oh-my-harness 0.20.0 → 0.21.0

package/README.md

@@ -28,6 +28,8 @@ That is the whole setup. Your agent now hits a wall when it tries to:
 | run `rm -rf /`, `chmod -R 777`, or any pattern you list | ⛔ **Blocked** |
 | write into `node_modules/`, `.next/`, `dist/` | ⛔ **Blocked** |
 | commit on a branch already merged to main | ⛔ **Blocked** |
+| `git commit --no-verify`, `git push --force origin main` | ⛔ **Blocked** |
+| edit its own hooks or `.claude/settings.json` to switch the guardrails off | ⛔ **Blocked** |
 | save a file | ✅ auto-lint |
 | push a branch | ✅ auto-PR |
 
@@ -72,6 +74,9 @@ All enforcement is powered by **catalog blocks** — reusable, parameterized hoo
 | 🧪 `commit-test-gate` | quality | Runs tests before git commit |
 | 🔍 `commit-typecheck-gate` | quality | Runs typecheck before git commit |
 | 🔒 `command-guard` | security | Blocks dangerous shell commands |
+| 🪝 `harness-guard` | security | Blocks shell writes to the harness's own hooks and config (always on) |
+| 🚫 `no-verify-guard` | git | Blocks `--no-verify` / `-n` / hooksPath overrides on commit and push (always on) |
+| 💥 `force-push-guard` | git | Blocks force pushes to protected branches (always on) |
 | 📁 `path-guard` | file-protection | Blocks writes to protected paths |
 | 🔐 `lockfile-guard` | file-protection | Prevents manual lockfile edits |
 | 🤫 `secret-file-guard` | security | Blocks edits to .env, credentials |

package/dist/catalog/blocks/auto-pr.js

@@ -28,7 +28,7 @@ set -euo pipefail
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0
-if ! echo "$COMMAND" | grep -q "git push"; then
+if ! _omh_cmd_matches "$COMMAND" git push; then
   exit 0
 fi
 if ! command -v gh >/dev/null 2>&1; then

package/dist/catalog/blocks/branch-guard.js

@@ -14,7 +14,7 @@ export const branchGuard = {
 set -euo pipefail
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
-if echo "$COMMAND" | grep -qE "git commit|git push"; then
+if _omh_cmd_matches "$COMMAND" git commit || _omh_cmd_matches "$COMMAND" git push; then
   BRANCH=$(git branch --show-current 2>/dev/null)
   [[ -z "$BRANCH" ]] && exit 0
   MAIN='{{mainBranch}}'

package/dist/catalog/blocks/command-guard.js

@@ -21,10 +21,9 @@ set -euo pipefail
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0
-NORMALIZED_CMD=$(printf '%s' "$COMMAND" | tr '[:space:]' ' ' | tr -s ' ')
 PATTERNS=({{#each patterns}}"{{{this}}}" {{/each}})
 for PATTERN in "\${PATTERNS[@]}"; do
-  if echo "$NORMALIZED_CMD" | grep -qF -- "$PATTERN"; then
+  if _omh_cmd_has_pattern "$COMMAND" "$PATTERN"; then
     REASON="oh-my-harness: command matches blocked pattern: $PATTERN"
     _log_event "block" "$REASON"
     _emit_decision "block" "$REASON"

package/dist/catalog/blocks/commit-test-gate.js

@@ -8,13 +8,26 @@ export const commitTestGate = {
     canBlock: true,
     params: [
         { name: "testCommand", type: "string", description: "Test command to run before commit", required: true },
+        {
+            name: "cacheTtlSeconds",
+            type: "number",
+            description: "Skip the run when the working tree is unchanged since the last pass and that pass is younger than this many seconds (0 disables)",
+            default: 600,
+            required: false,
+        },
     ],
     tags: ["git", "test", "quality", "guard"],
     template: `#!/bin/bash
 set -euo pipefail
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
-if echo "$COMMAND" | grep -qE "git commit"; then
+if _omh_cmd_matches "$COMMAND" git commit; then
+  FP=$(_omh_tree_fingerprint)
+  if _omh_gate_cached commit-test-gate {{cacheTtlSeconds}} "$FP"; then
+    echo "oh-my-harness: tests already passed on this exact tree; skipping" >&2
+    _log_event "allow" "cached: tree unchanged since last passing run"
+    exit 0
+  fi
   echo "oh-my-harness: Running {{{testCommand}}} before commit..." >&2
   if ! {{{testCommand}}} >&2 2>&1; then
     REASON="oh-my-harness: pre-commit check failed"
@@ -22,6 +35,7 @@ if echo "$COMMAND" | grep -qE "git commit"; then
     _emit_decision "block" "$REASON"
     exit 0
   fi
+  _omh_gate_record commit-test-gate "$FP"
 fi
 exit 0`,
 };

package/dist/catalog/blocks/commit-typecheck-gate.js

@@ -8,13 +8,26 @@ export const commitTypecheckGate = {
     canBlock: true,
     params: [
         { name: "typecheckCommand", type: "string", description: "Typecheck command to run before commit", required: true },
+        {
+            name: "cacheTtlSeconds",
+            type: "number",
+            description: "Skip the run when the working tree is unchanged since the last pass and that pass is younger than this many seconds (0 disables)",
+            default: 600,
+            required: false,
+        },
     ],
     tags: ["git", "typecheck", "quality", "guard"],
     template: `#!/bin/bash
 set -euo pipefail
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
-if echo "$COMMAND" | grep -qE "git commit"; then
+if _omh_cmd_matches "$COMMAND" git commit; then
+  FP=$(_omh_tree_fingerprint)
+  if _omh_gate_cached commit-typecheck-gate {{cacheTtlSeconds}} "$FP"; then
+    echo "oh-my-harness: typecheck already passed on this exact tree; skipping" >&2
+    _log_event "allow" "cached: tree unchanged since last passing run"
+    exit 0
+  fi
   echo "oh-my-harness: Running {{{typecheckCommand}}} before commit..." >&2
   if ! {{{typecheckCommand}}} >&2 2>&1; then
     REASON="oh-my-harness: pre-commit check failed"
@@ -22,6 +35,7 @@ if echo "$COMMAND" | grep -qE "git commit"; then
     _emit_decision "block" "$REASON"
     exit 0
   fi
+  _omh_gate_record commit-typecheck-gate "$FP"
 fi
 exit 0`,
 };

package/dist/catalog/blocks/force-push-guard.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const forcePushGuard: BuildingBlock;

package/dist/catalog/blocks/force-push-guard.js

@@ -0,0 +1,86 @@
+// #99: a force push to a shared branch rewrites history for everyone. Block
+// `git push` when the destination is a protected branch and the push is
+// forced: --force / -f / a "+refspec". The destination
+// is the refspec's target (`origin main`, `origin HEAD:main`,
+// `origin feat:refs/heads/main`, `origin +main`); with no refspec it is the
+// current branch, and if that cannot be determined the push is blocked rather
+// than guessed. --force-with-lease is allowed by default (it refuses to
+// clobber unseen commits); set allowLease: false to block it too.
+export const forcePushGuard = {
+    id: "force-push-guard",
+    name: "Force Push Guard",
+    description: "Blocks git push --force / -f / +refspec to protected branches",
+    category: "git",
+    event: "PreToolUse",
+    matcher: "Bash",
+    canBlock: true,
+    params: [
+        {
+            name: "protected",
+            type: "string[]",
+            description: "Branches that must never be force-pushed",
+            default: ["main", "master"],
+            required: false,
+        },
+        {
+            name: "allowLease",
+            type: "boolean",
+            description: "Allow --force-with-lease (safe force) to protected branches",
+            default: true,
+            required: false,
+        },
+    ],
+    tags: ["git", "push", "guard", "force"],
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[[ -z "$COMMAND" ]] && exit 0
+_omh_cmd_matches "$COMMAND" git push || exit 0
+
+PROTECTED=({{#each protected}}"{{{this}}}" {{/each}})
+CURRENT=$(git branch --show-current 2>/dev/null || echo "")
+
+HIT=$(_omh_simple_commands "$COMMAND" | awk -F '\\t' \\
+  -v protected="$(IFS='|'; printf '%s' "\${PROTECTED[*]}")" -v current="$CURRENT" -v allow_lease="{{allowLease}}" '
+  BEGIN { np = split(protected, P, "|"); for (k = 1; k <= np; k++) isp[P[k]] = 1 }
+  found != "" { next }
+  {
+    i = 1
+    while (i <= NF && $i ~ /^[A-Za-z_][A-Za-z0-9_]*=/) i++
+    if (i <= NF && ($i == "sudo" || $i == "doas")) { i++; while (i <= NF && $i ~ /^-/) i++ }
+    if (i > NF || $i != "git") next
+    j = i + 1
+    while (j <= NF && $j ~ /^-/) { if ($j == "-c" || $j == "-C") j++; j++ }
+    if (j > NF || $j != "push") next
+    force = 0; lease = 0; remote = ""; refspec = ""; plus = 0
+    for (k = j + 1; k <= NF; k++) {
+      t = $k
+      if (t == "--") { for (m = k + 1; m <= NF; m++) { if (remote == "") remote = $m; else if (refspec == "") refspec = $m }; break }
+      if (t == "--force" || t == "-f" || t ~ /^-[A-Za-z]*f[A-Za-z]*$/) { force = 1; continue }
+      if (t == "--force-if-includes") continue   # only modifies --force-with-lease; not a force on its own
+      if (t ~ /^--force-with-lease/) { lease = 1; continue }
+      if (t ~ /^--repo=/) { remote = substr(t, 8); continue }
+      if (t == "--repo" || t == "-o" || t == "--push-option" || t == "--receive-pack" || t == "--exec") { k++; continue }
+      if (t ~ /^-/) continue
+      if (remote == "") remote = t; else if (refspec == "") refspec = t
+    }
+    dst = refspec
+    if (substr(dst, 1, 1) == "+") { plus = 1; dst = substr(dst, 2) }   # "+refspec" forces without --force
+    if (index(dst, ":") > 0) dst = substr(dst, index(dst, ":") + 1)
+    sub(/^refs\\/heads\\//, "", dst)
+    if (!force && !plus && !(lease && allow_lease == "false")) next
+    if (dst == "HEAD" || dst == "") dst = current
+    if (dst == "") { found = "force push with an undeterminable target branch"; next }
+    if (isp[dst]) found = "force push to " dst
+  }
+  END { if (found != "") print found }')
+
+if [[ -n "$HIT" ]]; then
+  REASON="oh-my-harness: $HIT is blocked: rewriting a protected branch's history is not allowed. Push to a feature branch and open a PR."
+  _log_event "block" "$REASON"
+  _emit_decision "block" "$REASON"
+  exit 0
+fi
+exit 0`,
+};

package/dist/catalog/blocks/harness-guard.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const harnessGuard: BuildingBlock;

package/dist/catalog/blocks/harness-guard.js

@@ -0,0 +1,88 @@
+// Closes the Bash side of harness self-protection (#113). path-guard's
+// protectHarness stops Edit/Write on the hook files; this block stops shell
+// commands that would rewrite, delete or neuter them: file tools with a
+// protected path as an argument, output redirections into a protected path,
+// and git checkout/restore/clean/rm/mv on one. Read-only commands (cat, grep,
+// ls, diff) stay allowed so the agent can inspect its own rules, and `omh` is
+// never a writer here, so `omh sync` / `omh hook add` remain the sanctioned
+// way to change the harness.
+// ponytail: harness.yaml itself is deliberately not protected (it is the
+// user's knob); per-hook `locked: true` is tracked in #118. `rm -rf .` / `*`
+// from the project root are left to command-guard patterns.
+export const harnessGuard = {
+    id: "harness-guard",
+    name: "Harness Guard",
+    description: "Blocks shell commands that would modify or delete the harness's own hooks and runtime config (.omh/, .claude/settings.json, .codex/, .pi/)",
+    category: "security",
+    event: "PreToolUse",
+    matcher: "Bash",
+    canBlock: true,
+    params: [
+        {
+            name: "extraPaths",
+            type: "string[]",
+            description: "Additional paths (relative to the project root) to protect from shell writes",
+            default: [],
+            required: false,
+        },
+    ],
+    tags: ["security", "bash", "guard", "harness", "self-protection"],
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+# Codex apply_patch carries a diff, not a shell command; path-guard covers it.
+[[ "$TOOL_NAME" == "apply_patch" ]] && exit 0
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[[ -z "$COMMAND" ]] && exit 0
+
+PROTECTED=(".omh" ".claude/settings.json" ".codex/hooks.json" ".codex/config.toml" ".pi/extensions/omh-harness.ts" {{#each extraPaths}}"{{{this}}}" {{/each}})
+WRITERS="rm mv cp sed tee chmod chown chgrp truncate dd ln touch install rsync shred unlink perl"
+GIT_WRITERS="checkout restore clean rm mv"
+
+HIT=$(_omh_simple_commands "$COMMAND" | awk -F '\\t' \\
+  -v protected="$(IFS='|'; printf '%s' "\${PROTECTED[*]}")" -v writers="$WRITERS" -v gitw="$GIT_WRITERS" '
+  BEGIN {
+    np = split(protected, P, "|")
+    nw = split(writers, W, " "); for (k = 1; k <= nw; k++) isw[W[k]] = 1
+    ng = split(gitw, G, " ");    for (k = 1; k <= ng; k++) isg[G[k]] = 1
+  }
+  function hits(t,   k, p, L) {
+    sub(/^\\.\\//, "", t)
+    for (k = 1; k <= np; k++) {
+      p = P[k]; if (p == "") continue
+      L = length(p)
+      if (t == p) return p
+      if (substr(t, 1, L + 1) == p "/") return p
+      if (length(t) > L && substr(t, length(t) - L, L + 1) == "/" p) return p
+      if (index(t, "/" p "/") > 0) return p
+    }
+    return ""
+  }
+  found != "" { next }
+  {
+    if ($1 == "__omh_redirect__") { p = hits($2); if (p != "") found = "redirect into " p; next }
+    i = 1
+    while (i <= NF && $i ~ /^[A-Za-z_][A-Za-z0-9_]*=/) i++
+    if (i <= NF && ($i == "sudo" || $i == "doas")) { i++; while (i <= NF && $i ~ /^-/) i++ }
+    if (i > NF) next
+    a0 = $i
+    write = 0
+    if (isw[a0]) write = 1
+    else if (a0 == "git") {
+      j = i + 1; while (j <= NF && $j ~ /^-/) { if ($j == "-c" || $j == "-C") j++; j++ }
+      if (j <= NF && isg[$j]) write = 1
+    }
+    else if (a0 == "find") { for (k = i; k <= NF; k++) if ($k == "-delete" || $k == "-exec" || $k == "-execdir") write = 1 }
+    if (!write) next
+    for (k = i + 1; k <= NF; k++) { p = hits($k); if (p != "") { found = a0 " on " p; next } }
+  }
+  END { if (found != "") print found }')
+if [[ -n "$HIT" ]]; then
+  REASON="oh-my-harness: $HIT is blocked: the harness protects its own hooks and runtime config. Edit harness.yaml and run \\\`omh sync\\\` instead."
+  _log_event "block" "$REASON"
+  _emit_decision "block" "$REASON"
+  exit 0
+fi
+exit 0`,
+};

package/dist/catalog/blocks/index.js

@@ -16,6 +16,9 @@ import { configAudit } from "./config-audit.js";
 import { compactContext } from "./compact-context.js";
 import { worktreeSetup } from "./worktree-setup.js";
 import { loopGuard } from "./loop-guard.js";
+import { harnessGuard } from "./harness-guard.js";
+import { noVerifyGuard } from "./no-verify-guard.js";
+import { forcePushGuard } from "./force-push-guard.js";
 export const builtinBlocks = [
     branchGuard,
     commitTestGate,
@@ -35,4 +38,7 @@ export const builtinBlocks = [
     compactContext,
     worktreeSetup,
     loopGuard,
+    harnessGuard,
+    noVerifyGuard,
+    forcePushGuard,
 ];

package/dist/catalog/blocks/no-verify-guard.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const noVerifyGuard: BuildingBlock;

package/dist/catalog/blocks/no-verify-guard.js

@@ -0,0 +1,61 @@
+// Closes the hook-bypass hole (#98, first reported in #27): commit-test-gate
+// and friends are PreToolUse hooks, but git's own pre-commit / pre-push hooks
+// are a second line teams rely on, and an agent that learns "--no-verify"
+// makes them vanish. Blocked forms, on any simple command that is `git commit`
+// or `git push` (through env/sudo/sh -c, see #109/#110):
+//   git commit --no-verify | -n | any short cluster containing n (-anm, -qn)
+//   git push --no-verify
+//   git -c core.hooksPath=... <anything>   (points hooks at an empty dir)
+// `git push -n` is dry-run, not no-verify, so it stays allowed.
+export const noVerifyGuard = {
+    id: "no-verify-guard",
+    name: "No-Verify Guard",
+    description: "Blocks git commit/push that bypass git hooks (--no-verify, -n, core.hooksPath override)",
+    category: "git",
+    event: "PreToolUse",
+    matcher: "Bash",
+    canBlock: true,
+    params: [],
+    tags: ["git", "hooks", "guard", "bypass"],
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[[ -z "$COMMAND" ]] && exit 0
+
+HIT=$(_omh_simple_commands "$COMMAND" | awk -F '\\t' '
+  found != "" { next }
+  {
+    i = 1
+    while (i <= NF && $i ~ /^[A-Za-z_][A-Za-z0-9_]*=/) i++
+    if (i <= NF && ($i == "sudo" || $i == "doas")) { i++; while (i <= NF && $i ~ /^-/) i++ }
+    if (i > NF || $i != "git") next
+    # global options before the subcommand; -c core.hooksPath=... is itself a bypass
+    j = i + 1
+    while (j <= NF && $j ~ /^-/) {
+      if ($j == "-c" || $j == "-C") {
+        if ($j == "-c" && j + 1 <= NF && $(j + 1) ~ /^core\\.hooksPath=/) { found = "git -c core.hooksPath override"; next }
+        j++
+      }
+      j++
+    }
+    if (j > NF) next
+    sub_cmd = $j
+    if (sub_cmd != "commit" && sub_cmd != "push") next
+    for (k = j + 1; k <= NF; k++) {
+      if ($k == "--") break
+      if ($k == "--no-verify") { found = "git " sub_cmd " --no-verify"; next }
+      if (sub_cmd == "commit" && $k ~ /^-[A-Za-z]*n[A-Za-z]*$/) { found = "git commit -n (no-verify)"; next }
+      if (sub_cmd == "commit" && $k == "-m") k++
+    }
+  }
+  END { if (found != "") print found }')
+
+if [[ -n "$HIT" ]]; then
+  REASON="oh-my-harness: $HIT is blocked: git hooks are part of the harness. Fix what the hook reports instead of skipping it."
+  _log_event "block" "$REASON"
+  _emit_decision "block" "$REASON"
+  exit 0
+fi
+exit 0`,
+};

package/dist/catalog/blocks/path-guard.js

@@ -13,6 +13,13 @@ export const pathGuard = {
             description: "Paths or directory prefixes to block (e.g. dist/, node_modules/)",
             required: true,
         },
+        {
+            name: "protectHarness",
+            type: "boolean",
+            description: "Also block edits to the harness's own hook scripts and runtime wiring (.omh/hooks/, .claude/settings.json, .codex/hooks.json, .codex/config.toml, .pi/extensions/omh-harness.ts) so the agent cannot disable its guardrails",
+            default: true,
+            required: false,
+        },
     ],
     tags: ["security", "file", "path", "guard"],
     template: `#!/bin/bash
@@ -39,6 +46,10 @@ fi
 [[ \${#FILE_PATHS[@]} -eq 0 ]] && exit 0
 
 BLOCKED_PATHS=({{#each blockedPaths}}"{{{this}}}" {{/each}})
+{{#if protectHarness}}
+# Guardrails guard themselves: the agent must not edit the hooks or the runtime config that wires them in.
+BLOCKED_PATHS+=(".omh/hooks/" ".claude/settings.json" ".codex/hooks.json" ".codex/config.toml" ".pi/extensions/omh-harness.ts")
+{{/if}}
 for FILE_PATH in "\${FILE_PATHS[@]}"; do
   # Normalize each path to prevent directory traversal attacks (e.g., ./foo/../dist/secret.js -> dist/secret.js)
   if command -v python3 >/dev/null 2>&1; then

package/dist/catalog/blocks/sql-guard.js

@@ -21,7 +21,7 @@ set -euo pipefail
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [[ -z "$COMMAND" ]] && exit 0
-COMMAND_LOWER=$(echo "$COMMAND" | tr '[:upper:]' '[:lower:]')
+COMMAND_LOWER=$(_omh_simple_commands "$COMMAND" | tr '[:upper:]' '[:lower:]')
 PATTERNS=({{#each patterns}}"{{{this}}}" {{/each}})
 for PATTERN in "\${PATTERNS[@]}"; do
   PATTERN_LOWER=$(echo "$PATTERN" | tr '[:upper:]' '[:lower:]')

package/dist/cli/commands/test.js

@@ -12,6 +12,9 @@ export function formatCategoryName(category) {
     const names = {
         "path-guard": "File guards",
         "command-guard": "Command guards",
+        "harness-guard": "Harness self-protection",
+        "no-verify-guard": "Git hook bypass guard",
+        "force-push-guard": "Force push guard",
         "branch-guard": "Branch guard",
         "lockfile-guard": "Lockfile guard",
         "secret-file-guard": "Secret file guard",

package/dist/cli/harness-tester.js

@@ -178,6 +178,57 @@ export function generateBlockTestCases(hookEntries, blocks, currentBranch, regis
                 });
                 break;
             }
+            case "harness-guard": {
+                cases.push({
+                    name: '"rm -rf .omh" → BLOCKED',
+                    category: "harness-guard",
+                    hookScript,
+                    input: { tool_name: "Bash", tool_input: { command: "rm -rf .omh" } },
+                    expectation: "block",
+                });
+                cases.push({
+                    name: '"cat .omh/hooks/catalog-tdd-guard.sh" → ALLOWED',
+                    category: "harness-guard",
+                    hookScript,
+                    input: { tool_name: "Bash", tool_input: { command: "cat .omh/hooks/catalog-tdd-guard.sh" } },
+                    expectation: "allow",
+                });
+                break;
+            }
+            case "no-verify-guard": {
+                cases.push({
+                    name: '"git commit --no-verify" → BLOCKED',
+                    category: "no-verify-guard",
+                    hookScript,
+                    input: { tool_name: "Bash", tool_input: { command: "git commit -m x --no-verify" } },
+                    expectation: "block",
+                });
+                cases.push({
+                    name: '"git commit -m x" → ALLOWED',
+                    category: "no-verify-guard",
+                    hookScript,
+                    input: { tool_name: "Bash", tool_input: { command: "git commit -m x" } },
+                    expectation: "allow",
+                });
+                break;
+            }
+            case "force-push-guard": {
+                cases.push({
+                    name: '"git push --force origin main" → BLOCKED',
+                    category: "force-push-guard",
+                    hookScript,
+                    input: { tool_name: "Bash", tool_input: { command: "git push --force origin main" } },
+                    expectation: "block",
+                });
+                cases.push({
+                    name: '"git push origin main" → ALLOWED',
+                    category: "force-push-guard",
+                    hookScript,
+                    input: { tool_name: "Bash", tool_input: { command: "git push origin main" } },
+                    expectation: "allow",
+                });
+                break;
+            }
             case "branch-guard": {
                 const isProtected = currentBranch === "main" || currentBranch === "master";
                 cases.push({

package/dist/core/harness-converter-v2.js

@@ -95,6 +95,18 @@ export async function harnessToMergedConfigV2(harness, registry, projectDir) {
     }
     // Resolve registry — use provided one or create the default
     const resolvedRegistry = registry ?? (await createDefaultRegistry());
+    // A harness that enforces anything also guards itself: without this an
+    // agent could delete or rewrite the hooks through Bash (#113). An explicit
+    // entry may change its mode or add paths. Skipped for custom registries
+    // that do not ship the block.
+    // Same rule for the git-safety pair (#114): a harness that enforces anything
+    // gets no-verify-guard and force-push-guard on every runtime, instead of the
+    // Claude-only permissions.deny list the NL prompt sometimes emitted.
+    for (const id of ["harness-guard", "no-verify-guard", "force-push-guard"]) {
+        if (resolvedRegistry.has(id) && !allHookEntries.some((h) => h.block === id)) {
+            allHookEntries.push({ block: id, params: {}, mode: "block" });
+        }
+    }
     const catalogResult = await convertHookEntries(allHookEntries, resolvedRegistry, projectDir ?? ".");
     // Convert hooksConfig entries from catalog into HookDefinition format.
     // Errors are reported as warnings but don't block valid hooks.

package/dist/generators/hooks.js

@@ -8,6 +8,237 @@ import { OMH_VERSION } from "../utils/version.js";
 function shellSingleQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+// Shell-token helpers shared by every generated hook (#109). Guards must not
+// grep the raw command string: text inside quotes or heredocs is data, not a
+// command, and a pattern like "rm -rf /" must not match "rm -rf /tmp". The
+// tokenizer is a single-pass awk state machine so it runs anywhere bash does.
+//   _omh_simple_commands "<cmd>"          one simple command per line, TAB-separated tokens, quotes resolved
+//   _omh_cmd_matches "<cmd>" argv0 [sub]  0 when some simple command is `argv0 [opts] sub`
+//   _omh_cmd_has_pattern "<cmd>" "<pat>"  0 when pat's tokens appear contiguously in some simple command
+// ponytail: backticks and process substitution <(...) are treated as plain text;
+// $(...) is parsed as a nested command stream. Wrapper unwrapping (sh -c, eval) is #110.
+const OMH_CMD_TOKENIZER_AWK = String.raw `
+{ buf = buf $0 "\n" }
+END {
+  n = length(buf); d = 0; q[0] = 0; tok[0] = ""; cmd[0] = ""; nhd[0] = 0
+  i = 1
+  while (i <= n) {
+    c = substr(buf, i, 1); c2 = substr(buf, i, 2)
+    if (q[d] == 1) {                       # inside single quotes
+      if (c == "\047") q[d] = 0; else tok[d] = tok[d] c
+      i++; continue
+    }
+    if (q[d] == 2) {                       # inside double quotes
+      if (c == "\"") { q[d] = 0; i++; continue }
+      if (c == "\\" && i < n) { tok[d] = tok[d] substr(buf, i+1, 1); i += 2; continue }
+      if (c2 == "$(") { d++; q[d] = 0; tok[d] = ""; cmd[d] = ""; nhd[d] = 0; i += 2; continue }
+      tok[d] = tok[d] c; i++; continue
+    }
+    if (c == "\047") { q[d] = 1; i++; continue }
+    if (c == "\"")   { q[d] = 2; i++; continue }
+    if (c == "\\") { if (substr(buf, i+1, 1) != "\n") tok[d] = tok[d] substr(buf, i+1, 1); i += 2; continue }
+    if (c == "#" && tok[d] == "") { while (i <= n && substr(buf, i, 1) != "\n") i++; continue }
+    if (c2 == "$(") { d++; q[d] = 0; tok[d] = ""; cmd[d] = ""; nhd[d] = 0; i += 2; continue }
+    if (substr(buf, i, 3) == "<<<") { i += 3; skipnext[d] = 1; continue }   # here-string: drop operator and word
+    if (c2 == "<<") {                      # heredoc: remember the delimiter, drop the operator
+      i += 2; strip[d, nhd[d] + 1] = 0; if (substr(buf, i, 1) == "-") { i++; strip[d, nhd[d] + 1] = 1 }
+      while (substr(buf, i, 1) == " ") i++
+      delim = ""
+      while (i <= n) { h = substr(buf, i, 1); if (h ~ /[ \t\n;|&)]/) break; if (h != "\047" && h != "\"") delim = delim h; i++ }
+      nhd[d]++; hd[d, nhd[d]] = delim; continue
+    }
+    if (c == ")" && d > 0) {               # end of $( ... )
+      flush(d)
+      if (cmd[d] != "") print cmd[d]
+      d--; tok[d] = tok[d] "$(...)"; i++; continue
+    }
+    if (c ~ /[ \t]/) { flush(d); i++; continue }
+    if (c == "&" && tok[d] ~ />$/) { tok[d] = tok[d] "&"; i++; continue }   # 2>&1, >&2
+    if (c2 == "&>") { flush(d); tok[d] = "&"; i++; continue }               # &>log, &>>log
+    if (c ~ /[;|&()\n]/) {                 # command separator
+      flush(d)
+      if (cmd[d] != "") print cmd[d]; cmd[d] = ""; skipnext[d] = 0
+      i++
+      if (c == "\n" && nhd[d] > 0) {       # skip heredoc bodies that start on the next line
+        for (k = 1; k <= nhd[d]; k++) {
+          while (i <= n) {
+            j = index(substr(buf, i), "\n"); line = (j ? substr(buf, i, j-1) : substr(buf, i))
+            i = (j ? i + j : n + 1); if (strip[d, k]) sub(/^\t+/, "", line)
+            if (line == hd[d, k]) break
+          }
+        }
+        nhd[d] = 0
+      }
+      continue
+    }
+    tok[d] = tok[d] c; i++
+  }
+  while (d >= 0) {
+    flush(d)
+    if (cmd[d] != "") print cmd[d]
+    d--
+  }
+}
+# Append the pending token to the current simple command, unless it is a
+# redirection (2>/dev/null, >file, <in, 2>&1, &>log) or the word a bare
+# redirection operator (2>, >, <, >>) applies to. Output-redirection targets
+# are emitted as their own "__omh_redirect__<TAB>target" line so guards that
+# care about writes (harness-guard) can see them; argv0 matchers never match
+# that pseudo-command.
+function flush(d,   t) {
+  if (tok[d] == "") return
+  if (skipnext[d]) {
+    # the word an output redirection applies to: report it as a write target
+    if (skipnext[d] == 2) print "__omh_redirect__\t" tok[d]
+    skipnext[d] = 0; tok[d] = ""; return
+  }
+  if (tok[d] ~ /^[0-9]*(>>?|<|&>>?|>&)/) {
+    if (tok[d] ~ /^[0-9]*(>>?|&>>?)$/) skipnext[d] = 2        # bare "> " / "2> " / "&> ": next word is written
+    else if (tok[d] ~ /^<$/) skipnext[d] = 1                   # bare "< ": next word is read
+    else if (tok[d] ~ /^[0-9]*(>>?|&>>?)[^&]/) {              # attached ">file" (not the ">&2" dup form)
+      t = tok[d]; sub(/^[0-9]*(>>?|&>>?)/, "", t); print "__omh_redirect__\t" t
+    }
+    tok[d] = ""; return
+  }
+  cmd[d] = cmd[d] (cmd[d] == "" ? "" : "\t") tok[d]; tok[d] = ""
+}`;
+// Wrapper unwrapping (#110). Runs on each TAB-separated simple command the
+// tokenizer emits. Leading wrappers that only change *how* a command runs
+// (env, timeout, nohup, nice, xargs, command, exec, builtin, time) are
+// stripped so the real argv0 is matched (sudo/doas are kept as tokens so user
+// patterns like "sudo rm" still work; _omh_cmd_matches skips them). `sh -c <string>` and `eval <words>`
+// carry the real command as data, so those are printed as "S<TAB><string>"
+// for the bash side to re-tokenize; everything else is "R<TAB><tokens>".
+// ponytail: bounded to 4 levels; deeper nesting is left unparsed rather than
+// blocked, so a pathological command cannot make every guard fire at once.
+const OMH_CMD_UNWRAP_AWK = String.raw `
+BEGIN { FS = "\t" }
+{
+  i = 1
+  while (i <= NF) {
+    while (i <= NF && $i ~ /^[A-Za-z_][A-Za-z0-9_]*=/) i++
+    if (i > NF) break
+    f = $i
+    if (f == "env") {
+      i++; while (i <= NF && $i ~ /^-/) { if ($i ~ /^-(u|C|S)$/) i++; i++ }; continue
+    }
+    if (f == "nohup" || f == "command" || f == "exec" || f == "builtin" || f == "time") {
+      i++; while (i <= NF && $i ~ /^-/) i++; continue
+    }
+    if (f == "nice") {
+      i++; while (i <= NF && $i ~ /^-/) { if ($i == "-n") i++; i++ }; continue
+    }
+    if (f == "timeout") {
+      i++; while (i <= NF && $i ~ /^-/) { if ($i ~ /^-(s|k)$/) i++; i++ }; i++; continue
+    }
+    if (f == "xargs") {
+      i++; while (i <= NF && $i ~ /^-/) { if ($i ~ /^-(I|n|L|P|s|d|E|a)$/) i++; i++ }; continue
+    }
+    if (f == "sh" || f == "bash" || f == "zsh" || f == "dash" || f == "ksh") {
+      j = i + 1
+      while (j <= NF && $j ~ /^-/) {
+        if ($j ~ /^-[A-Za-z]*c$/) { if (j + 1 <= NF) { print "S\t" $(j + 1); next }; break }
+        j++
+      }
+      break
+    }
+    if (f == "eval") {
+      out = ""; for (k = i + 1; k <= NF; k++) out = out (k > i + 1 ? " " : "") $k
+      print "S\t" out; next
+    }
+    break
+  }
+  if (i > NF) next
+  out = ""; for (k = i; k <= NF; k++) out = out (k > i ? "\t" : "") $k
+  print "R\t" out
+}`;
+// Working-tree fingerprint for gates that want to skip a re-run when nothing
+// changed since the last pass (#112): HEAD plus the tree hash of a temporary
+// index with everything (tracked + untracked, .gitignore respected) added.
+// Prints "none" outside a git repo so callers can refuse to cache.
+const OMH_TREE_FINGERPRINT = `_omh_tree_fingerprint() {
+  local root head idx tree
+  root=$(git rev-parse --show-toplevel 2>/dev/null) || { echo none; return 0; }
+  head=$(git -C "$root" rev-parse HEAD 2>/dev/null || echo empty)
+  # Start from an EMPTY temporary index, never a copy of the real one: git
+  # trusts cached stat data, so a file rewritten within the same second at the
+  # same size would be reported unchanged (seen on Linux CI). An empty index
+  # forces every file to be hashed. The real index is never touched.
+  idx=$(mktemp) || { echo none; return 0; }
+  rm -f "$idx"
+  # Always from the repository root, whatever directory the hook runs in.
+  # .omh/state is hook-owned scratch (events.jsonl grows on every hook run) and
+  # must never count as a change, whether or not the user gitignored it.
+  tree=$(GIT_INDEX_FILE="$idx" git -C "$root" add -A -- . ':(exclude).omh/state' >/dev/null 2>&1 && GIT_INDEX_FILE="$idx" git -C "$root" write-tree 2>/dev/null) || tree=none
+  rm -f "$idx"
+  [ "$tree" = "none" ] && { echo none; return 0; }
+  printf '%s:%s\\n' "$head" "$tree"
+}
+# Gate cache. Capture the fingerprint BEFORE running the gate command and pass
+# it to both helpers, so what gets recorded is the tree the command actually
+# checked, not whatever it left behind (snapshot updates, formatters).
+#   _omh_gate_cached <name> <ttl-seconds> <fp>  -> 0 when the last recorded pass
+#                                                  for <name> is <fp> and younger than ttl.
+#   _omh_gate_record <name> <fp>                -> remember <fp> as passed.
+_omh_gate_cached() {
+  local name="$1" ttl="\${2:-0}" fp="\${3:-none}" file now cached_fp cached_ts
+  [ "$ttl" -gt 0 ] 2>/dev/null || return 1
+  [ "$fp" = "none" ] && return 1
+  file="\${_OMH_STATE_DIR:-.omh/state}/gate-$name.fp"
+  [ -f "$file" ] || return 1
+  read -r cached_fp cached_ts < "$file" || return 1
+  now=$(date +%s)
+  [ "$cached_fp" = "$fp" ] && [ $((now - cached_ts)) -le "$ttl" ]
+}
+_omh_gate_record() {
+  local name="$1" fp="\${2:-none}" file
+  [ "$fp" = "none" ] && return 0
+  file="\${_OMH_STATE_DIR:-.omh/state}/gate-$name.fp"
+  mkdir -p "$(dirname "$file")" 2>/dev/null || true
+  printf '%s %s\\n' "$fp" "$(date +%s)" > "$file"
+}`;
+const OMH_CMD_HELPERS = `${OMH_TREE_FINGERPRINT}
+_omh_tokenize() {
+  printf '%s\\n' "\${1:-}" | awk '${OMH_CMD_TOKENIZER_AWK}'
+}
+_omh_simple_commands() {
+  local depth="\${2:-0}" kind rest
+  _omh_tokenize "\${1:-}" | while IFS= read -r line; do
+    printf '%s\\n' "$line" | awk '${OMH_CMD_UNWRAP_AWK}' | while IFS=$'\\t' read -r kind rest; do
+      if [ "$kind" = "S" ] && [ "$depth" -lt 4 ]; then
+        _omh_simple_commands "$rest" $((depth + 1))
+      elif [ "$kind" = "S" ]; then
+        printf '%s\\n' "$line"
+      else
+        printf '%s\\n' "$rest"
+      fi
+    done
+  done
+}
+_omh_cmd_matches() {
+  local a0="\${2:-}" sc="\${3:-}"
+  _omh_simple_commands "\${1:-}" | awk -F '\t' -v a0="$a0" -v sc="$sc" '
+    { i = 1
+      while (i <= NF && $i ~ /^[A-Za-z_][A-Za-z0-9_]*=/) i++
+      if (i <= NF && ($i == "sudo" || $i == "doas")) {
+        i++; while (i <= NF && $i ~ /^-/) { if ($i ~ /^-(u|g|C|D|h|p|r|t|T|U)$/) i++; i++ }
+      }
+      if (i > NF || $i != a0) next
+      if (sc == "") { found = 1; next }
+      i++
+      while (i <= NF && $i ~ /^-/) { if ($i == "-c" || $i == "-C") i++; i++ }
+      if (i <= NF && $i == sc) { found = 1; next } }
+    END { exit found ? 0 : 1 }'
+}
+_omh_cmd_has_pattern() {
+  _omh_simple_commands "\${1:-}" | awk -F '\t' -v pat="\${2:-}" '
+    BEGIN { n = split(pat, p, " ") }
+    { for (s = 1; s + n - 1 <= NF; s++) {
+        ok = 1
+        for (k = 1; k <= n; k++) if ($(s + k - 1) != p[k]) { ok = 0; break }
+        if (ok) { found = 1; next } } }
+    END { exit found ? 0 : 1 }'
+}`;
 function buildLoggerSnippet(event, projectDir, mode = "block") {
     const stateDir = projectDir
         ? `${projectDir}/${OMH_STATE_DIR}`
@@ -75,21 +306,22 @@ _emit_decision() {
   jq -cn --arg decision "$decision" --arg reason "$reason" \\
     '{decision:$decision,reason:$reason}'
 }
+${OMH_CMD_HELPERS}
 trap '_OMH_EXIT_CODE=$?; if [ "$_OMH_LOGGED" -eq 0 ]; then if [ "$_OMH_EXIT_CODE" -ne 0 ]; then _log_event "error" "hook exited with code $_OMH_EXIT_CODE"; else _log_event "allow"; fi; fi' EXIT
 # --- end logger ---`;
 }
 export function wrapWithLogger(script, event = "unknown", projectDir, mode = "block") {
     const snippet = buildLoggerSnippet(event, projectDir, mode);
     if (script.includes("INPUT=$(cat)")) {
-        return script.replace("INPUT=$(cat)", `INPUT=$(cat)\n\n${snippet}`);
+        return script.replace("INPUT=$(cat)", () => `INPUT=$(cat)\n\n${snippet}`);
     }
     if (script.includes("set -euo pipefail")) {
-        return script.replace("set -euo pipefail", `set -euo pipefail\n\n${snippet}`);
+        return script.replace("set -euo pipefail", () => `set -euo pipefail\n\n${snippet}`);
     }
     // shebang 패턴: #!/bin/bash, #!/usr/bin/env bash, #!/bin/sh 등
     const shebangMatch = script.match(/^#!.+$/m);
     if (shebangMatch) {
-        return script.replace(shebangMatch[0], `${shebangMatch[0]}\n\n${snippet}`);
+        return script.replace(shebangMatch[0], () => `${shebangMatch[0]}\n\n${snippet}`);
     }
     return `${snippet}\n${script}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oh-my-harness",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Tame your AI coding agents with natural language",
   "type": "module",
   "bin": {
@@ -34,7 +34,18 @@
     "claude-code",
     "tdd",
     "hooks",
-    "cli"
+    "cli",
+    "codex",
+    "openai-codex",
+    "agents-md",
+    "cursorrules",
+    "ai-coding-agent",
+    "guardrails",
+    "tdd-guard",
+    "pretooluse",
+    "coding-agent",
+    "claude-md",
+    "cli-tool"
   ],
   "author": "kyu1204",
   "license": "MIT",