Gate Check

---
name: gate-check
description: Route changed file paths to the verify commands this repo requires before shipping — docs changed means docs strict build, shell changed means bash -n, CLI changed means the encoding smoke test. Use before committing/opening a PR, when the user asks "what checks do I need to run", "run the gates", "gate check", or after substantive edits in a repo with a .claude/gate-router.local.md rules file. Deterministic local gates instead of session memory; also helps AUTHOR the rules file for a new repo.
---

Resolve `PLUGIN_ROOT` from the host-provided `PLUGIN_ROOT` / `CLAUDE_PLUGIN_ROOT`, or from this loaded skill’s directory (`../..`). Use that absolute path for the bundled commands; do not assume the current directory is the install root.


# Gate Check

Deterministic changed-path → verify-command routing. The rules live in the
project, not in anyone's memory: `.claude/gate-router.local.md` (the
marketplace's plugin-settings pattern).

## Check the current diff

```bash
bash "${PLUGIN_ROOT}/scripts/gate-router.sh" --list       # what's required
bash "${PLUGIN_ROOT}/scripts/gate-router.sh" --run        # run them, stop on failure
bash "${PLUGIN_ROOT}/scripts/gate-router.sh" --list --json
```

- Default diff base is `origin/main` (fall back `HEAD`); override with
  `--base <ref>`. The changed set is committed-vs-base + staged + unstaged + untracked —
  the full "about to ship" surface.
- `--run` executes gates in rule order and stops at the first failure with
  its exit code — report that failure to the user verbatim, fix, re-run.
- No config → the script says so and exits 0 (nothing to enforce). Suggest
  authoring one (below) when the repo clearly has gate-worthy surfaces.

## Author or extend the rules file

`.claude/gate-router.local.md`, rules in the frontmatter, `glob => command`:

```markdown
---
rules:
  - docs/** => mkdocs build --strict
  - "**/*.sh" => for file in {files}; do test ! -f "$file" || bash -n "$file" || exit; done
  - bin/src/** => cd bin && uv run pytest -q
  - plugins/** => bash scripts/validate.sh
---
Notes for humans below the fence (ignored by the router).
```

- `**` crosses directories; a leading `**/` also matches paths at the root.
- `{files}` passes the matched files to the command as separate arguments
  (safe for spaces, Unicode, tabs, and newlines). Keep `{files}` standalone and unquoted; the router adds quoting. Use it for linters; omit it
  for suite commands that don't take a file list.
- Duplicate commands from overlapping rules run once. Order = rule order.
- Derive rules from the repo's own history: CI workflow steps, CLAUDE.md
  test instructions, and past incident classes (encoding, docs links) are
  the gate candidates. Keep each gate FAST — these run per-change, not
  nightly.

## Trust boundary

The rules file **executes shell commands** — treat `.claude/gate-router.local.md`
like a Makefile: only run `--run` in repos you trust, and review a rules file
you didn't write before running it. The script is injection-safe with respect
to *filenames* (matched files are passed as argv, never interpolated into the
shell, so a changed file named `x;rm -rf ~` is an inert argument), but the
COMMANDS themselves are run verbatim with your privileges.

`{files}` paths are repo-root-relative. Do **not** combine `{files}` with a
command that changes directory (e.g. `cd bin && lint {files}`) — the files
would resolve against the wrong directory. Either keep such gates directory-
stable, or let the command run from the repo root.

## Composition

- `ship-loop` step 4 ("test against reality"): run `--run` before the review
  gate.
- Works identically on Windows (Git Bash) and Linux; Codex runs the same
  script via this skill (no hooks involved).