navori 0.4.1 → 0.5.0

package/dist/assets/core/core-assets/agents/commit-pr-pilot.md

@@ -47,21 +47,31 @@ Open that specific file and confirm its verdict is `APPROVED` and that its scope
 
 An absent file, ambiguous (more than one candidate), or with a verdict/scope that doesn't match the current feature → does NOT count as approved: abort, tell the user the review is missing, and never assume a generic `APPROVED`.
 
-**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
+**Content receipt (R2+): the diff must still match what was approved.** The APPROVED verdict is bound to the reviewed bytes via `.claude/progress/receipt.txt` (written by the `reviewer`, one `<blob-sha>  <path>` line per reviewed file, or `deleted  <path>` for a removed one). Before committing, the approval has to cover the diff in **both** directions — coverage (every shipping file was reviewed) and no drift (no reviewed file changed its bytes):
 
 ```bash
 # 1) COVERAGE: shipping files the receipt never listed → reviewer never saw them.
-#    Same diff set the reviewer captured (tracked vs target + untracked), so the
-#    sets line up 1:1 with no spurious mismatches.
+#    EXACT same diff set the reviewer captured — tracked-vs-target + untracked,
+#    minus the harness's own progress/ files (same grep the receipt applies) — so
+#    the sets line up 1:1 with no spurious mismatches. A git-persisted progress/
+#    update never counts as "uncovered"; deletions DO stay in the set (the receipt
+#    records them as `deleted <path>`) so a removed file can't ship unreviewed.
 comm -23 \
-  <({ git diff --name-only "origin/{{prTarget}}"; git ls-files --others --exclude-standard; } | sort -u) \
+  <({ git diff --name-only "origin/{{prTarget}}"; git ls-files --others --exclude-standard; } \
+       | sort -u | grep -vE '^(\.claude/progress/|progress/)') \
   <(grep -v '^#' .claude/progress/receipt.txt | sed 's/^[^ ]*  //' | sort -u)
 
-# 2) DRIFT: a reviewed file whose bytes changed since the review.
+# 2) DRIFT: a reviewed file whose bytes changed since the review. A `deleted`
+#    marker means the reviewer signed off on the removal → drift only if the file
+#    came back.
 while IFS= read -r line; do
   case "$line" in ''|'#'*) continue ;; esac
   blob=${line%%  *}; path=${line#*  }
-  [ "$(git hash-object "$path" 2>/dev/null)" = "$blob" ] || echo "DRIFT: $path"
+  if [ "$blob" = deleted ]; then
+    [ -e "$path" ] && echo "DRIFT: $path (reappeared since review)"
+  else
+    [ "$(git hash-object "$path" 2>/dev/null)" = "$blob" ] || echo "DRIFT: $path"
+  fi
 done < .claude/progress/receipt.txt
 ```
 

package/dist/assets/core/core-assets/agents/explorer.md

@@ -1,7 +1,7 @@
 ---
 name: explorer
 description: Broad map of an area or module of the repo. Returns structure, dependencies, and entry points. Does not modify code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.explorer}}
 effort: {{effort.explorer}}
 ---
@@ -25,7 +25,7 @@ If the question is specific ("where is X?"), it's not you — it's `researcher`.
 
 1. Read `CLAUDE.md` to understand the repo's conventions.
 2. Define the scope: a folder, a logical module, a file pattern. The orchestrator should hand it to you precisely; if it arrives ambiguous, return `blocked` naming the options (folder X / module Y / pattern Z) so it re-sends it scoped — don't guess.
-3. Walk from the entry points (routes, module root exports, `index.ts`) toward the leaves. For each level, list files and their brief role. Apply `.claude/skills/structural-search.md` to locate shapes and entry points without reading whole files.
+3. Walk from the entry points (routes, module root exports, `index.ts`) toward the leaves. For each level, list files and their brief role. Apply `.claude/skills/structural-search/SKILL.md` to locate shapes and entry points without reading whole files.
 4. Identify reverse dependencies: which external modules consume this module? That indicates the "blast radius" of changing something here.
 5. Write `.claude/progress/explore_<area>.md`:
 

package/dist/assets/core/core-assets/agents/implementer.md

@@ -26,7 +26,7 @@ You execute **a single** task from start to verification. You don't orchestrate,
      ```
 
    - `Expected files: <list>`
-3. **Implement** following the repo's flow (the leader's "Project rules" define the concrete pattern: layers, libs, paths, naming). To locate the code to touch, apply `.claude/skills/structural-search.md`: open only the confirmed span, don't read whole files by reflex.
+3. **Implement** following the repo's flow (the leader's "Project rules" define the concrete pattern: layers, libs, paths, naming). To locate the code to touch, apply `.claude/skills/structural-search/SKILL.md`: open only the confirmed span, don't read whole files by reflex.
 4. **Quality gate** (mandatory before returning):
 
    ```bash
@@ -70,7 +70,7 @@ No speculative abstractions: no interface / layer / flag with a single "just in
 
 ## Evidence-based completion (gate before the report)
 
-Before returning `done -> .claude/progress/impl_<feature>.md`, apply `.claude/skills/verify-before-done.md`. Summary of the Iron Law:
+Before returning `done -> .claude/progress/impl_<feature>.md`, apply `.claude/skills/verify-before-done/SKILL.md`. Summary of the Iron Law:
 
 | Claim you're going to make | Required output | Not sufficient |
 |---|---|---|

package/dist/assets/core/core-assets/agents/leader.md

@@ -93,10 +93,12 @@ Expected files:
 
 - `.claude/progress/audit_ticket_<TICKET-ID>.md` — deep analysis of one ticket (`ticket-audit`)
 - `.claude/progress/audit_deep_<scope>.md` — deep read-only audit of a module/area/repo with no ticket (`auditor`)
+- `.claude/progress/plan_<scope>.md` — the `auditor`'s prioritized plan that accompanies a deep audit
 - `.claude/progress/explore_<topic>.md` — broad map (`explorer`)
 - `.claude/progress/research_<question>.md` — scoped question (`researcher`)
 - `.claude/progress/impl_<feature>.md` — the `implementer`'s report (includes its `Status: DONE | BLOCKED`)
 - `.claude/progress/review_<feature>.md` — the `reviewer`'s verdict
+- `.claude/progress/receipt.txt` — the `reviewer`'s content receipt on `APPROVED` (binds the diff to the reviewed bytes; consumed by `commit-pr-pilot`)
 
 **Path separation (don't mix):** `.claude/progress/` is ONLY for these ephemeral handoffs between agents. The **session state** (current task, plan, blockers) lives in `progress/current.md` (repo root, persists in git) and you consolidate it **YOU, only**: subagents never write it. When an `implementer` reports `blocked` in its `impl_<feature>.md`, you record the blocker in `progress/current.md` along with the next step.
 
@@ -105,7 +107,7 @@ Expected files:
 When `.claude/progress/review_<feature>.md` contains `APPROVED`:
 
 1. Invoke `commit-pr-pilot` to draft the title + body following the repo's format and open the PR.
-2. Pre-flight on you before invoking: clean working tree, you're not on `{{branchBase}}`, `{{qualityGate.fast}}` green this turn, `gh auth status` ok.
+2. Pre-flight on you before invoking: you're not on `{{branchBase}}`, `{{qualityGate.fast}}` green this turn, `gh auth status` ok. (Do NOT require a clean working tree — the pilot's trigger IS an uncommitted diff ready to commit, and the pilot, not you, owns that commit.)
 3. Return to the user only the PR URL + title.
 
 If the review returned `CHANGES_REQUESTED`, do NOT invoke `commit-pr-pilot`: launch another `implementer` with the list of changes and restart the cycle.

package/dist/assets/core/core-assets/agents/researcher.md

@@ -1,7 +1,7 @@
 ---
 name: researcher
 description: Read-only investigation of a scoped question. Reads the repo, writes findings to a file. Does not modify code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.researcher}}
 effort: {{effort.researcher}}
 ---
@@ -28,7 +28,7 @@ If the question is broad ("map the whole module X for me"), it's not you — it'
 3. Run the search:
    - Primary method: the native `Grep` (content) and `Glob` (files by name/pattern) tools. They're read-only, fast (ripgrep), and don't ask for permission.
    - Fallback only for what the tools don't cover (git history with `git grep`, FS metadata with `find`): shell commands. Chained with pipes/redirects they ask for confirmation, so reserve the shell for when `Grep`/`Glob` fall short.
-   - For semantic questions (not just string match), apply `.claude/skills/structural-search.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
+   - For semantic questions (not just string match), apply `.claude/skills/structural-search/SKILL.md`: locate the right region and open only the confirmed span; don't read whole files by reflex.
 4. Validate each finding: open the file, confirm the match means what it seems (sometimes a `grep` matches comments or strings unrelated to the concept).
 5. Write `.claude/progress/research_<question-slug>.md`:
 

package/dist/assets/core/core-assets/agents/reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: reviewer
 description: Strict reviewer. Approves or rejects the implementer's work against CLAUDE.md. Does not edit code.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.reviewer}}
 effort: {{effort.reviewer}}
 ---
@@ -26,11 +26,16 @@ You are a strict reviewer. Your only function is to **approve or reject**. You d
    git status --short
    git fetch origin {{prTarget}} --quiet
    git diff --stat
-   git diff origin/{{prTarget}}...HEAD
+   # two-dot: the FULL working tree vs the target (committed AND uncommitted),
+   # the exact set the receipt fingerprints below. Three-dot (`...HEAD`) would show
+   # only committed changes, but in the harness the diff is still uncommitted — so
+   # the review command would read empty while the receipt signs the working tree.
+   git diff "origin/{{prTarget}}"
+   git ls-files --others --exclude-standard   # untracked files (new, not yet staged)
    ```
 
 3. **Re-review** (if there's already a `.claude/progress/review_<feature>.md` from a previous cycle): focus the *reading* on (a) that the issues listed there are resolved and (b) the files the `implementer` reports having touched in this cycle (`impl_<feature>.md`). Don't re-review from scratch the already-approved code that didn't change; the full quality gate is still run anyway — a change can break something outside the delta.
-4. Apply `.claude/skills/verify-before-done.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
+4. Apply `.claude/skills/verify-before-done/SKILL.md` to every `[x]` that depends on evidence. The quality gate is run **this turn, in Pass 2** (not before: a `SPEC_MISS` in Pass 1 doesn't need it — don't spend the gate on a diff you're going to reject on spec). Don't assume from the implementer's cached report.
 
 ### Pass 1 — Spec compliance
 
@@ -52,7 +57,7 @@ Does the diff do EXACTLY what was asked? You don't review style yet.
 
 Does the code match the repo's conventions? Here you do review style/naming/types.
 
-Apply `.claude/skills/review-diff.md` — the full checklist by dimensions, with severities. Its CRITICAL/HIGH map to the ≥80 issues below; MEDIUM to the informational observations. Summary of the minimum to validate against `CLAUDE.md` and the leader's "Project rules":
+Apply `.claude/skills/review-diff/SKILL.md` — the full checklist by dimensions, with severities. Its CRITICAL/HIGH map to the ≥80 issues below; MEDIUM to the informational observations. Summary of the minimum to validate against `CLAUDE.md` and the leader's "Project rules":
 
 - **Conventions**: naming, path aliases, folder structure.
 - **Centralized types**: no inline `type`/`interface` where the convention says "outside".
@@ -87,12 +92,18 @@ printf '# navori-receipt v1 feature=<feature>\n' > .claude/progress/receipt.txt
   | sort -u \
   | grep -vE '^(\.claude/progress/|progress/)' \
   | while IFS= read -r f; do
-      [ -f "$f" ] && printf '%s  %s\n' "$(git hash-object "$f")" "$f"
+      if [ -f "$f" ]; then
+        printf '%s  %s\n' "$(git hash-object "$f")" "$f"   # live file → blob sha
+      else
+        printf 'deleted  %s\n' "$f"                        # removed file → deletion marker
+      fi
     done >> .claude/progress/receipt.txt
 ```
 
 It captures the working-tree bytes under review (committed **and** uncommitted). The `grep -v` drops the harness's own ephemeral progress files (the receipt, `impl_*`, `review_*`) — they never get committed, so fingerprinting them would be self-referential noise. Skip the whole step for `CHANGES_REQUESTED` — a rejected diff has nothing to bind.
 
+A **removed** file has no bytes to hash, so it's recorded as `deleted  <path>` instead of a blob sha. Keeping the deletion **in** the receipt is what closes the RDD cycle: the `commit-pr-pilot` coverage check is path-based, so it still sees the path (a deletion can't ship unreviewed), and both its drift check and the pre-commit hook read the `deleted` marker as "must stay absent" — flagging drift only if the file reappears. The shipping set the pilot compares against is then byte-for-byte the set you signed here (same `grep -vE`, deletions included), so a git-persisted `progress/` update or a removed file never shows up as "uncovered" and livelocks the close.
+
 ### Confidence scoring per finding (Pass 2)
 
 Each issue is scored 0-100. Only issues ≥80 block APPROVED. Issues 50-79 are listed as "informational observations" (they don't block). <50 = don't report.
@@ -164,7 +175,7 @@ CHANGES_REQUESTED -> .claude/progress/review_<feature>.md
 
 - ❌ Never skip Pass 1 (spec compliance). If the code is pretty but doesn't do what was asked, it's `CHANGES_REQUESTED`.
 - ❌ Never include as a blocker (in "Issues ≥80") a finding with confidence <80.
-- ✅ Apply `.claude/skills/verify-before-done.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
+- ✅ Apply `.claude/skills/verify-before-done/SKILL.md` before marking APPROVED: each `[x]` must be backed by evidence run this turn (not from the implementer's cached report).
 - ❌ Never approve with `{{qualityGate.full}}` red.
 - ❌ Never approve if the new code **adds new errors or warnings** vs baseline.
 - ❌ Never approve new code with explicit or implicit `any` without a valid `// any justified: <reason>`.

package/dist/assets/core/core-assets/agents/ticket-audit.md

@@ -1,7 +1,7 @@
 ---
 name: ticket-audit
 description: Deep analysis of a complex ticket before implementing. Produces audit_ticket_<ID>.md with root cause, affected areas, and a decomposition plan.
-tools: Read, Glob, Grep, Bash
+tools: Read, Glob, Grep, Bash, Write
 model: {{models.ticketAudit}}
 effort: {{effort.ticketAudit}}
 ---

package/dist/assets/core/core-assets/hooks/_partials/extract-cmd.sh

@@ -0,0 +1,21 @@
+# Shared hook boilerplate — inlined into each hook at render time (see the
+# include directive in the source scripts + lib/hook-includes.ts). Single source
+# of truth for the sibling gate scripts; DO NOT copy this body back into a hook
+# by hand (that is the drift #225/#261 removed).
+#
+# PreToolUse(Bash) passes the tool input on stdin. Extract .tool_input.command
+# WITHOUT hard-depending on jq (NOT preinstalled on macOS): try jq, then node
+# (Claude Code's own runtime), then a best-effort sed unwrap. No command
+# extracted → empty $cmd, and each caller decides what that means (the gate
+# scripts scan defensively; guard-destructive waves the command through).
+payload=$(cat)
+extract_cmd() {
+  if command -v jq >/dev/null 2>&1; then
+    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
+  fi
+  if command -v node >/dev/null 2>&1; then
+    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
+  fi
+  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
+}
+cmd=$(extract_cmd)

package/dist/assets/core/core-assets/hooks/_partials/gate-trigger.sh

@@ -0,0 +1,59 @@
+# Shared gate detector — inlined into each hook at render time (see the include
+# directive in the source scripts + lib/hook-includes.ts). The caller MUST set
+# $TRIGGER_RE (an ERE) before the include; it decides which git ops this hook
+# gates. Single source of truth for the FIX B/C wrapper-peeling logic; DO NOT
+# copy this body into a hook by hand.
+#
+# Detect whether $1 (a possibly-compound command) invokes a gated operation.
+# Splits $1 on the shell separators && || ; | and newlines, strips leading
+# whitespace plus wrapper words (`(`, `\`, `command `) and `VAR=value` env
+# prefixes from each segment, and returns 0 if ANY segment STARTS with a gated
+# `git …` invocation on a word boundary (matched by $TRIGGER_RE). Replaces
+# literal-prefix `case` matching, which silently skipped the gate for
+# `cd x && git commit`, `echo y; git push`, or a leading space (#88: NEVER skip
+# the gate silently). Matching a segment START means a quoted `echo "git commit"`
+# does NOT trigger it. Known limitation: it cannot see through `sh -c`, `eval`,
+# or obfuscation — a seatbelt, not a sandbox.
+is_scan_trigger() {
+  local input="$1" segment
+  # FIX B: join `\<newline>` continuations into a space FIRST, so a command
+  # split across lines with a trailing backslash stays ONE logical segment
+  # (otherwise the subcommand/flag lands in a segment not starting with git).
+  input="${input//\\$'\n'/ }"
+  input="${input//&&/$'\n'}"
+  input="${input//||/$'\n'}"
+  input="${input//;/$'\n'}"
+  input="${input//|/$'\n'}"
+  # `<<<` feeds the already-expanded value as data — no re-evaluation — so a
+  # command that contains backticks/$() is inspected, never executed.
+  while IFS= read -r segment; do
+    segment="${segment#"${segment%%[![:space:]]*}"}"        # strip leading ws
+    # FIX C: peel wrappers so `(git …`, `\git`, `command git …` and
+    # `VAR=val git …` all reduce to a plain `git …` before matching.
+    while [[ "$segment" == \(* ]]; do                       # strip leading ( runs
+      segment="${segment#\(}"
+      segment="${segment#"${segment%%[![:space:]]*}"}"
+    done
+    segment="${segment#\\}"                                 # strip a leading backslash (\git)
+    while [[ "$segment" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do  # strip VAR=val prefixes
+      case "$segment" in
+        *[[:space:]]*)
+          segment="${segment#*[[:space:]]}"
+          segment="${segment#"${segment%%[![:space:]]*}"}"
+          ;;
+        *) segment=""; break ;;
+      esac
+    done
+    if [[ "$segment" == command\ * ]]; then                 # strip a leading `command ` word
+      segment="${segment#command }"
+      segment="${segment#"${segment%%[![:space:]]*}"}"
+    fi
+    # FIX C: allow git global options between `git` and the subcommand
+    # (`git -c k=v commit`, `git -C /repo push`). $TRIGGER_RE's trailing boundary
+    # keeps `git commitgraph` / `git config …` from matching.
+    if printf '%s' "$segment" | grep -qE "$TRIGGER_RE"; then
+      return 0
+    fi
+  done <<< "$input"
+  return 1
+}

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -21,32 +21,21 @@
 # bottom — `$cmd` is already parsed and in scope there.
 set -euo pipefail
 
-# Extract .tool_input.command from the PreToolUse payload WITHOUT hard-depending
-# on jq (NOT preinstalled on macOS — a missing jq used to make this guard wave
-# every command through). Try jq, then node (Claude Code's own runtime), and if
-# no JSON parser is on PATH fall back to a best-effort sed unwrap so the guard
-# still inspects the command instead of failing open.
-payload=$(cat)
-extract_cmd() {
-  if command -v jq >/dev/null 2>&1; then
-    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
-  fi
-  # No JSON parser on PATH: pull the "command" string out with sed. Best-effort
-  # (won't handle a literal embedded quote), but far better than failing open.
-  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
-}
-cmd=$(extract_cmd)
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# A missing JSON parser used to make this guard wave every command through; the
+# shared extractor falls back to sed so it still inspects the command.
+# navori:include extract-cmd
 [ -z "$cmd" ] && exit 0
 
-base="{{branchBase}}"
+# branchBase is shell-quoted at render time via the shq: marker (#197): a
+# hostile branchBase in navori.config.json lands here as an inert literal,
+# never executable.
+base={{shq:branchBase}}
 
 block() {
-  echo "[navori] BLOQUEADO por guard-destructive: $1" >&2
-  echo "[navori] comando: $cmd" >&2
-  echo "[navori] si es intencional, corre el comando tú mismo fuera del agente." >&2
+  echo "[navori] BLOCKED by guard-destructive: $1" >&2
+  echo "[navori] command: $cmd" >&2
+  echo "[navori] if intentional, run the command yourself outside the agent." >&2
   exit 2
 }
 
@@ -86,7 +75,7 @@ git_cp='(^|[[:space:]]|[;&|])git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:spa
 #    (`git commit -qn`/`-nq`) without a hyphen-word in a message tripping it.
 if printf '%s' "$scan"       | grep -qE "${git_cp}([[:space:]]|.)*--no-verify" \
   || printf '%s' "$scan_flags" | grep -qE "${git_cp}([[:space:]]|.)*[[:space:]]-[a-zA-Z]*n[a-zA-Z]*([[:space:]]|\$)"; then
-  block "git commit/push con --no-verify (saltarse los hooks/gates)"
+  block "git commit/push with --no-verify (skipping hooks/gates)"
 fi
 
 # 2. Force-push to the base branch. force-with-lease is allowed (safe rebase
@@ -98,13 +87,13 @@ if printf '%s' "$scan" | grep -qE '(^|[[:space:]]|[;&|])git([[:space:]]+-[a-zA-Z
   && printf '%s' "$scan" | grep -qE '(--force([[:space:]]|$)|[[:space:]]-f([[:space:]]|$)|[[:space:]]\+)' \
   && ! printf '%s' "$scan" | grep -qE 'force-with-lease' \
   && printf '%s' "$scan" | grep -qE "(^|[[:space:]+/])${base}([[:space:]]|\$)"; then
-  block "force-push a la rama base '${base}'"
+  block "force-push to the base branch '${base}'"
 fi
 
 # 3. rm -rf with variable indirection or absolute/home roots that static deny
 #    globs miss (e.g. PATH=/; rm -rf $PATH).
 if printf '%s' "$cmd" | grep -qE '(^|[[:space:]])rm[[:space:]]+(-[a-zA-Z]*r[a-zA-Z]*[[:space:]]+|-[a-zA-Z]*f[a-zA-Z]*[[:space:]]+)*-?[a-zA-Z]*[rf][a-zA-Z]*[[:space:]]+("?\$|/[[:space:]]*$|~[[:space:]]*$)'; then
-  block "rm recursivo sobre variable / raíz / home"
+  block "recursive rm over a variable / root / home"
 fi
 
 # 4. Fork bomb.
@@ -114,13 +103,13 @@ fi
 
 # 5. Writing to a raw block device (wipes a disk/partition).
 if printf '%s' "$cmd" | grep -qE '(of=/dev/(sd|nvme|disk|hd)|>[[:space:]]*/dev/(sd|nvme|disk|hd))'; then
-  block "escritura directa a un dispositivo de bloque"
+  block "direct write to a block device"
 fi
 
 # navori:user-section
-# user: agrega guards adicionales acá. `$cmd` ya tiene el comando completo
-# (incluye comandos compuestos) y `block "<motivo>"` aborta con exit 2.
-# Ejemplo:
+# user: add extra guards here. `$cmd` already holds the full command (compound
+# commands included) and `block "<reason>"` aborts with exit 2.
+# Example:
 #
 #   if printf '%s' "$cmd" | grep -qE 'drop[[:space:]]+(table|database)'; then
 #     block "DROP TABLE/DATABASE"

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -9,20 +9,8 @@
 # bottom — they keep `cmd` and the original exit codes in scope.
 set -euo pipefail
 
-# Extract .tool_input.command WITHOUT hard-depending on jq (not preinstalled on
-# macOS). Try jq, then node (Claude Code's own runtime), then a best-effort sed
-# unwrap. If nothing extracts a command $cmd stays empty and the gate skips.
-payload=$(cat)
-extract_cmd() {
-  if command -v jq >/dev/null 2>&1; then
-    printf '%s' "$payload" | jq -r '.tool_input.command // empty' 2>/dev/null && return 0
-  fi
-  if command -v node >/dev/null 2>&1; then
-    printf '%s' "$payload" | node -e 'let s="";process.stdin.on("data",c=>s+=c).on("end",()=>{try{process.stdout.write(String(JSON.parse(s)?.tool_input?.command??""))}catch{}})' 2>/dev/null && return 0
-  fi
-  printf '%s' "$payload" | sed -n 's/.*"command"[[:space:]]*:[[:space:]]*"\(.*\)".*/\1/p'
-}
-cmd=$(extract_cmd)
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# navori:include extract-cmd
 
 # Detect the project's REAL package manager from lockfiles / package.json, so a
 # gate command hardcoded to one PM (e.g. `pnpm run ...`) can still run in a repo
@@ -59,7 +47,8 @@ run_gate() {
 # --- content receipt (RDD) --------------------------------------------------
 # Backstop that binds the commit to the exact bytes the reviewer approved. The
 # reviewer writes a receipt (`<blob-sha>  <path>` lines, one per approved file,
-# via `git hash-object`) when it marks APPROVED; the commit-pr-pilot recomputes
+# via `git hash-object`, plus `deleted  <path>` for a file it approved removing)
+# when it marks APPROVED; the commit-pr-pilot recomputes
 # it before committing and consumes it after. THIS is the mechanical net for a
 # direct `git commit` that skips the pilot: if an approved file's content
 # drifted since the review (rebase, human tweak, follow-up edit), block. It
@@ -99,6 +88,10 @@ check_content_receipt() {
     path=${line#*  }                                   # path = the rest (may contain spaces)
     [ -n "$blob" ] && [ "$blob" != "$path" ] || continue
     printf '%s\n' "$commit_set" | grep -qxF "$path" || continue   # not in this commit → ignore
+    if [ "$blob" = deleted ]; then                     # reviewer approved the removal
+      [ -e "$path" ] && drift="${drift}  - ${path} (reappeared)"$'\n'   # drift only if it came back
+      continue
+    fi
     now=$(git hash-object "$path" 2>/dev/null || true)
     if [ "$now" != "$blob" ]; then
       drift="${drift}  - ${path}"$'\n'
@@ -108,75 +101,26 @@ check_content_receipt() {
   if [ -n "$drift" ]; then
     echo "[navori] APPROVED content changed since review (receipt mismatch). Commit BLOCKED." >&2
     printf '%s' "$drift" >&2
-    echo "[navori] Re-run the reviewer over the current diff, or override with 'git commit --no-verify'." >&2
+    echo "[navori] Re-run the reviewer over the current diff. To bypass, run the commit yourself outside the agent." >&2
     echo "[navori] To clear a stale receipt: rm $receipt" >&2
     exit 2
   fi
 }
 
-# --- shared gate detection (keep IN SYNC across sibling hooks) --------------
-# Detect a `git commit` invocation anywhere in a (possibly
-# compound) command. Splits $1 on the shell separators && || ; | and newlines,
-# strips leading whitespace plus simple `VAR=value` env prefixes from each
-# segment, and returns 0 if ANY segment STARTS with `git commit` on
-# a word boundary. Replaces literal-prefix `case` matching, which silently
-# skipped the gate for `cd x && git commit`, `echo y; git commit`, or a leading
-# space (#88: NEVER skip the gate silently). Because it matches a segment START,
-# a quoted `echo "git commit"` does NOT trigger it. Known limitation: it cannot
-# see through `sh -c`, `eval`, or obfuscation — a seatbelt, not a sandbox.
-# The IDENTICAL function body lives in the sibling gate scripts (they render
-# standalone, so there is no shared lib to import):
-#   plugins/jscpd/scripts/check-jscpd.sh
-#   plugins/semgrep/scripts/check-semgrep.sh
-is_git_commit() {
-  local input="$1" segment
-  # FIX B: join `\<newline>` continuations into a space FIRST, so a command
-  # split across lines with a trailing backslash stays ONE logical segment
-  # (otherwise the subcommand/flag lands in a segment not starting with git).
-  input="${input//\\$'\n'/ }"
-  input="${input//&&/$'\n'}"
-  input="${input//||/$'\n'}"
-  input="${input//;/$'\n'}"
-  input="${input//|/$'\n'}"
-  # `<<<` feeds the already-expanded value as data — no re-evaluation — so a
-  # command that contains backticks/$() is inspected, never executed.
-  while IFS= read -r segment; do
-    segment="${segment#"${segment%%[![:space:]]*}"}"        # strip leading ws
-    # FIX C: peel wrappers so `(git …`, `\git`, `command git …` and
-    # `VAR=val git …` all reduce to a plain `git …` before matching.
-    while [[ "$segment" == \(* ]]; do                       # strip leading ( runs
-      segment="${segment#\(}"
-      segment="${segment#"${segment%%[![:space:]]*}"}"
-    done
-    segment="${segment#\\}"                                 # strip a leading backslash (\git)
-    while [[ "$segment" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do  # strip VAR=val prefixes
-      case "$segment" in
-        *[[:space:]]*)
-          segment="${segment#*[[:space:]]}"
-          segment="${segment#"${segment%%[![:space:]]*}"}"
-          ;;
-        *) segment=""; break ;;
-      esac
-    done
-    if [[ "$segment" == command\ * ]]; then                 # strip a leading `command ` word
-      segment="${segment#command }"
-      segment="${segment#"${segment%%[![:space:]]*}"}"
-    fi
-    # FIX C: allow git global options between `git` and the subcommand
-    # (`git -c k=v commit`, `git -C /repo push`). Trailing boundary keeps
-    # `git commitgraph` / `git config …` from matching as commit.
-    if printf '%s' "$segment" | grep -qE '^git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:space:]]+[^-][^[:space:]]*)?)*[[:space:]]+commit([[:space:]]|$)'; then
-      return 0
-    fi
-  done <<< "$input"
-  return 1
-}
+# Gate to `git commit` only. $TRIGGER_RE is consumed by the shared detector
+# inlined below.
+TRIGGER_RE='^git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:space:]]+[^-][^[:space:]]*)?)*[[:space:]]+commit([[:space:]]|$)'
+# navori:include gate-trigger
 
-if is_git_commit "$cmd"; then
+if is_scan_trigger "$cmd"; then
   # Content-bind first: refuse to commit bytes that drifted from the approval
   # before spending the fast gate on them.
   check_content_receipt
-  gate="{{qualityGate.fast}}"
+  # qualityGate.fast is shell-quoted at render time via the shq: marker (#197).
+  # The gate string is still `eval`'d by run_gate below (running the gate is the
+  # feature), but quoting it here means a hostile qualityGate.fast survives as one
+  # literal token instead of injecting commands at variable-assignment time.
+  gate={{shq:qualityGate.fast}}
   gate_bin="${gate%% *}"
   if command -v "$gate_bin" >/dev/null 2>&1; then
     run_gate "$gate"
@@ -188,19 +132,19 @@ if is_git_commit "$cmd"; then
     # `exit 0` that handed a contributor zero quality gate without a word.
     detected_pm="$(detect_pm)"
     if is_pm "$gate_bin" && [ -n "$detected_pm" ] && [ "$detected_pm" != "$gate_bin" ] && command -v "$detected_pm" >/dev/null 2>&1; then
-      echo "[navori] '$gate_bin' no está en PATH; uso el package manager detectado por lockfile: '$detected_pm'." >&2
+      echo "[navori] '$gate_bin' is not on PATH; using the lockfile-detected package manager: '$detected_pm'." >&2
       run_gate "$detected_pm ${gate#* }"
     else
-      echo "[navori] quality-gate NO ejecutado: '$gate_bin' no está en PATH y no hay un package manager alternativo detectado que pueda correrlo." >&2
-      echo "[navori] Commit BLOQUEADO para no saltarnos el gate en silencio. Instala '$gate_bin' o usa 'git commit --no-verify' si de verdad quieres saltártelo." >&2
+      echo "[navori] quality-gate NOT run: '$gate_bin' is not on PATH and no alternative package manager was detected that could run it." >&2
+      echo "[navori] Commit BLOCKED to avoid skipping the gate silently. Install '$gate_bin', or if you really want to skip it run the commit yourself outside the agent." >&2
       exit 2
     fi
   fi
 fi
 
 # navori:user-section
-# user: agrega checks adicionales acá. `$cmd` ya está parseado del input
-# de la tool. Ejemplo:
+# user: add extra checks here. `$cmd` is already parsed from the tool input.
+# Example:
 #
 #   case "$cmd" in
 #     'git push'*)

package/dist/assets/core/core-assets/hooks/session-start-context.sh

@@ -29,7 +29,9 @@ add() { ctx="${ctx}${1}"$'\n'; }
 
 if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo '?')
-  base="{{branchBase}}"
+  # branchBase is shell-quoted at render time via the shq: marker (#197) so an
+  # untrusted branchBase can't inject a command here.
+  base={{shq:branchBase}}
   if [ "$branch" = "$base" ]; then
     add "Branch: ${branch}  ⚠️ on the base branch — create a working branch before committing."
   else
@@ -59,6 +61,20 @@ if [ -n "$current" ]; then
   fi
 fi
 
+# Workspace Dominio: canonical cross-repo knowledge for the workspace this repo
+# belongs to (e.g. "coachee = user-profile.kind"), so agents don't relearn it
+# wrong in every repo. The CLI owns the resolution (which workspace is cwd in +
+# read the index); the hook stays dumb. Cheap pre-check first so the common
+# no-workspace case never spawns the binary, and `|| true` so a missing/broken
+# `navori` never blocks session startup. (spec 0011 §6.1)
+if [ -d "$HOME/.navori/workspaces" ] && command -v navori >/dev/null 2>&1; then
+  dominio=$(navori dominio inject 2>/dev/null || true)
+  if [ -n "$dominio" ]; then
+    add ""
+    add "$dominio"
+  fi
+fi
+
 [ -n "$ctx" ] || exit 0
 
 # Emit the JSON safely: node (best escaping) → jq → give up (exit 0, no context).

package/dist/assets/core/core-assets/hooks/subagent-stop-handoff.sh

@@ -47,7 +47,7 @@ shopt -s nullglob
 for f in "$dir"/impl_*.md; do
   if is_blank "$f"; then
     note "$(basename "$f") vacío"
-  elif ! grep -qi '^status:' "$f" 2>/dev/null; then
+  elif ! grep -qiE '^\*{0,2}status:?\*{0,2}' "$f" 2>/dev/null; then
     note "$(basename "$f") sin línea 'Status:'"
   fi
 done