@arthai/agents 1.0.0

package/dist/plugins/prime/hooks/sync-agents.sh

@@ -0,0 +1,269 @@
+#!/bin/bash
+# SessionStart hook: Auto-pull latest claude-agents and re-sync symlinks.
+# Runs on every new Claude Code session to keep agents/skills/hooks up to date.
+#
+# This hook:
+#   1. Pulls latest from the remote repo (fast-forward only)
+#   2. Re-validates the license key (cached for 24h)
+#   3. Re-syncs symlinks via install.sh (safe mode — never overwrites project files)
+
+set -euo pipefail
+
+# Resolve real home directory — Claude Desktop sandbox sets $HOME=/root/
+# which breaks path resolution. Use id -un + tilde expansion as fallback.
+REAL_HOME="$(eval echo ~"$(id -un)" 2>/dev/null || echo "$HOME")"
+AGENTS_DIR="$REAL_HOME/.claude-agents"
+LICENSE_FILE="$AGENTS_DIR/.license"
+LICENSE_CACHE="$AGENTS_DIR/.license-checked"
+CACHE_TTL=86400  # 24 hours in seconds
+
+# Exit silently if repo doesn't exist
+if [ ! -d "$AGENTS_DIR/.git" ]; then
+    exit 0
+fi
+
+# Exit silently if no license
+if [ ! -f "$LICENSE_FILE" ]; then
+    exit 0
+fi
+
+# --- Step 1: Pull latest (fast-forward only, silent on failure) ---
+cd "$AGENTS_DIR"
+
+# Capture current commit before pull to detect what changed
+BEFORE_SHA=$(git rev-parse HEAD 2>/dev/null || echo "")
+git pull --ff-only --quiet 2>/dev/null || true
+AFTER_SHA=$(git rev-parse HEAD 2>/dev/null || echo "")
+
+# --- Step 1b: Report what changed (if anything) ---
+# Compare against per-project stored SHA, not just before/after pull.
+# This catches local commits, rebases, branch switches — anything that changed
+# the toolkit since this project last saw it.
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+LAST_SEEN_FILE="$PROJECT_DIR/.claude/.toolkit-last-seen-sha"
+LAST_SEEN_SHA=""
+if [ -f "$LAST_SEEN_FILE" ]; then
+    LAST_SEEN_SHA=$(cat "$LAST_SEEN_FILE" 2>/dev/null || echo "")
+fi
+
+# Use the oldest reference: either what the project last saw, or what was before pull
+COMPARE_SHA=""
+if [ -n "$LAST_SEEN_SHA" ] && [ "$LAST_SEEN_SHA" != "$AFTER_SHA" ]; then
+    # Project hasn't seen the current toolkit state
+    COMPARE_SHA="$LAST_SEEN_SHA"
+elif [ -n "$BEFORE_SHA" ] && [ "$BEFORE_SHA" != "$AFTER_SHA" ]; then
+    # Pull brought new commits
+    COMPARE_SHA="$BEFORE_SHA"
+fi
+
+if [ -n "$COMPARE_SHA" ] && [ -n "$AFTER_SHA" ] && [ "$COMPARE_SHA" != "$AFTER_SHA" ]; then
+    # Verify COMPARE_SHA is a valid ancestor (not from a force-push or unrelated history)
+    if ! git merge-base --is-ancestor "$COMPARE_SHA" "$AFTER_SHA" 2>/dev/null; then
+        COMPARE_SHA=""
+    fi
+fi
+
+if [ -n "$COMPARE_SHA" ]; then
+    # Toolkit has changes this project hasn't seen
+    COMMIT_COUNT=$(git rev-list --count "$COMPARE_SHA..$AFTER_SHA" 2>/dev/null || echo "0")
+
+    # Categorize changes by type
+    CHANGED_FILES=$(git diff --name-only "$COMPARE_SHA..$AFTER_SHA" 2>/dev/null || true)
+    NEW_AGENTS=$(echo "$CHANGED_FILES" | { grep "^agents/.*\.md$" || true; } | while read f; do
+        git diff --diff-filter=A --name-only "$COMPARE_SHA..$AFTER_SHA" -- "$f" 2>/dev/null
+    done | sed 's|agents/||;s|\.md||' | tr '\n' ', ' | sed 's/,$//')
+    NEW_SKILLS=$(echo "$CHANGED_FILES" | { grep "^skills/.*/SKILL\.md$" || true; } | while read f; do
+        git diff --diff-filter=A --name-only "$COMPARE_SHA..$AFTER_SHA" -- "$f" 2>/dev/null
+    done | sed 's|skills/||;s|/SKILL\.md||' | tr '\n' ', ' | sed 's/,$//')
+    UPDATED_AGENTS=$(echo "$CHANGED_FILES" | { grep "^agents/.*\.md$" || true; } | while read f; do
+        git diff --diff-filter=M --name-only "$COMPARE_SHA..$AFTER_SHA" -- "$f" 2>/dev/null
+    done | sed 's|agents/||;s|\.md||' | tr '\n' ', ' | sed 's/,$//')
+    UPDATED_SKILLS=$(echo "$CHANGED_FILES" | { grep "^skills/.*/SKILL\.md$" || true; } | while read f; do
+        git diff --diff-filter=M --name-only "$COMPARE_SHA..$AFTER_SHA" -- "$f" 2>/dev/null
+    done | sed 's|skills/||;s|/SKILL\.md||' | tr '\n' ', ' | sed 's/,$//')
+    UPDATED_HOOKS=$(echo "$CHANGED_FILES" | { grep "^hooks/.*\.sh$" || true; } | while read f; do
+        git diff --diff-filter=M --name-only "$COMPARE_SHA..$AFTER_SHA" -- "$f" 2>/dev/null
+    done | sed 's|hooks/||;s|\.sh||' | tr '\n' ', ' | sed 's/,$//')
+
+    # Build update summary (compact — max 3 lines)
+    echo "Toolkit updated ($COMMIT_COUNT new commit$([ "$COMMIT_COUNT" != "1" ] && echo "s"))"
+    parts=()
+    [ -n "$NEW_AGENTS" ] && parts+=("new agents: $NEW_AGENTS")
+    [ -n "$NEW_SKILLS" ] && parts+=("new skills: $NEW_SKILLS")
+    [ -n "$UPDATED_AGENTS" ] && parts+=("updated agents: $UPDATED_AGENTS")
+    [ -n "$UPDATED_SKILLS" ] && parts+=("updated skills: $UPDATED_SKILLS")
+    [ -n "$UPDATED_HOOKS" ] && parts+=("updated hooks: $UPDATED_HOOKS")
+    if [ ${#parts[@]} -gt 0 ]; then
+        echo "  $(IFS='; '; echo "${parts[*]}")"
+    fi
+
+    # Check for a CHANGELOG or release notes in the new commits
+    CHANGELOG_ENTRY=$(git log --format="%s" "$COMPARE_SHA..$AFTER_SHA" 2>/dev/null | grep -iE "^(feat|fix|breaking|new):" | head -3)
+    if [ -n "$CHANGELOG_ENTRY" ]; then
+        echo "$CHANGELOG_ENTRY" | while read line; do
+            echo "  • $line"
+        done
+    fi
+fi
+
+# --- Step 2: Check license (with revocation enforcement) ---
+NOW=$(date +%s)
+
+# Detect if authorized-keys.txt changed in the pull — force re-check if so
+AK_HASH_FILE="$AGENTS_DIR/.ak-hash"
+AK_CURRENT_HASH=""
+if [ -f "$AGENTS_DIR/authorized-keys.txt" ]; then
+    AK_CURRENT_HASH=$(shasum -a 256 "$AGENTS_DIR/authorized-keys.txt" 2>/dev/null | awk '{print $1}')
+fi
+AK_STORED_HASH=""
+if [ -f "$AK_HASH_FILE" ]; then
+    AK_STORED_HASH=$(cat "$AK_HASH_FILE" 2>/dev/null || echo "")
+fi
+AK_CHANGED=false
+if [ -n "$AK_CURRENT_HASH" ] && [ "$AK_CURRENT_HASH" != "$AK_STORED_HASH" ]; then
+    AK_CHANGED=true
+    # Invalidate cache — force re-check NOW
+    rm -f "$LICENSE_CACHE" 2>/dev/null || true
+fi
+# Store current hash for next comparison
+[ -n "$AK_CURRENT_HASH" ] && echo "$AK_CURRENT_HASH" > "$AK_HASH_FILE" 2>/dev/null || true
+
+LICENSE_VALID=true
+if [ -f "$LICENSE_CACHE" ]; then
+    LAST_CHECK=$(cat "$LICENSE_CACHE" 2>/dev/null || echo "0")
+    ELAPSED=$((NOW - LAST_CHECK))
+    if [ "$ELAPSED" -lt "$CACHE_TTL" ]; then
+        # Cache is fresh, skip validation
+        :
+    else
+        # Re-validate
+        if ! "$AGENTS_DIR/install.sh" --check-license-only 2>/dev/null; then
+            LICENSE_VALID=false
+        else
+            echo "$NOW" > "$LICENSE_CACHE"
+        fi
+    fi
+else
+    # First check (or cache was invalidated by AK change)
+    if ! "$AGENTS_DIR/install.sh" --check-license-only 2>/dev/null; then
+        LICENSE_VALID=false
+    else
+        echo "$NOW" > "$LICENSE_CACHE"
+    fi
+fi
+
+# --- Step 2b: License revoked — enforce cleanup ---
+if ! $LICENSE_VALID; then
+    PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+
+    if [ -d "$PROJECT_DIR/.claude" ]; then
+        # Remove all toolkit symlinks from this project
+        for subdir in agents skills hooks; do
+            dir="$PROJECT_DIR/.claude/$subdir"
+            [ ! -d "$dir" ] && continue
+            for item in "$dir"/*; do
+                [ ! -e "$item" ] && [ ! -L "$item" ] && continue
+                if [ -L "$item" ]; then
+                    link_target=$(readlink "$item" 2>/dev/null || true)
+                    if echo "$link_target" | grep -q "/.claude-agents/"; then
+                        rm -f "$item" 2>/dev/null || true
+                    fi
+                fi
+            done
+            # Remove dir if empty
+            rmdir "$dir" 2>/dev/null || true
+        done
+
+        # Remove hook entries from settings.json via install.sh
+        if [ -f "$PROJECT_DIR/.claude/settings.json" ]; then
+            ALL_HOOKS="sync-agents triage-router session-end session-bootstrap pre-bash-guard pre-task-context pre-edit-guard pre-write-guard post-test-summary post-edit-lint post-deploy-health post-diff-test-compare post-merge-cleanup"
+            "$AGENTS_DIR/install.sh" --force-remove-hooks "$PROJECT_DIR" "$ALL_HOOKS" 2>/dev/null || true
+        fi
+
+        # Remove CLAUDE.md managed block
+        CLAUDEMD="$PROJECT_DIR/CLAUDE.md"
+        if [ -f "$CLAUDEMD" ] && grep -qF "<!-- >>> claude-agents toolkit -->" "$CLAUDEMD" 2>/dev/null; then
+            tmp=$(mktemp)
+            in_block=false
+            skip_next_blank=false
+            while IFS= read -r line; do
+                if echo "$line" | grep -qF "<!-- >>> claude-agents toolkit -->"; then
+                    in_block=true
+                    continue
+                fi
+                if echo "$line" | grep -qF "<!-- <<< claude-agents toolkit"; then
+                    in_block=false
+                    skip_next_blank=true
+                    continue
+                fi
+                if ! $in_block; then
+                    if $skip_next_blank && [ -z "$line" ]; then
+                        skip_next_blank=false
+                        continue
+                    fi
+                    skip_next_blank=false
+                    echo "$line" >> "$tmp"
+                fi
+            done < "$CLAUDEMD"
+            mv "$tmp" "$CLAUDEMD"
+        fi
+
+        # Remove config
+        rm -f "$PROJECT_DIR/.claude/.claude-agents.conf" 2>/dev/null || true
+        rm -f "$PROJECT_DIR/.claude/.toolkit-last-seen-sha" 2>/dev/null || true
+        rm -f "$PROJECT_DIR/.claude/.triage-full-emitted" 2>/dev/null || true
+        rm -f "$PROJECT_DIR/.claude/.project-state-cache.json" 2>/dev/null || true
+
+        # Invalidate license cache so next session re-checks
+        rm -f "$LICENSE_CACHE" 2>/dev/null || true
+    fi
+
+    echo "⚠ License revoked. Toolkit has been disabled for this project."
+    echo "  Contact support to renew your license."
+    exit 0
+fi
+
+# --- Step 3: Re-sync symlinks ---
+# Detect project dir from CLAUDE_PROJECT_DIR or pwd
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
+
+if [ -d "$PROJECT_DIR/.claude" ]; then
+    CONF_FILE="$PROJECT_DIR/.claude/.claude-agents.conf"
+
+    if [ -f "$CONF_FILE" ]; then
+        # Config exists — sync from config (respects selections, silent)
+        "$AGENTS_DIR/install.sh" --sync-from-config "$PROJECT_DIR" >/dev/null 2>/dev/null || true
+
+        # Check if /calibrate was just synced but project hasn't been calibrated yet
+        if [ -L "$PROJECT_DIR/.claude/skills/calibrate" ] || [ -d "$PROJECT_DIR/.claude/skills/calibrate" ]; then
+            if [ ! -f "$PROJECT_DIR/.claude/project-profile.md" ]; then
+                echo "New: /calibrate skill available — run it to deep-learn your project and configure MCP servers, agents, and workflows"
+            fi
+        fi
+    else
+        # No config — brownfield: generate config from existing state, then sync
+        "$AGENTS_DIR/install.sh" --generate-config "$PROJECT_DIR" >/dev/null 2>/dev/null || true
+        if [ -f "$CONF_FILE" ]; then
+            "$AGENTS_DIR/install.sh" --sync-from-config "$PROJECT_DIR" >/dev/null 2>/dev/null || true
+        else
+            # Fallback: detect railway, sync everything
+            RAILWAY_FLAG=""
+            if [ -L "$PROJECT_DIR/.claude/skills/database" ] || [ -L "$PROJECT_DIR/.claude/skills/deploy" ]; then
+                RAILWAY_FLAG="--railway"
+            fi
+            "$AGENTS_DIR/install.sh" $RAILWAY_FLAG "$PROJECT_DIR" >/dev/null 2>/dev/null || true
+        fi
+    fi
+fi
+
+# --- Step 4: DO NOT store SHA here ---
+# The SHA is stored by /onboard Step 0 AFTER displaying the update summary.
+# If we store it here, /onboard sees matching SHAs and shows nothing.
+# Only write the SHA if no .toolkit-last-seen-sha exists yet (first install).
+if [ -n "$AFTER_SHA" ] && [ -d "${PROJECT_DIR:-.}/.claude" ]; then
+    if [ ! -f "$PROJECT_DIR/.claude/.toolkit-last-seen-sha" ]; then
+        echo "$AFTER_SHA" > "$PROJECT_DIR/.claude/.toolkit-last-seen-sha" 2>/dev/null || true
+    fi
+fi
+
+exit 0