navori 0.8.4 → 0.8.5

package/dist/assets/plugins/tgrep/plugin.json

@@ -36,6 +36,11 @@
       "src": "scripts/tgrep-session.sh",
       "dest": "tgrep-session.sh",
       "exec": true
+    },
+    {
+      "src": "scripts/guard-search-routing.sh",
+      "dest": "guard-search-routing.sh",
+      "exec": true
     }
   ],
   "hooks": [
@@ -44,6 +49,13 @@
       "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/scripts/tgrep-session.sh\"",
       "timeout": 30,
       "statusMessage": "navori/tgrep: search index"
+    },
+    {
+      "event": "PreToolUse",
+      "matcher": "Bash",
+      "command": "bash \"$CLAUDE_PROJECT_DIR/.claude/scripts/guard-search-routing.sh\"",
+      "timeout": 10,
+      "statusMessage": "navori/tgrep: routing guard"
     }
   ],
   "skills": [
@@ -77,5 +89,7 @@
       "injectInto": ".claude/agents/reviewer.md"
     }
   ],
-  "invariants": ["tgrep-search.sh"]
+  "invariants": [
+    "tgrep-search.sh"
+  ]
 }

package/dist/assets/plugins/tgrep/scripts/guard-search-routing.sh

@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+#
+# PreToolUse(Bash) guard: content search goes through the tgrep wrapper.
+#
+# WHY THIS IS A GUARD AND NOT A SENTENCE IN CLAUDE.md. The doctrine telling the
+# model to route content search through the wrapper has shipped since 0.7.8 and
+# is measured at 7.4% adoption over 2,761 real searches. The session that
+# produced the best analysis of tgrep anyone has written still went through
+# shell for 9 of every 10 searches (#668), so comprehension was never the
+# bottleneck. In this harness the mechanical layers hold — guard-destructive 14
+# blocks out of 14, quality-gate-pre-commit 7 out of 7 — and the advisory ones
+# do not. This moves one doctrine across that line.
+#
+# WHAT IT BLOCKS, and nothing else: a segment that STARTS a command (never one
+# after a pipe) and invokes `grep`/`egrep`/`fgrep` recursively, or `rg` with no
+# single file target. Measured against the 8,562 real grep/rg invocations of the
+# park: it fires on 55% of genuine content searches and on ZERO extractions.
+#
+# WHAT IT DELIBERATELY LETS THROUGH, because a false block teaches the model to
+# route AROUND the guard — which is worse than the search it would have stopped:
+#
+#   · `… | grep x`        filtering another command's output (46% of all
+#                         invocations). Not a repo search; the wrapper cannot
+#                         replace it.
+#   · `grep -n x file.ts` extracting from an ALREADY KNOWN file (22%). The
+#                         harness's own doctrine prefers this to the wrapper.
+#   · anything it cannot parse with certainty — a quoted pattern carrying a
+#                         newline, an unbalanced quote. Unsure means allow.
+#
+# The managed block below is regenerated by `navori render` and must NOT be
+# edited by hand. Add repo-specific exceptions in the user section at the
+# bottom — `$cmd` is already parsed and in scope there.
+set -euo pipefail
+
+# Command extraction (payload → $cmd). Shared body, single source of truth.
+# navori:include extract-cmd
+cmd=$(extract_cmd)
+
+navori_audit_name="guard-search-routing"
+navori_audit_phase="PreToolUse"
+navori_audit_tool="Bash"
+# `source` names the PLUGIN, not core: disabling tgrep changes which hooks run,
+# and without this the report cannot explain why a phase thinned out between two
+# sessions.
+navori_audit_source="plugin:tgrep"
+# Fallback no-ops, overwritten by the real definitions the include brings in.
+# They exist because this hook is FAIL-OPEN: if the file ever runs WITHOUT its
+# includes expanded — a raw copy of the asset, a render that half-finished — an
+# undefined function would be exit 127, and under `set -e` that KILLS the hook.
+navori_audit_begin() { :; }
+navori_audit_log() { :; }
+# navori:include audit-log
+navori_audit_begin
+
+# The verdict is resolved in a trap, not by a call at the end of the file: this
+# hook's managed block ends before its user section, so a call placed after it
+# would live in the user's territory and never reach the mirror.
+navori_audit_verdict="allow"
+navori_audit_reason=""
+navori_audit_on_exit() {
+  navori_audit_log "$navori_audit_verdict" "$navori_audit_reason" || true
+  return 0
+}
+trap navori_audit_on_exit EXIT
+
+if [ -z "$cmd" ]; then
+  navori_audit_verdict="skip"
+  navori_audit_reason="sin comando que inspeccionar"
+  exit 0
+fi
+
+# The wrapper itself is never blocked — it runs `grep -rn` internally on the
+# fallback path, and this hook sees the command the agent typed, not the one the
+# wrapper spawns. Checked FIRST so no rule below can ever fire on it.
+case "$cmd" in
+  *tgrep-search.sh*)
+    navori_audit_verdict="skip"
+    navori_audit_reason="es el wrapper"
+    exit 0
+    ;;
+esac
+
+# BOUNDED WORK: the guard runs under a wall-clock timeout it does not control,
+# and being killed is indistinguishable from approving. Every pass below is one
+# linear `sed`/`grep` over the command; a command past the ceiling is ALLOWED
+# rather than inspected, because this guard redirects a search — it does not
+# protect against data loss, so failing open is the right failure here (and the
+# opposite of what guard-destructive does with the same trade-off).
+if [ "${#cmd}" -gt 20000 ]; then
+  navori_audit_verdict="skip"
+  navori_audit_reason="comando demasiado grande para inspeccionar"
+  exit 0
+fi
+
+# SEGMENTS. A command is split so each rule only ever matches WITHIN one
+# segment, and each segment carries whether it starts a command or continues a
+# pipe. That distinction is the whole design: `grep -n foo` is extraction from
+# stdin after a `|`, and a repo search at the start of a line. The segment alone
+# cannot tell them apart.
+#
+# Order matters: `||` must be rewritten before `|`, or the first `|` of a `||`
+# is consumed and the second starts a bogus "piped" segment.
+#
+# A line continuation is NOT a separator: without joining it first, `\` + newline
+# splits a quoted pattern in half and the fragment lands with no target, which
+# every heuristic below reads as a recursive search. Measured on the park: that
+# alone mislabelled over a thousand extractions.
+segments=$(printf '%s' "$cmd" \
+  | sed -e ':a' -e '$!N' -e 's/\\\n/ /' -e 'ta' -e 'P' -e 'D' \
+  | sed -e 's/||/\
+@C@/g' -e 's/&&/\
+@C@/g' -e 's/;/\
+@C@/g' -e 's/|/\
+@P@/g')
+
+block() {
+  echo "[navori] BLOCKED by guard-search-routing: $1" >&2
+  echo "[navori] route content search through the indexed wrapper:" >&2
+  echo "[navori]   bash .claude/scripts/tgrep-search.sh <same ripgrep flags>" >&2
+  echo "[navori] it carries its own 'allow' rule: no prompt, no classifier round-trip." >&2
+  echo "[navori] exit contract: 0 = match, 1 = no match, 2 = NOTHING WAS SEARCHED." >&2
+  echo "[navori] this does NOT apply to '| grep' (filtering output) nor to" >&2
+  echo "[navori] 'grep -n x known-file' (extracting from a file you already found):" >&2
+  echo "[navori] both of those stay correct, and the wrapper cannot replace them." >&2
+  # Only assignments here: nothing may come between the decision and `exit 2`.
+  # The recording happens in the trap, after the exit is already committed.
+  navori_audit_verdict="block"
+  navori_audit_reason="$1"
+  exit 2
+}
+
+# Walk the command-start segments only. `@P@` lines are dropped here, and that
+# is what keeps every pipe-filter out of every rule below: the first line of the
+# command carries no marker (it starts the command), and each `@C@` line starts
+# a new one.
+starts=$(printf '%s\n' "$segments" | sed -n -e 's/^@C@//p' -e '1{/^@[CP]@/!p;}')
+
+while IFS= read -r seg; do
+  [ -n "$seg" ] || continue
+
+  # Recursive grep: the flag may sit anywhere among the options, so the verb is
+  # anchored at the segment start and the flag matched as its own token.
+  # `-[a-zA-Z]*[rR][a-zA-Z]*` matches `-r`, `-R`, `-rn`, `-nr`; it cannot match
+  # `--include` or `--color`, because after the leading `-` the class does not
+  # accept another `-`.
+  if printf '%s' "$seg" | grep -qE '^[[:space:]]*(grep|egrep|fgrep)([[:space:]]|$)' \
+    && printf '%s' "$seg" | grep -qE '(^|[[:space:]])(-[a-zA-Z]*[rR][a-zA-Z]*|--recursive)([[:space:]]|=|$)'; then
+    block "busqueda de contenido recursiva por shell"
+  fi
+
+  # `rg` is recursive by DEFAULT, so the question inverts: it is extraction only
+  # when a single concrete file is named. The test is deliberately loose — any
+  # token that looks like a path with an extension — because the cost of the two
+  # errors is not symmetric. Missing a search costs one unmeasured call; blocking
+  # a legitimate extraction teaches the model to work around the guard.
+  if printf '%s' "$seg" | grep -qE '^[[:space:]]*rg([[:space:]]|$)' \
+    && ! printf '%s' "$seg" | grep -qE '(^|[[:space:]])[^[:space:]]*\.[A-Za-z0-9]+([[:space:]]|$)'; then
+    block "busqueda de contenido por shell (rg es recursivo por defecto)"
+  fi
+done <<EOF
+$starts
+EOF
+
+# navori:user-section
+# user: add repo-specific exceptions or extra redirects here. `$cmd` holds the
+# full command and `block "<reason>"` aborts with exit 2.
+
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "navori",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Multi-agent harness + SDD scaffolder for Claude Code and other AI engines",
   "type": "module",
   "bin": {