specpipe 1.0.0 → 1.0.2

package/src/lib/installer.js

@@ -11,14 +11,10 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
  * Component → file mappings.
  */
 export const COMPONENTS = {
-  hooks: [
-    '.claude/hooks/file-guard.js',
-    '.claude/hooks/path-guard.sh',
-    '.claude/hooks/comment-guard.js',
-    '.claude/hooks/glob-guard.js',
-    '.claude/hooks/self-review.sh',
-    '.claude/hooks/sensitive-guard.sh',
-  ],
+  // Hooks + settings.json are no longer static files — they're emitted per agent
+  // from the hook registry (hooks.js) via installAgentHooks. Kept as an (empty)
+  // component so `--only hooks` still resolves; init routes it to the emitter.
+  hooks: [],
   skills: [
     'skills/sp-explore/SKILL.md',
     'skills/sp-scaffold/SKILL.md',
@@ -44,31 +40,54 @@ export const COMPONENTS = {
     'skills/sp-md-render/components.md',
     'skills/sp-humanize/SKILL.md',
   ],
-  config: [
-    '.claude/settings.json',
-    '.claude/CLAUDE.md',
-  ],
-  docs: [
-    'docs/WORKFLOW.md',
-  ],
+  // CLAUDE.md is no longer a static file — it's emitted from the single rules source
+  // (kit/rules/specpipe-rules.md) as a marked section, like every other agent's rules.
+  config: [],
+  // docs/WORKFLOW.md was dropped — its content is covered by the skills (detailed) and
+  // the rules hub's workflow table. The user's docs/ holds only their own specs.
+  docs: [],
 };
 
+// ── Skill selection ─────────────────────────────────────────────────────────
+// Skills installed by default but safe to drop — standalone, not part of the
+// spec→build→review pipeline. Tagged "(optional)" in the interactive picker.
+export const OPTIONAL_SKILLS = ['sp-spec-render', 'sp-md-render', 'sp-humanize'];
+
+/** Every skill name (sp-*), derived from the skill component list. */
+export const ALL_SKILL_NAMES = [...new Set(COMPONENTS.skills.map((p) => p.split('/')[1]))];
+
 /**
- * Placeholder directories to create.
+ * Resolve a `--skills` value into a Set of selected skill names, or null = all.
+ * Accepts 'all', 'core' (all minus OPTIONAL_SKILLS), or a comma list of names
+ * (with or without the `sp-` prefix). Throws on an unknown name.
  */
-export const PLACEHOLDER_DIRS = [
-  'docs/specs',
-  'docs/test-plans',
-];
+export function resolveSkills(spec) {
+  if (!spec || spec === 'all') return null;
+  if (spec === 'core') return new Set(ALL_SKILL_NAMES.filter((n) => !OPTIONAL_SKILLS.includes(n)));
+  const names = spec.split(',').map((s) => s.trim()).filter(Boolean)
+    .map((n) => (n.startsWith('sp-') ? n : `sp-${n}`));
+  const unknown = names.filter((n) => !ALL_SKILL_NAMES.includes(n));
+  if (unknown.length) {
+    throw new Error(`Unknown skill(s): ${unknown.join(', ')}. Valid: ${ALL_SKILL_NAMES.join(', ')}, all, core`);
+  }
+  return new Set(names);
+}
 
 /**
- * Files that need +x permission.
+ * Whether a template file path is allowed under a skill selection (null = all).
+ * Non-skill files (hooks, config, docs) always pass; skill files pass only when
+ * their skill name is in the set.
  */
-export const EXECUTABLE_FILES = [
-  '.claude/hooks/path-guard.sh',
-  '.claude/hooks/self-review.sh',
-  '.claude/hooks/sensitive-guard.sh',
-];
+export function skillAllowed(filePath, skillsSet) {
+  if (!skillsSet) return true;
+  const m = filePath.replace(/\\/g, '/').match(/^skills\/([^/]+)\//);
+  return !m || skillsSet.has(m[1]);
+}
+
+
+// Files needing +x. Empty: guard scripts get +x at emit time (installAgentHooks
+// chmods them); none are installed as plain COMPONENTS files anymore.
+export const EXECUTABLE_FILES = [];
 
 /**
  * Get path to kit (templates) directory.
@@ -135,24 +154,10 @@ export async function installFile(relativePath, targetDir, { force = false } = {
 // re-exported here so callers keep importing from installer.js.
 export {
   installSkillForAgent, installAgentSkills, installAgentRules,
-  mergeAgentsMdGuards, stripAgentsMdGuards,
+  mergeRulesSection, stripRulesSection,
   installAgentHooks, removeAgentHooks,
 } from './agent-install.js';
 
-/**
- * Create a placeholder directory with .gitkeep.
- */
-export async function ensurePlaceholderDir(dir, targetDir) {
-  const fullPath = join(targetDir, dir);
-  if (existsSync(fullPath)) {
-    log.skip(`${dir}/ (exists)`);
-    return;
-  }
-  await mkdir(fullPath, { recursive: true });
-  await writeFile(join(fullPath, '.gitkeep'), '');
-  log.make(`${dir}/`);
-}
-
 /**
  * Set executable permissions on relevant files.
  */
@@ -167,28 +172,34 @@ export async function setPermissions(targetDir) {
   }
 }
 
+// Every file the rules section can land in (per agent). fillTemplate fills the
+// detected Project Info into whichever ones exist.
+export const RULE_FILES = [
+  '.claude/CLAUDE.md',
+  'AGENTS.md',
+  '.cursor/rules/specpipe-rules.mdc',
+  '.agents/rules/specpipe-rules.md',
+  'SPECPIPE-RULES.md',
+];
+
 /**
- * Fill [CUSTOMIZE] placeholders in CLAUDE.md with detected project info.
+ * Fill the `[CUSTOMIZE]` Project Info placeholders in every installed rules file with
+ * the detected project info. Rules are emitted per agent (CLAUDE.md, AGENTS.md, …), so
+ * fill all of them, not just CLAUDE.md.
  */
 export async function fillTemplate(targetDir, projectInfo) {
   if (!projectInfo) return;
-
-  const claudeMdPath = join(targetDir, '.claude/CLAUDE.md');
-  try {
-    let content = await readFile(claudeMdPath, 'utf-8');
-    content = content
-      .replace(/\[CUSTOMIZE\] Language:.*/, `**Language:** ${projectInfo.lang}`)
-      .replace(/\[CUSTOMIZE\] Test framework:.*/, `**Test framework:** ${projectInfo.framework}`)
-      .replace(/\[CUSTOMIZE\] Source directory:.*/, `**Source directory:** ${projectInfo.srcDir}`)
-      .replace(/\[CUSTOMIZE\] Test directory:.*/, `**Test directory:** ${projectInfo.testDir}`)
-      // Also handle the format without [CUSTOMIZE] prefix
-      .replace(/\*\*Language:\*\* \[CUSTOMIZE\]/, `**Language:** ${projectInfo.lang}`)
-      .replace(/\*\*Test framework:\*\* \[CUSTOMIZE\]/, `**Test framework:** ${projectInfo.framework}`)
-      .replace(/\*\*Source directory:\*\* \[CUSTOMIZE\]/, `**Source directory:** ${projectInfo.srcDir}`)
-      .replace(/\*\*Test directory:\*\* \[CUSTOMIZE\]/, `**Test directory:** ${projectInfo.testDir}`);
-    await writeFile(claudeMdPath, content);
-  } catch {
-    // CLAUDE.md might not exist
+  for (const rel of RULE_FILES) {
+    const p = join(targetDir, rel);
+    try {
+      const before = await readFile(p, 'utf-8');
+      const after = before
+        .replace(/\*\*Language:\*\* \[CUSTOMIZE\]/, `**Language:** ${projectInfo.lang}`)
+        .replace(/\*\*Test framework:\*\* \[CUSTOMIZE\]/, `**Test framework:** ${projectInfo.framework}`)
+        .replace(/\*\*Source directory:\*\* \[CUSTOMIZE\]/, `**Source directory:** ${projectInfo.srcDir}`)
+        .replace(/\*\*Test directory:\*\* \[CUSTOMIZE\]/, `**Test directory:** ${projectInfo.testDir}`);
+      if (after !== before) await writeFile(p, after);
+    } catch { /* file not installed for this agent — skip */ }
   }
 }
 
@@ -208,6 +219,7 @@ export async function verifySettingsJson(targetDir) {
 // Claude's global install (~/.claude/skills + hooks + settings.json) lives in
 // claude-global.js; re-exported here so callers keep importing from installer.js.
 export {
-  getGlobalSkillsDir, getGlobalHooksDir, installHookGlobal,
-  mergeGlobalSettings, removeGlobalHooksFromSettings, installSkillGlobal,
+  getGlobalHooksDir, installHookGlobal,
+  mergeGlobalSettings, removeGlobalHooksFromSettings,
+  installSkillGlobalForAgent,
 } from './claude-global.js';

package/src/lib/reconcile.js

@@ -1,10 +1,10 @@
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { hashContent } from './hasher.js';
-import { getAllFiles, COMPONENTS, getTemplateDir } from './installer.js';
-import { emitFile, emitRules } from './agents.js';
+import { getAllFiles, COMPONENTS, getTemplateDir, skillAllowed } from './installer.js';
+import { emitFile, emitRules, AGENTS } from './agents.js';
 
-export const GUARDS_TEMPLATE_REL = 'rules/specpipe-guards.md';
+export const RULES_TEMPLATE_REL = 'rules/specpipe-rules.md';
 
 /**
  * Template files a given agent receives. Claude gets the full kit
@@ -13,7 +13,11 @@ export const GUARDS_TEMPLATE_REL = 'rules/specpipe-guards.md';
  * hooks are Claude-specific.
  */
 export function templateFilesForAgent(agentId) {
-  return agentId === 'claude' ? getAllFiles() : COMPONENTS.skills;
+  if (agentId === 'claude') return getAllFiles();
+  // Agents that don't read project-local skills (Hermes scans only ~/.hermes/skills/)
+  // get no per-project skill files — they'd be dead. Their rules doc is still emitted.
+  if (AGENTS[agentId]?.perProjectSkills === false) return [];
+  return COMPONENTS.skills;
 }
 
 /**
@@ -22,13 +26,14 @@ export function templateFilesForAgent(agentId) {
  * @returns {Promise<Map<string, {agent, templateRel, content, kitHash}>>}
  *          keyed by installed (on-disk) relative path.
  */
-export async function computeDesired(agents) {
+export async function computeDesired(agents, skillsSet = null) {
   const dir = getTemplateDir();
   const desired = new Map();
-  const guardsBody = await readFile(join(dir, GUARDS_TEMPLATE_REL), 'utf-8');
+  const guardsBody = await readFile(join(dir, RULES_TEMPLATE_REL), 'utf-8');
 
   for (const agent of agents) {
     for (const templateRel of templateFilesForAgent(agent)) {
+      if (!skillAllowed(templateRel, skillsSet)) continue;
       const content = await readFile(join(dir, templateRel), 'utf-8');
       const emitted = emitFile(agent, templateRel, content);
       desired.set(emitted.path, {
@@ -43,10 +48,10 @@ export async function computeDesired(agents) {
     // are reconciled like any other file. Codex's AGENTS.md is shared, not owned
     // here — it's merged/stripped separately.
     const rules = emitRules(agent, guardsBody);
-    if (rules && rules.mode !== 'agents-md') {
+    if (rules && rules.mode !== 'merge') {
       desired.set(rules.path, {
         agent,
-        templateRel: GUARDS_TEMPLATE_REL,
+        templateRel: RULES_TEMPLATE_REL,
         content: rules.content,
         kitHash: hashContent(rules.content),
       });

package/templates/{.claude/hooks → hooks}/file-guard.js

@@ -147,10 +147,18 @@ function main() {
   const filePath = payload.tool_input?.file_path;
   if (!filePath) process.exit(0);
 
-  // Skip files outside the project directory (e.g. ~/.claude/plans/)
-  const projectDir = process.cwd() + path.sep;
+  // Cursor's generic postToolUse fires for EVERY tool (Read, Grep, Shell, …); only act
+  // on writes/edits. Claude's PostToolUse matcher already restricts this, so tool_name is
+  // either a write-ish name or absent there — both pass.
+  const toolName = payload.tool_name;
+  if (toolName && !/^(Write|Edit|MultiEdit|write_to_file|replace_file_content)/i.test(toolName)) process.exit(0);
+
+  // Skip files outside the project directory (e.g. ~/.claude/plans/). Cursor passes the
+  // project root in workspace_roots; otherwise fall back to cwd.
+  const projectRoot = (Array.isArray(payload.workspace_roots) && payload.workspace_roots[0]) || process.cwd();
+  const projectDir = projectRoot + path.sep;
   const resolvedFile = path.resolve(filePath);
-  if (!resolvedFile.startsWith(projectDir) && resolvedFile !== process.cwd()) process.exit(0);
+  if (!resolvedFile.startsWith(projectDir) && resolvedFile !== projectRoot) process.exit(0);
 
   // Skip non-source-code files (docs, configs, templates are naturally long)
   const ext = path.extname(filePath).toLowerCase();
@@ -173,14 +181,8 @@ function main() {
   try {
     const stat = fs.statSync(filePath);
     if (stat.size > MAX_BYTES) {
-      const rel = path.relative(process.cwd(), filePath);
-      process.stdout.write(JSON.stringify({
-        continue: true,
-        hookSpecificOutput: {
-          hookEventName: "PostToolUse",
-          additionalContext: `Warning: ${rel} is ${Math.round(stat.size / 1024)}KB. Consider splitting into smaller modules.`,
-        },
-      }) + "\n");
+      const rel = path.relative(projectRoot, filePath);
+      emitWarning(`Warning: ${rel} is ${Math.round(stat.size / 1024)}KB. Consider splitting into smaller modules.`, payload);
       process.exit(0);
     }
     const buf = fs.readFileSync(filePath);
@@ -194,18 +196,21 @@ function main() {
   if (lineCount <= THRESHOLD) process.exit(0);
 
   // Inject non-blocking warning
-  const rel = path.relative(process.cwd(), filePath);
-  const warning = `Warning: ${rel} has ${lineCount} lines (threshold: ${THRESHOLD}). Consider splitting into smaller, focused modules.`;
+  const rel = path.relative(projectRoot, filePath);
+  emitWarning(`Warning: ${rel} has ${lineCount} lines (threshold: ${THRESHOLD}). Consider splitting into smaller, focused modules.`, payload);
+}
 
-  process.stdout.write(
-    JSON.stringify({
+// Inject an advisory warning in the agent's native shape. Cursor's postToolUse reads
+// `additional_context`; Claude (and Codex PostToolUse) read hookSpecificOutput.additionalContext.
+function emitWarning(warning, payload) {
+  if (payload.cursor_version || payload.hook_event_name === "postToolUse") {
+    process.stdout.write(JSON.stringify({ additional_context: warning }) + "\n");
+  } else {
+    process.stdout.write(JSON.stringify({
       continue: true,
-      hookSpecificOutput: {
-        hookEventName: "PostToolUse",
-        additionalContext: warning,
-      },
-    }) + "\n"
-  );
+      hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: warning },
+    }) + "\n");
+  }
 }
 
 try {

package/templates/hooks/specpipe-read-guard.sh

@@ -1,42 +1,115 @@
 #!/usr/bin/env bash
 # specpipe-read-guard.sh — blocking pre-file-read hook (enforced guardrail).
 #
-# For agents whose pre-read payload puts the path at .file_path (Cursor
-# beforeReadFile) or .tool_input.file_path (Claude/Codex Read). Blocks (exit 2)
-# reads of secret files; allows *.example / *.sample / *.template.
+# The single file-access guard for every agent. Reads the target path from
+# whichever shape the agent's payload uses:
+#   .tool_input.file_path (Claude/Codex Read/Write/Edit)  ·  .file_path (Cursor beforeReadFile)
+#
+# Blocks (exit 2) reads/writes of secret files: .env, private keys, credentials,
+# tokens. Allows *.example / *.sample / *.template. Honors .agentignore.
 #
 # Exit codes: 0 = allow, 2 = block (reason on stderr).
+# Env: SENSITIVE_GUARD_EXTRA — extra pipe-separated path patterns to block.
 set -euo pipefail
 
 INPUT=$(cat)
 [[ -z "$INPUT" ]] && exit 0
 
+# Security guard: warn loudly if Node is missing rather than silently allowing.
+if ! command -v node &>/dev/null; then
+  echo "WARNING: read-guard degraded — Node.js not found. Sensitive files are NOT fully protected." >&2
+  exit 0
+fi
+
 extract_path() {
-  if command -v node &>/dev/null; then
-    printf '%s' "$1" | node -e "
-      try {
-        const d = JSON.parse(require('fs').readFileSync(0,'utf-8'));
-        const p = d.file_path ?? d.tool_input?.file_path ?? d.path;
-        if (typeof p === 'string') process.stdout.write(p);
-      } catch {}
-    " 2>/dev/null
-  else
-    printf '%s' "$1" | grep -oE '\"file_path\"[[:space:]]*:[[:space:]]*\"[^\"]*\"' | head -1 | sed -E 's/.*:[[:space:]]*\"//;s/\"$//'
+  printf '%s' "$1" | node -e "
+    try {
+      const d = JSON.parse(require('fs').readFileSync(0,'utf-8'));
+      const p = d.tool_input?.file_path ?? d.file_path ?? d.tool_input?.path ?? d.path;
+      if (typeof p === 'string') process.stdout.write(p);
+    } catch {}
+  " 2>/dev/null
+}
+
+FILE_PATH=$(extract_path "$INPUT") || exit 0
+[[ -z "$FILE_PATH" ]] && exit 0
+
+# ─── Fast-path: obviously safe source/doc files (json still checked) ─
+fast_path_safe() {
+  local ext="${1##*.}"
+  case "$ext" in
+    md|ts|tsx|js|jsx|css|scss|html|svg|yaml|yml|toml|xml|txt|sh|py|rb|rs|go|java|kt|swift|c|cpp|h|hpp|cs|vue|svelte|astro)
+      return 0 ;;
+  esac
+  return 1
+}
+
+# ─── Sensitive filename detection ───────────────────────────────────
+is_sensitive() {
+  local filepath="$1" basename
+  basename=$(basename "$filepath" 2>/dev/null) || return 1
+
+  case "$basename" in
+    .env|.env.local|.env.development|.env.production|.env.staging|.env.test) return 0 ;;
+    .npmrc|.pypirc|.netrc) return 0 ;;
+    id_rsa|id_ecdsa|id_ed25519|id_dsa) return 0 ;;
+    serviceAccountKey.json|service-account*.json) return 0 ;;
+    config.json) [[ "$filepath" == *".docker/config.json"* ]] && return 0 ;;
+  esac
+  case "$basename" in
+    *.pem|*.key|*.p12|*.pfx|*.jks|*.keystore|*.truststore) return 0 ;;
+    *_rsa|*_ecdsa|*_ed25519|*_dsa) return 0 ;;
+  esac
+  local lower
+  lower=$(echo "$basename" | tr '[:upper:]' '[:lower:]')
+  case "$lower" in
+    *credential*|*secret*|*private_key*|*privatekey*) return 0 ;;
+    firebase-adminsdk*) return 0 ;;
+  esac
+  if [[ "$basename" =~ ^\.env\. ]]; then
+    case "$basename" in
+      .env.example|.env.sample|.env.template) return 1 ;;
+      *) return 0 ;;
+    esac
   fi
+  if [[ -n "${SENSITIVE_GUARD_EXTRA:-}" ]] && printf '%s\n' "$filepath" | grep -qE "$SENSITIVE_GUARD_EXTRA"; then
+    return 0
+  fi
+  return 1
 }
 
-P=$(extract_path "$INPUT") || exit 0
-[[ -z "$P" ]] && exit 0
+# ─── .agentignore / .aiignore / .cursorignore ───────────────────────
+check_agentignore() {
+  local filepath="$1" ignorefile=""
+  for candidate in .agentignore .aiignore .cursorignore; do
+    [[ -f "$candidate" ]] && { ignorefile="$candidate"; break; }
+  done
+  [[ -z "$ignorefile" ]] && return 1
+
+  local normalized_fp normalized_pwd relpath
+  normalized_fp=$(printf '%s' "$filepath" | tr '\\' '/')
+  normalized_pwd=$(pwd | tr '\\' '/')
+  relpath=$(printf '%s' "$normalized_fp" | sed "s|^${normalized_pwd}/||") 2>/dev/null || relpath="$filepath"
 
-# Allow example/template variants.
-case "$P" in
+  while IFS= read -r pattern || [[ -n "$pattern" ]]; do
+    [[ -z "$pattern" || "$pattern" == \#* ]] && continue
+    if [[ "$relpath" == $pattern ]] || [[ "$(basename "$relpath")" == $pattern ]]; then
+      return 0
+    fi
+  done < "$ignorefile"
+  return 1
+}
+
+# ─── Allow example/template variants outright ───────────────────────
+case "$FILE_PATH" in
   *.example|*.sample|*.template) exit 0 ;;
 esac
 
-SECRET="(\.env)($|\.[A-Za-z0-9]+$)|\.(pem|key|p12|pfx|keystore)$|id_(rsa|ed25519|ecdsa)$|(credentials|secrets?)\.(json|ya?ml|toml|txt)$"
-if printf '%s\n' "$P" | grep -qiE "$SECRET"; then
-  echo "Blocked: '$P' is a secret file. Use its .example variant, or ask the user first." >&2
-  exit 2
+if ! fast_path_safe "$FILE_PATH"; then
+  if is_sensitive "$FILE_PATH" || check_agentignore "$FILE_PATH"; then
+    echo "Blocked: '$FILE_PATH' is a sensitive file (secrets, keys, or credentials). Use its .example variant, or ask the user first." >&2
+    exit 2
+  fi
 fi
 
 exit 0

package/templates/hooks/specpipe-shell-guard.sh

@@ -1,29 +1,68 @@
 #!/usr/bin/env bash
 # specpipe-shell-guard.sh — blocking pre-shell/pre-tool hook (enforced guardrail).
 #
-# Portable across agents whose hook payload puts the shell command at either
-#   .tool_input.command   (Codex PreToolUse, Claude PreToolUse)
+# The single shell guard for every agent. Reads the command from whichever shape
+# the agent's hook payload uses:
+#   .tool_input.command   (Claude PreToolUse, Codex PreToolUse)
 #   .command              (Cursor beforeShellExecution)
-# Blocks (exit 2) commands that explore wasteful directories or touch secrets.
+#
+# Two protections:
+#   1. Secrets — commands that read/copy credential files (.env, keys, …).
+#        SECRET_POLICY=block (default) → exit 2; =warn → warn on stderr, exit 0
+#        (the approval flow: Claude asks the user, then may `cat .env`).
+#   2. Wasteful dirs — exploring node_modules / build output / caches, which
+#        burns tokens. Always blocks (exit 2) when an exploration verb is present.
 #
 # Exit codes: 0 = allow, 2 = block (reason on stderr). Exit 2 is the portable
 # block primitive honored by Claude, Codex, and Cursor.
+#
+# Env:
+#   SECRET_POLICY          block (default) | warn
+#   PATH_GUARD_EXTRA       extra pipe-separated dir patterns to block
+#   SENSITIVE_GUARD_EXTRA  extra pipe-separated secret patterns to block
 set -euo pipefail
 
 INPUT=$(cat)
 [[ -z "$INPUT" ]] && exit 0
+POLICY="${SECRET_POLICY:-block}"
+
+# Antigravity honors a stdout JSON decision ({"decision":"deny","reason":…}), NOT exit
+# codes — a non-zero exit is logged as a hook failure and falls through to its native
+# permission prompt. Detect its payload shape so block() emits the right thing.
+IS_ANTIGRAVITY=0
+printf '%s' "$INPUT" | grep -q '"toolCall"' && IS_ANTIGRAVITY=1
+
+# Block primitive. Antigravity → stdout JSON deny (+ exit 0, clean). Everyone else →
+# reason on stderr + exit 2 (honored by Claude/Codex directly, Cursor via failClosed).
+block() {
+  local reason="$1"
+  if [[ "$IS_ANTIGRAVITY" == "1" ]]; then
+    local esc; esc=$(printf '%s' "$reason" | sed 's/\\/\\\\/g; s/"/\\"/g')
+    printf '{"decision":"deny","reason":"%s"}\n' "$esc"
+    exit 0
+  fi
+  echo "$reason" >&2
+  exit 2
+}
 
+# ─── Extract command (multi-payload) ────────────────────────────────
+# Covers every agent's hook payload shape:
+#   .tool_input.command   Claude / Codex (PreToolUse Bash)
+#   .command              Cursor (beforeShellExecution)
+#   .tool_args.CommandLine  Antigravity (PreToolUse run_command) — verified 2026
 extract_command() {
   if command -v node &>/dev/null; then
     printf '%s' "$1" | node -e "
       try {
         const d = JSON.parse(require('fs').readFileSync(0,'utf-8'));
-        const c = d.tool_input?.command ?? d.command;
+        const a = d.toolCall?.args ?? {};   // Antigravity 1.0.13: { toolCall: { args: { CommandLine } } }
+        const c = d.tool_input?.command ?? d.command ?? d.tool_args?.CommandLine
+                  ?? a.CommandLine ?? a.Command ?? a.command;
         if (typeof c === 'string') process.stdout.write(c);
       } catch {}
     " 2>/dev/null
   else
-    printf '%s' "$1" | grep -oE '\"command\"[[:space:]]*:[[:space:]]*\"[^\"]*\"' | head -1 | sed -E 's/.*:[[:space:]]*\"//;s/\"$//'
+    printf '%s' "$1" | grep -oE '"(command|CommandLine)"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed -E 's/.*:[[:space:]]*"//;s/"$//'
   fi
 }
 
@@ -32,34 +71,87 @@ COMMAND=$(extract_command "$INPUT") || exit 0
 
 SEP="[/\\\\]"
 
-# Secrets: block reading/copying credential files (allow *.example / *.sample).
-SECRET="(^|[ /\\\\\"'])(\.env)($|[ /\\\\\"'.])"
-SECRET+="|(^|[ /\\\\])\.env\.[A-Za-z0-9]+"
-SECRET+="|\.(pem|key|p12|pfx|keystore)(\b|$)"
-SECRET+="|(^|[ /\\\\])id_(rsa|ed25519|ecdsa)"
-SECRET+="|(credentials|secrets?)\.(json|ya?ml|toml|txt)"
-if printf '%s\n' "$COMMAND" | grep -qiE '(^|[ |;&`(])(cat|less|more|head|tail|bat|cp|nano|vi|vim|grep|rg|strings|xxd|od|base64)([ ])'; then
-  CLEAN=$(printf '%s\n' "$COMMAND" | sed -E 's/\.env\.(example|sample|template)//g')
-  if printf '%s\n' "$CLEAN" | grep -qiE "$SECRET"; then
-    echo "Blocked: command accesses a secret file (.env / key / credentials). Use .env.example, or ask the user first." >&2
-    exit 2
+# ─── Secrets in the command ─────────────────────────────────────────
+# Only flag when a read/copy verb is present (so "echo use .env.example" or
+# variable assignments don't trip the guard).
+handle_secret() {
+  local match="$1"
+  if [[ "$POLICY" == "warn" ]]; then
+    echo "Warning: '$match' is a sensitive file. If the user approved this access, proceed. Otherwise ask the user first before reading secrets." >&2
+    exit 0
   fi
-fi
+  block "Blocked: command accesses a secret file ('$match'). Use its .example variant, or ask the user first."
+}
 
-# Wasteful directories: only when an exploration verb is present.
-EXPLORE="(^|[[:space:]|;&\`(])(ls|ll|la|find|cat|head|tail|less|more|wc|stat|du|tree|bat|od|xxd|hexdump|nl)([[:space:]]|$)"
-printf '%s\n' "$COMMAND" | grep -qE "$EXPLORE" || exit 0
+# No verb gate here (matches the original sensitive-guard): a secret referenced
+# anywhere in the command is flagged — `ssh -i id_rsa`, `openssl -in cert.pem`,
+# `gcloud --key-file=…` included. The .example/.sample/.template strip avoids the
+# obvious false positives.
+CLEAN=$(printf '%s\n' "$COMMAND" | sed -E 's/\.env\.(example|sample|template)//g')
 
+SENSITIVE_IN_CMD=$(printf '%s\n' "$CLEAN" | grep -oE '[\./[:alnum:]_-]*\.env([\.[:alnum:]_-]*)?' | head -5) || true
+if [[ -n "$SENSITIVE_IN_CMD" ]]; then
+  while IFS= read -r m; do
+    [[ -z "$m" ]] && continue
+    case "$m" in *.example|*.sample|*.template) continue ;; esac
+    handle_secret "$m"
+  done <<< "$SENSITIVE_IN_CMD"
+fi
+KEY_IN_CMD=$(printf '%s\n' "$CLEAN" | grep -oE '[[:alnum:]_./-]*\.(pem|key|p12|pfx|jks|keystore)($|[^[:alnum:]])' | head -3) || true
+[[ -n "$KEY_IN_CMD" ]] && handle_secret "$(printf '%s' "$KEY_IN_CMD" | head -1)"
+NAME_IN_CMD=$(printf '%s\n' "$CLEAN" | grep -oiE '(id_rsa|id_ecdsa|id_ed25519|id_dsa|serviceAccountKey\.json|service-account[[:alnum:]_-]*\.json|\.npmrc|\.pypirc|\.netrc)' | head -3) || true
+[[ -n "$NAME_IN_CMD" ]] && handle_secret "$(printf '%s' "$NAME_IN_CMD" | head -1)"
+CRED_IN_CMD=$(printf '%s\n' "$CLEAN" | grep -oiE '[[:alnum:]_./-]*(credential|secret|private_key|privatekey)[[:alnum:]_./-]*' | head -3) || true
+[[ -n "$CRED_IN_CMD" ]] && handle_secret "$(printf '%s' "$CRED_IN_CMD" | head -1)"
+if [[ -n "${SENSITIVE_GUARD_EXTRA:-}" ]] && printf '%s\n' "$CLEAN" | grep -qE "$SENSITIVE_GUARD_EXTRA"; then
+  handle_secret "$(printf '%s\n' "$CLEAN" | grep -oE "$SENSITIVE_GUARD_EXTRA" | head -1)"
+fi
+
+# ─── Wasteful directories ───────────────────────────────────────────
 BLOCKED="(^|[ /\\\\])node_modules(${SEP}|$| )"
-BLOCKED+="|(__pycache__)|\.git${SEP}(objects|refs)"
-BLOCKED+="|(^|[ /\\\\])dist${SEP}|(^|[ /\\\\])build${SEP}|\.next${SEP}"
-BLOCKED+="|(^|[ /\\\\])vendor(${SEP}|$| )|(^|[ /\\\\])target${SEP}"
-BLOCKED+="|(^|[ /\\\\])\.venv${SEP}|(^|[ /\\\\])venv${SEP}|\.pytest_cache${SEP}|\.cache(${SEP}|$| )"
-CLEAN=$(printf '%s\n' "$COMMAND" | sed -E "s|node_modules[/\\]\.bin[/\\][^[:space:]]*||g")
-if printf '%s\n' "$CLEAN" | grep -qE "$BLOCKED"; then
-  M=$(printf '%s\n' "$COMMAND" | grep -oE "$BLOCKED" | head -1)
-  echo "Blocked: command explores '$M' — a large/generated directory. Use scoped paths or Grep." >&2
-  exit 2
+BLOCKED+="|(__pycache__)"
+BLOCKED+="|\.git${SEP}(objects|refs)"
+BLOCKED+="|(^|[ /\\\\])dist${SEP}"
+BLOCKED+="|(^|[ /\\\\])build${SEP}"
+BLOCKED+="|\.next${SEP}"
+BLOCKED+="|(^|[ /\\\\])vendor(${SEP}|$| )"
+BLOCKED+="|(^|[ /\\\\])Pods(${SEP}|$| )"
+BLOCKED+="|\.build${SEP}"
+BLOCKED+="|DerivedData"
+BLOCKED+="|\.gradle${SEP}"
+BLOCKED+="|(^|[ /\\\\])target${SEP}"
+BLOCKED+="|\.nuget"
+BLOCKED+="|\.cache(${SEP}|$| )"
+BLOCKED+="|(^|[ /\\\\])\.venv${SEP}"
+BLOCKED+="|(^|[ /\\\\])venv${SEP}"
+BLOCKED+="|\.mypy_cache${SEP}"
+BLOCKED+="|\.pytest_cache${SEP}"
+BLOCKED+="|\.ruff_cache${SEP}"
+BLOCKED+="|\.egg-info(${SEP}|$| )"
+BLOCKED+="|(^|[ /\\\\])bin${SEP}(Debug|Release|net|x64|x86)"
+BLOCKED+="|(^|[ /\\\\])obj${SEP}(Debug|Release|net)"
+BLOCKED+="|\.nuxt${SEP}"
+BLOCKED+="|\.svelte-kit${SEP}"
+BLOCKED+="|\.parcel-cache${SEP}"
+BLOCKED+="|\.turbo${SEP}"
+BLOCKED+="|(^|[ /\\\\])out${SEP}(server|static|_next)"
+BLOCKED+="|\.bundle${SEP}"
+
+if [[ -n "${PATH_GUARD_EXTRA:-}" ]]; then
+    BLOCKED+="|$PATH_GUARD_EXTRA"
+fi
+
+EXPLORE_VERB_RE="(^|[[:space:]|;&\`(])(ls|ll|la|find|cat|head|tail|less|more|wc|stat|du|tree|bat|od|xxd|hexdump|nl)([[:space:]]|$)"
+if ! printf '%s\n' "$COMMAND" | grep -qE "$EXPLORE_VERB_RE"; then
+    exit 0
+fi
+
+# Strip node_modules/.bin/<binary> — executing an installed binary isn't exploration.
+COMMAND_FOR_CHECK=$(printf '%s\n' "$COMMAND" | sed -E "s|node_modules[/\\]\.bin[/\\][^[:space:]]*||g")
+
+if printf '%s\n' "$COMMAND_FOR_CHECK" | grep -qE "$BLOCKED"; then
+    MATCHED=$(printf '%s\n' "$COMMAND" | grep -oE "$BLOCKED" | head -1)
+    block "Blocked: command references '$MATCHED' — this directory is typically large and exploring it wastes tokens. Use Glob or Grep tools instead."
 fi
 
 exit 0