString(value) {
   return JSON.stringify(value);
@@ -530,7 +543,12 @@ var opencodeAdapter = {
       lines.push(`  edit: ${agent.readonly ? "deny" : "allow"}`);
       if (agent.bash === "none") lines.push("  bash: deny");
       else if (agent.bash === "git-read") lines.push('  bash:\n    "git diff*": allow\n    "git log*": allow');
-      else lines.push("  bash: allow");
+      else {
+        const deny = DESTRUCTIVE_GIT_DENY.map((p7) => `    ${yamlString(p7)}: deny`).join("\n");
+        lines.push(`  bash:
+    "*": allow
+${deny}`);
+      }
       if (!agent.spawn) lines.push("  task: deny");
       lines.push("tools:");
       lines.push(`  write: ${agent.readonly ? "false" : "true"}`);
@@ -773,6 +791,16 @@ ${agent.body}`;
     const tools = toolsFor(agent);
     if (tools !== null) lines.push(`tools: ${tools}`);
     lines.push(`model: ${resolveAgentModel(models, agent.name, agent.tier).model}`);
+    if (agent.bash === "full") {
+      lines.push(
+        "hooks:",
+        "  PreToolUse:",
+        '    - matcher: "Bash|PowerShell"',
+        "      hooks:",
+        "        - type: command",
+        `          command: "node \\"{{SCRIPTS_DIR}}/${GIT_GUARD_SCRIPT}\\""`
+      );
+    }
     return [
       {
         file: `${agent.name}.md`,
@@ -827,7 +855,7 @@ ${agent.body}`,
             continue;
           }
           const command = server.command === "{{ENGRAM_BIN}}" ? ctx.engramBin : server.command;
-          servers[name] = { command, args: server.args ?? [] };
+          servers[name] = { type: "stdio", command, args: server.args ?? [] };
         } else {
           const previous = servers[name];
           const headers = {};
@@ -1208,7 +1236,7 @@ function planSystemPrompt(adapter, ctx) {
 // src/components/agents.ts
 import path13 from "path";
 function planAgents(adapter, ctx) {
-  const { agentsDir, commandsDir, outputStylesDir, skillsDir, profilesDir } = adapter.paths(ctx.configDir);
+  const { agentsDir, commandsDir, outputStylesDir, skillsDir, profilesDir, scriptsDir } = adapter.paths(ctx.configDir);
   const dirFor = {
     agent: agentsDir,
     command: commandsDir,
@@ -1216,6 +1244,7 @@ function planAgents(adapter, ctx) {
     skill: skillsDir,
     profile: profilesDir
   };
+  const scriptsBase = scriptsDir.replace(/\\/g, "/");
   return loadCanonicalAgents(path13.join(ctx.stackDir, "agents")).flatMap(
     (agent) => adapter.renderAgent(agent, ctx.models).flatMap((rendered) => {
       const dir = dirFor[rendered.kind];
@@ -1223,7 +1252,8 @@ function planAgents(adapter, ctx) {
         ctx.warnings.push(`${adapter.name}: sin destino para '${rendered.kind}' (${rendered.file}) \u2014 omitido.`);
         return [];
       }
-      return [{ kind: "write", target: path13.join(dir, rendered.file), content: rendered.content }];
+      const content = rendered.content.replace(/\{\{SCRIPTS_DIR\}\}/g, scriptsBase);
+      return [{ kind: "write", target: path13.join(dir, rendered.file), content }];
     })
   );
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI y OpenCode",
   "type": "module",
   "license": "MIT",

package/stack/agents/implementer.md

@@ -13,6 +13,8 @@ You implement real changes. You don't stop at analysis, you don't answer with ju
 
 **Mandatory first action**: load the `agent-delegation` skill.
 
+**Never run destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Commit forward; if you think you need to discard or reset repo state, stop and ask the user.
+
 **Conditional skill**:
 
 - `tdd`: load it when the prompt implies GREEN within a TDD flow.

package/stack/agents/tester.md

@@ -13,6 +13,8 @@ Your job is to describe behavior with tests, fix broken tests, and verify they f
 
 **Mandatory first action**: load the `tdd` and `agent-delegation` skills.
 
+**Never run destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Commit forward; if you think you need to discard or reset repo state, stop and ask the user.
+
 ## Before writing tests
 
 Don't assume a framework. The test command and conventions are often already in your context; when they aren't, detect the real setup of THIS project:

package/stack/agents/translator.md

@@ -13,6 +13,8 @@ You handle translations, multi-language text and integration with the project's
 
 **Mandatory first action**: load the `agent-delegation` skill.
 
+**Never run destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Commit forward; if you think you need to discard or reset repo state, stop and ask the user.
+
 **Final output, last of all**: your final report (ending with the Result contract) must be the very last thing you emit. If you need to save anything to memory, do it BEFORE that output — never after.
 
 ## Scope

package/stack/scripts/block-destructive-git.cjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+// PreToolUse guard (Claude Code): blocks destructive git commands in the
+// subagents that declare it, leaving the main agent unrestricted. Claude Code
+// has no per-subagent command denylist, so this is the documented mechanism
+// (sub-agents docs -> "Conditional rules with hooks"). Reads the PreToolUse
+// payload from stdin and exits 2 to block if any segment of the command would
+// discard work or rewrite history. Best-effort guardrail, not an adversarial
+// sandbox. Fail-open: any read/parse problem allows the command (exit 0) so the
+// guard can never wedge legitimate work — but it logs why, so a silent no-op is
+// diagnosable.
+
+// git global options that sit BETWEEN `git` and the subcommand. Without skipping
+// them, `git -C /repo reset --hard` would slip past a naive `git reset` match.
+const GLOBAL_OPT_WITH_ARG = new Set([
+  "-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--super-prefix", "--config-env",
+]);
+
+const isForceFlag = (token) =>
+  token === "--force" || token === "--force-with-lease" || /^-[a-z]*f[a-z]*$/i.test(token);
+
+/** True if a single command segment is a destructive git invocation. */
+function isDestructiveSegment(segment) {
+  const tokens = segment.trim().split(/\s+/).filter(Boolean);
+  const gitIdx = tokens.indexOf("git");
+  if (gitIdx === -1) return false;
+
+  // Skip leading git global options to reach the real subcommand.
+  let i = gitIdx + 1;
+  while (i < tokens.length) {
+    const token = tokens[i];
+    if (token === "--") break;
+    if (/^(--git-dir|--work-tree|--namespace|--exec-path|--super-prefix|--config-env)=/.test(token)) { i++; continue; }
+    if (GLOBAL_OPT_WITH_ARG.has(token)) { i += 2; continue; } // option + its value
+    if (token.startsWith("-")) { i++; continue; } // any other global flag
+    break;
+  }
+
+  const sub = tokens[i];
+  const rest = tokens.slice(i + 1);
+  if (!sub) return false;
+
+  // Always destructive: discard worktree/index, delete untracked files.
+  if (sub === "reset" || sub === "clean" || sub === "restore") return true;
+  // git switch --discard-changes drops local modifications.
+  if (sub === "switch") return rest.includes("--discard-changes");
+  // git checkout: a branch switch is safe; the discard forms carry "--", a
+  // force flag, or a "." pathspec (git checkout . / git checkout HEAD -- .).
+  if (sub === "checkout") {
+    return rest.includes("--") || rest.includes(".") || rest.some(isForceFlag);
+  }
+  // git push --force / --force-with-lease / -f (incl. bundled like -fq) or a
+  // leading "+" refspec all force-overwrite remote history.
+  if (sub === "push") {
+    return rest.some((t) => isForceFlag(t) || /^\+/.test(t));
+  }
+  return false;
+}
+
+function isDestructive(command) {
+  // Evaluate each command segment independently so a destructive op anywhere in
+  // a compound command is caught (cd x && git reset), without a quoted token in
+  // one command (git commit -m "git reset") leaking into another's match.
+  return command
+    .split(/&&|\|\||[;|\n]/)
+    .some((segment) => isDestructiveSegment(segment));
+}
+
+function extractCommand(payload) {
+  const toolInput = payload && payload.tool_input;
+  const raw = toolInput && (toolInput.command != null ? toolInput.command : toolInput.script);
+  // Codex-style hooks pass argv as an array; normalize like post-pr-review.cjs.
+  if (Array.isArray(raw)) return raw.join(" ");
+  return typeof raw === "string" ? raw : "";
+}
+
+function allow(reason) {
+  if (reason) process.stderr.write(`block-destructive-git: ${reason} (fail-open, allowing)\n`);
+  process.exit(0);
+}
+
+let input = "";
+process.stdin.on("data", (chunk) => {
+  input += chunk;
+});
+process.stdin.on("error", () => allow("stdin error"));
+process.stdin.on("end", () => {
+  let command = "";
+  try {
+    command = extractCommand(JSON.parse(input || "{}"));
+  } catch {
+    allow("unreadable payload");
+    return;
+  }
+  if (command.trim() === "") process.exit(0);
+
+  if (isDestructive(command)) {
+    process.stderr.write(
+      "Blocked: destructive git is not allowed in this subagent " +
+        "(reset / clean / checkout discard / restore / switch --discard-changes / push --force). " +
+        "Don't discard or rewrite repo state — commit forward, or stop and ask the user.\n",
+    );
+    process.exit(2);
+  }
+  process.exit(0);
+});
+
+// Safety nets so the guard can never hang the tool call: resume the stream (some
+// shells need it to emit EOF) and bail out fail-open if stdin never ends.
+process.stdin.resume();
+setTimeout(() => allow("stdin timeout"), 2000).unref();