Extends the opt-in design-lint catalog from 17 rules to 22. The new rules flag decorative script display fonts (Pacifico, Caveat, Comic Sans, Lobster, Dancing Script), pure-channel hex colors like #f00 or #00ff00 used outside :root token definitions, transition: all and the transition-all utility, default scale(1.05) and scale(1.1) hover effects, and emoji placed inside headings or buttons. Each rule ships with positive and false-positive tests, and the Design Lint reference page documents the full set.

Adds an opt-in PostToolUse content gate that scans UI file writes and edits for generic, templated design and missing UI-quality basics. It catches the overused #667eea/#764ba2 gradient, beige and brass "premium" palettes, default Tailwind indigo, Inter as the display font, placeholder names and fabricated stats, marketing filler copy, em and en dashes in rendered text, hardcoded Tailwind palette classes, raw hex in inline styles, hotlinked images, and interactive elements with no visible focus style. Violet and purple gradients are matched by OKLCH hue rather than a fixed hex list, so arbitrary violets are caught too. Findings attach as additionalContext next to the security reminders so the assistant can self-correct on the next turn. The gate is off by default (features.design_lint), raw color values inside :root token definitions are exempt, and individual rules disable by id. See the Design Lint reference page.

Broadens the v1.27.0 session scratch auto-allow from Write/Edit plus mkdir/touch/cp/redirect to the rest of the common write surface, so agents stop being prompted for routine throwaway work. New scratch-aware upgrades: mv (destination), tee output, chmod/chown/chgrp, curl -o/wget -O downloads, sd in-place edits, and MultiEdit/NotebookEdit file writes.

Also fixes a quoted-redirect gap: a quoted scratch target like > "$TOOL_GATES_SCRATCH/..." previously prompted because the quoted path was blanked before the scratch check, so the real target is now recovered from the original command. The safety model: each gate flips Ask to Allow only when the write target resolves under the scratch base (symlink or .. escapes still gate), and every non-scratch write still prompts. Tools whose sublanguage can run shell or write outside the named target (sed -i, sqlite3, zip, tar) are deliberately left asking, since a scratch target does not bound what they do.

Also adds a guarded awk/gawk/mawk gate so common read-only idioms (field selection, column sums, line counts, range extraction) auto-allow instead of prompting, while any awk that runs a command or writes a file still asks. A program auto-allows only as a static, inline, single-quoted literal with none of the exec/write markers (system, getline, a real | pipe, an @ indirect call, or a > redirect); || and >= are exempt so logical-or and range comparisons still allow. A program built from a shell variable, command substitution, ANSI-C quoting, or a later -e/--source chunk is opaque and asks since its text cannot be inspected, and -f/-i/-l/-E external-program flags ask. Dynamic filenames and -v values still allow because awk never executes them. Measured against the real session corpus, a clear majority of routine awk now auto-allows, with no file-writing or command-running awk allowed.

Adds a friction-free session scratch directory so agents stop reaching for /tmp. When $TOOL_GATES_SCRATCH is set (default ~/.cache/tool-gates-scratch), Write/Edit targets and shell mkdir/touch/cp/redirect destinations that resolve under it are auto-allowed in every permission mode. Targets are canonicalized first, so a symlink or .. that escapes the base is not matched, and sensitive or guarded paths still gate. On Claude this is a true allow; on Codex (deny-only PreToolUse) it falls through.

Also replaces the single generic awk suggestion with idiom-aware routing: byte/size math points at numbat, column sums at jq -Rn, line counts at rg -c, positional row/field extraction at jc | jq, and plain field selection at choose. Stateful range extraction and bare filters get no nudge.

Tightens the review TUI blast-radius model. A scoped family glob over a high-stakes program (docker run:*, aws s3:*, ssh, rm, ...) written to project or global settings is a team- or machine-wide standing grant to run arbitrary subcommands of a high-blast-radius tool, so approving one now requires an explicit y confirm. Local-only grants and non-high-stakes programs are unchanged.

Replaces the focus-mode three-panel layout with a flat keyboard model: arrows always navigate, letter keys act (a approve, d deny, x remove, y confirm). Adds Pending, Approved, and Denied views; the two rule views read settings.json and remove existing allow/deny rules behind a confirmation. A new blast-radius risk model (pattern breadth, scope reach, and whether the program is high-stakes) colors the panel and forces an explicit confirm before a dangerous write, and a compound segment with no safe suggested pattern is refused instead of fabricating a broad glob for the wrong program. Walkthrough and keymap live on the new Review TUI page.

Corrects the Antigravity hook install model. v1.24.0 shipped Antigravity as global-only at ~/.gemini/antigravity-cli/hooks.json; this release moves the default to the shared user path ~/.gemini/config/hooks.json and adds a -s project scope that writes .agents/hooks.json. tool-gates hooks status and tool-gates doctor now report both scopes. Also fixes the four-client install grid layout and footer wrapping on the documentation index.

Adds Antigravity CLI (Google's agy, the Gemini CLI successor) as a first-class client. Antigravity uses a distinct wire format: a payload nesting the tool under toolCall with PascalCase args, a flat {decision, reason} output, and a hooks.json keyed by hook name. tool-gates normalizes the payload, installs a single PreToolUse hook via tool-gates hooks add --antigravity, and gates shell, file, grep, and glob tools. The Gemini CLI client is marked deprecated across the docs because Google sunsets the consumer Gemini CLI on 2026-06-18; it keeps working through the transition.

Introduces an interactive documentation site with a WebAssembly command simulator. It adds a declarative rules exporter (tool-gates rules export) and auto approval configurations for Codex in project edits ([codex] accept_project_edits). The output truncation pipe blocker was refined to focus only on build, test, and GitHub producers (such as cargo, npm, go, make, and gh), allowing soft producers (like cat and ls) to pass through with modern CLI hints. This release also adds a Lefthook pre-commit hook to automatically regenerate the Markdown documentation on rule changes.

Adds gating for media tools (allowing ffprobe and d2, while gating ffmpeg info flags). It introduces read-only subcommands (including pending list, rules list, hooks status, and doctor) to the tool-gates command line interface. It also updates the raw string scanner to skip quoted heredocs. It resolves false positive asks caused by mise usage argument (stripping the usage_args eval prefix) and bun file execution expansion (by checking for code extensions or path separators).

Cleans up the output truncation blocker by dropping a vendor specific output tail reference from the head and tail deny rule.

Improves the clarity and usefulness of hook feedback. The denial messages for the output truncation and GitHub blockers now state the security risk and clear remediation steps. The modern hint suffix was replaced with agent actionable benefits. All other hints were polished for consistency.

Enforces a rule against running rg on code files. It routes searches to specialized tools such as probe, chunkhound, serena, and ast-grep. It introduces a hints catalog, system message tiering, and a length guard.

Introduces detailed reason prompts to the help menu for rejected hooks. It also adds tiered system messages and updates the build script to pass the 2024 edition to rustfmt.

Hardens the fallback behavior in accept edits mode. It ensures that the permission policy is correctly applied when resolving command wrappers.

Aligns the hook interface contracts across the Claude, Gemini, and Codex clients. This ensures consistent decision behavior across all tools.

Adds support for the Codex command line interface client. It gates worktree auto approvals on the subagent agent ID. It also fires Claude PermissionRequest events for Model Context Protocol tools to streamline subagent flows.

Resolves user defined git aliases against the user git configuration file so that custom git shortcuts are evaluated correctly. It also splits nested if let blocks to support Rust 1.86. It drops redundant plan mode checks and prevents home directory leaks during tracking tests.

Introduces the ask audit command to identify rules that shadow accept edits or suppress the third button in Claude Code. It adds an interactive review terminal user interface. It collapses duplicate pending entries and integrates plan mode checks to block mutations. It also defers benign asks to Claude Code to preserve the prefix suggestion prompt. It adds self healing capabilities to the tool detection cache.

Polishes the deny message for the head and tail truncation blocker. It removes vendor-specific references that did not apply to the general toolchain.

Adds a configuration toggle to block piping command outputs to head or tail. It also adds a configuration warning when user settings shadow the Model Context Protocol accept edits rule.

Enables auto approvals for Model Context Protocol tools in acceptEdits mode. This streamlines editing workflows for subagents.

Nudges network tools to use gh api when requesting GitHub URLs. This reduces unnecessary web scraping or API token usage.

Integrates with the Claude Code auto mode classifier. This enables hard ask promotion to deny, pending queue filtering, and PermissionDenied retry signals.

Unifies home directory path handling across all gates. It enforces strict cargo formatting checks in the continuous integration pipeline. It also uses generic users in test fixtures.

Adds support for the Claude Code Monitor tool. This enables permission gating for background monitoring commands.

Resolves package manager wrappers during acceptEdits mode. This ensures that linters and formatters can run without triggering prompts.

Consolidates Python, Node, Ruby, Deno, PHP, and other language runtimes into a single runtime gate. This provides unified security analysis across language execution commands.

Fixes a continuous integration race condition. It removes a redundant workflow dispatch trigger that raced with pushes.

Removes redundant approval context from the hook additionalContext response. This minimizes context token usage.

Automatically detects and updates out of date matchers in the Claude configuration when registering hooks.

Enables auto approvals for file edits inside agent worktrees during PermissionRequest events. It also allows gate allowed commands to participate in compound settings approvals. It clarifies that the branch allow rule covers creation too.

Bumps the plugin to version 1.5.8. It removes the MultiEdit tool and the mcp cli gate. It replaces all em dash patterns in the source code and configuration with periods and commas.

Improves binary path resolution in hook scripts. It searches the environment PATH variable when argv[0] is not an absolute path.

Resolves Homebrew installation path issues. It references the symlinked binary path rather than the canonicalized Cellar path.

Introduces native support for Gemini CLI BeforeTool and AfterTool hooks. It automatically translates payloads and responses to match the Gemini format.

Adds dedicated rules and gates for missing system programs. This expands command coverage and improves security check safety.

Provides a large reliability release. It adds fine-grained token detection for GitHub and Stripe. It uses atomic cache updates, strips transparent command wrappers, and blocks direct modifications to the git directory in accept edits mode. It also ensures generated code is formatted to prevent dirty worktrees.

Polishes modern command hints and removes the redundant ALWAYS indicator. It updates plugin skills to match path-scoped rules.

Enables per subcommand gate evaluation for compound commands. It adds Windows target platform support to the automated build pipeline.

Improves settings resolution by adding specificity based allow/ask matching. It expands the HOME variable in pattern matching. It also integrates release plz with custom bot authentication.

Stages build generated rules during pre-commit hooks. It documents Homebrew as the recommended installation method.

Corrects Homebrew tap repository push authentication in GitHub Actions. It integrates build provenance attestation to secure release binary publishing.

Fixes Cargo package verification issues in the release pipeline. It moves the plugin into a subdirectory to prevent skill leakage. It also removes the name field from skills to improve editor autocompletion.

Switches the release workflow to release-plz with automated homebrew tap publishing. It moves the plugin to a subdirectory to prevent skill leakage. It fixes cargo package verification and cargo build issues under continuous integration by committing generated files, matching import order to cargo fmt, sorting custom handler lists, and skipping codegen during verification. It also ignores cross-session hint deduplication tests in shared processes.

Hardens security for compound commands. It requires all subcommands to match allowed patterns in user settings before granting auto approval.

Removes the patch command from the acceptEdits auto allow list to prevent arbitrary write bypasses. It backs this check with 20 new security tests.

Improves secret checking heuristics. This prevents false positive leakage reports in documentation and environment files.

Introduces the doctor command to diagnose hook health. It adds auto approval configurations for trusted project skills.

Adds granular configuration toggles in the config file. This enables or disables specific gate tiers.

Implements PreToolUse hook support for Model Context Protocol tools. It adds content scanning security reminders for file write operations. It also replaces deprecated approval responses.

The initial public release of tool-gates. It features an AST based bash parser for precise command identification. It integrates with settings files. It checks against shell execution patterns. It provides a terminal user interface for review and hooks subcommand management.