@10et/cli 1.0.0

package/scripts/session/test-session-sync.sh

@@ -0,0 +1,320 @@
+#!/usr/bin/env bash
+#
+# Rigorous tests for session-sync.sh
+# Tests both positive cases AND anti-tests (what should NOT happen)
+#
+# @purpose Test session-sync.sh before committing (work-loss prevention)
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEST_DIR="/tmp/jfl-session-sync-test-$$"
+REPO_DIR="$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null || echo ".")"
+REPO_DIR="${REPO_DIR%/.git}"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+TESTS_PASSED=0
+TESTS_FAILED=0
+
+pass() {
+    echo -e "${GREEN}✓${NC} $1"
+    TESTS_PASSED=$((TESTS_PASSED + 1))
+}
+
+fail() {
+    echo -e "${RED}✗${NC} $1"
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+}
+
+section() {
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo -e "${BLUE}$1${NC}"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+}
+
+cleanup() {
+    rm -rf "$TEST_DIR" 2>/dev/null || true
+}
+
+trap cleanup EXIT
+
+# ==============================================================================
+# Test 1: Script Safety Checks
+# ==============================================================================
+
+test_safety_checks() {
+    section "Test 1: Safety Checks (prevent data loss)"
+
+    # Check for uncommitted changes protection
+    if grep -q "has uncommitted changes AND is behind" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Protects against pulling over uncommitted changes"
+    else
+        fail "No protection for uncommitted changes + pull"
+    fi
+
+    # Check that it uses 'set -e' for failure propagation
+    if head -10 "$SCRIPT_DIR/session-sync.sh" | grep -q "set -e"; then
+        pass "Uses 'set -e' for error propagation"
+    else
+        fail "Doesn't use 'set -e' - errors may be silent"
+    fi
+
+    # Check that it exits with error code on failure
+    if grep -q "exit 1" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Exits with error code on failure"
+    else
+        fail "Doesn't exit with error - CI/CD won't catch failures"
+    fi
+
+    # Anti-test: Verify it doesn't use --force flags
+    if grep -E "git pull.*--force|git reset --hard" "$SCRIPT_DIR/session-sync.sh" >/dev/null; then
+        fail "DANGER: Uses destructive git commands (--force, --hard)"
+    else
+        pass "Doesn't use destructive git commands"
+    fi
+
+    # Check for graceful network failure handling
+    if grep -q "Could not fetch.*no network" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Handles network failures gracefully"
+    else
+        fail "No graceful handling of network failures"
+    fi
+}
+
+# ==============================================================================
+# Test 2: Detached HEAD Handling
+# ==============================================================================
+
+test_detached_head() {
+    section "Test 2: Detached HEAD Handling (submodules)"
+
+    # Check if script detects detached HEAD
+    if grep -q "detached HEAD state" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Detects detached HEAD state"
+    else
+        fail "Doesn't detect detached HEAD"
+    fi
+
+    # Check if it attempts to fix detached HEAD
+    if grep -A5 "detached HEAD" "$SCRIPT_DIR/session-sync.sh" | grep -q "checkout main"; then
+        pass "Attempts to fix detached HEAD automatically"
+    else
+        fail "Doesn't auto-fix detached HEAD"
+    fi
+
+    # Anti-test: Verify it doesn't force checkout (would lose work)
+    if grep -E "git checkout.*-f|git checkout.*--force" "$SCRIPT_DIR/session-sync.sh" >/dev/null; then
+        fail "DANGER: Uses force checkout (loses uncommitted work)"
+    else
+        pass "Doesn't use force checkout"
+    fi
+}
+
+# ==============================================================================
+# Test 3: Submodule vs Symlink Detection
+# ==============================================================================
+
+test_product_detection() {
+    section "Test 3: Product Detection (submodule vs symlink)"
+
+    # Check for submodule detection (has .git FILE)
+    if grep -q "It's a submodule" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Detects submodules correctly (.git as file)"
+    else
+        fail "Doesn't detect submodules"
+    fi
+
+    # Check for symlink detection
+    if grep -q "\[ -L \"\$PRODUCT_PATH\" \]" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Detects symlinks correctly"
+    else
+        fail "Doesn't detect symlinks"
+    fi
+
+    # Check for missing product handling
+    if grep -q "Initializing product submodule" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Handles missing product gracefully"
+    else
+        fail "Doesn't handle missing product"
+    fi
+
+    # Check for symlink deprecation warning
+    if grep -q "product/ is a symlink, not a submodule" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Warns about legacy symlink usage"
+    else
+        fail "Doesn't warn about symlinks (legacy pattern)"
+    fi
+}
+
+# ==============================================================================
+# Test 4: Failure Tracking
+# ==============================================================================
+
+test_failure_tracking() {
+    section "Test 4: Failure Tracking (exit codes)"
+
+    # Check that failures are tracked
+    if grep -q "FAILURES=0" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Initializes failure counter"
+    else
+        fail "Doesn't track failures"
+    fi
+
+    # Check that failures increment counter
+    if grep -q "FAILURES=\$((FAILURES + 1))" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Increments failure counter on errors"
+    else
+        fail "Doesn't increment failure counter"
+    fi
+
+    # Check that exit code reflects failures
+    if grep -A5 "if.*FAILURES.*-gt 0" "$SCRIPT_DIR/session-sync.sh" | grep -q "exit 1"; then
+        pass "Exits with code 1 when failures occur"
+    else
+        fail "Doesn't exit with error code on failures"
+    fi
+}
+
+# ==============================================================================
+# Test 5: Integration with Current Repo
+# ==============================================================================
+
+test_current_repo_integration() {
+    section "Test 5: Integration with Current Repo"
+
+    cd "$REPO_DIR"
+
+    # Test that script runs without crashing
+    if "$SCRIPT_DIR/session-sync.sh" >/dev/null 2>&1; then
+        pass "Script runs successfully on current repo"
+    else
+        exit_code=$?
+        if [[ $exit_code -eq 1 ]]; then
+            # Check if failure was due to uncommitted changes (safe failure)
+            output=$("$SCRIPT_DIR/session-sync.sh" 2>&1 || true)
+            if echo "$output" | grep -q "uncommitted changes"; then
+                pass "Script correctly fails on uncommitted changes"
+            else
+                fail "Script failed for unknown reason (exit code 1)"
+            fi
+        else
+            fail "Script crashed with exit code $exit_code"
+        fi
+    fi
+
+    # Test that it doesn't modify uncommitted changes
+    before_status=$(git status --porcelain)
+    "$SCRIPT_DIR/session-sync.sh" >/dev/null 2>&1 || true
+    after_status=$(git status --porcelain)
+
+    if [[ "$before_status" == "$after_status" ]]; then
+        pass "Doesn't modify uncommitted changes"
+    else
+        fail "DANGER: Modified uncommitted changes!"
+    fi
+}
+
+# ==============================================================================
+# Test 6: Behind/Ahead Detection
+# ==============================================================================
+
+test_behind_ahead_detection() {
+    section "Test 6: Behind/Ahead Detection"
+
+    # Check for behind detection
+    if grep -q "commits behind origin" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Detects when repo is behind origin"
+    else
+        fail "Doesn't detect behind status"
+    fi
+
+    # Check for ahead detection
+    if grep -q "commits ahead" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Detects when repo is ahead (unpushed)"
+    else
+        fail "Doesn't detect ahead status"
+    fi
+
+    # Check for up-to-date message
+    if grep -q "is up to date" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Reports when repo is up to date"
+    else
+        fail "Doesn't report up-to-date status"
+    fi
+}
+
+# ==============================================================================
+# Test 7: Recursive Submodule Update
+# ==============================================================================
+
+test_recursive_submodules() {
+    section "Test 7: Recursive Submodule Handling"
+
+    # Check for recursive submodule update
+    if grep -q "submodule update.*--recursive" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Updates submodules recursively"
+    else
+        fail "Doesn't update nested submodules"
+    fi
+
+    # Check for --init flag (initializes new submodules)
+    if grep -q "submodule update --init" "$SCRIPT_DIR/session-sync.sh"; then
+        pass "Initializes new submodules automatically"
+    else
+        fail "Doesn't initialize new submodules"
+    fi
+}
+
+# ==============================================================================
+# Run All Tests
+# ==============================================================================
+
+main() {
+    echo ""
+    echo "╔══════════════════════════════════════════════════════════╗"
+    echo "║  session-sync.sh Rigorous Testing                       ║"
+    echo "║  Before Commit Verification                             ║"
+    echo "╚══════════════════════════════════════════════════════════╝"
+
+    test_safety_checks
+    test_detached_head
+    test_product_detection
+    test_failure_tracking
+    test_current_repo_integration
+    test_behind_ahead_detection
+    test_recursive_submodules
+
+    # Summary
+    echo ""
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo -e "${BLUE}Test Results${NC}"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    echo -e "${GREEN}Passed:${NC} $TESTS_PASSED"
+    if [[ $TESTS_FAILED -gt 0 ]]; then
+        echo -e "${RED}Failed:${NC} $TESTS_FAILED"
+        echo ""
+        echo -e "${RED}session-sync.sh NOT READY TO COMMIT${NC}"
+        exit 1
+    else
+        echo ""
+        echo -e "${GREEN}✓ session-sync.sh ready to commit${NC}"
+        echo ""
+        echo "Safety verified:"
+        echo "  • Won't pull over uncommitted changes"
+        echo "  • Exits with error on failure"
+        echo "  • Handles network failures gracefully"
+        echo "  • No destructive operations"
+        echo "  • Detached HEAD auto-fix"
+        echo "  • Recursive submodule updates"
+        exit 0
+    fi
+}
+
+main "$@"

package/scripts/setup-branch-protection.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Setup branch protection for 402goose/jfl-cli
+# Requires: admin access to the repo
+# Usage: ./scripts/setup-branch-protection.sh
+
+REPO="402goose/jfl-cli"
+BRANCH="main"
+
+echo "Setting up branch protection for $REPO ($BRANCH)..."
+echo ""
+
+# Method 1: Repository rulesets (preferred — newer API, more flexible)
+echo "Attempting rulesets API..."
+if gh api "repos/$REPO/rulesets" \
+  --method POST \
+  --input - <<'EOF' 2>/dev/null; then
+{
+  "name": "Require CI + Sentinel before merge",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "required_status_checks": [
+          {
+            "context": "build-and-test",
+            "integration_id": null
+          },
+          {
+            "context": "PR Sentinel",
+            "integration_id": null
+          }
+        ]
+      }
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false
+      }
+    }
+  ]
+}
+EOF
+  echo "✅ Ruleset created successfully"
+  exit 0
+fi
+
+echo "Rulesets API failed, trying branch protection API..."
+
+# Method 2: Classic branch protection (fallback)
+if gh api "repos/$REPO/branches/$BRANCH/protection" \
+  --method PUT \
+  --input - <<'EOF' 2>/dev/null; then
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": [
+      "build-and-test",
+      "PR Sentinel"
+    ]
+  },
+  "enforce_admins": false,
+  "required_pull_request_reviews": null,
+  "restrictions": null,
+  "required_linear_history": false,
+  "allow_force_pushes": false,
+  "allow_deletions": false
+}
+EOF
+  echo "✅ Branch protection configured successfully"
+  exit 0
+fi
+
+echo ""
+echo "❌ Both APIs returned 404. You need admin access to $REPO."
+echo ""
+echo "Manual setup (GitHub UI):"
+echo "  1. Go to: https://github.com/$REPO/settings/rules"
+echo "  2. Click 'New ruleset'"
+echo "  3. Name: 'Require CI + Sentinel before merge'"
+echo "  4. Enforcement: Active"
+echo "  5. Target branches: Add 'main'"
+echo "  6. Add rule: 'Require status checks to pass'"
+echo "     - Check 'Require branches to be up to date'"
+echo "     - Add checks: 'build-and-test', 'PR Sentinel'"
+echo "  7. Add rule: 'Require a pull request before merging'"
+echo "     - Required approvals: 0"
+echo "  8. Save"
+echo ""
+echo "This prevents merging PRs until both CI and Sentinel have run."
+exit 1

package/scripts/spawn-fleet.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+# spawn-fleet.sh — Spin up N agent VMs from template for parallel autoresearch
+#
+# Usage:
+#   ./scripts/spawn-fleet.sh [FLEET_SIZE] [TARGET_REPO]
+#
+# Prerequisites:
+#   - Parallels Desktop Pro (prlctl)
+#   - Base VM "pi-base" with snapshot "clean-install"
+#   - hv_apple_isa_vm_quota=255 boot arg (for >2 VMs)
+#
+# Each VM gets:
+#   - Latest policy weights from .jfl/policy-weights.json
+#   - Agent identity config
+#   - Runs jfl peter autoresearch --rounds 5 autonomously
+
+set -euo pipefail
+
+FLEET_SIZE=${1:-5}
+TARGET_REPO=${2:-$(git remote get-url origin 2>/dev/null || echo "")}
+WAVE_ID=$(date +%s)
+WEIGHTS_PATH=".jfl/policy-weights.json"
+BASE_VM="pi-base"
+SNAPSHOT="clean-install"
+
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  JFL Agent Fleet — Wave ${WAVE_ID}"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Fleet size: ${FLEET_SIZE}"
+echo "  Target repo: ${TARGET_REPO}"
+echo "  Base VM: ${BASE_VM}"
+echo ""
+
+# Verify prlctl
+if ! command -v prlctl &>/dev/null; then
+  echo "ERROR: prlctl not found. Install Parallels Desktop Pro."
+  exit 1
+fi
+
+# Verify base VM exists
+if ! prlctl list -a 2>/dev/null | grep -q "${BASE_VM}"; then
+  echo "ERROR: Base VM '${BASE_VM}' not found."
+  echo ""
+  echo "Create it:"
+  echo "  prlctl create '${BASE_VM}' --ostype macos --dist macos-tahoe"
+  echo "  prlctl set '${BASE_VM}' --memsize 2048 --cpus 2"
+  echo "  prlctl start '${BASE_VM}'"
+  echo "  # Install: brew, node, git, jfl, ralph-tui"
+  echo "  prlctl stop '${BASE_VM}'"
+  echo "  prlctl snapshot '${BASE_VM}' --name '${SNAPSHOT}'"
+  exit 1
+fi
+
+# Create shared directories
+SHARED_DIR="/tmp/jfl-fleet-${WAVE_ID}"
+mkdir -p "${SHARED_DIR}/tuples" "${SHARED_DIR}/config"
+
+# Copy policy weights if they exist
+if [ -f "${WEIGHTS_PATH}" ]; then
+  cp "${WEIGHTS_PATH}" "${SHARED_DIR}/config/policy-weights.json"
+  TRAINED_ON=$(python3 -c "import json; print(json.load(open('${WEIGHTS_PATH}'))['trained_on'])" 2>/dev/null || echo "?")
+  echo "  Policy weights: trained on ${TRAINED_ON} tuples"
+else
+  echo "  No policy weights — agents will use heuristic selection"
+fi
+
+echo ""
+
+# Spawn VMs
+STARTED=0
+for i in $(seq 1 "${FLEET_SIZE}"); do
+  AGENT_NAME="agent-${WAVE_ID}-${i}"
+
+  echo -n "  [${i}/${FLEET_SIZE}] Spawning ${AGENT_NAME}..."
+
+  # Clone from template (linked clone = fast, CoW)
+  if ! prlctl clone "${BASE_VM}" --name "${AGENT_NAME}" --linked --snapshot "${SNAPSHOT}" 2>/dev/null; then
+    echo " FAILED (clone)"
+    continue
+  fi
+
+  # Configure VM
+  prlctl set "${AGENT_NAME}" --memsize 2048 --cpus 2 2>/dev/null
+
+  # Start VM
+  if ! prlctl start "${AGENT_NAME}" 2>/dev/null; then
+    echo " FAILED (start)"
+    prlctl delete "${AGENT_NAME}" 2>/dev/null || true
+    continue
+  fi
+
+  # Wait for VM to boot
+  sleep 5
+
+  # Inject agent config
+  prlctl exec "${AGENT_NAME}" -- bash -c "
+    mkdir -p /tmp/agent-config
+    cat > /tmp/agent-config/identity.json << EOF
+{
+  \"agent_id\": \"${AGENT_NAME}\",
+  \"wave_id\": \"${WAVE_ID}\",
+  \"fleet_index\": ${i},
+  \"fleet_size\": ${FLEET_SIZE},
+  \"target_repo\": \"${TARGET_REPO}\"
+}
+EOF
+  " 2>/dev/null
+
+  # Copy policy weights if available
+  if [ -f "${SHARED_DIR}/config/policy-weights.json" ]; then
+    prlctl copy-to "${AGENT_NAME}" \
+      "${SHARED_DIR}/config/policy-weights.json" \
+      /tmp/agent-config/policy-weights.json 2>/dev/null || true
+  fi
+
+  # Launch autoresearch inside VM
+  prlctl exec "${AGENT_NAME}" -- bash -c "
+    cd /tmp && git clone '${TARGET_REPO}' workspace 2>/dev/null
+    cd /tmp/workspace
+
+    # Load policy weights
+    mkdir -p .jfl
+    cp /tmp/agent-config/policy-weights.json .jfl/policy-weights.json 2>/dev/null || true
+    cp /tmp/agent-config/identity.json .jfl/agent-identity.json
+
+    # Run autoresearch (detached so exec returns)
+    nohup jfl peter autoresearch --rounds 5 > /tmp/autoresearch.log 2>&1 &
+    echo \$! > /tmp/autoresearch.pid
+  " 2>/dev/null &
+
+  STARTED=$((STARTED + 1))
+  echo " OK"
+done
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Fleet started: ${STARTED}/${FLEET_SIZE} agents"
+echo "  Wave ID: ${WAVE_ID}"
+echo "  Shared dir: ${SHARED_DIR}"
+echo ""
+echo "  Collect tuples:  ./scripts/collect-tuples.sh ${WAVE_ID}"
+echo "  Monitor:         prlctl list -a | grep agent-${WAVE_ID}"
+echo "  Destroy fleet:   ./scripts/destroy-fleet.sh ${WAVE_ID}"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

package/scripts/telemetry-dashboard.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Physical-World Telemetry Dashboard
+# Quick overview of telemetry monitoring capabilities
+
+set -euo pipefail
+
+echo "🌍 Physical-World Telemetry Dashboard"
+echo "====================================="
+echo
+
+# Check if telemetry is enabled
+echo "📊 Telemetry Status:"
+jfl telemetry status
+echo
+
+# Generate some sample data if none exists
+echo "🧪 Generating sample data..."
+jfl telemetry test --count 3 --interval 100 --categories "command,performance"
+echo
+
+# Show current snapshot
+echo "📈 Current Physical-World Metrics:"
+jfl telemetry monitor --compact
+echo
+
+echo "🔍 Available Monitoring Options:"
+echo "  jfl telemetry monitor --live          # Real-time updates"
+echo "  jfl telemetry monitor --filter cpu    # Filter for CPU-related events"
+echo "  jfl telemetry monitor --compact       # Compact display"
+echo
+
+echo "💡 Physical-World Data Captured:"
+echo "  • System: CPU usage, memory, thermal state, system load"
+echo "  • Hardware: battery level, disk space, sensors"
+echo "  • Workflow: git branch, dirty files, terminal count, IDE"
+echo "  • Network: latency, connectivity, local dev servers"
+echo "  • Performance: build times, test durations, command timing"
+echo
+
+echo "🎯 Competitive Advantage:"
+echo "  This data is impossible for web UIs to access!"
+echo "  You own the edge - local machine context during live operations."
+echo