@cubis/foundry 0.3.76 → 0.3.77

package/mcp/src/tools/skillTools.test.ts

@@ -85,7 +85,7 @@ function createRouteManifest(): RouteManifest {
     $schema: "cubis-foundry-route-manifest-v1",
     generatedAt: new Date(0).toISOString(),
     contentHash: "test",
-    summary: { totalRoutes: 6, workflows: 5, agents: 1 },
+    summary: { totalRoutes: 7, workflows: 5, agents: 2 },
     routes: [
       {
         kind: "workflow",
@@ -207,6 +207,23 @@ function createRouteManifest(): RouteManifest {
           antigravity: { agentFile: "test-engineer.md" },
         },
       },
+      {
+        kind: "agent",
+        id: "researcher",
+        command: null,
+        displayName: "researcher",
+        description: "Expert in codebase research and external verification",
+        triggers: ["research", "latest", "compare", "investigate", "survey"],
+        primaryAgent: "researcher",
+        supportingAgents: [],
+        primarySkills: ["deep-research", "architecture-designer"],
+        supportingSkills: ["prompt-engineer"],
+        artifacts: {
+          codex: { compatibilityAlias: "$agent-researcher", agentFile: "researcher.md" },
+          copilot: { agentFile: "researcher.md" },
+          antigravity: { agentFile: "researcher.md" },
+        },
+      },
     ],
   };
 }
@@ -612,6 +629,22 @@ describe("skill tools", () => {
     });
   });
 
+  it("routes research intent to researcher with deep-research as the primary skill hint", async () => {
+    const result = payload(
+      await handleRouteResolve(
+        { intent: "research latest Claude Code hooks behavior" },
+        createRouteManifest(),
+      ),
+    );
+    expect(result).toMatchObject({
+      resolved: true,
+      kind: "agent",
+      id: "researcher",
+      primarySkillHint: "deep-research",
+    });
+    expect(["trigger-match", "intent-match"]).toContain(result.matchedBy);
+  });
+
   it("falls back cleanly when no route matches the intent", async () => {
     const result = payload(
       await handleRouteResolve(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubis/foundry",
-  "version": "0.3.76",
+  "version": "0.3.77",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
   "type": "module",
   "bin": {

package/src/cli/core.ts

@@ -174,17 +174,20 @@ const WORKFLOW_PROFILES = {
       workflowDirs: [".claude/workflows"],
       agentDirs: [".claude/agents"],
       skillDirs: [".claude/skills"],
+      hookDirs: [".claude/hooks"],
       ruleFilesByPriority: ["CLAUDE.md"],
     },
     global: {
       workflowDirs: ["~/.claude/workflows"],
       agentDirs: ["~/.claude/agents"],
       skillDirs: ["~/.claude/skills"],
+      hookDirs: ["~/.claude/hooks"],
       ruleFilesByPriority: ["~/.claude/CLAUDE.md"],
     },
     detectorPaths: [
       "CLAUDE.md",
       ".claude",
+      ".claude/hooks",
       ".claude/rules",
       ".claude/settings.json",
     ],
@@ -2783,6 +2786,7 @@ async function recordBundleInstallState({
     skills: artifacts.skills.map(toPosixPath),
     commands: (artifacts.commands || []).map(toPosixPath),
     prompts: (artifacts.prompts || []).map(toPosixPath),
+    hooks: (artifacts.hooks || []).map(toPosixPath),
   };
 
   await writeState(scope, state, cwd);
@@ -2815,6 +2819,7 @@ async function resolveProfilePaths(profileId, scope, cwd = process.cwd()) {
   const skillDirs = Array.isArray(cfg.skillDirs) ? cfg.skillDirs : [];
   const commandDirs = Array.isArray(cfg.commandDirs) ? cfg.commandDirs : [];
   const promptDirs = Array.isArray(cfg.promptDirs) ? cfg.promptDirs : [];
+  const hookDirs = Array.isArray(cfg.hookDirs) ? cfg.hookDirs : [];
 
   const resolvePreferredDir = async (dirs) => {
     if (dirs.length === 0) return null;
@@ -2831,6 +2836,7 @@ async function resolveProfilePaths(profileId, scope, cwd = process.cwd()) {
     skillsDir: await resolvePreferredDir(skillDirs),
     commandsDir: commandDirs[0] ? expandPath(commandDirs[0], cwd) : null,
     promptsDir: promptDirs[0] ? expandPath(promptDirs[0], cwd) : null,
+    hooksDir: hookDirs[0] ? expandPath(hookDirs[0], cwd) : null,
     ruleFilesByPriority: cfg.ruleFilesByPriority.map((filePath) =>
       expandPath(filePath, cwd),
     ),
@@ -2862,6 +2868,7 @@ function resolveProfilePathCandidates(profileId, scope, cwd = process.cwd()) {
     skillsDirs: expandUniquePaths(cfg.skillDirs, cwd),
     commandsDirs: expandUniquePaths(cfg.commandDirs, cwd),
     promptsDirs: expandUniquePaths(cfg.promptDirs, cwd),
+    hooksDirs: expandUniquePaths(cfg.hookDirs, cwd),
     ruleFilesByPriority: expandUniquePaths(cfg.ruleFilesByPriority, cwd),
   };
 }
@@ -2895,6 +2902,7 @@ async function resolveArtifactProfilePaths(
     agentsDir: workspacePaths.agentsDir,
     commandsDir: workspacePaths.commandsDir ?? scopedPaths.commandsDir,
     promptsDir: workspacePaths.promptsDir ?? scopedPaths.promptsDir,
+    hooksDir: scopedPaths.hooksDir,
   };
 }
 
@@ -6681,6 +6689,13 @@ async function installBundleArtifacts({
     ) {
       await mkdir(profilePaths.promptsDir, { recursive: true });
     }
+    if (
+      profilePaths.hooksDir &&
+      Array.isArray(platformSpec.hooks) &&
+      platformSpec.hooks.some((entry) => typeof entry?.file === "string")
+    ) {
+      await mkdir(profilePaths.hooksDir, { recursive: true });
+    }
   }
 
   const bundleRoot = path.join(agentAssetsRoot(), "workflows", bundleId);
@@ -6694,6 +6709,7 @@ async function installBundleArtifacts({
     skills: [],
     commands: [],
     prompts: [],
+    hooks: [],
   };
 
   // Bind useSymlinks into copyArtifact so every call site inherits it
@@ -6806,6 +6822,40 @@ async function installBundleArtifacts({
       skipped.push(destination);
     else installed.push(destination);
   }
+  const hookFiles = Array.isArray(platformSpec.hooks)
+    ? platformSpec.hooks
+        .map((entry) =>
+          typeof entry === "string"
+            ? entry
+            : typeof entry?.file === "string"
+              ? entry.file
+              : null,
+        )
+        .filter(Boolean)
+    : [];
+  for (const hookFile of hookFiles) {
+    if (!profilePaths.hooksDir) continue;
+    const source = path.join(platformRoot, "hooks", hookFile);
+    const destination = path.join(
+      profilePaths.hooksDir,
+      path.basename(hookFile),
+    );
+
+    if (!(await pathExists(source))) {
+      throw new Error(`Missing hook source file: ${source}`);
+    }
+
+    const result = await copyArt({
+      source,
+      destination,
+      overwrite,
+      dryRun,
+    });
+    artifacts.hooks.push(destination);
+    if (result.action === "skipped" || result.action === "would-skip")
+      skipped.push(destination);
+    else installed.push(destination);
+  }
   if (shouldInstallPlatformSkills) {
     const agentSkillDependencies = await resolvePlatformAgentSkillDependencies({
       platformRoot,
@@ -7103,6 +7153,22 @@ async function removeBundleArtifacts({
     if (await safeRemove(destination, dryRun)) removed.push(destination);
   }
 
+  for (const hookEntry of platformSpec.hooks || []) {
+    if (!profilePaths.hooksDir) continue;
+    const hookFile =
+      typeof hookEntry === "string"
+        ? hookEntry
+        : typeof hookEntry?.file === "string"
+          ? hookEntry.file
+          : null;
+    if (!hookFile) continue;
+    const destination = path.join(
+      profilePaths.hooksDir,
+      path.basename(hookFile),
+    );
+    if (await safeRemove(destination, dryRun)) removed.push(destination);
+  }
+
   const skillIds = await resolveInstallSkillIds({
     platformSpec,
     extraSkillIds: [],

package/workflows/skills/_schema/skill-platform-attributes.json

@@ -38,6 +38,13 @@
     "userInvocable": true,
     "argumentHint": "Schema, query, or data model to design"
   },
+  "deep-research": {
+    "allowedTools": ["Read", "Grep", "Glob", "Bash"],
+    "contextFork": true,
+    "forkAgent": "researcher",
+    "userInvocable": true,
+    "argumentHint": "Topic, vendor capability, or public comparison to research"
+  },
   "django-drf": {
     "allowedTools": ["Read", "Grep", "Glob", "Bash", "Edit", "Write"],
     "contextFork": false,

package/workflows/skills/deep-research/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: deep-research
+description: Use when investigating latest vendor behavior, comparing tools or platforms, verifying claims beyond the repo, or gathering external evidence before implementation.
+license: MIT
+metadata:
+  author: cubis-foundry
+  version: "1.0"
+compatibility: Claude Code, Codex, GitHub Copilot
+---
+
+# Deep Research
+
+## Purpose
+
+Run a disciplined research pass before implementation when the repo alone is not enough. This skill keeps research evidence-driven: inspect the local codebase first, escalate to official docs when freshness or public comparison matters, then use labeled community evidence only when it adds practical context.
+
+## When to Use
+
+- Verifying latest SDK, CLI, API, or platform behavior
+- Comparing tools, frameworks, hosted services, or implementation approaches
+- Checking whether public docs and the local repo disagree
+- Gathering external evidence before planning a migration or new capability
+- Producing a structured research brief that hands off cleanly into implementation
+
+## Instructions
+
+1. **Define the research question before collecting sources** because vague research sprawls quickly. Restate the target topic, freshness requirement, comparison axis, and what decision the findings need to support.
+
+2. **Inspect the repo first** because many questions are already answerable from local code, configs, tests, docs, or generated assets. Do not browse externally until the local evidence is exhausted or clearly insufficient.
+
+3. **Decide whether external research is actually required** because not every task needs web evidence. Escalate only when freshness matters, public comparison matters, or the user explicitly asks to research or verify.
+
+4. **Follow the source ladder strictly** because evidence quality matters. Use official docs, upstream repositories, standards, and maintainer material as primary sources before looking at blogs, issue threads, or Reddit.
+
+5. **Capture concrete source details** because research without provenance is hard to trust. Record exact links, relevant dates, versions, and any repo files that support or contradict the external evidence.
+
+6. **Cross-check important claims across more than one source when possible** because public docs, repos, and community advice can drift. If sources disagree, say so explicitly instead of smoothing over the conflict.
+
+7. **Use Reddit and other community sources only as labeled secondary evidence** because they can surface practical gotchas but are not authoritative. Treat them as implementation color, not final truth.
+
+8. **Separate verified facts from inference** because downstream planning depends on confidence. Mark what is directly supported by repo evidence or official sources versus what you infer from patterns or secondary signals.
+
+9. **Keep the output decision-oriented** because the goal is not to dump links. Tie each finding back to the implementation, workflow, agent, or skill decision it affects.
+
+10. **Recommend the next route explicitly** because research is usually a handoff, not the end of the task. Name the next workflow, agent, or exact skill that should continue the work.
+
+11. **State the remaining gaps and risks** because incomplete research is still useful when the uncertainty is visible. Call out what you could not verify, what may have changed recently, and what assumptions remain.
+
+12. **Avoid over-quoting and over-collecting** because research quality comes from synthesis, not volume. Prefer concise summaries with high-signal citations over long pasted excerpts.
+
+13. **When the task turns into implementation, stop researching and hand off** because mixing discovery and execution usually creates drift. Deliver the research brief first, then route into the correct workflow or specialist.
+
+## Output Format
+
+Deliver:
+
+1. **Research question** — topic, freshness requirement, and decision to support
+2. **Verified facts** — repo evidence and primary-source findings
+3. **Secondary/community evidence** — labeled lower-trust supporting signals
+4. **Gaps / unknowns** — unresolved questions or contradictory evidence
+5. **Recommended next route** — direct execution, workflow, agent, or exact skill to use next
+
+## References
+
+Load only the file needed for the current question.
+
+| File | Load when |
+| --- | --- |
+| `references/source-ladder.md` | Need the repo-first and source-priority policy for official docs versus community evidence. |
+| `references/research-output.md` | Need the structured output format, evidence labeling rules, or handoff pattern. |
+| `references/comparison-checklist.md` | Comparing vendors, frameworks, or tools and need a concrete evaluation frame. |
+
+## Examples
+
+Use these when the task shape already matches.
+
+| File | Use when |
+| --- | --- |
+| `examples/01-latest-docs-check.md` | Verifying a latest capability or doc claim before implementation. |
+| `examples/02-ecosystem-comparison.md` | Comparing multiple tools or platforms with official-first sourcing. |
+| `examples/03-research-to-implementation-handoff.md` | Turning research findings into a concrete next workflow or specialist handoff. |

package/workflows/skills/deep-research/evals/assertions.md

@@ -0,0 +1,17 @@
+# Deep Research Eval Assertions
+
+## Eval 1: Latest Capability Verification
+
+1. **repo-first** — Starts by checking repo or local evidence before jumping to web claims.
+2. **official-first** — Uses official docs or upstream sources as the primary evidence for the capability.
+3. **secondary-labeled** — If community sources are mentioned, labels them as secondary evidence instead of presenting them as authoritative.
+4. **gaps-called-out** — Identifies unresolved uncertainty or missing confirmation.
+5. **next-route** — Ends with a concrete recommended workflow, agent, or skill to use next.
+
+## Eval 2: Tool Comparison
+
+1. **comparison-frame** — Defines the comparison axes instead of producing vague preferences.
+2. **repo-impact** — Connects the comparison back to the current repo or implementation constraints.
+3. **fact-vs-inference** — Separates verified facts from inference or interpretation.
+4. **decision-oriented** — Produces a recommendation or explicit defer condition.
+5. **no-research-sprawl** — Keeps the output concise and structured rather than dumping raw links.

package/workflows/skills/deep-research/evals/evals.json

@@ -0,0 +1,56 @@
+[
+  {
+    "name": "latest-capability-verification",
+    "description": "Validate that the skill performs repo-first research, prioritizes official documentation, labels secondary evidence, and recommends a next route.",
+    "prompt": "Research whether the latest official Claude Code hook surface supports reinforcing route honoring before implementation. Start with the current repo state, then use official docs if needed. If community sources add useful practical context, include them but label them appropriately. End with the next workflow, agent, or skill we should use.",
+    "assertions": [
+      {
+        "id": "repo-first",
+        "description": "Starts with repo or local evidence before using external sources."
+      },
+      {
+        "id": "official-first",
+        "description": "Treats official docs or upstream sources as the primary evidence."
+      },
+      {
+        "id": "secondary-labeled",
+        "description": "Labels any Reddit or community evidence as secondary rather than authoritative."
+      },
+      {
+        "id": "gaps-called-out",
+        "description": "States any unresolved gaps, conflicts, or unknowns."
+      },
+      {
+        "id": "next-route",
+        "description": "Ends with a concrete recommended next route."
+      }
+    ]
+  },
+  {
+    "name": "tool-comparison",
+    "description": "Validate that the skill compares options with a clear frame, ties findings back to repo impact, and produces a decision-ready output.",
+    "prompt": "Compare whether our CLI should keep enforcement in Gemini command wrappers only or also add Claude hook templates. Use the repo state first, then official docs for current platform capabilities, and include community evidence only if it adds implementation nuance. Finish with a recommendation and the next route to take.",
+    "assertions": [
+      {
+        "id": "comparison-frame",
+        "description": "Defines concrete comparison axes such as repo impact, enforcement surface, and maintenance cost."
+      },
+      {
+        "id": "repo-impact",
+        "description": "Connects each option back to the current repo or bundle behavior."
+      },
+      {
+        "id": "fact-vs-inference",
+        "description": "Separates verified facts from inference or interpretation."
+      },
+      {
+        "id": "decision-oriented",
+        "description": "Produces a recommendation or explicit defer condition."
+      },
+      {
+        "id": "no-research-sprawl",
+        "description": "Keeps the answer structured instead of turning into an unfiltered dump of sources."
+      }
+    ]
+  }
+]

package/workflows/skills/deep-research/examples/01-latest-docs-check.md

@@ -0,0 +1,12 @@
+# Example: Latest Docs Check
+
+## User Request
+
+> Research whether Claude Code hooks can reinforce route honoring before we add new workflow rules.
+
+## Expected Shape
+
+1. Inspect the repo's current Claude rule and hook support first.
+2. Verify the current official Claude docs for hooks, event names, and config format.
+3. Separate those verified facts from any community commentary about hook effectiveness.
+4. End with the recommended next route, for example `@researcher` continuing the research or `/create` applying the validated hook template changes.

package/workflows/skills/deep-research/examples/02-ecosystem-comparison.md

@@ -0,0 +1,12 @@
+# Example: Ecosystem Comparison
+
+## User Request
+
+> Compare whether our CLI should keep Gemini command enforcement only, or add another platform-native hook layer for Claude as well.
+
+## Expected Shape
+
+1. Start with repo constraints and current platform bundle behavior.
+2. Compare the official platform capabilities using primary docs.
+3. Add any useful community evidence as clearly labeled secondary input.
+4. Produce a recommendation tied to the repo: which platform gets which enforcement surface, and why.

package/workflows/skills/deep-research/examples/03-research-to-implementation-handoff.md

@@ -0,0 +1,12 @@
+# Example: Research To Implementation Handoff
+
+## User Request
+
+> Research the latest Codex, Claude, and Gemini MCP behavior, then tell me the next route to update our workflow rules safely.
+
+## Expected Shape
+
+1. Gather repo evidence first.
+2. Verify current official docs for each platform.
+3. Summarize verified facts, secondary evidence, and gaps.
+4. End with a precise next route such as `/plan` for a policy change or `skill-creator` for skill/rule packaging work.

package/workflows/skills/deep-research/references/comparison-checklist.md

@@ -0,0 +1,57 @@
+# Comparison Checklist
+
+Use this when evaluating tools, frameworks, APIs, or platforms.
+
+## 1. Scope the Comparison
+
+Define:
+
+- what is being compared
+- whether the comparison is about implementation fit, operational cost, or product capability
+- what time horizon matters: immediate migration, medium-term maintenance, or long-term platform fit
+
+## 2. Compare on Stable Axes
+
+Use a short set of dimensions:
+
+- integration fit with the current repo
+- maturity and maintenance signal
+- official documentation quality
+- configuration complexity
+- ecosystem and tooling support
+- operational constraints
+- migration cost
+
+Do not compare on vague criteria like "better DX" without concrete evidence.
+
+## 3. Capture Repo Impact
+
+Tie each option back to the current codebase:
+
+- what code would change
+- which workflows or agents would own the work
+- what risks are specific to this repo
+- whether new MCP tools or skills would be required
+
+## 4. Separate Product Claims from Team Constraints
+
+An option can be technically stronger and still be a worse fit for the repo.
+
+Keep these separate:
+
+- product capability
+- ecosystem quality
+- team familiarity
+- migration blast radius
+- existing architecture constraints
+
+## 5. Decision Frame
+
+Finish with one of:
+
+- recommend option A
+- recommend option B
+- defer decision pending one missing verification
+- keep current approach because switching cost outweighs gain
+
+If the evidence is mixed, say what would change the recommendation.

package/workflows/skills/deep-research/references/research-output.md

@@ -0,0 +1,69 @@
+# Research Output Contract
+
+## Required Sections
+
+### 1. Research question
+
+State:
+
+- the exact topic
+- why research was necessary
+- whether freshness or public comparison mattered
+- the decision this research is meant to support
+
+### 2. Verified facts
+
+List the strongest findings first.
+
+For each fact:
+
+- state the claim in one sentence
+- cite the source class: repo, official docs, upstream repo, standard
+- include the relevant link or file path
+- include date/version when it matters
+
+### 3. Secondary / community evidence
+
+Only include this when it adds signal the primary sources did not provide.
+
+For each item:
+
+- label it as secondary evidence
+- state what practical signal it adds
+- avoid presenting it as settled fact
+
+### 4. Gaps / unknowns
+
+Document:
+
+- unresolved conflicts
+- missing official confirmation
+- assumptions that still need validation
+- risks if the team proceeds anyway
+
+### 5. Recommended next route
+
+Research should end with one clear recommendation:
+
+- direct execution
+- a specific workflow like `/plan` or `/create`
+- a specialist like `@researcher` or `@frontend-specialist`
+- an exact skill like `stitch` or `deep-research`
+
+Keep this recommendation concrete enough that the next step does not need another routing pass.
+
+## Compression Rules
+
+- Prefer 5 strong findings over 20 weak ones.
+- Do not paste long quotes from docs when a citation plus summary will do.
+- If multiple sources say the same thing, summarize once and cite the strongest source.
+- If research found nothing reliable, say that directly.
+
+## Handoff Pattern
+
+When handing off to implementation or planning, include:
+
+- the decision summary
+- the highest-confidence constraints
+- the unresolved risks
+- the next route to take

package/workflows/skills/deep-research/references/source-ladder.md

@@ -0,0 +1,81 @@
+# Source Ladder
+
+## Goal
+
+Use the smallest amount of external research that still produces a decision-ready answer. Keep the evidence traceable and ordered by trust.
+
+## 1. Repo / Local Evidence First
+
+Start by inspecting:
+
+- application code and tests
+- README files and internal docs
+- generated workflow or skill assets
+- lockfiles, config files, and package manifests
+- existing integration code and migration history
+
+If the repo already answers the question, stop there. Do not browse externally just because web research feels safer.
+
+## 2. Primary External Sources
+
+Use these next:
+
+- official vendor docs
+- upstream repositories and release notes
+- standards bodies and reference specs
+- maintainer-authored examples
+
+Prefer sources that expose:
+
+- exact feature names
+- current version constraints
+- config formats
+- dates or changelog context
+
+When the topic is time-sensitive, capture the date you verified the source and the version or doc page involved.
+
+## 3. Secondary / Community Sources
+
+Use these only after primary evidence:
+
+- Reddit threads
+- issue comments
+- independent blog posts
+- forum discussions
+- third-party comparison articles
+
+Community evidence is useful for:
+
+- practical gotchas
+- migration pain points
+- missing-doc workarounds
+- real-world adoption patterns
+
+Community evidence is not enough on its own for authoritative claims about product behavior, supported configuration, or security guarantees.
+
+## 4. Conflict Handling
+
+When sources disagree:
+
+1. Prefer repo evidence for the current codebase state.
+2. Prefer official docs over community claims for product behavior.
+3. Prefer newer dated material when the sources cover the same feature.
+4. If the conflict remains unresolved, report it as a gap instead of guessing.
+
+## 5. Evidence Labels
+
+Use these labels in research output:
+
+- **Verified fact** — backed by repo evidence or a primary source
+- **Secondary evidence** — backed only by community or indirect sources
+- **Inference** — reasoned conclusion not directly stated by a source
+- **Gap** — could not be verified confidently
+
+## 6. Stop Conditions
+
+Stop researching when:
+
+- the decision is already clear
+- new sources only repeat the same point
+- the remaining uncertainty is small and clearly documented
+- the task should move into implementation or planning

package/workflows/skills/generated/skill-audit.json

@@ -2,7 +2,7 @@
   "$schema": "cubis-foundry-skill-audit-v1",
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "summary": {
-    "keep": 68,
+    "keep": 69,
     "review": 0,
     "alias-only": 0
   },
@@ -61,6 +61,15 @@
       "tier": "system",
       "reason": "Canonical skill remains active in the layered catalog."
     },
+    {
+      "id": "deep-research",
+      "canonical_id": "deep-research",
+      "status": "keep",
+      "layer": "core-operating",
+      "category": "core-operating",
+      "tier": "experimental",
+      "reason": "Canonical skill remains active in the layered catalog."
+    },
     {
       "id": "django-drf",
       "canonical_id": "django-drf",
@@ -620,5 +629,5 @@
       "reason": "Canonical skill remains active in the layered catalog."
     }
   ],
-  "contentHash": "43507f9496b367a5"
+  "contentHash": "101f661a3eeb90cd"
 }