rules.json

[
  {
    "id": "ssh-db-mutation",
    "description": "Block gcloud compute ssh with inline DB or Moodle config commands",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "gcloud[[:space:]]+compute[[:space:]]+ssh.*--command.*(php[[:space:]]+-r|set_config|mdl_|scorm_|mysql[[:space:]]+-|mysqldump|\\$DB->)"
      }
    ],
    "action": "block",
    "bypass_marker": "ssh-db-rule",
    "memory_ref": "feedback_scripts_not_db.md",
    "message": "BLOCKED: gcloud compute ssh + inline DB/Moodle command detected.\n\nUse a versioned script in scripts/ instead. If none fits, write+commit\none first. Bypass: add \"// hook-bypass: ssh-db-rule\" to the command.\n",
    "tests": [
      {
        "name": "blocks-ssh-php-r",
        "input": {
          "tool_input": {
            "command": "gcloud compute ssh acme-vm --command=\"docker exec moodle php -r 'var_dump(1);'\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-ssh-set-config",
        "input": {
          "tool_input": {
            "command": "gcloud compute ssh acme-vm --command=\"set_config('foo', 'bar', 'moodlecourse')\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-ssh-mysql-shell",
        "input": {
          "tool_input": {
            "command": "gcloud compute ssh acme-vm --command=\"mysql -u root -e 'SELECT 1'\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-regular-ssh",
        "input": {
          "tool_input": {
            "command": "gcloud compute ssh acme-vm --command=\"ls /var/log\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "gcloud compute ssh acme-vm --command=\"php -r 'echo 1;'\" # hook-bypass: ssh-db-rule"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "gcloud-missing-project",
    "description": "Warn when gcloud command is missing --project= flag",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "^[[:space:]]*gcloud([[:space:]]+--[a-zA-Z0-9_-]+(=[^[:space:]]+)?)*[[:space:]]+(compute|sql|run|iam|secrets|projects|storage|functions|builds|artifacts|container|auth)[[:space:]]",
        "not_pattern": "--project[= ]|gcloud([[:space:]]+--[a-zA-Z0-9_-]+(=[^[:space:]]+)?)*[[:space:]]+(version|help|info|config)[[:space:]]"
      }
    ],
    "action": "warn",
    "bypass_marker": null,
    "memory_ref": "feedback_gcloud_explicit_flags.md",
    "references": [],
    "message": "WARNING: gcloud command without explicit --project= flag.\n\nActive config drift can cause cross-project mistakes. Pass --project=<id>\non every gcloud command (and --account= for multi-account setups).\n",
    "tests": [
      {
        "name": "warns-on-compute-without-project",
        "input": {
          "tool_input": {
            "command": "gcloud compute instances list"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "gcloud-missing-project"
      },
      {
        "name": "allows-with-project",
        "input": {
          "tool_input": {
            "command": "gcloud compute instances list --project=acme-dev"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-version-subcommand",
        "input": {
          "tool_input": {
            "command": "gcloud version"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "warns-with-global-flags-before-subcommand",
        "input": {
          "tool_input": {
            "command": "gcloud --verbosity=debug compute instances list"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "gcloud-missing-project"
      }
    ]
  },
  {
    "id": "prod-ops-no-approval",
    "description": "Block production operations without explicit user acknowledgement",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "--project=([a-z0-9-]+-prod\\b|production\\b)|--env=prod\\b|\\bENV=prod\\b|--target=prod\\b"
      }
    ],
    "action": "block",
    "bypass_marker": "prod-ops",
    "memory_ref": "feedback_never_touch_prod_without_approval.md",
    "references": [],
    "message": "BLOCKED: production operation detected.\n\nProduction changes require explicit user approval. Once confirmed, add\n\"// hook-bypass: prod-ops\" to the command to acknowledge.\n",
    "tests": [
      {
        "name": "blocks-prod-project-flag",
        "input": {
          "tool_input": {
            "command": "gcloud --project=acme-prod compute instances list"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-env-prod",
        "input": {
          "tool_input": {
            "command": "ENV=prod npm run deploy"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-staging",
        "input": {
          "tool_input": {
            "command": "gcloud --project=acme-dev compute instances list"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass",
        "input": {
          "tool_input": {
            "command": "gcloud --project=acme-prod compute instances list # hook-bypass: prod-ops"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "destructive-db-ops",
    "description": "Block destructive DB operations even with --local",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "supabase[[:space:]]+db[[:space:]]+(reset|push|repair)\\b|psql[^|]*\\b(DROP[[:space:]]+(TABLE|DATABASE|SCHEMA)|TRUNCATE|DELETE[[:space:]]+FROM)\\b"
      }
    ],
    "action": "block",
    "bypass_marker": "db-destructive",
    "memory_ref": "feedback_db_ops_explicit_permission.md",
    "references": [],
    "message": "BLOCKED: destructive DB operation.\n\nEven with --local, ask explicit user permission first. Once confirmed,\nadd \"// hook-bypass: db-destructive\" to the command.\n",
    "tests": [
      {
        "name": "blocks-supabase-reset",
        "input": {
          "tool_input": {
            "command": "supabase db reset --local"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-psql-drop-table",
        "input": {
          "tool_input": {
            "command": "psql -c \"DROP TABLE users\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-psql-truncate",
        "input": {
          "tool_input": {
            "command": "psql -c \"TRUNCATE users\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-supabase-status",
        "input": {
          "tool_input": {
            "command": "supabase status"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass",
        "input": {
          "tool_input": {
            "command": "supabase db reset --local # hook-bypass: db-destructive"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "manual-edge-fn-deploy",
    "description": "Block manual Edge Function deploy (CI-only)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "supabase[[:space:]]+functions[[:space:]]+deploy\\b"
      }
    ],
    "action": "block",
    "bypass_marker": "edge-fn-manual",
    "memory_ref": "feedback_edge_functions_via_ci.md",
    "references": [],
    "message": "BLOCKED: manual Edge Function deploy.\n\nDeploy via CI workflow (push to develop for staging, main for prod).\nBypass: add \"// hook-bypass: edge-fn-manual\" if a hotfix justifies it.\n",
    "tests": [
      {
        "name": "blocks-functions-deploy",
        "input": {
          "tool_input": {
            "command": "supabase functions deploy my-function"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-functions-list",
        "input": {
          "tool_input": {
            "command": "supabase functions list"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass",
        "input": {
          "tool_input": {
            "command": "supabase functions deploy my-function # hook-bypass: edge-fn-manual"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "minified-build-output",
    "description": "Block writing minified content to build/ directories",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "amd/build/.*\\.min\\.js$|dist/.*\\.min\\.(js|css)$"
      },
      {
        "field": "content",
        "pattern": "(var [a-z]=function|;function [a-z]\\(\\)|^[a-zA-Z0-9_$]+=function\\([a-zA-Z0-9_$,]*\\)\\{)"
      }
    ],
    "action": "block",
    "bypass_marker": "minified-build",
    "memory_ref": "feedback_no_minified_build.md",
    "references": [],
    "message": "BLOCKED: minified content being written to build/.\n\nBuild artifacts must stay human-readable. Replace with a readable copy\nof src/. Bypass: \"// hook-bypass: minified-build\" inside the content.\n",
    "tests": [
      {
        "name": "blocks-minified-amd-build",
        "input": {
          "tool_input": {
            "file_path": "plugins/foo/amd/build/main.min.js",
            "content": "var a=function(b){return b};var c=function(){};"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-readable-amd-build",
        "input": {
          "tool_input": {
            "file_path": "plugins/foo/amd/build/main.min.js",
            "content": "define(['jquery'], function($) {\n    'use strict';\n    return {\n        init: function() { console.log('hello'); }\n    };\n});\n"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-build-paths",
        "input": {
          "tool_input": {
            "file_path": "src/utils/helper.js",
            "content": "var a=function(b){return b};"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "secrets-hardcoded",
    "description": "Block hardcoded credential patterns being written to source files",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "content",
        "pattern": "(password|secret|api_key|apikey|token|access_key|private_key)[\"\\']?[[:space:]]*[:=][[:space:]]*[\"\\']?[A-Za-z0-9_!@#$%^&*+/=-]{12,}",
        "flags": "i"
      },
      {
        "field": "file_path",
        "not_pattern": "\\.env\\.example|\\.(test|spec)\\.|README|\\.md$|fixtures/|mocks?/"
      }
    ],
    "action": "block",
    "bypass_marker": "secret-leak",
    "memory_ref": "feedback_never_leak_secrets.md",
    "references": [],
    "message": "POTENTIAL SECRET LEAK: hardcoded credential pattern detected.\n\nUse Secret Manager / .env / local memory for real values. If this is a\nplaceholder or test fixture, prefix with \"EXAMPLE_\" / \"CHANGEME_\", move\nto .env.example, or add \"// hook-bypass: secret-leak\" near the line.\n",
    "tests": [
      {
        "name": "blocks-hardcoded-password-in-src",
        "input": {
          "tool_input": {
            "file_path": "src/config.ts",
            "content": "const password = \"supersecret123ABC!\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-hardcoded-api-key",
        "input": {
          "tool_input": {
            "file_path": "src/lib/api.ts",
            "content": "const api_key: \"sk_live_abc123def456ghi789\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-env-example",
        "input": {
          "tool_input": {
            "file_path": ".env.example",
            "content": "PASSWORD=changeme_supersecret_placeholder"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass",
        "input": {
          "tool_input": {
            "file_path": "src/config.ts",
            "content": "const password = \"supersecret123ABC!\" // hook-bypass: secret-leak"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-test-file",
        "input": {
          "tool_input": {
            "file_path": "src/auth.test.ts",
            "content": "const password = \"supersecret123ABC!\""
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "slack-unicode-bullets",
    "description": "Warn on Unicode bullets in Slack messages (use - instead)",
    "applies_to": [
      "Slack"
    ],
    "match": [
      {
        "field": "text",
        "pattern": "[•◦▪▫]"
      }
    ],
    "action": "warn",
    "bypass_marker": null,
    "memory_ref": "feedback_slack_no_unicode_bullets.md",
    "references": [],
    "message": "Slack style: Unicode bullets (•◦▪▫) detected. Use \"-\" instead.\n",
    "tests": [
      {
        "name": "warns-on-bullet",
        "input": {
          "tool_input": {
            "text": "Hola • mundo"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "slack-unicode-bullets"
      },
      {
        "name": "allows-dash-bullet",
        "input": {
          "tool_input": {
            "text": "Hola - mundo"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "slack-tables-no-codeblock",
    "description": "Warn when a markdown table separator row appears in Slack text",
    "applies_to": [
      "Slack"
    ],
    "match": [
      {
        "field": "text",
        "pattern": "^\\|[-:|[:space:]]+\\|[[:space:]]*$"
      }
    ],
    "action": "warn",
    "bypass_marker": null,
    "memory_ref": "feedback_slack_tables.md",
    "message": "Slack style: markdown table syntax detected.\nSlack mrkdwn does not render bare pipe-tables — wrap the table in\ntriple-backtick fences for it to display correctly.\n",
    "tests": [
      {
        "name": "warns-on-bare-table",
        "input": {
          "tool_input": {
            "text": "Resultados:\n| col1 | col2 | col3 |\n| ---- | ---- | ---- |\n| a    | b    | c    |\n"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "slack-tables-no-codeblock"
      },
      {
        "name": "allows-message-with-stray-pipes",
        "input": {
          "tool_input": {
            "text": "Just a paragraph with | a stray pipe | character — no table here.\n"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "slack-spanish-tildes",
    "description": "Warn when common Spanish words appear without tildes",
    "applies_to": [
      "Slack"
    ],
    "match": [
      {
        "field": "text",
        "pattern": "\\b(migracion|verificacion|analisis|patron|tambien|configuracion|implementacion|version|integracion|notificacion|aplicacion|comunicacion)\\b",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": null,
    "memory_ref": "feedback_spanish_accents.md",
    "references": [],
    "message": "Slack style: Spanish word without tilde detected. Always write with accents\n(migración, verificación, análisis, patrón, también, configuración, ...).\n",
    "tests": [
      {
        "name": "warns-on-tildeless-migracion",
        "input": {
          "tool_input": {
            "text": "La migracion fue exitosa"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "slack-spanish-tildes"
      },
      {
        "name": "allows-with-tilde",
        "input": {
          "tool_input": {
            "text": "La migración fue exitosa"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "ds-arbitrary-breakpoint",
    "description": "Block arbitrary Tailwind breakpoints (min-[Xpx]) in TSX/JSX/TS source — use sm:/md:/lg:/xl:/2xl: preset breakpoints",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "\\.(tsx|jsx|ts|js)$"
      },
      {
        "field": "content",
        "pattern": "min-\\[[0-9]+px\\]"
      }
    ],
    "action": "block",
    "bypass_marker": "ds-arbitrary-breakpoint",
    "memory_ref": "feedback_design_system_no_arbitrary_breakpoints.md",
    "message": "BLOCKED: arbitrary Tailwind breakpoint detected (min-[Xpx]).\n\nUse Tailwind's preset breakpoints instead: sm: (640px), md: (768px),\nlg: (1024px), xl: (1280px), 2xl: (1536px). Arbitrary values fragment\nthe responsive design language and break consistency across the app.\n\nIf a non-preset breakpoint is genuinely required, add\n\"// hook-bypass: ds-arbitrary-breakpoint\" to the line and justify\nin the PR description.\n",
    "tests": [
      {
        "name": "blocks-min-1200px-in-tsx",
        "input": {
          "tool_input": {
            "file_path": "src/components/foo.tsx",
            "content": "<div className=\"min-[1200px]:flex\">x</div>"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-min-768-arbitrary",
        "input": {
          "tool_input": {
            "file_path": "src/pages/Bar.tsx",
            "content": "<div className=\"min-[768px]:block\">y</div>"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-preset-md",
        "input": {
          "tool_input": {
            "file_path": "src/components/foo.tsx",
            "content": "<div className=\"md:flex\">x</div>"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-tsx-files",
        "input": {
          "tool_input": {
            "file_path": "docs/example.md",
            "content": "Use min-[1200px] for ..."
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "src/components/foo.tsx",
            "content": "<div className=\"min-[1380px]:hidden\">x</div> // hook-bypass: ds-arbitrary-breakpoint"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "ds-deep-ui-import",
    "description": "Block deep imports from @/components/ui/<file> — always import from the barrel @/components/ui",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "\\.(tsx|jsx|ts)$"
      },
      {
        "field": "content",
        "pattern": "from[[:space:]]+[\"']@/components/ui/[a-zA-Z][a-zA-Z0-9_-]+[\"']"
      }
    ],
    "action": "block",
    "bypass_marker": "ds-deep-ui-import",
    "memory_ref": "feedback_design_system_barrel_imports.md",
    "message": "BLOCKED: deep import from @/components/ui/<file> detected.\n\nAlways import Design System components from the barrel:\n  import { Button, Card, TextInput } from \"@/components/ui\"\n\nDeep imports like @/components/ui/button bypass the barrel-controlled\nsurface and make refactors brittle. The barrel is the public API.\n",
    "tests": [
      {
        "name": "blocks-deep-button-import",
        "input": {
          "tool_input": {
            "file_path": "src/pages/Foo.tsx",
            "content": "import { Button } from \"@/components/ui/button\""
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-deep-textinput-import",
        "input": {
          "tool_input": {
            "file_path": "src/components/Bar.tsx",
            "content": "import { TextInput } from '@/components/ui/text-input'"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-barrel-import",
        "input": {
          "tool_input": {
            "file_path": "src/pages/Foo.tsx",
            "content": "import { Button, Card } from \"@/components/ui\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-ds-import",
        "input": {
          "tool_input": {
            "file_path": "src/pages/Foo.tsx",
            "content": "import { foo } from \"@/lib/utils\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "src/pages/Foo.tsx",
            "content": "import { Button } from \"@/components/ui/button\" // hook-bypass: ds-deep-ui-import"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "ds-arbitrary-fixed-width-in-ds-component",
    "description": "Block arbitrary fixed widths (w-[Xpx]) inside DS components — they must be flexible (w-full + max-w)",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "(^|/)src/components/ui/"
      },
      {
        "field": "content",
        "pattern": "(^|[^a-zA-Z-])w-\\[[0-9]+px\\]"
      }
    ],
    "action": "block",
    "bypass_marker": "ds-arbitrary-fixed-width",
    "memory_ref": "feedback_design_system_no_fixed_pixel_widths.md",
    "message": "BLOCKED: arbitrary fixed pixel width in a DS component.\n\nDS components live under src/components/ui/ and must be flexible.\nUse w-full + max-w-[Xpx] instead of w-[Xpx], so the component\nadapts to its container.\n\nApplication-level usage (outside src/components/ui/) is exempt —\nthis rule only fires when editing the DS components themselves.\n",
    "tests": [
      {
        "name": "blocks-w-pixel-in-ui-button",
        "input": {
          "tool_input": {
            "file_path": "src/components/ui/button.tsx",
            "content": "<button className=\"w-[120px]\">x</button>"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-w-pixel-in-ui-card",
        "input": {
          "tool_input": {
            "file_path": "src/components/ui/card.tsx",
            "content": "<div className=\"w-[300px] p-4\">y</div>"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-w-pixel-in-ui-button-absolute-path",
        "input": {
          "tool_input": {
            "file_path": "/home/user/repo/src/components/ui/button.tsx",
            "content": "<button className=\"w-[120px]\">x</button>"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-w-pixel-outside-ds",
        "input": {
          "tool_input": {
            "file_path": "src/pages/Settings.tsx",
            "content": "<div className=\"w-[300px]\">page-specific</div>"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-w-full-max-w",
        "input": {
          "tool_input": {
            "file_path": "src/components/ui/button.tsx",
            "content": "<button className=\"w-full max-w-[200px]\">x</button>"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "src/components/ui/special.tsx",
            "content": "<div className=\"w-[42px]\">px-perfect-icon</div> // hook-bypass: ds-arbitrary-fixed-width"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "ds-raw-hex-color-in-source",
    "description": "Warn on raw hex color literals in TSX/TS source — colors must come from Tailwind tokens (dojo-primary-*, etc.)",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "\\.(tsx|jsx|ts|js)$",
        "not_pattern": "(tailwind\\.config|theme/|design-system/|design-tokens|\\.test\\.|\\.stories\\.)"
      },
      {
        "field": "content",
        "pattern": "#[0-9a-fA-F]{6}\\b"
      }
    ],
    "action": "warn",
    "bypass_marker": "ds-raw-hex-color",
    "memory_ref": "feedback_design_system_token_only_colors.md",
    "message": "WARNING: raw hex color literal found in source.\n\nUse a Tailwind token instead (e.g., bg-dojo-primary-lilac, text-dojo-foreground).\nThe token system is the single source of truth for color and theming.\n\nExempt paths (NOT flagged): tailwind.config.*, theme/, design-system/,\ndesign-tokens, .test.*, .stories.*. Use the bypass marker if a hex is\ngenuinely required outside those paths (e.g. embedding a brand color\nin a logo SVG that the design system doesn't yet expose).\n",
    "tests": [
      {
        "name": "warns-on-raw-hex-in-tsx",
        "input": {
          "tool_input": {
            "file_path": "src/components/foo.tsx",
            "content": "<div style={{ color: \"#FF7151\" }}>x</div>"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "ds-raw-hex-color-in-source"
      },
      {
        "name": "warns-on-raw-hex-in-ts",
        "input": {
          "tool_input": {
            "file_path": "src/lib/util.ts",
            "content": "const PRIMARY = \"#C980FC\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "ds-raw-hex-color-in-source"
      },
      {
        "name": "allows-tailwind-config",
        "input": {
          "tool_input": {
            "file_path": "tailwind.config.ts",
            "content": "lilac: \"#C980FC\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-theme-file",
        "input": {
          "tool_input": {
            "file_path": "src/theme/tokens.ts",
            "content": "export const PRIMARY = \"#C980FC\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-test-file",
        "input": {
          "tool_input": {
            "file_path": "src/components/foo.test.tsx",
            "content": "expect(color).toBe(\"#FF7151\")"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-design-system-folder",
        "input": {
          "tool_input": {
            "file_path": "src/design-system/tokens.ts",
            "content": "export const PRIMARY = \"#C980FC\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-design-tokens-file",
        "input": {
          "tool_input": {
            "file_path": "src/lib/design-tokens.ts",
            "content": "export const LILAC = \"#C980FC\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "src/components/Logo.tsx",
            "content": "<svg fill=\"#FF7151\" /> // hook-bypass: ds-raw-hex-color"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "schema-sql-outside-migrations",
    "description": "Block schema-changing SQL (ALTER/CREATE/DROP/GRANT/REVOKE/CREATE POLICY) in .sql files outside supabase/migrations/",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "\\.sql$",
        "not_pattern": "(supabase/migrations/|supabase/tests/|supabase/seed)"
      },
      {
        "field": "content",
        "pattern": "\\b(ALTER TABLE|CREATE TABLE|DROP TABLE|CREATE POLICY|DROP POLICY|GRANT |REVOKE |CREATE FUNCTION|DROP FUNCTION|CREATE TYPE|ALTER TYPE)\\b",
        "flags": "i"
      }
    ],
    "action": "block",
    "bypass_marker": "schema-sql-outside-migrations",
    "memory_ref": "feedback_scripts_not_db.md",
    "message": "BLOCKED: schema-changing SQL in a file outside supabase/migrations/.\n\nEvery schema mutation (ALTER/CREATE/DROP/GRANT/POLICY) MUST live in a\ntimestamped migration file, never in ad-hoc scripts or runtime queries.\n\nCreate a new file:\n  supabase/migrations/$(date -u +%Y%m%d%H%M%S)_<slug>.sql\n\nLegitimate exceptions (use the bypass marker):\n- Schema docs / examples in READMEs — should not be executable SQL\n- Test fixtures under supabase/tests/ — already exempt via not_pattern\n",
    "tests": [
      {
        "name": "blocks-create-table-in-script",
        "input": {
          "tool_input": {
            "file_path": "scripts/setup.sql",
            "content": "CREATE TABLE foo (id int primary key);"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-grant-in-edge-function",
        "input": {
          "tool_input": {
            "file_path": "supabase/functions/foo/migrate.sql",
            "content": "GRANT SELECT ON foo TO authenticated;"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-alter-table-in-readme-example",
        "input": {
          "tool_input": {
            "file_path": "docs/example.sql",
            "content": "ALTER TABLE foo ADD COLUMN bar text;"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-schema-in-migrations-folder",
        "input": {
          "tool_input": {
            "file_path": "supabase/migrations/20260509000000_foo.sql",
            "content": "CREATE TABLE foo (id int primary key);"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-schema-in-tests-folder",
        "input": {
          "tool_input": {
            "file_path": "supabase/tests/foo_test.sql",
            "content": "CREATE TABLE temp_test_t (id int);"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-schema-sql-anywhere",
        "input": {
          "tool_input": {
            "file_path": "scripts/query.sql",
            "content": "SELECT * FROM foo;"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "scripts/oneshot.sql",
            "content": "-- # hook-bypass: schema-sql-outside-migrations\nCREATE TABLE foo (id int primary key);\n"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-psql-against-supabase-remote",
    "description": "Warn when psql / pg_dump / pg_restore is executed directly against a *.supabase.co host (drift risk vs versioned migrations)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "\\b(psql|pg_dump|pg_restore|pg_dumpall)\\b.*\\.supabase\\.co",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": "psql-supabase-remote",
    "memory_ref": "feedback_scripts_not_db.md",
    "message": "WARNING: direct psql / pg_dump / pg_restore execution against a Supabase\nremote host.\n\nSQL Editor / direct-Postgres-CLI workflows create drift between the\nversioned migrations directory and other devs' local databases.\n\nCorrect workflow:\n  1. Add a migration in supabase/migrations/<timestamp>_<slug>.sql\n  2. Test locally:  supabase db reset --local\n  3. Push to develop — CI applies the migration to staging automatically\n  4. For production: follow the create-release SOP\n\nUse the bypass marker only for legitimate hotfixes where the PR cycle\nis too slow.\n",
    "tests": [
      {
        "name": "warns-on-psql-supabase-remote",
        "input": {
          "tool_input": {
            "command": "psql postgresql://user:pass@db.example1.supabase.co:5432/postgres -c 'SELECT 1'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-psql-against-supabase-remote"
      },
      {
        "name": "warns-on-psql-different-supabase-host",
        "input": {
          "tool_input": {
            "command": "psql -h db.example2.supabase.co -d postgres -c 'CREATE INDEX foo_idx ON foo (id)'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-psql-against-supabase-remote"
      },
      {
        "name": "warns-on-pg-dump-supabase-remote",
        "input": {
          "tool_input": {
            "command": "pg_dump -h db.example1.supabase.co -d postgres -t public.foo > foo.sql"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-psql-against-supabase-remote"
      },
      {
        "name": "warns-on-pg-restore-supabase-remote",
        "input": {
          "tool_input": {
            "command": "pg_restore -h db.example1.supabase.co -d postgres backup.dump"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-psql-against-supabase-remote"
      },
      {
        "name": "allows-psql-localhost",
        "input": {
          "tool_input": {
            "command": "psql -h localhost -p 54322 -d postgres -c 'SELECT 1'"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-psql-supabase-references",
        "input": {
          "tool_input": {
            "command": "curl https://example1.supabase.co/rest/v1/foo"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "psql -h db.example1.supabase.co -c 'SELECT 1' # hook-bypass: psql-supabase-remote"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "pr-create-with-migrations-needs-deploy-note",
    "description": "Warn when gh pr create body (inline --body) does not mention migrations (caller should verify the PR has no migration files)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "gh[[:space:]]+pr[[:space:]]+create.*--body([[:space:]]|=|$)",
        "not_pattern": "--body-file",
        "flags": "i"
      },
      {
        "field": "command",
        "not_pattern": "(migration|db push|supabase db|migration-deployment|requires.*staging|requires.*prod)",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": "pr-create-no-migration-note",
    "memory_ref": "feedback_scripts_not_db.md",
    "message": "WARNING: gh pr create body does not mention migrations.\n\nIf your PR modifies files under supabase/migrations/, the body MUST\ninclude a \"Migration deployment\" section that lists:\n  1. Which envs need supabase db push (staging auto via CI; prod via release)\n  2. Backfill order if the migrations depend on existing data\n  3. Post-merge verification steps\n\nThis rule does NOT inspect the diff — it only reads the command, and it\nintentionally skips --body-file invocations because it cannot read the\nreferenced file. Use the bypass marker if your PR has no migrations.\n",
    "tests": [
      {
        "name": "warns-on-pr-create-body-without-migration-mention",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\" --body \"Adds feature X\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "pr-create-with-migrations-needs-deploy-note"
      },
      {
        "name": "allows-pr-create-body-mentioning-migration",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\" --body \"Adds X. Migration deployment: requires supabase db push on staging\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-pr-create-body-mentioning-db-push",
        "input": {
          "tool_input": {
            "command": "gh pr create --body \"Use db push to apply\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-pr-create-with-body-file",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\" --body-file ./pr-body.md"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "gh pr create --body \"release notes only # hook-bypass: pr-create-no-migration-note\""
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-supabase-db-push-prod",
    "description": "Block supabase db push that targets the PRODUCTION project ref or uses --linked (the linked project may transparently be production)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "supabase[[:space:]]+db[[:space:]]+push.*(__PROD_SUPABASE_REF__|--linked\\b)"
      }
    ],
    "action": "block",
    "bypass_marker": "prod-db-push-approved",
    "memory_ref": "feedback_never_touch_prod_without_approval.md",
    "message": "BLOCKED: supabase db push targeting either the PRODUCTION project ref\nor the currently-linked project (which may be production).\n\nNEVER run against production without explicit user approval — see\nfeedback_never_touch_prod_without_approval.md.\n\nCorrect workflow:\n  1. Merge to main\n  2. The release owner runs the create-release SOP that ships\n     migrations to production through CI, not from a developer machine.\n\nUse the bypass marker ONLY when the user has verbally approved the\noperation. For --linked, double-check the active link first:\n  supabase status --output json | jq -r '.project_ref'\n\nMarketplace consumers: the production project ref is configured per\ninstall via .private/substitutions.json (PROD_SUPABASE_REF token). See\nhooks/rules/README.md for the substitution workflow.\n",
    "tests": [
      {
        "name": "blocks-supabase-db-push-prod",
        "input": {
          "tool_input": {
            "command": "supabase db push --db-url postgresql://postgres:pwd@db.__PROD_SUPABASE_REF__.supabase.co:5432/postgres"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-supabase-db-push-prod-with-project-ref-flag",
        "input": {
          "tool_input": {
            "command": "supabase db push --project-ref __PROD_SUPABASE_REF__"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-supabase-db-push-linked",
        "input": {
          "tool_input": {
            "command": "supabase db push --linked"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-supabase-db-push-linked-with-extra-flags",
        "input": {
          "tool_input": {
            "command": "supabase db push --linked --include-all"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-supabase-db-push-staging",
        "input": {
          "tool_input": {
            "command": "supabase db push --project-ref __STAGING_SUPABASE_REF__"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-supabase-db-push-local",
        "input": {
          "tool_input": {
            "command": "supabase db push"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-prod-ref",
        "input": {
          "tool_input": {
            "command": "supabase db push --project-ref __PROD_SUPABASE_REF__ # hook-bypass: prod-db-push-approved"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-linked",
        "input": {
          "tool_input": {
            "command": "supabase db push --linked # hook-bypass: prod-db-push-approved"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-curl-mutating-supabase-rest",
    "description": "Warn when curl issues a mutating HTTP method (POST/PATCH/PUT/DELETE) against the Supabase PostgREST endpoint (drift risk vs versioned migrations + RLS bypass)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "curl.*((-X[[:space:]]*(POST|PATCH|PUT|DELETE).*\\.supabase\\.co/rest/v1/)|(\\.supabase\\.co/rest/v1/.*-X[[:space:]]*(POST|PATCH|PUT|DELETE))|((-d[[:space:]]|--data([[:space:]]|=|-raw[[:space:]]|-raw=|-binary[[:space:]]|-binary=|-urlencode[[:space:]]|-urlencode=)).*\\.supabase\\.co/rest/v1/)|(\\.supabase\\.co/rest/v1/.*(-d[[:space:]]|--data([[:space:]]|=|-raw[[:space:]]|-raw=|-binary[[:space:]]|-binary=|-urlencode[[:space:]]|-urlencode=))))",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": "curl-supabase-rest-mutation",
    "memory_ref": "feedback_scripts_not_db.md",
    "message": "WARNING: mutating curl against the Supabase PostgREST endpoint.\n\nDirect REST mutations bypass:\n  - the versioned migrations workflow (drift across local DBs / envs),\n  - the RLS + admin-role checks the Supabase clients enforce, and\n  - the access pattern already encapsulated in src/services/api/.\n\nCorrect outlets:\n  - Schema changes      -> supabase/migrations/<timestamp>_<slug>.sql\n  - Data mutations      -> an Edge Function or a committed script\n  - One-shot fixes      -> use the API client from a versioned script\n\nUse the bypass marker (curl-supabase-rest-mutation) only for documented\nhotfixes that the team has explicitly approved.\n",
    "tests": [
      {
        "name": "warns-curl-post-supabase-rest",
        "input": {
          "tool_input": {
            "command": "curl -X POST https://example.supabase.co/rest/v1/profiles -H 'apikey: x' -d '{\"id\":1}'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-patch",
        "input": {
          "tool_input": {
            "command": "curl -X PATCH https://example.supabase.co/rest/v1/profiles?id=eq.1 -d '{\"name\":\"a\"}'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-put",
        "input": {
          "tool_input": {
            "command": "curl -X PUT https://example.supabase.co/rest/v1/profiles?id=eq.1 -d '{\"name\":\"b\"}'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-delete",
        "input": {
          "tool_input": {
            "command": "curl -X DELETE https://example.supabase.co/rest/v1/profiles?id=eq.1"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-xpost-no-space",
        "input": {
          "tool_input": {
            "command": "curl -XPOST https://example.supabase.co/rest/v1/profiles -d '{\"id\":1}'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-url-before-flag",
        "input": {
          "tool_input": {
            "command": "curl https://example.supabase.co/rest/v1/profiles -X POST -d '{\"id\":1}'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "allows-curl-get-supabase-rest",
        "input": {
          "tool_input": {
            "command": "curl https://example.supabase.co/rest/v1/profiles?select=id,name"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-curl-non-supabase",
        "input": {
          "tool_input": {
            "command": "curl -X POST https://example.com/api/v1/users -d '{\"id\":1}'"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "warns-curl-implicit-post-via-d",
        "input": {
          "tool_input": {
            "command": "curl -d '{\"id\":1}' https://example.supabase.co/rest/v1/profiles"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-implicit-post-via-data-raw",
        "input": {
          "tool_input": {
            "command": "curl --data-raw '{\"id\":1}' https://example.supabase.co/rest/v1/profiles"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-supabase-then-d",
        "input": {
          "tool_input": {
            "command": "curl https://example.supabase.co/rest/v1/profiles -d '{\"id\":1}'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "warns-curl-implicit-post-via-data-urlencode",
        "input": {
          "tool_input": {
            "command": "curl --data-urlencode 'name=Alice' https://example.supabase.co/rest/v1/profiles"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-curl-mutating-supabase-rest"
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "curl -X POST https://example.supabase.co/rest/v1/profiles -d '{\"id\":1}' # hook-bypass: curl-supabase-rest-mutation"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-playwright-headless",
    "description": "Block `playwright test` invocations that omit --headed / --ui / --debug (memory feedback_no_headless.md — browser must be visible during E2E)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "\\bplaywright[[:space:]]+test\\b"
      },
      {
        "field": "command",
        "not_pattern": "(--headed|--ui|--debug)"
      }
    ],
    "action": "block",
    "bypass_marker": "playwright-headless-allowed",
    "memory_ref": "feedback_no_headless.md",
    "message": "BLOCKED: `playwright test` without --headed / --ui / --debug.\n\nPer feedback_no_headless.md the browser must be visible during E2E:\nheadless runs hide visual regressions and UI race conditions, and\nthe in-focus requirement only holds when a window is up.\n\nUse one of:\n  - --headed   browser visible\n  - --ui       Playwright UI mode (interactive)\n  - --debug    step-through debugger\n\nBypass marker (playwright-headless-allowed) is reserved for\nexplicitly-documented CI runs (e.g. a Vercel preview workflow).\n",
    "tests": [
      {
        "name": "blocks-playwright-test-bare",
        "input": {
          "tool_input": {
            "command": "npx playwright test"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-playwright-test-config",
        "input": {
          "tool_input": {
            "command": "npx playwright test --config=playwright.config.ts"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-playwright-headed",
        "input": {
          "tool_input": {
            "command": "npx playwright test --headed"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-playwright-ui",
        "input": {
          "tool_input": {
            "command": "npx playwright test --ui"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-playwright-debug",
        "input": {
          "tool_input": {
            "command": "npx playwright test --debug"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-playwright-test",
        "input": {
          "tool_input": {
            "command": "npm test"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "blocks-pnpm-dlx-playwright-headless",
        "input": {
          "tool_input": {
            "command": "pnpm dlx playwright test"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-yarn-dlx-playwright-headless",
        "input": {
          "tool_input": {
            "command": "yarn dlx playwright test"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-pnpm-dlx-playwright-headed",
        "input": {
          "tool_input": {
            "command": "pnpm dlx playwright test --headed"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "npx playwright test # hook-bypass: playwright-headless-allowed"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-git-force-push-no-lease",
    "description": "Block `git push --force` / `-f` without `--force-with-lease` (overwrites collaborator pushes silently)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "git[[:space:]]+push.*(-f\\b|--force([[:space:]]|$))"
      },
      {
        "field": "command",
        "not_pattern": "--force-with-lease"
      }
    ],
    "action": "block",
    "bypass_marker": "git-force-push-bare-allowed",
    "memory_ref": "feedback_resolve_merge_conflicts.md",
    "message": "BLOCKED: `git push --force` without --force-with-lease.\n\nBare --force overwrites the remote without verifying that what is\nthere is what you last fetched — it silently destroys collaborator\npushes. --force-with-lease aborts when the remote has advanced since\nyour last fetch, which is the safety net you want.\n\nUse:\n  git push --force-with-lease origin <branch>\n\nBypass marker (git-force-push-bare-allowed) ONLY when you have\nverified that no other contributor has pushed to the branch.\n",
    "tests": [
      {
        "name": "blocks-force-short-flag",
        "input": {
          "tool_input": {
            "command": "git push -f origin feature-x"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-force-long-flag",
        "input": {
          "tool_input": {
            "command": "git push --force origin feature-x"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-force-with-lease",
        "input": {
          "tool_input": {
            "command": "git push --force-with-lease origin feature-x"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-no-force-push",
        "input": {
          "tool_input": {
            "command": "git push origin feature-x"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-force-with-lease-and-force-combined",
        "input": {
          "tool_input": {
            "command": "git push -f origin main --force-with-lease"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "git push --force origin feature-x # hook-bypass: git-force-push-bare-allowed"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-git-rebase-skip",
    "description": "Block `git rebase --skip` (drops the conflicting commit silently)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "git[[:space:]]+rebase[[:space:]]+--skip\\b"
      }
    ],
    "action": "block",
    "bypass_marker": "git-rebase-skip-acknowledged",
    "memory_ref": "feedback_resolve_merge_conflicts.md",
    "message": "BLOCKED: `git rebase --skip` drops the conflicting commit silently.\n\nPer feedback_resolve_merge_conflicts.md: never skip; resolve each\nconflict one by one, verify the result, and `git rebase --continue`.\n\nCorrect moves:\n  - Resolve manually, `git add`, `git rebase --continue`\n  - If the commit is genuinely obsolete, `git rebase --abort` and\n    cherry-pick the commits you want\n  - Bypass marker (git-rebase-skip-acknowledged) ONLY with explicit\n    acknowledgement of the data loss\n",
    "tests": [
      {
        "name": "blocks-rebase-skip",
        "input": {
          "tool_input": {
            "command": "git rebase --skip"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-rebase-continue",
        "input": {
          "tool_input": {
            "command": "git rebase --continue"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-rebase-abort",
        "input": {
          "tool_input": {
            "command": "git rebase --abort"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-rebase-command",
        "input": {
          "tool_input": {
            "command": "git status"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "git rebase --skip # hook-bypass: git-rebase-skip-acknowledged"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-standup-not-in-escritorio",
    "description": "Block `daily-standup*.md` writes anywhere outside ~/Escritorio (memory feedback_standup_desktop.md)",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "daily-standup.*\\.md$",
        "not_pattern": "(/Escritorio/|/Desktop/)"
      }
    ],
    "action": "block",
    "bypass_marker": "standup-non-desktop-acknowledged",
    "memory_ref": "feedback_standup_desktop.md",
    "message": "BLOCKED: daily-standup file being written outside ~/Escritorio.\n\nPer feedback_standup_desktop.md the standup lives in ~/Escritorio,\nNEVER inside a repo (commit-by-accident risk + cross-repo\nfragmentation). The standup-post-slack skill always resolves the\npath from ~/Escritorio.\n\nUse the absolute path:\n  ~/Escritorio/daily-standup.md\n(or ~/Desktop/daily-standup.md on English-locale machines).\n\nBypass marker is intentionally NOT recommended — there is no\nlegitimate path outside the desktop.\n",
    "tests": [
      {
        "name": "blocks-standup-in-repo",
        "input": {
          "tool_input": {
            "file_path": "/home/user/repo/docs/daily-standup.md",
            "content": "# Standup 2026-05-09"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-standup-in-tmp",
        "input": {
          "tool_input": {
            "file_path": "/tmp/daily-standup.md",
            "content": "# Standup"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-standup-in-escritorio",
        "input": {
          "tool_input": {
            "file_path": "/home/user/Escritorio/daily-standup.md",
            "content": "# Standup"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-standup-in-desktop-english",
        "input": {
          "tool_input": {
            "file_path": "/home/user/Desktop/daily-standup.md",
            "content": "# Standup"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-standup-file",
        "input": {
          "tool_input": {
            "file_path": "/home/user/repo/docs/notes.md",
            "content": "# Notes"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-write-tool",
        "input": {
          "tool_input": {
            "file_path": "/tmp/daily-standup.md",
            "content": "# Standup // hook-bypass: standup-non-desktop-acknowledged"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-edit-tool",
        "input": {
          "tool_input": {
            "file_path": "/tmp/daily-standup.md",
            "old_string": "# Old",
            "new_string": "# Standup // hook-bypass: standup-non-desktop-acknowledged"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-multiedit-tool",
        "input": {
          "tool_input": {
            "file_path": "/tmp/daily-standup.md",
            "edits": [
              {
                "old_string": "# A",
                "new_string": "# B // hook-bypass: standup-non-desktop-acknowledged"
              }
            ]
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-goodnight-not-in-escritorio",
    "description": "Block /goodnight handoff files (`next-day-*.md` / `goodnight-*.md`) anywhere outside ~/Escritorio (memory feedback_goodnight_desktop.md)",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "(next-day-|goodnight-).*\\.md$",
        "not_pattern": "(/Escritorio/|/Desktop/)"
      }
    ],
    "action": "block",
    "bypass_marker": "goodnight-non-desktop-acknowledged",
    "memory_ref": "feedback_goodnight_desktop.md",
    "message": "BLOCKED: /goodnight handoff file being written outside ~/Escritorio.\n\nPer feedback_goodnight_desktop.md the /goodnight skill must save\nnext-day handoff files to ~/Escritorio, NOT inside .claude/next-day/\nor any repo path.\n\nUse the absolute path:\n  ~/Escritorio/<filename>.md\n(or ~/Desktop/<filename>.md on English-locale machines).\n\nBypass marker is intentionally NOT recommended.\n",
    "tests": [
      {
        "name": "blocks-next-day-in-claude-dir",
        "input": {
          "tool_input": {
            "file_path": "/home/user/.claude/next-day/next-day-2026-05-09.md",
            "content": "# Handoff"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-goodnight-in-tmp",
        "input": {
          "tool_input": {
            "file_path": "/tmp/goodnight-context.md",
            "content": "# Goodnight"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-next-day-in-escritorio",
        "input": {
          "tool_input": {
            "file_path": "/home/user/Escritorio/next-day-2026-05-09.md",
            "content": "# Handoff"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-goodnight-in-desktop",
        "input": {
          "tool_input": {
            "file_path": "/home/user/Desktop/goodnight-2026-05-09.md",
            "content": "# Handoff"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-handoff-file",
        "input": {
          "tool_input": {
            "file_path": "/home/user/repo/docs/notes.md",
            "content": "# Notes"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-write-tool",
        "input": {
          "tool_input": {
            "file_path": "/tmp/next-day-2026-05-09.md",
            "content": "# Handoff // hook-bypass: goodnight-non-desktop-acknowledged"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-edit-tool",
        "input": {
          "tool_input": {
            "file_path": "/tmp/next-day-2026-05-09.md",
            "old_string": "# Old",
            "new_string": "# Handoff // hook-bypass: goodnight-non-desktop-acknowledged"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker-multiedit-tool",
        "input": {
          "tool_input": {
            "file_path": "/tmp/next-day-2026-05-09.md",
            "edits": [
              {
                "old_string": "# A",
                "new_string": "# B // hook-bypass: goodnight-non-desktop-acknowledged"
              }
            ]
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-deletes-console-log",
    "description": "Warn when an Edit operation removes a line containing a debug-logging call (memory feedback_never_delete_debug_logs.md — gate via env var, never delete)",
    "applies_to": [
      "Edit",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "old_string",
        "pattern": "(console\\.log\\(|console\\.debug\\(|console\\.error\\(|\\bdebug\\(|logger\\.(debug|info|trace)\\()",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": "console-log-deletion-verified",
    "memory_ref": "feedback_never_delete_debug_logs.md",
    "message": "WARNING: Edit removes a line containing a debug-log call.\n\nPer feedback_never_delete_debug_logs.md NEVER delete debug logs;\ngate them with an env var (e.g. DEBUG_TOOLS), disable for prod,\nre-enable when needed.\n\nPer feedback_never_remove_debug_logs_early.md even when converting\nto env-gating, NEVER delete before verifying the fix in prod.\n\nUse the bypass marker (console-log-deletion-verified) ONLY when:\n  - Converting to env-gating (the new gate replaces the log)\n  - The fix has been verified in prod for >24h\n  - The log was a documented debug-temp called out in the original\n    commit message\n",
    "tests": [
      {
        "name": "warns-on-edit-deleting-console-log",
        "input": {
          "tool_input": {
            "old_string": "console.log('debug:', x)",
            "new_string": ""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-deletes-console-log"
      },
      {
        "name": "warns-on-edit-deleting-logger-debug",
        "input": {
          "tool_input": {
            "old_string": "logger.debug(\"trace\", { id })",
            "new_string": ""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-deletes-console-log"
      },
      {
        "name": "warns-on-edit-deleting-console-error",
        "input": {
          "tool_input": {
            "old_string": "if (err) console.error(err)",
            "new_string": "if (err) reportToSentry(err)"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-deletes-console-log"
      },
      {
        "name": "allows-edit-not-touching-logs",
        "input": {
          "tool_input": {
            "old_string": "const x = 1",
            "new_string": "const x = 2"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "warns-on-multiedit-deleting-console-log",
        "input": {
          "tool_input": {
            "edits": [
              {
                "old_string": "console.log('debug:', x)",
                "new_string": ""
              }
            ]
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-deletes-console-log"
      },
      {
        "name": "warns-on-multiedit-second-edit-deletes-logger",
        "input": {
          "tool_input": {
            "edits": [
              {
                "old_string": "const x = 1",
                "new_string": "const x = 2"
              },
              {
                "old_string": "logger.debug(\"trace\", { id })",
                "new_string": ""
              }
            ]
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-deletes-console-log"
      },
      {
        "name": "warns-on-multiedit-with-null-old-string",
        "input": {
          "tool_input": {
            "edits": [
              {
                "new_string": "inserted line"
              },
              {
                "old_string": "console.log('debug:', y)",
                "new_string": ""
              }
            ]
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-deletes-console-log"
      },
      {
        "name": "allows-multiedit-not-touching-logs",
        "input": {
          "tool_input": {
            "edits": [
              {
                "old_string": "const x = 1",
                "new_string": "const x = 2"
              }
            ]
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "old_string": "console.log('debug:', x) // hook-bypass: console-log-deletion-verified",
            "new_string": ""
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-time-estimates-in-plans",
    "description": "Warn when plan/spec/design files contain time-based estimates (memory feedback_no_time_estimates.md — use sequential ordering, not days/sprints/cycles)",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "(plans?/|specs?/|design/|openspec/|docs/superpowers/).*\\.md$"
      },
      {
        "field": "content",
        "pattern": "\\b[0-9]+[[:space:]]*(days?|sprints?|weeks?|d[ií]as?|semanas?|cycles?|ciclos?)\\b",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": "time-estimates-allowed",
    "memory_ref": "feedback_no_time_estimates.md",
    "message": "WARNING: time-based estimate (X days/weeks/sprints) in plan/spec.\n\nPer feedback_no_time_estimates.md never use days/sprints/cycles;\nuse sequential ordering with conceptual milestones.\n\nReplace with:\n  - \"Phase 1, Phase 2, Phase 3\"\n  - \"After X ships -> Y starts\"\n  - \"Once Greptile 5/5 + CI green -> merge\"\n\nBypass marker (time-estimates-allowed) ONLY when the doc is\nmarketing / external-facing (where calendar dates are expected).\n",
    "tests": [
      {
        "name": "warns-on-3-days-in-plan",
        "input": {
          "tool_input": {
            "file_path": "plans/2026-05-feature.md",
            "content": "Estimate: 3 days for the implementation phase."
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-time-estimates-in-plans"
      },
      {
        "name": "warns-on-2-sprints-in-spec",
        "input": {
          "tool_input": {
            "file_path": "specs/2026-05-pricing.md",
            "content": "Will land in 2 sprints."
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-time-estimates-in-plans"
      },
      {
        "name": "warns-on-spanish-dias",
        "input": {
          "tool_input": {
            "file_path": "openspec/changes/2026-05-foo/design.md",
            "content": "Listo en 5 dias."
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-time-estimates-in-plans"
      },
      {
        "name": "warns-on-spanish-semanas-with-tilde",
        "input": {
          "tool_input": {
            "file_path": "docs/superpowers/plans/foo.md",
            "content": "Tomara 4 semanas mas o menos."
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-time-estimates-in-plans"
      },
      {
        "name": "allows-non-time-content",
        "input": {
          "tool_input": {
            "file_path": "plans/2026-05-feature.md",
            "content": "## Plan\\n\\nPhase 1: spike. Phase 2: implement."
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-numbers-without-time-units",
        "input": {
          "tool_input": {
            "file_path": "plans/2026-05-feature.md",
            "content": "Phase 1 and Phase 2 cover the implementation; depends on issue 42 closing first."
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-plan-files",
        "input": {
          "tool_input": {
            "file_path": "README.md",
            "content": "Will land in 2 sprints"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "plans/marketing-launch.md",
            "content": "3 weeks to launch # hook-bypass: time-estimates-allowed"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-pr-create-many-files",
    "description": "Warn on `gh pr create` — caller must verify the PR has <=15 files (memory feedback_split_large_prs.md / 15-file rule)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "gh[[:space:]]+pr[[:space:]]+create\\b"
      }
    ],
    "action": "warn",
    "bypass_marker": "pr-file-count-verified",
    "memory_ref": "feedback_split_large_prs.md",
    "message": "WARNING: `gh pr create`.\n\nPer feedback_split_large_prs.md / the 15-file rule (DOJ-2482):\nPRs with >15 files get abandoned more easily — split by domain\nbefore opening.\n\nVerify with:\n  git diff --stat <base>..HEAD | tail -1\n\nIf the diff touches <=15 files, use bypass marker\n`pr-file-count-verified`. If it touches >15 files, abort and split.\n",
    "tests": [
      {
        "name": "warns-on-pr-create-bare",
        "input": {
          "tool_input": {
            "command": "gh pr create --title \"feat: foo\" --base main"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-pr-create-many-files"
      },
      {
        "name": "warns-on-pr-create-with-body",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\" --body \"Adds X\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-pr-create-many-files"
      },
      {
        "name": "warns-on-pr-create-with-base",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --head feature-x"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-pr-create-many-files"
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "gh pr create --title \"feat: foo\" --base main # hook-bypass: pr-file-count-verified"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-pr-create-gh-commands",
        "input": {
          "tool_input": {
            "command": "gh pr list"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-gh-pr-edit",
        "input": {
          "tool_input": {
            "command": "gh pr edit 16 --add-label foo"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-posthog-in-alerts",
    "description": "Warn when Slack messages mention PostHog / dashboard / instrumentation (memory feedback_no_posthog_nag.md — Juan owns; out of scope for other POs)",
    "applies_to": [
      "Slack"
    ],
    "match": [
      {
        "field": "text",
        "pattern": "\\b(posthog|dashboard|instrumentation)\\b",
        "flags": "i"
      }
    ],
    "action": "warn",
    "bypass_marker": "posthog-mention-approved",
    "memory_ref": "feedback_no_posthog_nag.md",
    "message": "WARNING: PostHog / dashboard / instrumentation mention in Slack.\n\nPer feedback_no_posthog_nag.md the agent / automation must EXCLUDE\nPostHog / dashboards / instrumentation from alerts; Juan owns that\nsurface, other POs explicitly told it is out of scope.\n\nUse the bypass marker (posthog-mention-approved) ONLY when:\n  - The alert is addressed to Juan directly (his Slack user-id)\n  - You confirmed with Juan that the alert is welcome\n",
    "tests": [
      {
        "name": "warns-posthog-in-slack",
        "input": {
          "tool_input": {
            "text": "Vi una metrica rara en PostHog ayer, podemos revisar?"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-posthog-in-alerts"
      },
      {
        "name": "warns-dashboard-in-slack",
        "input": {
          "tool_input": {
            "text": "El dashboard de Sentry esta en rojo"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-posthog-in-alerts"
      },
      {
        "name": "warns-instrumentation-in-slack",
        "input": {
          "tool_input": {
            "text": "Falta instrumentation en el endpoint /foo"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-posthog-in-alerts"
      },
      {
        "name": "allows-non-posthog-text",
        "input": {
          "tool_input": {
            "text": "PR #16 listo para review"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "text": "Subi un evento nuevo a PostHog # hook-bypass: posthog-mention-approved"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "block-sibling-suffix-storage",
    "description": "Block storage uploads that use a sibling-suffix layout (memory feedback_explicit_storage_prefixes.md — use originals/ + processed/ subdirs instead)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "(supabase[[:space:]]+storage[[:space:]]+upload|gcloud[[:space:]]+storage[[:space:]]+cp|gsutil[[:space:]]+cp).*\\.(processed|original|raw|optimized)\\.(zip|tar|gz|bin|jpg|jpeg|png|pdf|mp4)\\b",
        "flags": "i"
      }
    ],
    "action": "block",
    "bypass_marker": "sibling-suffix-storage-allowed",
    "memory_ref": "feedback_explicit_storage_prefixes.md",
    "message": "BLOCKED: storage upload with a sibling-suffix layout.\n\nPer feedback_explicit_storage_prefixes.md pipelines that transform\nartefacts must use <bucket>/originals/ + <bucket>/processed/\n(or stage-specific names), never siblings like foo.zip +\nfoo.processed.zip in the same folder.\n\nUse:\n  <bucket>/originals/foo.zip\n  <bucket>/processed/foo.zip\n\nBypass marker (sibling-suffix-storage-allowed) ONLY for legacy\nbuckets in active migration.\n",
    "tests": [
      {
        "name": "blocks-supabase-storage-processed-suffix",
        "input": {
          "tool_input": {
            "command": "supabase storage upload my-bucket/foo.processed.zip ./foo.processed.zip"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-gcloud-storage-cp",
        "input": {
          "tool_input": {
            "command": "gcloud storage cp ./foo.processed.zip gs://my-bucket/foo.processed.zip"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "blocks-gsutil-original-suffix",
        "input": {
          "tool_input": {
            "command": "gsutil cp ./foo.original.mp4 gs://my-bucket/foo.original.mp4"
          }
        },
        "expected_exit": 2
      },
      {
        "name": "allows-clean-paths",
        "input": {
          "tool_input": {
            "command": "supabase storage upload my-bucket/originals/foo.zip ./foo.zip"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-clean-source-and-clean-destination-bucket-prefix",
        "input": {
          "tool_input": {
            "command": "gcloud storage cp ./foo.zip gs://my-bucket/processed/foo.zip"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-storage-cp",
        "input": {
          "tool_input": {
            "command": "cp ./foo.processed.zip /tmp/foo.processed.zip"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "gcloud storage cp ./foo.processed.zip gs://my-bucket/foo.processed.zip # hook-bypass: sibling-suffix-storage-allowed"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-localhost-in-pr-body",
    "description": "Warn when `gh pr create` / `gh pr edit` body contains a localhost reference (memory feedback_test_on_staging.md — QA target is dev.dojocoding.io, not localhost)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "gh[[:space:]]+pr[[:space:]]+(create|edit).*--body([[:space:]]|=|$)"
      },
      {
        "field": "command",
        "pattern": "(localhost|127\\.0\\.0\\.1)"
      }
    ],
    "action": "warn",
    "bypass_marker": "localhost-in-pr-body-allowed",
    "memory_ref": "feedback_test_on_staging.md",
    "message": "WARNING: localhost reference in PR body.\n\nPer feedback_test_on_staging.md the QA testing target is\ndev.dojocoding.io (staging), not localhost. Any reviewer who tries\nto verify against localhost will hit env mismatches:\n  - Local DB differs from staging\n  - Edge Functions missing local secrets\n  - Different feature flags\n\nReplace localhost links with dev.dojocoding.io equivalents.\n\nBypass marker (localhost-in-pr-body-allowed) ONLY for steps that\nlegitimately require an explicit local build (e.g. asking the\nreviewer to run `bun run dev` before pushing).\n",
    "tests": [
      {
        "name": "warns-pr-create-with-localhost",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\" --body \"Test on http://localhost:5173/foo\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-localhost-in-pr-body"
      },
      {
        "name": "warns-pr-edit-with-127",
        "input": {
          "tool_input": {
            "command": "gh pr edit 16 --body \"Hit http://127.0.0.1:54321/health\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-localhost-in-pr-body"
      },
      {
        "name": "allows-pr-create-with-staging-url",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\" --body \"Test on https://dev.dojocoding.io/foo\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-pr-localhost",
        "input": {
          "tool_input": {
            "command": "curl http://localhost:5173/foo"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-pr-create-no-body",
        "input": {
          "tool_input": {
            "command": "gh pr create --base develop --title \"feat: foo\""
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "gh pr create --body \"Run bun run dev on localhost:5173 # hook-bypass: localhost-in-pr-body-allowed\""
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-bash-mutation-without-leading-cd",
    "description": "Warn when bash mutation commands (git commit/push/mv/rm/reset/merge/revert, sed -i / sed --in-place, gh pr create/merge/edit) don't start with an absolute-path `cd /<...>` (or `pushd /<...>`, `cd ~/<...>`, `cd $VAR/<...>`) — prevents commits landing on the wrong branch when working across multiple parallel worktrees",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "git[[:space:]]+(commit|push|mv|rm[[:space:]]|reset|revert|merge)|sed[[:space:]]+-i([[:space:]]|[^[:space:]-])|sed[[:space:]]+--in-place[[:space:]]|gh[[:space:]]+pr[[:space:]]+(create|merge|edit)"
      },
      {
        "field": "command",
        "not_pattern": "^[[:space:]]*(cd|pushd)[[:space:]]+(/|~|\\$)"
      }
    ],
    "action": "warn",
    "bypass_marker": "cd-worktree-rule",
    "memory_ref": "feedback_cd_between_worktrees.md",
    "references": [
      "DOJ-4007 PR-2/PR-3 cross-ref fixup (2026-05-10) — bug that motivated this rule"
    ],
    "message": "WARN: bash mutation command (git commit/push/mv/rm/reset/merge/revert,\nsed -i, or gh pr create/merge/edit) detected without a leading\n`cd /<path>` prefix.\n\nPer feedback_cd_between_worktrees.md: when working across multiple\nparallel git worktrees in the same session, EVERY bash invocation that\ntouches a specific worktree MUST start with explicit\n`cd /full/path/to/worktree && ...`.\n\nBug pattern this prevents (real, 2026-05-10):\n- Two parallel worktrees for two PRs (PR-2 + PR-3 of same repo).\n- First worktree's sed + commit + push: correct (cwd was PR-2).\n- Second worktree's sed + commit + push: missing cd → still in PR-2 cwd\n  → commit landed on PR-2 branch instead of PR-3 branch.\n- Required revert on PR-2 + correct re-apply on PR-3. Confused commit\n  history visible to reviewers.\n\nIf the command operates on absolute paths or doesn't need cwd context,\nor you've intentionally verified cwd via `pwd` immediately before,\nadd \"# hook-bypass: cd-worktree-rule\" to acknowledge.\n",
    "tests": [
      {
        "name": "warns-on-git-commit-no-cd",
        "input": {
          "tool_input": {
            "command": "git add foo.md && git commit -m \"fix\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-git-push-no-cd",
        "input": {
          "tool_input": {
            "command": "git push origin main"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-git-mv-no-cd",
        "input": {
          "tool_input": {
            "command": "git mv content/old content/new"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-git-rm-no-cd",
        "input": {
          "tool_input": {
            "command": "git rm path/to/file.md"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-sed-i-no-cd",
        "input": {
          "tool_input": {
            "command": "sed -i s/foo/bar/g content/file.md"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-sed-i-bak-no-cd",
        "input": {
          "tool_input": {
            "command": "sed -i.bak s/foo/bar/g content/file.md"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-sed-in-place-long-form-no-cd",
        "input": {
          "tool_input": {
            "command": "sed --in-place s/foo/bar/g content/file.md"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-git-commit-with-relative-cd",
        "input": {
          "tool_input": {
            "command": "cd worktree-dir && git commit -m \"fix\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-git-push-with-dotdot-cd",
        "input": {
          "tool_input": {
            "command": "cd ../sibling-dir && git push"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-gh-pr-create-no-cd",
        "input": {
          "tool_input": {
            "command": "gh pr create --base main --title foo"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-gh-pr-merge-no-cd",
        "input": {
          "tool_input": {
            "command": "gh pr merge 27 --squash --delete-branch"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "warns-on-git-reset-hard-no-cd",
        "input": {
          "tool_input": {
            "command": "git reset --hard origin/main"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-bash-mutation-without-leading-cd"
      },
      {
        "name": "passes-with-cd-prefix",
        "input": {
          "tool_input": {
            "command": "cd /home/user/repo && git commit -m fix && git push"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-with-pushd-prefix",
        "input": {
          "tool_input": {
            "command": "pushd /home/user/repo && git commit -m fix"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-with-tilde-cd-prefix",
        "input": {
          "tool_input": {
            "command": "cd ~/repo && git commit -m fix"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-with-env-var-cd-prefix",
        "input": {
          "tool_input": {
            "command": "cd $WORKTREE && git push"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-on-git-status",
        "input": {
          "tool_input": {
            "command": "git status"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-on-git-log",
        "input": {
          "tool_input": {
            "command": "git log --oneline -3"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-on-git-diff",
        "input": {
          "tool_input": {
            "command": "git diff --stat"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-on-gh-pr-list",
        "input": {
          "tool_input": {
            "command": "gh pr list --author=@me"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-on-gh-pr-view",
        "input": {
          "tool_input": {
            "command": "gh pr view 27 --json mergeable"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "passes-with-bypass-marker",
        "input": {
          "tool_input": {
            "command": "git push origin main # hook-bypass: cd-worktree-rule"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-version-readme-changelog-sync",
    "description": "Warn when a version manifest (package.json, plugin.json, marketplace.json) is being bumped without a parallel update to README.md + CHANGELOG.md — the visible-version surface drifts silently otherwise (DOJ-4064 defense-in-depth, sister rule to dojo-os repo-local post-write-version-readme-sync.sh)",
    "applies_to": [
      "Edit",
      "Write",
      "MultiEdit"
    ],
    "match": [
      {
        "field": "file_path",
        "pattern": "(^|/)(package\\.json|plugin\\.json|marketplace\\.json|\\.claude-plugin/plugin\\.json|\\.claude-plugin/marketplace\\.json)$"
      },
      {
        "field": "content",
        "pattern": "\"version\"[[:space:]]*:[[:space:]]*\"[0-9]"
      }
    ],
    "action": "warn",
    "bypass_marker": "version-readme-changelog-sync",
    "memory_ref": "feedback_version_readme_changelog_sync.md",
    "references": [
      "DOJ-4064 — three-layer drift thesis (Cure 4: PreToolUse/PostToolUse hooks)",
      "Sister hook in dojo-os: .claude/hooks/post-write-version-readme-sync.sh",
      "make-no-mistakes-toolkit PR #21 — visible README version + reconstructed CHANGELOG"
    ],
    "message": "WARN: a version manifest (package.json / plugin.json / marketplace.json)\nis being written with a \"version\": \"X.Y.Z\" field, but this hook cannot\nsee whether README.md and CHANGELOG.md were updated in the same change.\n\nWhen you bump the version in any manifest, also update in the same PR:\n  1. README.md — the \"Version: X.Y.Z\" line at the top\n  2. CHANGELOG.md — add a new entry under ## [X.Y.Z] - YYYY-MM-DD\n\nWhy this rule exists (DOJ-4064 three-layer drift thesis):\n- The repo shipped 1.1.0 → 1.14.0 with NO visible version anywhere a\n  human would look (README, CHANGELOG, or git tags). PR #21 closed that\n  gap by reconstructing the CHANGELOG and adding a header version line.\n- Without this rule, the same drift will reappear on the next bump.\n- Defense-in-depth: the dojo-os repo has a sister PostToolUse hook\n  (.claude/hooks/post-write-version-readme-sync.sh) that catches the\n  same drift locally even if this toolkit isn't installed.\n\nSuggested workflow:\n  bump version in manifest(s) → update README.md \"Version: ...\" line →\n  append CHANGELOG.md entry → commit all four files together.\n\nIf you're intentionally splitting the bump from the README/CHANGELOG\nupdate (e.g., bumping a vendored sub-manifest's version that isn't user-\nvisible), add \"# hook-bypass: version-readme-changelog-sync\" inline in\na comment near the version field or pass it on the Write call.\n",
    "tests": [
      {
        "name": "warns-on-package-json-version-bump",
        "input": {
          "tool_input": {
            "file_path": "package.json",
            "content": "{\n  \"name\": \"@example/pkg\",\n  \"version\": \"1.15.0\"\n}\n"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-version-readme-changelog-sync"
      },
      {
        "name": "warns-on-plugin-json-version-bump",
        "input": {
          "tool_input": {
            "file_path": ".claude-plugin/plugin.json",
            "content": "{\n  \"name\": \"make-no-mistakes\",\n  \"version\": \"1.15.0\"\n}\n"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-version-readme-changelog-sync"
      },
      {
        "name": "warns-on-marketplace-json-version-bump",
        "input": {
          "tool_input": {
            "file_path": ".claude-plugin/marketplace.json",
            "content": "{\n  \"name\": \"marketplace\",\n  \"version\": \"1.15.0\",\n  \"plugins\": [{\"version\": \"1.15.0\"}]\n}\n"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-version-readme-changelog-sync"
      },
      {
        "name": "warns-on-absolute-path-package-json",
        "input": {
          "tool_input": {
            "file_path": "/home/user/repo/package.json",
            "content": "{\"version\": \"2.0.0\"}"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-version-readme-changelog-sync"
      },
      {
        "name": "warns-on-root-plugin-json",
        "input": {
          "tool_input": {
            "file_path": "plugin.json",
            "content": "{\"version\": \"1.0.1\"}"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-version-readme-changelog-sync"
      },
      {
        "name": "warns-on-edit-of-package-json",
        "input": {
          "tool_input": {
            "file_path": "package.json",
            "old_string": "\"version\": \"1.14.0\"",
            "new_string": "\"version\": \"1.15.0\""
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-version-readme-changelog-sync"
      },
      {
        "name": "allows-package-json-write-without-version-field",
        "input": {
          "tool_input": {
            "file_path": "package.json",
            "content": "{\n  \"name\": \"@example/pkg\",\n  \"description\": \"no version field touched\"\n}\n"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-unrelated-json-file",
        "input": {
          "tool_input": {
            "file_path": "tsconfig.json",
            "content": "{\"version\": \"1.0.0\"}"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-readme-write",
        "input": {
          "tool_input": {
            "file_path": "README.md",
            "content": "**Version: 1.15.0**"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-changelog-write",
        "input": {
          "tool_input": {
            "file_path": "CHANGELOG.md",
            "content": "## [1.15.0] - 2026-05-14"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "file_path": "package.json",
            "content": "{\n  \"version\": \"1.15.0\"\n  // hook-bypass: version-readme-changelog-sync\n}\n"
          }
        },
        "expected_exit": 0
      }
    ]
  },
  {
    "id": "warn-greptile-review-extraction-by-created-at",
    "description": "Warn when a Bash command extracts Greptile review state but uses created_at / chronology / first-commit-URL capture — Greptile edits the same comment in-place, so updated_at + the \"Last reviewed commit:\" footer hash are the authoritative signals (memory feedback_greptile_match_head_not_chronology.md)",
    "applies_to": [
      "Bash"
    ],
    "match": [
      {
        "field": "command",
        "pattern": "gh[[:space:]]+api\\b.*\\bcomments\\b"
      },
      {
        "field": "command",
        "pattern": "greptile",
        "flags": "i"
      },
      {
        "field": "command",
        "pattern": "(\\bcreated_at\\b|\\b(head|tail)[[:space:]]+-n?[[:space:]]*[0-9]+|capture\\([^)]*/commit/)"
      },
      {
        "field": "command",
        "not_pattern": "(Last reviewed commit|\\bupdated_at\\b)"
      }
    ],
    "action": "warn",
    "bypass_marker": "greptile-extraction-acknowledged",
    "memory_ref": "feedback_greptile_match_head_not_chronology.md",
    "references": [
      "feedback_tail_with_desc_ordering.md — sister rule on DESC|tail bug",
      "CIV-728 PR #114 forensic 2026-05-25 — stale 3/5 review picked over 5/5 HEAD review"
    ],
    "message": "WARN: Bash command extracts Greptile review state with a chronology-based\npattern (created_at / head -N / tail -N / capture(.../commit/...)).\n\nGreptile App on GitHub EDITS the same review comment in-place on each\nre-review. As a result:\n  - comment.created_at is FROZEN at original posting; it DOES NOT\n    change when Greptile re-analyzes a new commit.\n  - comment.updated_at IS what moves with each re-review.\n  - The \"<sub>Last reviewed commit: ...(commit/HASH)</sub>\" footer in\n    the body is the authoritative source for \"which commit this review\n    is about\" — NOT the first /commit/ URL captured anywhere in the\n    body (which is often a permalink quoted inside a finding).\n\nUse this pattern instead (copy-paste-able):\n\n  HEAD=$(gh pr view <N> --json headRefOid --jq '.headRefOid')\n  export SHORT=${HEAD:0:10}\n  gh api \"repos/<owner>/<repo>/issues/<N>/comments\" --jq '\n    [.[] | select(.user.login | test(\"greptile\";\"i\")) | {\n      updated: .updated_at,\n      commit: ((.body | split(\"Last reviewed commit:\")[1] // \"\" |\n                split(\"commit/\")[1] // \"\" | split(\")\")[0])[0:10]),\n      score: ((.body | capture(\"<h3>Confidence Score: (?<s>[0-9]/5)</h3>\").s) // \"?\")\n    }] | map(select(.commit == env.SHORT)) | sort_by(.updated) | last'\n\nThis:\n  1. Pulls the PR's actual HEAD SHA up front.\n  2. Filters Greptile comments to ONLY those whose \"Last reviewed\n     commit:\" footer matches HEAD (so a stale older review can't win).\n  3. Among the matching reviews, picks the latest by updated_at.\n\nPer feedback_greptile_match_head_not_chronology.md: out-of-order parallel\nre-runs make creation order misleading. Per feedback_tail_with_desc_\nordering.md: same failure mode (trust an implicit order without\nvalidating it).\n\nBypass marker (greptile-extraction-acknowledged) ONLY for legitimate\ncases (e.g., you explicitly WANT the creation order to audit posting\ncadence, not the latest state).\n",
    "tests": [
      {
        "name": "warns-on-sort-by-created-at-greptile-comments",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '[.[] | select(.user.login | test(\"greptile\";\"i\"))] | sort_by(.created_at) | last'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-greptile-review-extraction-by-created-at"
      },
      {
        "name": "warns-on-greptile-grep-then-tail",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '.[].body' | grep -i greptile | tail -1"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-greptile-review-extraction-by-created-at"
      },
      {
        "name": "warns-on-greptile-grep-then-head",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '.[] | select(.body | test(\"greptile\";\"i\"))' | grep 'Confidence Score' | head -1"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-greptile-review-extraction-by-created-at"
      },
      {
        "name": "warns-on-capture-commit-sha-from-greptile-body",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '[.[] | select(.user.login | test(\"greptile\";\"i\")) | {commit: (.body | capture(\"/commit/(?<sha>[0-9a-f]+)\").sha)}]'"
          }
        },
        "expected_exit": 0,
        "expected_stderr_contains": "warn-greptile-review-extraction-by-created-at"
      },
      {
        "name": "allows-correct-pattern-updated-at-and-last-reviewed-commit",
        "input": {
          "tool_input": {
            "command": "gh api \"repos/o/r/issues/1/comments\" --jq '\n  [.[] | select(.user.login | test(\"greptile\";\"i\")) | {\n    updated: .updated_at,\n    commit: ((.body | split(\"Last reviewed commit:\")[1] // \"\" | split(\"commit/\")[1] // \"\" | split(\")\")[0])[0:10]),\n    score: ((.body | capture(\"<h3>Confidence Score: (?<s>[0-9]/5)</h3>\").s) // \"?\")\n  }] | sort_by(.updated) | last'\n"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-non-greptile-comments-call",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '[.[] | .body] | sort_by(.created_at)'"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-greptile-with-updated-at-and-sort",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '[.[] | select(.user.login | test(\"greptile\";\"i\"))] | sort_by(.updated_at) | last'"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-gh-search-greptile-not-api-comments",
        "input": {
          "tool_input": {
            "command": "gh search prs --label greptile-approved"
          }
        },
        "expected_exit": 0
      },
      {
        "name": "allows-bypass-marker",
        "input": {
          "tool_input": {
            "command": "gh api repos/o/r/issues/1/comments --jq '[.[] | select(.user.login | test(\"greptile\";\"i\"))] | sort_by(.created_at) | last' # hook-bypass: greptile-extraction-acknowledged"
          }
        },
        "expected_exit": 0
      }
    ]
  }
]