jorgex-stack 1.9.47 → 1.9.49

package/dist/cli.js

@@ -1401,11 +1401,6 @@ ${gitReadCommands.map((command) => `- \`${command}\``).join("\n")}
 import path10 from "path";
 import fs7 from "fs";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
-
-// src/lib/git-guard.ts
-var GIT_GUARD_SCRIPT = "block-destructive-git.cjs";
-
-// src/adapters/claude-code.ts
 function yamlString2(value) {
   return JSON.stringify(value);
 }
@@ -1551,16 +1546,6 @@ ${agent.body}`;
     const tools = toolsFor(agent);
     if (tools !== null) lines.push(`tools: ${tools}`);
     lines.push(`model: ${resolveAgentModel(models, agent.name, agent.tier).model}`);
-    if (agent.bash === "full") {
-      lines.push(
-        "hooks:",
-        "  PreToolUse:",
-        '    - matcher: "Bash|PowerShell"',
-        "      hooks:",
-        "        - type: command",
-        `          command: "node \\"{{SCRIPTS_DIR}}/${GIT_GUARD_SCRIPT}\\""`
-      );
-    }
     return [
       {
         file: `${agent.name}.md`,
@@ -6146,16 +6131,16 @@ import { createHash as createHash2 } from "crypto";
 var pi_runtime_pin_default = {
   package: {
     name: "jorgex-pi",
-    version: "0.8.23",
-    source: "npm:jorgex-pi@0.8.23"
+    version: "0.8.24",
+    source: "npm:jorgex-pi@0.8.24"
   },
   provenance: {
-    commit: "ebb5e6e18e8e9297ffbf7bd53cf6785b952474b9"
+    commit: "652d7e445e6f184c4543593c115026aa2f71e761"
   },
   tarball: {
-    bytes: 89140657,
-    sha256: "cbe75c7975353c6ed3123a9bd9c3395e18263a49f33f80a607123392ba27a8fd",
-    sha512: "bb6dd4075a25818f301ed73d6b7b1432beca635fb6c130c0b0543844d086475640c41fa1e1e68035f3df97ad3cee52e5de8917b05fe01d7483875ae934e3374d"
+    bytes: 89140631,
+    sha256: "6f67e546c86f21f9b5ff139f429551e696be4a8389ce4a6262e137dcce923a5f",
+    sha512: "1ce4bfc316f1635c5e498af7134ae16f430a4f6a3d2c99c7aa6fc31b76ce18684759c6480f506b5de45aa5b5b682e03f68d10fc77c83ae1679006dab679d9aa4"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.47",
+  "version": "1.9.49",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",

package/stack/agents/implementer.md

@@ -13,7 +13,7 @@ You implement real changes. You don't stop at analysis, you don't answer with ju
 
 **Mandatory first action**: load the `agent-delegation` skill.
 
-**Never run destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Commit forward; if you think you need to discard or reset repo state, stop and ask the main agent/orchestrator.
+**Ask before destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Prefer commit forward; if you need to discard or reset repo state, ask the main agent/orchestrator first and only proceed with explicit approval.
 
 **Conditional skill**:
 

package/stack/agents/tester.md

@@ -13,7 +13,7 @@ Your job is to produce the strongest testing evidence for the risk—not to maxi
 
 **Mandatory first action**: load the `tdd` and `agent-delegation` skills.
 
-**Never run destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Commit forward; if you think you need to discard or reset repo state, stop and ask the main agent/orchestrator.
+**Ask before destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Prefer commit forward; if you need to discard or reset repo state, ask the main agent/orchestrator first and only proceed with explicit approval.
 
 ## Before acting
 

package/stack/agents/translator.md

@@ -13,7 +13,7 @@ You handle translations, multi-language text and integration with the project's
 
 **Mandatory first action**: load the `agent-delegation` skill.
 
-**Never run destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Commit forward; if you think you need to discard or reset repo state, stop and ask the main agent/orchestrator.
+**Ask before destructive git** (`reset`, `clean`, `checkout --`, `restore`, `push --force`) — it can discard work or rewrite history. Prefer commit forward; if you need to discard or reset repo state, ask the main agent/orchestrator first and only proceed with explicit approval.
 
 **Final output, last of all**: your final report (ending with the Result contract) must be the very last thing you emit. If you need to save anything to memory, do it BEFORE that output — never after.
 

package/stack/config/defaults.json

@@ -162,6 +162,41 @@
         "git.exe *push*": "ask",
         "*/git.exe *push*": "ask",
         "*\\git.exe *push*": "ask",
+        "git *checkout*--*": "ask",
+        "*/git *checkout*--*": "ask",
+        "git.exe *checkout*--*": "ask",
+        "*/git.exe *checkout*--*": "ask",
+        "*\\git.exe *checkout*--*": "ask",
+        "git *checkout* -f*": "ask",
+        "*/git *checkout* -f*": "ask",
+        "git.exe *checkout* -f*": "ask",
+        "*/git.exe *checkout* -f*": "ask",
+        "*\\git.exe *checkout* -f*": "ask",
+        "git *restore*": "ask",
+        "*/git *restore*": "ask",
+        "git.exe *restore*": "ask",
+        "*/git.exe *restore*": "ask",
+        "*\\git.exe *restore*": "ask",
+        "git *switch*--discard-changes*": "ask",
+        "*/git *switch*--discard-changes*": "ask",
+        "git.exe *switch*--discard-changes*": "ask",
+        "*/git.exe *switch*--discard-changes*": "ask",
+        "*\\git.exe *switch*--discard-changes*": "ask",
+        "git *rebase*": "ask",
+        "*/git *rebase*": "ask",
+        "git.exe *rebase*": "ask",
+        "*/git.exe *rebase*": "ask",
+        "*\\git.exe *rebase*": "ask",
+        "* git *checkout*--*": "ask",
+        "* git.exe *checkout*--*": "ask",
+        "* git *checkout* -f*": "ask",
+        "* git.exe *checkout* -f*": "ask",
+        "* git *restore*": "ask",
+        "* git.exe *restore*": "ask",
+        "* git *switch*--discard-changes*": "ask",
+        "* git.exe *switch*--discard-changes*": "ask",
+        "* git *rebase*": "ask",
+        "* git.exe *rebase*": "ask",
         "git -c *": "ask",
         "*/git -c *": "ask",
         "git.exe -c *": "ask",

package/stack/scripts/repair-worktree-config.cjs

@@ -17,8 +17,8 @@
 //
 // Cross-agent (Claude Code / Codex / OpenCode) y cross-platform: node puro, sin deps.
 // Idempotente, INDEPENDIENTE del cwd de escritura (opera con --file sobre rutas absolutas),
-// fail-open y exit 0 SIEMPRE (un guardian nunca debe bloquear una tool). Como el guardian
-// hermano (block-destructive-git.cjs), un fail-open deja rastro en stderr para ser diagnosticable.
+// fail-open y exit 0 SIEMPRE (un guardian nunca debe bloquear una tool): un
+// fail-open deja rastro en stderr para ser diagnosticable.
 
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");

package/stack/scripts/block-destructive-git.cjs

@@ -1,110 +0,0 @@
-#!/usr/bin/env node
-// PreToolUse guard (Claude Code): blocks destructive git commands in the
-// subagents that declare it, leaving the main agent unrestricted. Claude Code
-// has no per-subagent command denylist, so this is the documented mechanism
-// (sub-agents docs -> "Conditional rules with hooks"). Reads the PreToolUse
-// payload from stdin and exits 2 to block if any segment of the command would
-// discard work or rewrite history. Best-effort guardrail, not an adversarial
-// sandbox. Fail-open: any read/parse problem allows the command (exit 0) so the
-// guard can never wedge legitimate work — but it logs why, so a silent no-op is
-// diagnosable.
-
-// git global options that sit BETWEEN `git` and the subcommand. Without skipping
-// them, `git -C /repo reset --hard` would slip past a naive `git reset` match.
-const GLOBAL_OPT_WITH_ARG = new Set([
-  "-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--super-prefix", "--config-env",
-]);
-
-const isForceFlag = (token) =>
-  token === "--force" || token === "--force-with-lease" || /^-[a-z]*f[a-z]*$/i.test(token);
-
-/** True if a single command segment is a destructive git invocation. */
-function isDestructiveSegment(segment) {
-  const tokens = segment.trim().split(/\s+/).filter(Boolean);
-  const gitIdx = tokens.indexOf("git");
-  if (gitIdx === -1) return false;
-
-  // Skip leading git global options to reach the real subcommand.
-  let i = gitIdx + 1;
-  while (i < tokens.length) {
-    const token = tokens[i];
-    if (token === "--") break;
-    if (/^(--git-dir|--work-tree|--namespace|--exec-path|--super-prefix|--config-env)=/.test(token)) { i++; continue; }
-    if (GLOBAL_OPT_WITH_ARG.has(token)) { i += 2; continue; } // option + its value
-    if (token.startsWith("-")) { i++; continue; } // any other global flag
-    break;
-  }
-
-  const sub = tokens[i];
-  const rest = tokens.slice(i + 1);
-  if (!sub) return false;
-
-  // Always destructive: discard worktree/index, delete untracked files.
-  if (sub === "reset" || sub === "clean" || sub === "restore") return true;
-  // git switch --discard-changes drops local modifications.
-  if (sub === "switch") return rest.includes("--discard-changes");
-  // git checkout: a branch switch is safe; the discard forms carry "--", a
-  // force flag, or a "." pathspec (git checkout . / git checkout HEAD -- .).
-  if (sub === "checkout") {
-    return rest.includes("--") || rest.includes(".") || rest.some(isForceFlag);
-  }
-  // git push --force / --force-with-lease / -f (incl. bundled like -fq) or a
-  // leading "+" refspec all force-overwrite remote history.
-  if (sub === "push") {
-    return rest.some((t) => isForceFlag(t) || /^\+/.test(t));
-  }
-  return false;
-}
-
-function isDestructive(command) {
-  // Evaluate each command segment independently so a destructive op anywhere in
-  // a compound command is caught (cd x && git reset), without a quoted token in
-  // one command (git commit -m "git reset") leaking into another's match.
-  return command
-    .split(/&&|\|\||[;|\n]/)
-    .some((segment) => isDestructiveSegment(segment));
-}
-
-function extractCommand(payload) {
-  const toolInput = payload && payload.tool_input;
-  const raw = toolInput && (toolInput.command != null ? toolInput.command : toolInput.script);
-  // Codex-style hooks pass argv as an array; normalize like post-pr-review.cjs.
-  if (Array.isArray(raw)) return raw.join(" ");
-  return typeof raw === "string" ? raw : "";
-}
-
-function allow(reason) {
-  if (reason) process.stderr.write(`block-destructive-git: ${reason} (fail-open, allowing)\n`);
-  process.exit(0);
-}
-
-let input = "";
-process.stdin.on("data", (chunk) => {
-  input += chunk;
-});
-process.stdin.on("error", () => allow("stdin error"));
-process.stdin.on("end", () => {
-  let command = "";
-  try {
-    command = extractCommand(JSON.parse(input || "{}"));
-  } catch {
-    allow("unreadable payload");
-    return;
-  }
-  if (command.trim() === "") process.exit(0);
-
-  if (isDestructive(command)) {
-    process.stderr.write(
-      "Blocked: destructive git is not allowed in this subagent " +
-        "(reset / clean / checkout discard / restore / switch --discard-changes / push --force). " +
-        "Don't discard or rewrite repo state — commit forward, or stop and ask the user.\n",
-    );
-    process.exit(2);
-  }
-  process.exit(0);
-});
-
-// Safety nets so the guard can never hang the tool call: resume the stream (some
-// shells need it to emit EOF) and bail out fail-open if stdin never ends.
-process.stdin.resume();
-setTimeout(() => allow("stdin timeout"), 2000).unref();