diff --git a/.claude/settings.json b/.claude/settings.json index e2456a1..b2f14e7 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -6,7 +6,7 @@ "hooks": [ { "type": "command", - "command": ": pwg-guard-v3; i=$(cat); c=$(printf '%s' \"$i\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$c\" ] && c=$i; printf '%s' \"$c\" | grep -Eq '(^|[;&|])[[:space:]]*(git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--[A-Za-z][A-Za-z-]*(=[^[:space:];&|]*)?|-[A-Za-z]+))*[[:space:]]+push|gh[[:space:]]+pr[[:space:]]+(create|merge))([[:space:];&|]|$)' || exit 0; d=''; t=$(printf '%s' \"$c\" | sed -n 's/.*git[[:space:]][[:space:]]*-C[[:space:]][[:space:]]*\\([^[:space:];&][^[:space:];&]*\\).*/\\1/p'); [ -n \"$t\" ] && d=$t; if [ -z \"$d\" ]; then p=$(printf '%s' \"$c\" | sed -n 's/^[[:space:]]*cd[[:space:]][[:space:]]*\\([^[:space:];&][^[:space:];&]*\\).*/\\1/p'); [ -n \"$p\" ] && d=$p; fi; case $d in '~') d=$HOME;; '~/'*) d=$HOME/${d#\\~/};; esac; if [ -n \"$d\" ]; then b=$(git -C \"$d\" rev-parse --abbrev-ref HEAD 2>/dev/null); else b=$(git rev-parse --abbrev-ref HEAD 2>/dev/null); fi; printf '%s' \"$b\" | grep -Eqi '^(AGENT-PREAMBLE|bob|dia|dr-sommer|engels|gary|hans-cee|jack|james|lenin|linus|lorne-cee|maschin|obi|rumi|sensei|seo-[a-z-]+|steffi|sven|trillian)/' && exit 0; echo \"Write blocked (PWG/#813): branch '$b' is not a sanctioned /… branch. A no-persona/cloud session must PROPOSE, not push or open PRs.\" >&2; exit 2", + "command": ": pwg-guard-v5; i=$(cat); c=$(printf '%s' \"$i\" | jq -r '.tool_input.command // empty' 2>/dev/null); [ -z \"$c\" ] && c=$i; k=$(printf '%s' \"$c\" | awk 'BEGIN{h=0} h==1{if($0 ~ \"^[[:blank:]]*\" d \"[[:blank:]]*$\"){h=0} next} {if(match($0,/<<-?[[:blank:]]*[\\047\\042]?[A-Za-z_][A-Za-z0-9_]*[\\047\\042]?/)){s=substr($0,RSTART,RLENGTH);sub(/^<<-?[[:blank:]]*/,\"\",s);gsub(/[\\047\\042]/,\"\",s);d=s;h=1} print}'); printf '%s' \"$k\" | grep -Eq '(^|[;&|])[[:space:]]*(git([[:space:]]+(-[Cc][[:space:]]+[^[:space:];&|]+|--[A-Za-z][A-Za-z-]*(=[^[:space:];&|]*)?|-[A-Za-z]+))*[[:space:]]+push|gh[[:space:]]+pr[[:space:]]+(create|merge))([[:space:];&|]|$)' || exit 0; ct=$(printf '%s' \"$k\" | grep -Eo '(checkout|switch)[[:space:]]+(-[qf][[:space:]]+)*-[bBc][[:space:]]+[^[:space:];&|]+' | sed -E 's/.*[[:space:]]//' | grep -v '^$' | sort -u); n=$(printf '%s' \"$ct\" | grep -c .); [ \"$n\" -gt 1 ] && { echo \"Write blocked (PWG/#446): ambiguous branch target — this command checks out more than one branch, so the guard cannot tell which one is pushed. Split the calls.\" >&2; exit 2; }; d=''; u=0; t=$(printf '%s' \"$k\" | sed -n 's/.*git[[:space:]][[:space:]]*-C[[:space:]][[:space:]]*\\([^[:space:];&][^[:space:];&]*\\).*/\\1/p'); [ -n \"$t\" ] && d=$t; if [ -z \"$d\" ]; then p=$(printf '%s' \"$k\" | sed -n 's/^[[:space:]]*cd[[:space:]][[:space:]]*\\([^[:space:];&][^[:space:];&]*\\).*/\\1/p'); [ -n \"$p\" ] && d=$p; fi; case $d in *'$'*) u=1; d='';; esac; case $d in '~') d=$HOME;; '~/'*) d=$HOME/${d#\\~/};; esac; if [ \"$n\" -eq 1 ]; then b=$ct; elif [ -n \"$d\" ]; then b=$(git -C \"$d\" rev-parse --abbrev-ref HEAD 2>/dev/null); else b=$(git rev-parse --abbrev-ref HEAD 2>/dev/null); fi; [ \"$u\" -eq 1 ] && echo \"PWG/#446: the -C target is an unexpanded variable and cannot be resolved; judging against the current-directory branch '$b' instead.\" >&2; printf '%s' \"$b\" | grep -Eqi '^(bob|dia|dr-sommer|engels|gary|hans-cee|jack|james|lenin|linus|lorne-cee|maschin|obi|rumi|sensei|seo-[a-z-]+|steffi|sven|trillian)/' && exit 0; echo \"Write blocked (PWG/#813): branch '$b' is not a sanctioned /… branch. A no-persona/cloud session must PROPOSE, not push or open PRs.\" >&2; exit 2", "timeout": 10 } ]