@amg555/frameforge-mcp 2.7.6 → 2.7.7

package/.agent/skills/gstack-freeze/SKILL.md

@@ -1,79 +0,0 @@
----
-name: gstack-freeze
-description: "Restrict file edits to a specific directory for the session. (gstack)"
----
-
-> [!NOTE]
-> **Antigravity Tool Mapping:** `AskUserQuestion` -> `ask_question`. `Bash` -> `run_command`. `Read` -> `view_file`. `Write` -> `write_to_file`. `Edit` -> `replace_file_content`. `Grep` -> `grep_search`. `Glob` -> `list_dir`. `Agent` -> subagent.
-
-<!-- AUTO-GENERATED from SKILL.md.tmpl — do not edit directly -->
-<!-- Regenerate: bun run gen:skill-docs -->
-
-
-## When to invoke this skill
-
-Blocks Edit,
-Write and NotebookEdit outside the allowed path. Use when debugging to prevent accidentally
-"fixing" unrelated code, or when you want to scope changes to one module.
-Use when asked to "freeze", "restrict edits", "only edit this folder",
-or "lock down edits".
-
-# /freeze — Restrict Edits to a Directory
-
-Lock file edits to a specific directory. Any Edit, Write or NotebookEdit
-operation targeting a file outside the allowed path will be **blocked** (not
-just warned).
-
-```bash
-GSTACK_STATE_ROOT=$(~/.claude/skills/gstack/bin/gstack-paths --get GSTACK_STATE_ROOT); : "${GSTACK_STATE_ROOT:?gstack-paths failed; reinstall with ./setup or /gstack-upgrade}"
-mkdir -p "$GSTACK_STATE_ROOT"/analytics
-echo '{"skill":"freeze","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> "$GSTACK_STATE_ROOT"/analytics/skill-usage.jsonl 2>/dev/null || true
-```
-
-## Setup
-
-Ask the user which directory to restrict edits to. Use AskUserQuestion:
-
-- Question: "Which directory should I restrict edits to? Files outside this path will be blocked from editing."
-- Text input (not multiple choice) — the user types a path.
-
-Once the user provides a directory path:
-
-Set the user-selected boundary with the shared state writer. It resolves the physical absolute path and serializes replacement with investigation cleanup:
-```bash
-bash "$HOME/.claude/skills/gstack/freeze/bin/freeze-state.sh" set "<user-provided-path>"
-```
-
-Only report success if the helper succeeds. On `FREEZE_BUSY` or unexpected state, preserve it and ask the user to inspect recovery after any active writer finishes; never write or delete the state file directly.
-
-Tell the user: "Edits are now restricted to `<path>/`. Any Edit, Write or
-NotebookEdit outside this directory will be blocked. To change the boundary, run `/freeze`
-again. To remove it, run `/unfreeze`."
-
-## How it works
-
-The hook reads `file_path` from the Edit/Write tool input JSON, or
-`notebook_path` from a NotebookEdit (Jupyter notebook) call (shared
-real-JSON extractor with /careful — one copy, sourced by both hooks), then
-checks whether the path starts with the freeze directory. If not, it returns a
-`hookSpecificOutput` payload with `permissionDecision: "deny"` to block the
-operation (nested under `hookSpecificOutput` — Claude Code ignores a top-level
-`permissionDecision`).
-
-Polarity is fail-closed: a tool payload the hook cannot parse is DENIED, not
-allowed — a boundary that fails open is not a boundary. A payload that parses
-but has neither path field (a non-file tool) is allowed. A deny names the
-tool, the path field, the boundary and `/unfreeze`. Symlinks are resolved
-through their FINAL component, so an in-boundary symlink pointing outside the
-boundary is checked against its target.
-
-The freeze boundary persists until explicitly removed via the state file. The hook
-script reads it on every Edit/Write/NotebookEdit invocation. Boundaries containing spaces
-are supported.
-
-## Notes
-
-- The trailing `/` on the freeze directory prevents `/src` from matching `/src-old`
-- Freeze applies to Edit, Write and NotebookEdit only — Read, Bash, PowerShell, Glob, Grep are unaffected
-- This prevents accidental edits, not a security boundary — Bash or PowerShell commands like `sed` or `Set-Content` can still modify files outside the boundary
-- To deactivate, run `/unfreeze`; ending or killing a conversation does not remove persisted state

package/.agent/skills/gstack-freeze/SKILL.md.tmpl

@@ -1,96 +0,0 @@
----
-name: freeze
-version: 0.1.0
-description: |
-  Restrict file edits to a specific directory for the session. Blocks Edit,
-  Write and NotebookEdit outside the allowed path. Use when debugging to prevent accidentally
-  "fixing" unrelated code, or when you want to scope changes to one module.
-  Use when asked to "freeze", "restrict edits", "only edit this folder",
-  or "lock down edits". (gstack)
-triggers:
-  - freeze edits to directory
-  - lock editing scope
-  - restrict file changes
-allowed-tools:
-  - Bash
-  - Read
-  - AskUserQuestion
-hooks:
-  PreToolUse:
-    - matcher: "Edit"
-      hooks:
-        - type: command
-          command: 'bash -c "exec bash \"$HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh\""'
-          statusMessage: "Checking freeze boundary..."
-    - matcher: "Write"
-      hooks:
-        - type: command
-          command: 'bash -c "exec bash \"$HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh\""'
-          statusMessage: "Checking freeze boundary..."
-    - matcher: "NotebookEdit"
-      hooks:
-        - type: command
-          command: 'bash -c "exec bash \"$HOME/.claude/skills/gstack/freeze/bin/check-freeze.sh\""'
-          statusMessage: "Checking freeze boundary..."
-sensitive: true
----
-
-# /freeze — Restrict Edits to a Directory
-
-Lock file edits to a specific directory. Any Edit, Write or NotebookEdit
-operation targeting a file outside the allowed path will be **blocked** (not
-just warned).
-
-```bash
-GSTACK_STATE_ROOT=$(~/.claude/skills/gstack/bin/gstack-paths --get GSTACK_STATE_ROOT); : "${GSTACK_STATE_ROOT:?gstack-paths failed; reinstall with ./setup or /gstack-upgrade}"
-mkdir -p "$GSTACK_STATE_ROOT"/analytics
-echo '{"skill":"freeze","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}'  >> "$GSTACK_STATE_ROOT"/analytics/skill-usage.jsonl 2>/dev/null || true
-```
-
-## Setup
-
-Ask the user which directory to restrict edits to. Use AskUserQuestion:
-
-- Question: "Which directory should I restrict edits to? Files outside this path will be blocked from editing."
-- Text input (not multiple choice) — the user types a path.
-
-Once the user provides a directory path:
-
-Set the user-selected boundary with the shared state writer. It resolves the physical absolute path and serializes replacement with investigation cleanup:
-```bash
-bash "{{RUNTIME_ROOT}}/freeze/bin/freeze-state.sh" set "<user-provided-path>"
-```
-
-Only report success if the helper succeeds. On `FREEZE_BUSY` or unexpected state, preserve it and ask the user to inspect recovery after any active writer finishes; never write or delete the state file directly.
-
-Tell the user: "Edits are now restricted to `<path>/`. Any Edit, Write or
-NotebookEdit outside this directory will be blocked. To change the boundary, run `/freeze`
-again. To remove it, run `/unfreeze`."
-
-## How it works
-
-The hook reads `file_path` from the Edit/Write tool input JSON, or
-`notebook_path` from a NotebookEdit (Jupyter notebook) call (shared
-real-JSON extractor with /careful — one copy, sourced by both hooks), then
-checks whether the path starts with the freeze directory. If not, it returns a
-`hookSpecificOutput` payload with `permissionDecision: "deny"` to block the
-operation (nested under `hookSpecificOutput` — Claude Code ignores a top-level
-`permissionDecision`).
-
-Polarity is fail-closed: a tool payload the hook cannot parse is DENIED, not
-allowed — a boundary that fails open is not a boundary. A payload that parses
-but has neither path field (a non-file tool) is allowed. A deny names the
-tool, the path field, the boundary and `/unfreeze`. Symlinks are resolved
-through their FINAL component, so an in-boundary symlink pointing outside the
-boundary is checked against its target.
-
-The freeze boundary persists until explicitly removed via the state file. The hook
-script reads it on every Edit/Write/NotebookEdit invocation. Boundaries containing spaces
-are supported.
-
-## Notes
-
-- The trailing `/` on the freeze directory prevents `/src` from matching `/src-old`
-- Freeze applies to Edit, Write and NotebookEdit only — Read, Bash, PowerShell, Glob, Grep are unaffected
-- This prevents accidental edits, not a security boundary — Bash or PowerShell commands like `sed` or `Set-Content` can still modify files outside the boundary
-- To deactivate, run `/unfreeze`; ending or killing a conversation does not remove persisted state

package/.agent/skills/gstack-freeze/bin/check-freeze.sh

@@ -1,210 +0,0 @@
-#!/usr/bin/env bash
-# check-freeze.sh — PreToolUse hook for /freeze skill
-# Reads JSON from stdin, checks if the edited path is within the freeze
-# boundary: file_path for Edit/Write, notebook_path for NotebookEdit (#3067).
-# Returns a PreToolUse hookSpecificOutput with permissionDecision "deny" to block,
-# or {} to allow. The decision MUST be nested under hookSpecificOutput — Claude
-# Code ignores a top-level permissionDecision, which silently no-ops the block.
-#
-# Polarity: freeze is a DENY-tier hook, so an unreadable payload DENIES
-# (fail closed). A payload that parses but has no file_path is a non-file
-# tool — allow. This is the opposite edge-handling from careful's ask-tier
-# and intentionally so: /guard runs both, and a boundary that fails open is
-# not a boundary.
-set -euo pipefail
-
-# Deny-tier backstop: any unexpected non-zero death (a failing pipeline under
-# set -e, a deleted cwd, EACCES) would otherwise exit with no decision JSON,
-# which Claude Code treats as non-blocking — the edit proceeds. Every
-# deliberate output below sets _FREEZE_DECIDED first so a late failure after
-# a decision never prints a second JSON object.
-_FREEZE_DECIDED=""
-_freeze_backstop() {
-  local rc=$?
-  if [ "$rc" -ne 0 ] && [ -z "$_FREEZE_DECIDED" ]; then
-    _FREEZE_DECIDED=1
-    printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook failed unexpectedly (exit %s) - blocked, fail closed. Re-run ./setup or /unfreeze."}}\n' "$rc"
-    exit 0
-  fi
-}
-trap _freeze_backstop EXIT
-
-# Read stdin
-INPUT=$(cat)
-
-# Shared JSON helpers (extractor + encoder) — one copy for careful AND freeze.
-# freeze previously carried its own grep-first extractor which truncated at
-# escaped quotes and failed OPEN; the shared file kills that drift class.
-_HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=careful/bin/hook-extract.sh
-# Freeze is deny-tier: if its own helpers are missing/broken (partial install,
-# mid-upgrade state), the boundary must fail CLOSED — inline JSON, since the
-# encoder we would normally use lives in the file that just failed to load.
-# NOTE: bash treats `.` on a MISSING file as fatal in non-interactive shells
-# (an if-guard cannot catch it) — the existence check must come first.
-_HOOK_HELPER="$_HOOK_DIR/../../careful/bin/hook-extract.sh"
-if [ ! -f "$_HOOK_HELPER" ] || ! . "$_HOOK_HELPER" 2>/dev/null; then
-  _FREEZE_DECIDED=1
-  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook helpers unavailable (broken install?) - blocked, fail closed. Reinstall gstack or run /unfreeze."}}\n'
-  exit 0
-fi
-
-# Locate the freeze directory state file. The writer (/freeze via
-# gstack-paths) and this reader MUST resolve the same root or the boundary
-# fails open: with GSTACK_HOME set, /freeze wrote freeze-dir.txt under
-# GSTACK_HOME while this hook read $HOME/.gstack, found nothing, and allowed
-# everything (#1459, #1509). gstack_hook_state_root mirrors gstack-paths.
-# A helper from an older install that lacks the function must fail CLOSED
-# (the existence check above only proves the file sourced), never exit 127
-# with no JSON — Claude Code treats that as non-blocking.
-if ! command -v gstack_hook_state_root >/dev/null 2>&1 || ! command -v gstack_hook_normalize_path >/dev/null 2>&1 || ! command -v gstack_hook_extract_tool >/dev/null 2>&1; then
-  _FREEZE_DECIDED=1
-  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"[freeze] Hook helpers out of date (partial upgrade?) - blocked, fail closed. Re-run ./setup or /unfreeze."}}\n'
-  exit 0
-fi
-STATE_DIR="$(gstack_hook_state_root; printf x)"; STATE_DIR="${STATE_DIR%x}"
-FREEZE_FILE="$STATE_DIR/freeze-dir.txt"
-
-# If no freeze file exists, allow everything (not yet configured)
-if [ ! -f "$FREEZE_FILE" ]; then
-  _FREEZE_DECIDED=1
-  echo '{}'
-  exit 0
-fi
-
-{
-  IFS= read -r FREEZE_DIR || true
-  IFS= read -r FREEZE_OWNER_LINE || true
-} < "$FREEZE_FILE"
-case "$FREEZE_OWNER_LINE" in
-  gstack-freeze-v1:*) ;;
-  *) FREEZE_DIR=$(printf '%s\n' "$FREEZE_DIR" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') ;;
-esac
-# A literal leading ~ in the state file never matches absolute tool paths
-# (tilde is not expanded from variables) — expand it here.
-case "$FREEZE_DIR" in
-  "~/"*) FREEZE_DIR="$HOME/${FREEZE_DIR#\~/}" ;;
-  "~") FREEZE_DIR="$HOME" ;;
-esac
-
-# If freeze dir is empty, allow
-if [ -z "$FREEZE_DIR" ]; then
-  _FREEZE_DECIDED=1
-  echo '{}'
-  exit 0
-fi
-
-# Both sides of the comparison go through one canonicalization: the state
-# file may hold C:\dev\proj\ or the /c/dev/proj/ that `pwd` prints in Git
-# Bash, and Claude Code on Windows reports file_path as C:\... (#2876).
-gstack_hook_normalize_path "$FREEZE_DIR"
-FREEZE_DIR="$GSTACK_HOOK_PATH"
-
-case "$FREEZE_DIR" in
-  /*) ;;
-  *)
-    gstack_hook_decision deny '[freeze] Legacy relative boundary is ambiguous. Re-run /freeze with an absolute directory chosen by the user; the saved state was preserved.'
-    _FREEZE_DECIDED=1
-    exit 0
-    ;;
-esac
-
-# Extract the edited path with the shared real-JSON parser. Edit and Write
-# carry tool_input.file_path; NotebookEdit carries tool_input.notebook_path
-# (Claude Code Agent SDK reference, NotebookEditInput), so a notebook edit
-# used to parse as "no path" and pass every boundary.
-set +e
-gstack_hook_extract_tool "$INPUT" file_path notebook_path
-EXTRACT_RC=$?
-set -e
-FILE_PATH="$GSTACK_HOOK_VALUE"
-TOOL_LABEL="${GSTACK_HOOK_TOOL:+$GSTACK_HOOK_TOOL }$GSTACK_HOOK_FIELD"
-
-# Unparseable payload (or no parser available): DENY. A boundary hook that
-# allows what it cannot read is not a boundary.
-if [ "$EXTRACT_RC" -ne 0 ] && [ -n "$INPUT" ]; then
-  gstack_hook_decision deny "[freeze] Could not parse the tool payload to check the freeze boundary. Blocked (fail closed). Freeze boundary: $FREEZE_DIR"
-  _FREEZE_DECIDED=1
-  exit 0
-fi
-
-# Parsed fine but no path field: a non-file tool payload — allow.
-if [ -z "$FILE_PATH" ]; then
-  _FREEZE_DECIDED=1
-  echo '{}'
-  exit 0
-fi
-
-# Canonicalize before the absolute test: a drive-letter path does not start
-# with '/', so it used to be joined onto cwd and every edit was denied.
-gstack_hook_normalize_path "$FILE_PATH"
-FILE_PATH="$GSTACK_HOOK_PATH"
-
-# Resolve file_path to absolute if it isn't already
-case "$FILE_PATH" in
-  /*) ;; # already absolute
-  *)
-    FILE_PATH="$(pwd)/$FILE_PATH"
-    ;;
-esac
-
-# Normalize: remove double slashes and trailing slash. A leading '//' is a UNC
-# host (//server/share) and is kept, or the check would compare a local path.
-_FP_LEAD=""
-case "$FILE_PATH" in
-  //[!/]*) _FP_LEAD="/" ;;
-esac
-FILE_PATH=$(printf '%s' "$FILE_PATH" | sed 's|/\+|/|g;s|/$||')
-FILE_PATH="$_FP_LEAD$FILE_PATH"
-[ -n "$FILE_PATH" ] || FILE_PATH="/"
-
-# Resolve symlinks and .. sequences (POSIX-portable, works on macOS).
-# The FULL path is resolved, including the FINAL component: the previous
-# version resolved only the parent directory, so an in-boundary symlink
-# pointing at an out-of-boundary target sailed through the check while the
-# actual write landed outside the boundary. A final component that is a
-# symlink is followed (bounded, cycle-safe) so the TARGET gets checked; a
-# final component that does not exist yet (new file) has nothing to follow
-# and parent resolution is the correct behavior.
-_resolve_path() {
-  local _p="$1" _dir _base _tgt _i=0
-  while [ -L "$_p" ] && [ "$_i" -lt 40 ]; do
-    _tgt=$(readlink "$_p" 2>/dev/null) || break
-    case "$_tgt" in
-      /*) _p="$_tgt" ;;
-      *) _p="$(dirname "$_p")/$_tgt" ;;
-    esac
-    _i=$((_i + 1))
-  done
-  _dir="$(dirname "$_p")"
-  _base="$(basename "$_p")"
-  if [ "$_base" = / ]; then printf '/'; return; fi
-  _dir="$(cd "$_dir" 2>/dev/null && pwd -P || printf '%s' "$_dir")"
-  # pwd -P answers in the platform's own dialect (/cygdrive/c/... on Cygwin).
-  gstack_hook_normalize_path "${_dir%/}/$_base"
-  printf '%s' "$GSTACK_HOOK_PATH"
-}
-FILE_PATH=$(_resolve_path "$FILE_PATH")
-FREEZE_DIR=$(_resolve_path "$FREEZE_DIR")
-
-# Check: does the file path start with the freeze directory? Windows paths
-# are case-insensitive, so compare that way there.
-[ "$GSTACK_HOOK_IS_WINDOWS" = 1 ] && shopt -s nocasematch
-case "$FILE_PATH" in
-  "${FREEZE_DIR%/}/"*|"${FREEZE_DIR}")
-    # Inside freeze boundary — allow
-    _FREEZE_DECIDED=1
-    echo '{}'
-    ;;
-  *)
-    # Outside freeze boundary — deny
-    # Log hook fire event (shared helper respects GSTACK_HOME)
-    gstack_hook_log_fire freeze boundary_deny
-
-    # The reason is JSON-encoded by the shared helper. Never interpolate paths
-    # into hand-built JSON: a path containing a quote or newline produced
-    # malformed JSON here, and the deny silently no-oped.
-    gstack_hook_decision deny "[freeze] Blocked: $TOOL_LABEL $FILE_PATH is outside the freeze boundary ($FREEZE_DIR). Only edits within the frozen directory are allowed; run /unfreeze to remove the boundary."
-    _FREEZE_DECIDED=1
-    ;;
-esac

package/.agent/skills/gstack-freeze/bin/freeze-state.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-_here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-. "$_here/../../careful/bin/hook-extract.sh"
-if ! command -v gstack_hook_state_root >/dev/null 2>&1; then
-  echo "FREEZE_ERROR: cannot resolve the gstack state root: $_here/../../bin/gstack-state-root.sh is missing. No boundary changed. Fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)." >&2
-  exit 1
-fi
-STATE_DIR="$(gstack_hook_state_root; printf x)"; STATE_DIR="${STATE_DIR%x}"
-mkdir -p "$STATE_DIR"
-STATE_DIR="$(cd "$STATE_DIR" && pwd -P && printf x)"; STATE_DIR="${STATE_DIR%$'\nx'}"
-state="$STATE_DIR/freeze-dir.txt"
-mutex="$STATE_DIR/.freeze-mutation.lock"
-action="${1:-}"
-case "$action" in acquire|set|release|clear) ;; *) echo 'Usage: freeze-state.sh acquire|set DIRECTORY | release OWNER | clear' >&2; exit 2 ;; esac
-
-if ! mkdir "$mutex" 2>/dev/null; then
-  echo 'FREEZE_BUSY: another writer or an interrupted mutation owns the state lock. Retry after it finishes; if abandoned, inspect it with the user before recovery. No boundary changed.' >&2
-  exit 1
-fi
-temp=""
-finish() {
-  local rc=$?
-  [ -z "$temp" ] || rm -f -- "$temp"
-  rmdir "$mutex"
-  exit "$rc"
-}
-trap finish EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
-
-if [ "$action" = acquire ] && { [ -e "$state" ] || [ -L "$state" ]; }; then
-  echo 'FREEZE_PRESERVED: an existing boundary belongs to the user or another run. Do not release it; use /freeze to re-establish an ambiguous legacy boundary with the user.'
-  exit 0
-fi
-if [ -L "$state" ] || { [ -e "$state" ] && [ ! -f "$state" ]; }; then
-  echo 'FREEZE_PRESERVED: unexpected state type; inspect it with the user before recovery.' >&2
-  exit 1
-fi
-case "$action" in
-  acquire|set)
-    boundary="$(cd -- "${2:?Directory required}" && pwd -P && printf x)"; boundary="${boundary%$'\nx'}"
-    case "$boundary" in *$'\n'*|*$'\r'*) echo 'FREEZE_ERROR: boundary must fit on one line.' >&2; exit 2 ;; esac
-    owner="$(od -An -N16 -tx1 /dev/urandom | tr -d '[:space:]')"
-    [ "${#owner}" -eq 32 ] || exit 1
-    temp="$(mktemp "$STATE_DIR/.freeze-write.XXXXXX")"
-    printf '%s\ngstack-freeze-v1:%s\n' "$boundary" "$owner" > "$temp"
-    mv -f -- "$temp" "$state"
-    temp=""
-    printf 'FREEZE_OWNER=%s\nFREEZE_DIR=%s\n' "$owner" "$boundary"
-    ;;
-  release)
-    owner="${2:?Owner required}"
-    case "$owner" in ''|*[!a-f0-9]*) echo 'FREEZE_ERROR: invalid owner token.' >&2; exit 2 ;; esac
-    [ "${#owner}" -eq 32 ] || exit 2
-    if [ -f "$state" ] && [ "$(sed -n '2p' "$state")" = "gstack-freeze-v1:$owner" ]; then
-      rm -- "$state"
-      echo 'FREEZE_RELEASED: investigation-owned boundary removed.'
-    else
-      echo 'FREEZE_PRESERVED: no matching owner; existing or replacement state was left untouched.'
-    fi
-    ;;
-  clear)
-    rm -f -- "$state"
-    echo 'FREEZE_CLEARED: user-requested edit boundary removal completed.'
-    ;;
-esac