@bhargavvc/sdd-cc 1.35.0 → 1.42.4

package/scripts/strip-prose-atrefs.cjs

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+/**
+ * strip-prose-atrefs.cjs
+ *
+ * Removes redundant @~/.claude/sdd/ path tokens from prose lines
+ * in <process> and <context> blocks. The path is already declared in
+ * <execution_context> where it actually loads the file. Prose copies are
+ * inert and add ~900 tokens/invocation of dead weight.
+ *
+ * Transformation rules (applied per matching line):
+ *   - "Execute the X workflow from @PATH end-to-end." → "Execute end-to-end."
+ *   - "Execute @PATH end-to-end."                    → "Execute end-to-end."
+ *   - "Read and execute the X workflow from @PATH end-to-end." → "Execute end-to-end."
+ *   - "Follow the X workflow at @PATH."              → "Execute end-to-end."
+ *   - "Output the X reference from @PATH."           → "Execute end-to-end."
+ *   - "**Follow the X** from `@PATH`."               → "**Follow the X.**"
+ *   - "- If it is '...': ... from @PATH end-to-end." → strip path token only
+ *   - "- Otherwise: ... from @PATH end-to-end."      → strip path token only
+ *   - "- @PATH (label)"                              → "- (label)"
+ *
+ * Run with --dry-run to preview without writing.
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const DRY_RUN      = process.argv.includes('--dry-run');
+const ROOT         = path.join(__dirname, '..');
+const COMMANDS_DIR = path.join(ROOT, 'commands', 'sdd');
+
+const AT_PATH_PATTERN = /@(?:~|\$HOME)\/.+?sdd\/[^\s`\)]+/;
+const mkAtRe = () => new RegExp(AT_PATH_PATTERN.source, 'g');
+
+function transformLine(line) {
+  if (!AT_PATH_PATTERN.test(line)) return line;
+
+  const trimmed = line.trim();
+
+  // "- @PATH (label)"  →  "- (label)"
+  if (/^- @(?:~|\$HOME)\//.test(trimmed)) {
+    return line.replace(/^(\s*- )@(?:~|\$HOME)\/[^\s(]+\s*/, '$1');
+  }
+
+  // "**Follow the X workflow** from `@PATH`."  →  "**Follow the X workflow.**"
+  // "**Follow the X workflow** from `@PATH`"   →  "**Follow the X workflow.**"
+  if (/\*\*Follow the .+ workflow\*\* from `@/.test(trimmed)) {
+    return line.replace(/\s+from `@(?:~|\$HOME)\/[^`]+`\.?/, '.');
+  }
+
+  // Routing bullet: keep everything except "from @PATH" or bare "@PATH"
+  // "- If …: … from @PATH end-to-end." → strip path, keep bullet
+  // "- Otherwise: … from @PATH end-to-end." → strip path, keep bullet
+  if (/^- (?:If |Otherwise:|pass all)/.test(trimmed)) {
+    return line
+      .replace(/\s+from\s+@(?:~|\$HOME)\/\S+/g, '')
+      .replace(/@(?:~|\$HOME)\/\S+/g, '');
+  }
+
+  // "Execute [the X workflow] [from] @PATH [end-to-end]."
+  // "Read and execute …"  /  "Follow …"  /  "Output …"
+  // → collapse to leading indent + "Execute end-to-end."
+  const indent = line.match(/^(\s*)/)[1];
+  return `${indent}Execute end-to-end.`;
+}
+
+function processFile(filePath) {
+  const original = fs.readFileSync(filePath, 'utf-8');
+  const lines    = original.split('\n');
+  const out      = [];
+  let inProse    = false; // true when inside <process> or <context> (not execution_context)
+
+  for (const line of lines) {
+    const t = line.trim();
+    if (/<(process|context)>/.test(t) && !t.includes('execution_context')) inProse = true;
+    if (/<\/(process|context)>/.test(t) && !t.includes('execution_context')) inProse = false;
+
+    if (inProse && AT_PATH_PATTERN.test(line)) {
+      const re = mkAtRe();
+      re.lastIndex = 0;
+      out.push(transformLine(line));
+    } else {
+      out.push(line);
+    }
+  }
+
+  const result = out.join('\n');
+  if (result === original) return false; // no change
+
+  if (!DRY_RUN) fs.writeFileSync(filePath, result, 'utf-8');
+  return true;
+}
+
+const files = fs.readdirSync(COMMANDS_DIR)
+  .filter(f => f.endsWith('.md'))
+  .map(f => path.join(COMMANDS_DIR, f));
+
+let changed = 0;
+for (const f of files) {
+  if (processFile(f)) {
+    console.log(`${DRY_RUN ? '[dry]' : 'fixed'}: ${path.basename(f)}`);
+    changed++;
+  }
+}
+console.log(`\n${changed} file(s) ${DRY_RUN ? 'would be' : 'were'} modified.`);

package/scripts/verify-tarball-sdk-dist.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Verify the published @bhargavvc/sdd-cc tarball actually contains
+# sdk/dist/cli.js and that the `query` subcommand is exposed.
+#
+# Guards regression of bug #2647: v1.38.3 shipped without sdk/dist/
+# because the outer `files` whitelist and `prepublishOnly` chain
+# drifted out of alignment. Any future drift fails release CI here.
+#
+# Run AFTER `npm run build:sdk` (so sdk/dist exists on disk) and
+# before `npm publish`. Exits non-zero on any mismatch.
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$REPO_ROOT"
+
+echo "==> Packing tarball (ignore-scripts: sdk/dist must already exist)"
+TARBALL=$(npm pack --ignore-scripts 2>/dev/null | tail -1)
+if [ -z "$TARBALL" ] || [ ! -f "$TARBALL" ]; then
+  echo "::error::npm pack produced no tarball"
+  exit 1
+fi
+echo "    tarball: $TARBALL"
+
+EXTRACT_DIR=$(mktemp -d)
+trap 'rm -rf "$EXTRACT_DIR" "$TARBALL"' EXIT
+
+echo "==> Extracting tarball into $EXTRACT_DIR"
+tar -xzf "$TARBALL" -C "$EXTRACT_DIR"
+
+CLI_JS="$EXTRACT_DIR/package/sdk/dist/cli.js"
+if [ ! -f "$CLI_JS" ]; then
+  echo "::error::$CLI_JS is missing from the published tarball"
+  echo "Tarball contents under sdk/:"
+  find "$EXTRACT_DIR/package/sdk" -maxdepth 2 -print | head -40
+  exit 1
+fi
+echo "    OK: sdk/dist/cli.js present ($(wc -c < "$CLI_JS") bytes)"
+
+echo "==> Installing runtime deps inside the extracted package and invoking sdd-sdk query --help"
+pushd "$EXTRACT_DIR/package" >/dev/null
+# Install only production deps so the extracted tarball resolves
+# @anthropic-ai/claude-agent-sdk / ws the same way a real user install would.
+npm install --omit=dev --no-audit --no-fund --silent
+OUTPUT=$(node sdk/dist/cli.js query --help 2>&1 || true)
+popd >/dev/null
+
+echo "$OUTPUT" | head -20
+if ! echo "$OUTPUT" | grep -qi 'query'; then
+  echo "::error::sdk/dist/cli.js did not expose a 'query' subcommand"
+  exit 1
+fi
+if echo "$OUTPUT" | grep -qiE 'unknown command|unrecognized'; then
+  echo "::error::sdk/dist/cli.js rejected 'query' as unknown"
+  exit 1
+fi
+
+echo "==> Also verifying sdd-sdk bin shim resolves ../sdk/dist/cli.js"
+SHIM="$EXTRACT_DIR/package/bin/sdd-sdk.js"
+if [ ! -f "$SHIM" ]; then
+  echo "::error::bin/sdd-sdk.js missing from tarball"
+  exit 1
+fi
+if ! grep -qE "sdk.*dist.*cli\.js" "$SHIM"; then
+  echo "::error::bin/sdd-sdk.js does not reference sdk/dist/cli.js"
+  exit 1
+fi
+
+echo "==> Tarball verification passed"

package/sdd/bin/check-latest-version.cjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Deterministic latest-version check for /sdd-update (#2992).
+ *
+ * The /sdd-update workflow's check_latest_version step was previously
+ * prescribed in LLM-driven prose ("run `npm view @bhargavvc/sdd-cc
+ * version`"). The executing model could shortcut the prescription and
+ * invent npm queries against wrong-shaped names (`@sdd/cli`,
+ * `sdd-cli`, `sdd`), all of which 404 or — worse — return an
+ * unrelated typosquat package.
+ *
+ * This script makes the package name a CONSTANT in code, not a free
+ * choice at execution time. The workflow calls it via `npm run
+ * check-latest-version -- --json` and parses the structured response.
+ *
+ * Tests assert on the typed CHECK_REASON enum and the structured result
+ * record, never on console prose. See CONTRIBUTING.md "Prohibited: Raw
+ * Text Matching on Test Outputs".
+ */
+
+const { execNpm } = require('./lib/shell-command-projection.cjs');
+
+// Hardcoded. Do not parameterise — the whole point of this script is that
+// the package name is not a runtime choice for the caller.
+const PACKAGE_NAME = '@bhargavvc/sdd-cc';
+
+const CHECK_REASON = Object.freeze({
+  OK: 'ok',
+  FAIL_NPM_FAILED: 'fail_npm_failed',
+  FAIL_INVALID_OUTPUT: 'fail_invalid_output',
+});
+
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+
+/**
+ * Pure-ish: takes an injected spawn function so tests don't actually run npm.
+ * In production, defaults to execNpm() from the shell-projection seam.
+ */
+function checkLatestVersion(opts = {}) {
+  // Default path routes through the shell-projection seam (execNpm owns the
+  // Windows shell-flag policy and timeout default). The injection point
+  // remains spawnSync-shaped for test compatibility — the adapter below
+  // translates { exitCode } → { status } so the consumer logic is unchanged.
+  // Bounded at 15s so a hung registry doesn't block /sdd-update (#2993 CR).
+  const defaultSpawn = () => {
+    const r = execNpm(['view', PACKAGE_NAME, 'version'], { timeout: 15_000 });
+    return {
+      status: r.exitCode,
+      stdout: r.stdout,
+      stderr: r.stderr,
+      signal: r.signal,
+      error: r.error,
+    };
+  };
+  const spawn = opts.spawn || defaultSpawn;
+
+  const r = spawn();
+  if (!r || r.status !== 0) {
+    // Distinguish timeout (status null, signal set, stderr empty) from a
+    // genuine npm failure. Without this, both surfaced as "npm exited
+    // non-zero" and the operator couldn't tell which (#2993 CR).
+    let detail;
+    if (r && r.signal) {
+      detail = `npm timed out (signal: ${r.signal})`;
+    } else if (r && r.stderr) {
+      detail = r.stderr.trim();
+    } else {
+      detail = 'npm exited non-zero';
+    }
+    return {
+      ok: false,
+      reason: CHECK_REASON.FAIL_NPM_FAILED,
+      detail,
+    };
+  }
+  const version = (r.stdout || '').trim();
+  if (!SEMVER_RE.test(version)) {
+    return {
+      ok: false,
+      reason: CHECK_REASON.FAIL_INVALID_OUTPUT,
+      detail: version || '(empty)',
+    };
+  }
+  return { ok: true, version, reason: CHECK_REASON.OK };
+}
+
+function main() {
+  const json = process.argv.includes('--json');
+  const r = checkLatestVersion();
+  if (json) {
+    process.stdout.write(JSON.stringify(r) + '\n');
+  } else if (r.ok) {
+    process.stdout.write(r.version + '\n');
+  } else {
+    process.stderr.write(`check-latest-version: ${r.reason}: ${r.detail}\n`);
+  }
+  process.exit(r.ok ? 0 : 1);
+}
+
+if (require.main === module) main();
+
+module.exports = { checkLatestVersion, CHECK_REASON, PACKAGE_NAME };

package/sdd/bin/lib/active-workstream-store.cjs

@@ -0,0 +1,85 @@
+/**
+ * Active Workstream Pointer Store Module
+ *
+ * Owns workstream source precedence and selection:
+ * CLI --ws > SDD_WORKSTREAM env > stored active workstream pointer.
+ */
+
+const { getActiveWorkstream } = require('./planning-workspace.cjs');
+const { isValidActiveWorkstreamName } = require('./workstream-name-policy.cjs');
+
+function validateWorkstreamName(name) {
+  return isValidActiveWorkstreamName(name);
+}
+
+function parseCliWorkstream(args) {
+  const wsEqArg = args.find(arg => arg.startsWith('--ws='));
+  const wsIdx = args.indexOf('--ws');
+
+  if (wsEqArg) {
+    const value = wsEqArg.slice('--ws='.length).trim();
+    if (!value) throw new Error('Missing value for --ws');
+    return {
+      value,
+      source: 'cli',
+      args: args.filter(arg => arg !== wsEqArg),
+    };
+  }
+
+  if (wsIdx !== -1) {
+    const value = args[wsIdx + 1];
+    if (!value || value.startsWith('--')) throw new Error('Missing value for --ws');
+    return {
+      value,
+      source: 'cli',
+      args: args.filter((_, idx) => idx !== wsIdx && idx !== wsIdx + 1),
+    };
+  }
+
+  return {
+    value: null,
+    source: null,
+    args: args.slice(),
+  };
+}
+
+function resolveActiveWorkstream(cwd, args, env = process.env, deps = {}) {
+  const parsed = parseCliWorkstream(args);
+  const getStored = deps.getStored || getActiveWorkstream;
+
+  let ws = null;
+  let source = 'none';
+
+  if (parsed.value) {
+    ws = parsed.value;
+    source = parsed.source;
+  } else if (env && typeof env.SDD_WORKSTREAM === 'string' && env.SDD_WORKSTREAM.trim()) {
+    ws = env.SDD_WORKSTREAM.trim();
+    source = 'env';
+  } else {
+    ws = getStored(cwd) || null;
+    source = ws ? 'store' : 'none';
+  }
+
+  if (ws && !validateWorkstreamName(ws)) {
+    throw new Error('Invalid workstream name: must be alphanumeric, hyphens, underscores, or dots');
+  }
+
+  return {
+    ws,
+    source,
+    args: parsed.args,
+  };
+}
+
+function applyResolvedWorkstreamEnv(resolution, env = process.env) {
+  if (!resolution || !resolution.ws) return;
+  env.SDD_WORKSTREAM = resolution.ws;
+}
+
+module.exports = {
+  validateWorkstreamName,
+  parseCliWorkstream,
+  resolveActiveWorkstream,
+  applyResolvedWorkstreamEnv,
+};