oh-my-harness 0.23.0 → 0.25.0

package/README.md

@@ -99,11 +99,30 @@ omh init "Next.js + FastAPI, TDD enforced, no auto PRs"
 - Get a key from the [TypeSafe console](https://typesafe.ai) (early access at the time of writing). One init costs a fraction of a cent (input $0.042 per million tokens, output free) and takes about half a second.
 - `--preset` always wins and never calls Jev. No key and no LLM provider? `omh init "description"` falls back to `safe` and says so.
 - `omh doctor` and `omh config --show` tell you whether the chooser is active. Remove the key to go back to the LLM providers or presets.
+- `omh modify "..."` later edits the same way: Jev answers enable / disable / ask / keep per block, you confirm the change set, `omh sync` runs. Mark an entry `locked: true` in harness.yaml and modify will refuse to remove or weaken it.
 - Interactive `omh init` offers both: "Describe your project (Jev picks the blocks)" and "Use a preset (no AI)".
 - Descriptions in English work best; other languages are handled but with lower confidence, so include the specifics.
 
 The always-on guards (harness self-protection, `--no-verify`, force-push) are added to every preset and every Jev result.
 
+### Rules that enforce themselves
+
+Two fields on a rule in `harness.yaml` turn prose into a check:
+
+```yaml
+rules:
+  - id: no-deps
+    title: No new dependencies
+    content: Do not add npm dependencies without asking.
+    enforce: true          # every Bash/Edit/Write call is judged against this rule by Jev
+  - id: no-secrets
+    title: No secrets in code
+    content: Never commit tokens or passwords.
+    lint: hardcodes a secret, token or password   # the staged diff is linted with jgrep before commit
+```
+
+`enforce: true` adds `semantic-rule-guard`: one Jev question per enforced rule per tool call, block at p ≥ 0.9, ask between 0.6 and 0.9, allow below; without a key, or on an API error, it allows and logs `skipped`. `lint:` adds `semantic-diff-gate`, which runs `jgrep --diff --staged "<description>"` and blocks the commit on a hit with `file:line`. When the same command also stages (`git add … && git commit`, `git commit -a`), the gate previews the index that command would build, so nothing slips through because it was not staged yet. jgrep is optional: `npm i -g jevgrep && jgrep init`; the `strict` preset adds three generic lints when `omh init` finds it. Both layers are additive and never relax a deterministic guard.
+
 ---
 
 ## 🧱 Building Block Catalog
@@ -119,6 +138,10 @@ All enforcement is powered by **catalog blocks** — reusable, parameterized hoo
 | 🪝 `harness-guard` | security | Blocks shell writes to the harness's own hooks and config (always on) |
 | 🚫 `no-verify-guard` | git | Blocks `--no-verify` / `-n` / hooksPath overrides on commit and push (always on) |
 | 💥 `force-push-guard` | git | Blocks force pushes to protected branches (always on) |
+| 🛑 `stop-test-gate` | quality | When the agent tries to end its turn with failing tests, sends it back (retry-capped) |
+| 📝 `stop-uncommitted-warn` | git | Lists uncommitted changes as a system message when the turn ends |
+| 🧠 `semantic-rule-guard` | security | Rules marked `enforce: true` are judged by Jev on every Bash/Edit/Write call |
+| 🔎 `semantic-diff-gate` | quality | Lints the staged diff with [jgrep](https://github.com/kyu1204/jgrep) against `lint:` rule descriptions before commit (optional) |
 | 📁 `path-guard` | file-protection | Blocks writes to protected paths |
 | 🔐 `lockfile-guard` | file-protection | Prevents manual lockfile edits |
 | 🤫 `secret-file-guard` | security | Blocks edits to .env, credentials |
@@ -192,6 +215,7 @@ Hand omh a `WORKPLAN.md` and it runs one work order per fresh agent session, in
 omh init "your project description"      # Jev with TYPESAFE_API_KEY, else an LLM provider, else the "safe" preset
 omh init --preset strict                  # No provider: minimal | safe | strict
 omh explain                               # Why were the last tool calls blocked, and what to do about it
+omh modify "no auto PRs, TDD guard asks"  # Edit harness.yaml from a sentence (Jev decides per block; locked: true entries stay)
 omh init                                  # Interactive TUI (import existing harness.yaml)
 
 # 📋 Catalog

package/dist/catalog/blocks/branch-guard.js

@@ -33,7 +33,7 @@ if _omh_cmd_matches "$COMMAND" git commit || _omh_cmd_matches "$COMMAND" git pus
       if ($i != "git") next
       c = cwd; ex = 0; j = i + 1
       while (j <= NF && $j ~ /^-/) {
-        if ($j == "-C") { if ($(j + 1) ~ /^\\//) ex = 1; c = omh_cd(c, $(j + 1), home); j++ }
+        if ($j == "-C") { if ($(j + 1) ~ /^(\\/|~\\/)/) ex = 1; c = omh_cd(c, $(j + 1), home); j++ }
         else if ($j == "-c") j++
         j++
       }

package/dist/catalog/blocks/commit-test-gate.js

@@ -27,7 +27,11 @@ INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 if _omh_cmd_matches "$COMMAND" git commit; then
   FP=$(_omh_tree_fingerprint)
-  if _omh_gate_cached commit-test-gate {{cacheTtlSeconds}} "$FP"; then
+  GATE_CMD=$(cat <<'OMH_GATE_CMD'
+{{{testCommand}}}
+OMH_GATE_CMD
+)
+  if _omh_gate_cached commit-test-gate {{cacheTtlSeconds}} "$FP" "$GATE_CMD"; then
     echo "oh-my-harness: tests already passed on this exact tree; skipping" >&2
     _log_event "allow" "cached: tree unchanged since last passing run"
     exit 0
@@ -39,7 +43,7 @@ if _omh_cmd_matches "$COMMAND" git commit; then
     _emit_decision "block" "$REASON"
     exit 0
   fi
-  _omh_gate_record commit-test-gate "$FP"
+  _omh_gate_record commit-test-gate "$FP" "$GATE_CMD"
 fi
 exit 0`,
 };

package/dist/catalog/blocks/commit-typecheck-gate.js

@@ -27,7 +27,11 @@ INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 if _omh_cmd_matches "$COMMAND" git commit; then
   FP=$(_omh_tree_fingerprint)
-  if _omh_gate_cached commit-typecheck-gate {{cacheTtlSeconds}} "$FP"; then
+  GATE_CMD=$(cat <<'OMH_GATE_CMD'
+{{{typecheckCommand}}}
+OMH_GATE_CMD
+)
+  if _omh_gate_cached commit-typecheck-gate {{cacheTtlSeconds}} "$FP" "$GATE_CMD"; then
     echo "oh-my-harness: typecheck already passed on this exact tree; skipping" >&2
     _log_event "allow" "cached: tree unchanged since last passing run"
     exit 0
@@ -39,7 +43,7 @@ if _omh_cmd_matches "$COMMAND" git commit; then
     _emit_decision "block" "$REASON"
     exit 0
   fi
-  _omh_gate_record commit-typecheck-gate "$FP"
+  _omh_gate_record commit-typecheck-gate "$FP" "$GATE_CMD"
 fi
 exit 0`,
 };

package/dist/catalog/blocks/index.js

@@ -19,6 +19,10 @@ import { loopGuard } from "./loop-guard.js";
 import { harnessGuard } from "./harness-guard.js";
 import { noVerifyGuard } from "./no-verify-guard.js";
 import { forcePushGuard } from "./force-push-guard.js";
+import { stopTestGate } from "./stop-test-gate.js";
+import { stopUncommittedWarn } from "./stop-uncommitted-warn.js";
+import { semanticRuleGuard } from "./semantic-rule-guard.js";
+import { semanticDiffGate } from "./semantic-diff-gate.js";
 export const builtinBlocks = [
     branchGuard,
     commitTestGate,
@@ -41,4 +45,8 @@ export const builtinBlocks = [
     harnessGuard,
     noVerifyGuard,
     forcePushGuard,
+    stopTestGate,
+    stopUncommittedWarn,
+    semanticRuleGuard,
+    semanticDiffGate,
 ];

package/dist/catalog/blocks/semantic-diff-gate.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const semanticDiffGate: BuildingBlock;

package/dist/catalog/blocks/semantic-diff-gate.js

@@ -0,0 +1,118 @@
+// Semantic lint of the staged diff before a commit (#145), powered by jgrep
+// (https://github.com/kyu1204/jgrep): `jgrep --json --diff --staged "<rule>"`
+// asks Jev, hunk by hunk, whether the change does what the rule describes.
+// Any hit blocks the commit with file:line ranges. jgrep is optional by
+// construction: it is called through PATH, never bundled; when it is not
+// installed (or fails) the gate allows and logs why, so a harness without
+// jgrep behaves exactly as before.
+export const semanticDiffGate = {
+    id: "semantic-diff-gate",
+    name: "Semantic Diff Gate",
+    description: "Before git commit, lints the staged diff with jgrep against rule descriptions and blocks on a hit (needs jgrep on PATH)",
+    category: "quality",
+    event: "PreToolUse",
+    matcher: "Bash",
+    canBlock: true,
+    params: [
+        { name: "rules", type: "string[]", description: "English descriptions of changes that must not be committed (filled from rules with a lint: field)", required: true },
+        { name: "threshold", type: "number", description: "jgrep probability threshold for a hit", default: 0.85, required: false },
+        { name: "jgrep", type: "string", description: "jgrep command", default: "jgrep", required: false },
+    ],
+    tags: ["semantic", "jev", "jgrep", "diff", "lint", "gate"],
+    explain: {
+        allowOnce: "change the staged hunks jgrep pointed at (file:line in the reason), or unstage them",
+        change: "harness.yaml > rules: drop or edit the lint: description; threshold lives under hooks > semantic-diff-gate; uninstalling jgrep disables the gate, then omh sync",
+    },
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+[[ -z "$COMMAND" ]] && exit 0
+_omh_cmd_matches "$COMMAND" git commit || exit 0
+
+JGREP='{{{jgrep}}}'
+if ! command -v "$JGREP" >/dev/null 2>&1; then
+  _log_event "allow" "skipped: jgrep not found (npm i -g jevgrep && jgrep init to enable the semantic diff gate)"
+  exit 0
+fi
+GIT_DIR_PATH=$(git rev-parse --git-dir 2>/dev/null) || { _log_event "allow" "skipped: not a git repository"; exit 0; }
+
+# The agent usually stages and commits in one call, so at this point the index
+# does not hold what the commit will contain. Preview it in a temporary index:
+# copy the real one, replay every "git add ..." from the command (and
+# "git add -u" for commit -a/--all), then let jgrep read that index through
+# GIT_INDEX_FILE. The real index is never touched.
+TMPIDX=$(mktemp)
+if [[ -f "$GIT_DIR_PATH/index" ]]; then cp "$GIT_DIR_PATH/index" "$TMPIDX"; else rm -f "$TMPIDX"; fi
+export GIT_INDEX_FILE="$TMPIDX"
+# WIDEN=1 means the replay cannot be trusted (cd/pushd in the command, or a
+# git add that fails here): stage every change instead, so nothing that
+# the real command would stage is missed. Over-approximating can block on
+# an unrelated dirty file; missing a file would let a secret through.
+WIDEN=0
+while IFS= read -r ADD_LINE; do
+  [[ -z "$ADD_LINE" ]] && continue
+  if [[ "$ADD_LINE" == "__widen__" ]]; then WIDEN=1; continue; fi
+  IFS=$'\\t' read -r -a ADD_ARGS <<< "$ADD_LINE"
+  git "\${ADD_ARGS[@]}" >/dev/null 2>&1 || WIDEN=1
+done < <(_omh_simple_commands "$COMMAND" | awk -F '\\t' '
+  { i = 1
+    while (i <= NF && $i ~ /^[A-Za-z_][A-Za-z0-9_]*=/) i++
+    if (i > NF) next
+    if ($i == "cd" || $i == "pushd" || $i == "popd") { print "__widen__"; next }
+    if ($i != "git") next
+    i++; cdir = ""
+    while (i <= NF && $i ~ /^-/) { if ($i == "-c") i++; else if ($i == "-C") { i++; cdir = $i }; i++ }
+    if (i > NF) next
+    pre = (cdir == "" ? "" : "-C\\t" cdir "\\t")
+    if ($i == "add") {
+      line = ""
+      for (j = i + 1; j <= NF; j++) {
+        if ($j ~ /^-(p|i|e|-patch|-interactive|-edit)$/) next
+        line = line (line == "" ? "" : "\\t") $j
+      }
+      if (line != "") print pre "add\\t" line
+    } else if ($i == "commit") {
+      for (j = i + 1; j <= NF; j++) if ($j == "--all" || ($j ~ /^-[A-Za-z]+$/ && $j ~ /a/)) { print pre "add\\t-u"; break }
+    } }')
+if [[ "$WIDEN" == "1" ]]; then git add -A >/dev/null 2>&1 || true; fi
+_omh_sdg_done() { rm -f "$TMPIDX"; }
+
+RULES_RAW=$(cat <<'OMH_RULES'
+{{#each rules}}{{{this}}}
+OMH_RULES_SEP
+{{/each}}
+OMH_RULES
+)
+HITS=""
+N=0
+ERR=$(mktemp)
+while IFS= read -r RULE; do
+  [[ -z "$RULE" ]] && continue
+  N=$((N + 1))
+  STATUS=0
+  OUT=$("$JGREP" --json -t {{threshold}} --diff --staged "$RULE" 2>"$ERR") || STATUS=$?
+  case "$STATUS" in
+    0)
+      LINES=$(printf '%s' "$OUT" | jq -r '.[]? | "  \\(.file):\\(.start)-\\(.end) (p=\\(.p))"' 2>/dev/null || true)
+      [[ -n "$LINES" ]] && HITS+="rule \\"$RULE\\":
+$LINES
+" ;;
+    1) ;;
+    *)
+      _log_event "allow" "jgrep failed (exit $STATUS): $(head -c 200 "$ERR" | tr '\\n' ' ')"
+      rm -f "$ERR"; _omh_sdg_done; exit 0 ;;
+  esac
+done < <(printf '%s' "$RULES_RAW" | jq -Rs -r 'rtrimstr("\\nOMH_RULES_SEP") | split("\\nOMH_RULES_SEP\\n") | map(select(. != "")) | .[]')
+rm -f "$ERR"; _omh_sdg_done
+
+if [[ -n "$HITS" ]]; then
+  REASON="oh-my-harness: the staged diff matches a lint rule; fix these hunks before committing:
+$HITS"
+  _log_event "block" "$REASON"
+  _emit_decision "block" "$REASON"
+  exit 0
+fi
+_log_event "allow" "no lint hits ($N rules)"
+exit 0`,
+};

package/dist/catalog/blocks/semantic-rule-guard.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const semanticRuleGuard: BuildingBlock;

package/dist/catalog/blocks/semantic-rule-guard.js

@@ -0,0 +1,95 @@
+// Rules become enforceable (#144). For every Bash / Edit / Write call, ask
+// Jev one yes/no question per enforced rule ("does this tool call violate
+// the rule?") in a single fan-out request and act on the calibrated
+// probability: block at or above blockAbove, ask in the middle band (on
+// runtimes with ask; elsewhere allow and log a warning), allow below.
+// This layer is additive: no key, no curl, an API error or a timeout all
+// mean "allow and log skipped". It never relaxes a deterministic guard.
+// State sent to Jev is the tool input only (command, path, truncated text).
+export const semanticRuleGuard = {
+    id: "semantic-rule-guard",
+    name: "Semantic Rule Guard",
+    description: "Judges every Bash/Edit/Write call against your enforced rules with Jev and blocks clear violations",
+    category: "security",
+    event: "PreToolUse",
+    matcher: "Bash|Edit|Write|MultiEdit",
+    canBlock: true,
+    params: [
+        { name: "rules", type: "string[]", description: "Rule statements to enforce (filled from rules marked enforce: true)", required: true },
+        { name: "blockAbove", type: "number", description: "Block when the violation probability is at or above this", default: 0.9, required: false },
+        { name: "askAbove", type: "number", description: "Ask for confirmation when the probability is at or above this (below blockAbove)", default: 0.6, required: false },
+    ],
+    tags: ["semantic", "jev", "rules", "guard"],
+    explain: {
+        allowOnce: "rewrite the call so it clearly does not do what the rule forbids, or answer the ask prompt",
+        change: "harness.yaml > rules: remove enforce: true from the rule, or edit its text; thresholds live under hooks > semantic-rule-guard (blockAbove / askAbove), then omh sync",
+    },
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+case "$TOOL" in Bash|Edit|Write|MultiEdit) ;; *) exit 0 ;; esac
+
+KEY="\${TYPESAFE_API_KEY:-}"
+if [[ -z "$KEY" && -f "$_OMH_PROJECT_ROOT/.env" ]]; then
+  KEY=$(sed -nE 's/^[[:space:]]*(export[[:space:]]+)?TYPESAFE_API_KEY[[:space:]]*=[[:space:]]*"?([^"#[:space:]]+)"?.*/\\2/p' "$_OMH_PROJECT_ROOT/.env" | head -n 1)
+fi
+if [[ -z "$KEY" ]]; then _log_event "allow" "skipped: no TYPESAFE_API_KEY"; exit 0; fi
+command -v curl >/dev/null 2>&1 || { _log_event "allow" "skipped: curl not found"; exit 0; }
+
+# Rules arrive through a quoted heredoc so any characters survive; one rule per separator.
+RULES_RAW=$(cat <<'OMH_RULES'
+{{#each rules}}{{{this}}}
+OMH_RULES_SEP
+{{/each}}
+OMH_RULES
+)
+RULES_JSON=$(printf '%s' "$RULES_RAW" | jq -Rs 'rtrimstr("\\nOMH_RULES_SEP") | split("\\nOMH_RULES_SEP\\n") | map(select(. != ""))')
+[[ "$(echo "$RULES_JSON" | jq 'length')" -gt 0 ]] || exit 0
+
+STATE=$(echo "$INPUT" | jq -c '{
+  tool: .tool_name,
+  command: .tool_input.command,
+  description: .tool_input.description,
+  file_path: .tool_input.file_path,
+  old_string: ((.tool_input.old_string // "") | .[0:2000]),
+  new_string: ((.tool_input.new_string // "") | .[0:4000]),
+  content: ((.tool_input.content // "") | .[0:4000])
+} | with_entries(select(.value != null and .value != ""))')
+BODY=$(jq -cn --argjson state "$STATE" --argjson rules "$RULES_JSON" '{
+  model: "jev-latest", state: $state,
+  questions: ($rules | to_entries | map({
+    key: ("rule:" + ((.key + 1) | tostring)),
+    value: {type: "noul", instructions: ("Does this tool call violate the following project rule? Rule: " + .value + " Answer yes only if the call clearly does what the rule forbids.")}
+  }) | from_entries)}')
+
+RESP=$(curl -sS -m 10 -X POST "\${OMH_TYPESAFE_ENDPOINT:-https://api.typesafe.ai/v1/systemone}" \\
+  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" --data-binary "$BODY" -w '\\n%{http_code}' 2>/dev/null) || RESP=$'\\n000'
+CODE="\${RESP##*$'\\n'}"; RESP="\${RESP%$'\\n'*}"
+if [[ "$CODE" != "200" ]]; then _log_event "allow" "skipped: TypeSafe API $CODE"; exit 0; fi
+
+TOP=$(echo "$RESP" | jq -r '[.answers // {} | to_entries[] | select(.value.type == "noul") | {i: (.key | ltrimstr("rule:") | tonumber), p: .value.noul}] | max_by(.p) // empty | "\\(.i) \\(.p)"')
+[[ -z "$TOP" ]] && { _log_event "allow" "skipped: no answers"; exit 0; }
+IDX="\${TOP%% *}"; P="\${TOP#* }"
+RULE=$(echo "$RULES_JSON" | jq -r --argjson i "$IDX" '.[$i - 1]')
+PSHORT=$(printf '%.2f' "$P")
+BLOCK_AT={{blockAbove}}
+ASK_AT={{askAbove}}
+if awk -v p="$P" -v t="$BLOCK_AT" 'BEGIN { exit !(p >= t) }'; then
+  REASON="oh-my-harness: this call violates an enforced rule (p=$PSHORT): $RULE"
+  _log_event "block" "$REASON"
+  _emit_decision "block" "$REASON"
+  exit 0
+fi
+if awk -v p="$P" -v t="$ASK_AT" 'BEGIN { exit !(p >= t) }'; then
+  REASON="oh-my-harness: this call may violate an enforced rule (p=$PSHORT): $RULE"
+  if printf '%s' "$INPUT" | jq -e 'has("transcript_path")' >/dev/null 2>&1; then
+    _log_event "allow" "ask: $REASON"
+    jq -cn --arg reason "$REASON" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:$reason}}'
+  else
+    _log_event "allow" "warn: $REASON"
+  fi
+  exit 0
+fi
+exit 0`,
+};

package/dist/catalog/blocks/stop-test-gate.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const stopTestGate: BuildingBlock;

package/dist/catalog/blocks/stop-test-gate.js

@@ -0,0 +1,81 @@
+// Stop-event gate (#117): when the agent is about to end its turn with a red
+// test suite, hand the failure back so it keeps working instead of finishing
+// on a broken tree. Two safety valves: Claude's stop_hook_active flag (a Stop
+// hook that blocked once must not block the follow-up stop) and a per-session
+// retry cap kept in .omh/state, which also covers runtimes without that flag.
+// The tree-fingerprint cache shared with commit-test-gate means a suite that
+// just passed on this exact tree is not run again.
+export const stopTestGate = {
+    id: "stop-test-gate",
+    name: "Stop Test Gate",
+    description: "Runs tests when the agent tries to end its turn and sends it back to work while they fail",
+    category: "quality",
+    event: "Stop",
+    canBlock: true,
+    params: [
+        { name: "testCommand", type: "string", description: "Test command to run before the turn may end", required: true },
+        {
+            name: "maxRetries",
+            type: "number",
+            description: "How many times per session the turn may be sent back before the gate gives up and lets it end",
+            default: 2,
+            required: false,
+        },
+        {
+            name: "cacheTtlSeconds",
+            type: "number",
+            description: "Skip the run when the working tree is unchanged since the last pass and that pass is younger than this many seconds (0 disables)",
+            default: 600,
+            required: false,
+        },
+    ],
+    tags: ["stop", "test", "quality", "gate"],
+    explain: {
+        allowOnce: "make the test command pass; after maxRetries send-backs in one session the gate lets the turn end anyway",
+        change: "harness.yaml > hooks > stop-test-gate: change testCommand, maxRetries or cacheTtlSeconds, or remove it, then omh sync",
+    },
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+# A Stop hook that already sent the agent back must not block the follow-up stop.
+[[ "$(echo "$INPUT" | jq -r '.stop_hook_active // false' 2>/dev/null)" == "true" ]] && exit 0
+
+SESSION=$(echo "$INPUT" | jq -r '.session_id // "default"' 2>/dev/null | tr -c 'A-Za-z0-9_-' '_')
+STATE_DIR="\${_OMH_STATE_DIR:-.omh/state}"
+COUNT_FILE="$STATE_DIR/stop-test-gate-\${SESSION}.count"
+COUNT=$(cat "$COUNT_FILE" 2>/dev/null || echo 0)
+[[ "$COUNT" =~ ^[0-9]+$ ]] || COUNT=0
+if [[ "$COUNT" -ge {{maxRetries}} ]]; then
+  _log_event "allow" "stop-test-gate: retry cap ({{maxRetries}}) reached for this session; letting the turn end"
+  exit 0
+fi
+
+FP=$(_omh_tree_fingerprint)
+GATE_CMD=$(cat <<'OMH_GATE_CMD'
+{{{testCommand}}}
+OMH_GATE_CMD
+)
+if _omh_gate_cached stop-test-gate {{cacheTtlSeconds}} "$FP" "$GATE_CMD"; then
+  rm -f "$COUNT_FILE"
+  _log_event "allow" "cached: tree unchanged since last passing run"
+  exit 0
+fi
+
+STATUS=0
+set -o pipefail
+ESC=$'\\x1b'
+OUTPUT=$(NO_COLOR=1 FORCE_COLOR=0 {{{testCommand}}} 2>&1 | sed "s/\${ESC}\\[[0-9;]*[A-Za-z]//g") || STATUS=$?
+if [[ "$STATUS" -ne 0 ]]; then
+  mkdir -p "$STATE_DIR" 2>/dev/null || true
+  echo $((COUNT + 1)) > "$COUNT_FILE"
+  TAIL=$(printf '%s\\n' "$OUTPUT" | tail -n 15)
+  REASON="oh-my-harness: the test suite is failing; fix it before ending the turn (attempt $((COUNT + 1))/{{maxRetries}}):
+$TAIL"
+  _log_event "block" "$REASON"
+  jq -cn --arg r "$REASON" '{decision:"block", reason:$r, hookSpecificOutput:{hookEventName:"Stop", decision:"block", reason:$r}}'
+  exit 0
+fi
+rm -f "$COUNT_FILE"
+_omh_gate_record stop-test-gate "$FP" "$GATE_CMD"
+exit 0`,
+};

package/dist/catalog/blocks/stop-uncommitted-warn.d.ts

@@ -0,0 +1,2 @@
+import type { BuildingBlock } from "../types.js";
+export declare const stopUncommittedWarn: BuildingBlock;

package/dist/catalog/blocks/stop-uncommitted-warn.js

@@ -0,0 +1,30 @@
+// Stop-event notice (#117): when the turn ends with uncommitted changes, say
+// so as a system message. Never blocks; the point is that the human sees what
+// was left behind instead of discovering it later.
+export const stopUncommittedWarn = {
+    id: "stop-uncommitted-warn",
+    name: "Stop Uncommitted Warning",
+    description: "When the agent ends its turn with uncommitted changes, lists them as a system message (never blocks)",
+    category: "git",
+    event: "Stop",
+    canBlock: false,
+    params: [],
+    tags: ["stop", "git", "notice"],
+    template: `#!/bin/bash
+set -euo pipefail
+INPUT=$(cat)
+git rev-parse --is-inside-work-tree >/dev/null 2>&1 || exit 0
+if ! CHANGES=$(git status --porcelain 2>&1); then
+  MSG="oh-my-harness: could not read git status, so uncommitted changes may be unreported: $(printf '%s' "$CHANGES" | head -n 3)"
+  _log_event "allow" "$MSG"
+  jq -cn --arg m "$MSG" '{systemMessage:$m}'
+  exit 0
+fi
+[[ -z "$CHANGES" ]] && exit 0
+N=$(printf '%s\\n' "$CHANGES" | wc -l | tr -d ' ')
+MSG="oh-my-harness: $N uncommitted change(s) left behind:
+$(printf '%s\\n' "$CHANGES" | head -n 20)"
+_log_event "allow" "$MSG"
+jq -cn --arg m "$MSG" '{systemMessage:$m}'
+exit 0`,
+};

package/dist/catalog/types.d.ts

@@ -31,6 +31,8 @@ export interface HookEntry {
     block: string;
     params: Record<string, unknown>;
     mode?: "block" | "ask";
+    /** `omh modify` may never remove or weaken a locked entry (#118). */
+    locked?: boolean;
 }
 export declare const ParamDefinitionSchema: z.ZodObject<{
     name: z.ZodString;
@@ -82,7 +84,7 @@ export declare const BuildingBlockSchema: z.ZodObject<{
     tags: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
     id: string;
-    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "UserPromptSubmit" | "Stop" | "PreCompact" | "PostCompact" | "SubagentStop" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
+    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "Stop" | "SubagentStop" | "UserPromptSubmit" | "PreCompact" | "PostCompact" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
     name: string;
     params: {
         name: string;
@@ -99,7 +101,7 @@ export declare const BuildingBlockSchema: z.ZodObject<{
     matcher?: string | undefined;
 }, {
     id: string;
-    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "UserPromptSubmit" | "Stop" | "PreCompact" | "PostCompact" | "SubagentStop" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
+    event: "PreToolUse" | "PostToolUse" | "SessionStart" | "Notification" | "ConfigChange" | "WorktreeCreate" | "Stop" | "SubagentStop" | "UserPromptSubmit" | "PreCompact" | "PostCompact" | "PreBash" | "PostBash" | "PreEdit" | "PostEdit" | "PreRead" | "PostRead" | "PreWrite" | "PostWrite" | "SessionEnd" | "PreToolResult" | "PostToolResult" | "WorktreeRemove";
     name: string;
     params: {
         name: string;
@@ -119,12 +121,16 @@ export declare const HookEntrySchema: z.ZodObject<{
     block: z.ZodString;
     params: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     mode: z.ZodDefault<z.ZodEnum<["block", "ask"]>>;
+    /** `omh modify` may never remove or weaken a locked entry (#118). */
+    locked: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     block: string;
     params: Record<string, unknown>;
     mode: "block" | "ask";
+    locked?: boolean | undefined;
 }, {
     block: string;
     params?: Record<string, unknown> | undefined;
     mode?: "block" | "ask" | undefined;
+    locked?: boolean | undefined;
 }>;

package/dist/catalog/types.js

@@ -22,4 +22,6 @@ export const HookEntrySchema = z.object({
     block: z.string(),
     params: z.record(z.unknown()).default({}),
     mode: z.enum(["block", "ask"]).default("block"),
+    /** `omh modify` may never remove or weaken a locked entry (#118). */
+    locked: z.boolean().optional(),
 });

package/dist/cli/commands/doctor.js

@@ -5,6 +5,7 @@ import { OMH_HOOKS_DIR } from "../../utils/paths.js";
 import { computeDrift, HarnessNotFoundError } from "../../core/drift.js";
 import { loadProviderConfig } from "../../nl/config-store.js";
 import { resolveTypesafeApiKey } from "../../nl/typesafe-chooser.js";
+import { commandExists } from "../deps-checker.js";
 export async function doctorCommand(options = {}) {
     const projectDir = options.projectDir ?? process.cwd();
     const messages = [];
@@ -185,6 +186,9 @@ async function checkProviderConfig(messages, projectDir) {
     const jev = Boolean(resolveTypesafeApiKey(projectDir));
     if (jev) {
         messages.push("INFO: Chooser: TypeSafe Jev (TYPESAFE_API_KEY found) — `omh init \"...\"` picks catalog blocks with it; no LLM provider needed.");
+        if (!(await commandExists("jgrep"))) {
+            messages.push("INFO: jgrep not found — `npm i -g jevgrep && jgrep init` enables semantic-diff-gate (strict preset, rules with lint:).");
+        }
     }
     const config = await loadProviderConfig();
     if (!config) {

package/dist/cli/commands/init.js

@@ -5,6 +5,7 @@ import { generate } from "../../core/generator.js";
 import { generateHarnessConfig, providerConfigFromEnv } from "../../nl/parse-intent.js";
 import { hasProviderConfig } from "../../nl/config-store.js";
 import { buildPresetHarness, isPresetName, PRESET_NAMES } from "../../core/presets.js";
+import { commandExists } from "../deps-checker.js";
 import { chooseWithJev, harnessFromChoices, resolveTypesafeApiKey, TYPESAFE_MODEL } from "../../nl/typesafe-chooser.js";
 import { detectProject } from "../../detector/project-detector.js";
 import { harnessToMergedConfigV2 } from "../../core/harness-converter-v2.js";
@@ -93,9 +94,10 @@ export async function initWithNL(projectDir, options) {
     const typesafeKey = resolveTypesafeApiKey(projectDir);
     const registryBlocks = registry.list();
     let harness;
+    const jgrep = await commandExists("jgrep");
     if (preset) {
-        harness = buildPresetHarness(preset, facts, { description: description || undefined });
-        console.log(`preset: ${preset}`);
+        harness = buildPresetHarness(preset, facts, { description: description || undefined }, { jgrep });
+        console.log(`preset: ${preset}${preset === "strict" ? (jgrep ? " (jgrep found: semantic-diff-gate enabled)" : " (install jgrep to add the semantic diff gate: npm i -g jevgrep)") : ""}`);
     }
     else if (options.nlRunner) {
         harness = await generateHarnessConfig(description, options.nlRunner, catalogBlocks, facts);
@@ -103,7 +105,7 @@ export async function initWithNL(projectDir, options) {
     else if (typesafeKey && description) {
         try {
             const result = await chooseWithJev({ description, facts, blocks: registryBlocks }, { apiKey: typesafeKey });
-            const applied = harnessFromChoices(result, facts, { description });
+            const applied = harnessFromChoices(result, facts, { description }, { jgrep });
             const on = [...result.blocks].filter(([, v]) => v === "on").map(([k]) => k);
             const off = [...result.blocks].filter(([, v]) => v === "off").map(([k]) => k);
             const undecided = [...result.blocks].filter(([, v]) => v === "undecided").map(([k]) => k);

package/dist/cli/commands/modify.d.ts

@@ -0,0 +1,8 @@
+export interface ModifyOptions {
+    projectDir?: string;
+    yes?: boolean;
+    dryRun?: boolean;
+}
+export declare function modifyCommand(requestParts: string[], options?: ModifyOptions): Promise<{
+    exitCode: number;
+}>;