@dadado/agent-kit-cli 5.16.0 → 5.18.0

package/dist/chunk-C26I6HTO.js

@@ -0,0 +1,39 @@
+// src/utils/kit-paths.ts
+import { mkdir, writeFile } from "fs/promises";
+import path from "path";
+var HANDOFF_REL = ".cursor/HANDOFF.md";
+var STATE_ROOT_ENV = "AGENT_KIT_STATE_ROOT";
+var STATE_ROOT_DIRS = [".cursor", ".agent-kit"];
+function resolveStateDir(env = process.env) {
+  const raw = (env[STATE_ROOT_ENV] ?? "").trim().replace(/\/+$/, "");
+  if (!raw) return { stateDir: ".cursor" };
+  if (STATE_ROOT_DIRS.includes(raw))
+    return { stateDir: raw };
+  return { stateDir: ".cursor", invalid: raw };
+}
+function runnerStatePaths(root, env = process.env) {
+  const { stateDir, invalid } = resolveStateDir(env);
+  const base = path.join(root, stateDir);
+  return {
+    stateDir,
+    loopLogsDir: path.join(base, "loop-logs"),
+    stopFile: path.join(base, "loop.stop"),
+    ...invalid !== void 0 ? { invalid } : {}
+  };
+}
+async function ensureLoopLogsDir(paths) {
+  await mkdir(paths.loopLogsDir, { recursive: true });
+  if (paths.stateDir === ".cursor") return;
+  const ignore = path.join(paths.loopLogsDir, ".gitignore");
+  try {
+    await writeFile(ignore, "*\n", { flag: "wx" });
+  } catch {
+  }
+}
+
+export {
+  HANDOFF_REL,
+  STATE_ROOT_ENV,
+  runnerStatePaths,
+  ensureLoopLogsDir
+};

package/dist/{chunk-6QV2BFGA.js → chunk-GSCXFJB7.js}

@@ -4,7 +4,7 @@ import {
   loadRegistry,
   packMemberFileTargets,
   skillFileTargets
-} from "./chunk-VS2JD2XC.js";
+} from "./chunk-WSJ77EHO.js";
 
 // src/lifecycle/l0.ts
 var L0_ARTIFACTS = [

package/dist/{chunk-KI6ZHBPV.js → chunk-HRILMD5N.js}

@@ -1,3 +1,14 @@
+import {
+  CLAUDE_COMMANDS_DIR_REL,
+  CLAUDE_SETTINGS_REL,
+  GUARD_SHELL_HOOK_MARKER,
+  RESOLVE_AGENT_KIT_REL,
+  SESSION_START_HOOK_MARKER,
+  discoverInstalledCommands
+} from "./chunk-TZYKLR5J.js";
+import {
+  findOnPath
+} from "./chunk-WGLPZXNU.js";
 import {
   createReadinessReport
 } from "./chunk-PNFF6OU3.js";
@@ -19,9 +30,297 @@ import {
   writeJson
 } from "./chunk-77V75A7O.js";
 
-// src/scanner/safe-fixes.ts
-import { readFile, writeFile } from "fs/promises";
+// src/invariants/hooks-health.ts
+import { execFile } from "child_process";
+import { constants, access, readFile, readdir, stat } from "fs/promises";
 import path from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var GIT_HOOK_CANONICAL_NAMES = ["pre-commit", "pre-push", "prepare-commit-msg"];
+var EXPECTED_EVENTS = [
+  "sessionStart",
+  "preCompact",
+  "beforeShellExecution",
+  "afterFileEdit",
+  "beforeSubmitPrompt"
+];
+async function exists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isExecutable(p) {
+  try {
+    await access(p, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function resolveAgentKitCli(rootDir) {
+  const root = path.resolve(rootDir);
+  const candidates = [
+    path.join(root, "node_modules", ".bin", "agent-kit"),
+    path.join(root, "packages", "cli", "dist", "index.js")
+  ];
+  for (const c of candidates) {
+    if (await exists(c)) return c;
+  }
+  return findOnPath("agent-kit");
+}
+function commandLooksLikeAdapter(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return null;
+  const m = trimmed.match(/(\.cursor\/hooks\/agent\/[A-Za-z0-9._-]+\.sh)\b/);
+  return m?.[1] ?? null;
+}
+async function assessGitHooksInstallDrift(rootDir) {
+  const root = path.resolve(rootDir);
+  const canonicalDir = path.join(root, "git-hooks");
+  if (!await exists(canonicalDir)) return [];
+  let hooksPathCfg = "";
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["-C", root, "config", "--get", "core.hooksPath"],
+      { encoding: "utf8" }
+    );
+    hooksPathCfg = stdout.trim();
+  } catch {
+  }
+  if (hooksPathCfg) {
+    const resolved = path.isAbsolute(hooksPathCfg) ? path.normalize(hooksPathCfg) : path.normalize(path.join(root, hooksPathCfg));
+    if (resolved === path.normalize(canonicalDir)) {
+      return [];
+    }
+  }
+  const gitDir = path.join(root, ".git");
+  if (!await exists(gitDir)) return [];
+  try {
+    const st = await stat(gitDir);
+    if (!st.isDirectory()) return [];
+  } catch {
+    return [];
+  }
+  const installedDir = path.join(gitDir, "hooks");
+  const advisories = [];
+  const installHint = "Install or refresh with: `cp git-hooks/<name> .git/hooks/<name> && chmod +x .git/hooks/<name>` (see git-hooks/README.md)";
+  let names = [...GIT_HOOK_CANONICAL_NAMES];
+  try {
+    const listed = await readdir(canonicalDir);
+    const fromDisk = listed.filter(
+      (n) => GIT_HOOK_CANONICAL_NAMES.includes(n)
+    );
+    if (fromDisk.length > 0) names = fromDisk;
+  } catch {
+  }
+  for (const name of names) {
+    const canonical = path.join(canonicalDir, name);
+    const installed = path.join(installedDir, name);
+    if (!await exists(canonical)) continue;
+    if (!await exists(installed)) {
+      advisories.push(
+        `git-hooks drift: \`.git/hooks/${name}\` missing (canonical \`git-hooks/${name}\` present). ${installHint}`
+      );
+      continue;
+    }
+    try {
+      const [a, b] = await Promise.all([readFile(canonical, "utf8"), readFile(installed, "utf8")]);
+      if (a !== b) {
+        advisories.push(
+          `git-hooks drift: \`.git/hooks/${name}\` differs from \`git-hooks/${name}\`. ${installHint}`
+        );
+      }
+    } catch {
+      advisories.push(
+        `git-hooks drift: could not compare \`git-hooks/${name}\` with \`.git/hooks/${name}\`. ${installHint}`
+      );
+    }
+  }
+  return advisories;
+}
+async function assessSignatureGateHook(rootDir) {
+  const root = path.resolve(rootDir);
+  if (!await exists(path.join(root, "autogit", "gitupdate.md"))) return [];
+  if (await exists(path.join(root, "git-hooks", "prepare-commit-msg"))) return [];
+  return [
+    "signature gate hook missing: `git-hooks/prepare-commit-msg` (/git-staging runs `sh git-hooks/prepare-commit-msg --check -`; a missing file exits 127 and reads as red). Run `agent-kit update` to restore it."
+  ];
+}
+async function assessClaudeCommandAdapters(rootDir) {
+  const root = path.resolve(rootDir);
+  if (!await exists(path.join(root, ".claude"))) return [];
+  const sources = await discoverInstalledCommands(root);
+  if (sources.length === 0) return [];
+  const missing = [];
+  for (const { name } of sources) {
+    if (!await exists(path.join(root, CLAUDE_COMMANDS_DIR_REL, `${name}.md`))) missing.push(name);
+  }
+  if (missing.length === 0) return [];
+  const shown = missing.slice(0, 3).map((n) => `/${n}`);
+  const more = missing.length > shown.length ? `, +${missing.length - shown.length} more` : "";
+  return [
+    `Claude Code command adapters missing: ${missing.length} of ${sources.length} installed kit commands have no \`.claude/commands/<name>.md\` (${shown.join(", ")}${more}), so they are not recognized as slash commands. Run \`agent-kit update --claude\` to generate them (writes only \`.claude/commands/*\`).`
+  ];
+}
+async function resolveGuardProbeArgv(root) {
+  const hookBin = process.env.AGENT_KIT_HOOK_BIN;
+  if (hookBin && await isExecutable(hookBin)) return [hookBin];
+  const local = path.join(root, "node_modules", ".bin", "agent-kit");
+  if (await isExecutable(local)) return [local];
+  const dist = path.join(root, "packages", "cli", "dist", "index.js");
+  if (await exists(dist)) return [process.execPath, dist];
+  const hit = await findOnPath("agent-kit");
+  return hit ? [hit] : null;
+}
+async function assessClaudeGuardProbe(rootDir) {
+  const root = path.resolve(rootDir);
+  let text;
+  try {
+    text = await readFile(path.join(root, CLAUDE_SETTINGS_REL), "utf8");
+  } catch {
+    return [];
+  }
+  if (!text.includes(GUARD_SHELL_HOOK_MARKER)) {
+    return text.includes(SESSION_START_HOOK_MARKER) ? [
+      "Claude SessionStart hook is installed but the PreToolUse guard hook is absent from `.claude/settings.json`. Run `agent-kit install --claude`."
+    ] : [];
+  }
+  const stale = "Claude guard hook active but resolved CLI is too old or stale dist; update the CLI / rebuild.";
+  const argv = await resolveGuardProbeArgv(root);
+  if (!argv) return [`${stale} (agent-kit CLI not resolvable)`];
+  const [bin, ...lead] = argv;
+  try {
+    const { stdout } = await execFileAsync(
+      bin,
+      [
+        ...lead,
+        "guard",
+        "shell",
+        "--format",
+        "claude",
+        "--command",
+        "git push --force origin main"
+      ],
+      {
+        cwd: root,
+        encoding: "utf8",
+        timeout: 1e4,
+        env: { ...process.env, ALLOW_MAIN_PUSH: "" }
+      }
+    );
+    const decision = JSON.parse(stdout).hookSpecificOutput?.permissionDecision;
+    return decision === "deny" ? [] : [stale];
+  } catch {
+    return [stale];
+  }
+}
+async function assessHooksHealth(rootDir) {
+  const root = path.resolve(rootDir);
+  const hooksJsonPath = ".cursor/hooks.json";
+  const hooksJsonAbs = path.join(root, hooksJsonPath);
+  const reasons = [];
+  const wiredEvents = [];
+  const advisories = [
+    ...await assessGitHooksInstallDrift(root),
+    ...await assessSignatureGateHook(root),
+    ...await assessClaudeGuardProbe(root),
+    ...await assessClaudeCommandAdapters(root)
+  ];
+  if (!await exists(hooksJsonAbs)) {
+    return {
+      status: "missing",
+      reasons: ["`.cursor/hooks.json` not found"],
+      advisories,
+      hooksJsonPath,
+      expectedEvents: [...EXPECTED_EVENTS],
+      wiredEvents
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(hooksJsonAbs, "utf8"));
+  } catch {
+    return {
+      status: "degraded",
+      reasons: ["`.cursor/hooks.json` is not valid JSON"],
+      advisories,
+      hooksJsonPath,
+      expectedEvents: [...EXPECTED_EVENTS],
+      wiredEvents
+    };
+  }
+  const hooks = parsed.hooks ?? {};
+  const adapterRels = /* @__PURE__ */ new Set();
+  for (const event of EXPECTED_EVENTS) {
+    const list = hooks[event];
+    if (Array.isArray(list) && list.length > 0) {
+      wiredEvents.push(event);
+      for (const entry of list) {
+        if (!entry || typeof entry !== "object") continue;
+        const command = String(entry.command ?? "");
+        if (command.endsWith(".py") || command.includes("python")) {
+          reasons.push(`${event} still points at a Python script (${command})`);
+        }
+        const rel = commandLooksLikeAdapter(command);
+        if (rel) adapterRels.add(rel);
+      }
+    } else {
+      reasons.push(`missing hook event: ${event}`);
+    }
+  }
+  const resolveLib = path.join(root, RESOLVE_AGENT_KIT_REL);
+  if (!await exists(resolveLib)) {
+    reasons.push(`missing \`${RESOLVE_AGENT_KIT_REL}\` (thin adapter resolver)`);
+  } else if (!await isExecutable(resolveLib)) {
+    reasons.push(`\`${RESOLVE_AGENT_KIT_REL}\` is not executable (chmod +x)`);
+  }
+  for (const rel of adapterRels) {
+    const abs = path.join(root, rel);
+    if (!await exists(abs)) {
+      reasons.push(`missing adapter script: \`${rel}\``);
+      continue;
+    }
+    try {
+      const st = await stat(abs);
+      if (!st.isFile()) {
+        reasons.push(`adapter path is not a file: \`${rel}\``);
+        continue;
+      }
+    } catch {
+      reasons.push(`unreadable adapter script: \`${rel}\``);
+      continue;
+    }
+    if (!await isExecutable(abs)) {
+      reasons.push(`adapter not executable: \`${rel}\` (chmod +x)`);
+    }
+  }
+  const cli = await resolveAgentKitCli(root);
+  if (!cli) {
+    reasons.push(
+      "agent-kit CLI not resolvable (node_modules/.bin/agent-kit, packages/cli/dist, or PATH)"
+    );
+  }
+  if (Array.isArray(hooks.stop) && hooks.stop.length > 0) {
+    reasons.push("`stop` hook is registered (forbidden; remove it)");
+  }
+  const status = reasons.length === 0 && wiredEvents.length === EXPECTED_EVENTS.length ? "active" : "degraded";
+  return {
+    status,
+    reasons,
+    advisories,
+    hooksJsonPath,
+    expectedEvents: [...EXPECTED_EVENTS],
+    wiredEvents
+  };
+}
+
+// src/scanner/safe-fixes.ts
+import { readFile as readFile2, writeFile } from "fs/promises";
+import path2 from "path";
 var CONTEXT_CONFIG_REL_POSIX = CONTEXT_CONFIG_REL.replace(/\\/g, "/");
 var ESSENTIAL_DIRECTORIES = [
   ".cursor",
@@ -207,7 +506,7 @@ async function refreshRepositoryProfile(rootDir, options) {
     generatedAt
   });
   const desiredProfile = createProfile(scan, report, generatedAt);
-  const profilePath = path.join(scan.rootDir, REPOSITORY_PROFILE_REL);
+  const profilePath = path2.join(scan.rootDir, REPOSITORY_PROFILE_REL);
   const existingProfile = await readJson(profilePath) ?? {};
   const reconciled = reconcileFreshOverExisting(desiredProfile, existingProfile);
   const meaningfulChange = !jsonEqual(
@@ -230,21 +529,21 @@ async function executeSafeReadinessFixes(rootDir, options) {
   });
   const changes = [];
   for (const relativePath of ESSENTIAL_DIRECTORIES) {
-    const absolutePath = path.join(beforeScan.rootDir, relativePath);
-    const exists = await fileExists(absolutePath);
-    if (!exists && !dryRun) await ensureDir(absolutePath);
+    const absolutePath = path2.join(beforeScan.rootDir, relativePath);
+    const exists2 = await fileExists(absolutePath);
+    if (!exists2 && !dryRun) await ensureDir(absolutePath);
     recordChange(
       changes,
       "ensure-agent-kit-directory",
       relativePath,
-      !exists,
+      !exists2,
       dryRun,
-      relativeEvidence(relativePath, exists ? "already exists" : "missing directory")
+      relativeEvidence(relativePath, exists2 ? "already exists" : "missing directory")
     );
   }
   const gitignoreRelativePath = ".gitignore";
-  const gitignorePath = path.join(beforeScan.rootDir, gitignoreRelativePath);
-  const existingGitignore = await fileExists(gitignorePath) ? await readFile(gitignorePath, "utf8") : "";
+  const gitignorePath = path2.join(beforeScan.rootDir, gitignoreRelativePath);
+  const existingGitignore = await fileExists(gitignorePath) ? await readFile2(gitignorePath, "utf8") : "";
   const gitignoreAfterSecrets = mergeSecretIgnores(existingGitignore);
   const secretsChanged = gitignoreAfterSecrets !== existingGitignore;
   const mergedGitignore = mergeKitOwnedIgnores(gitignoreAfterSecrets);
@@ -273,7 +572,7 @@ async function executeSafeReadinessFixes(rootDir, options) {
       kitOwnedChanged ? "kit-owned session/derived paths are missing" : "kit-owned session/derived paths are present"
     )
   );
-  const profilePath = path.join(beforeScan.rootDir, REPOSITORY_PROFILE_REL);
+  const profilePath = path2.join(beforeScan.rootDir, REPOSITORY_PROFILE_REL);
   const existingProfile = await readJson(profilePath) ?? {};
   const desiredProfile = createProfile(beforeScan, before, generatedAt);
   const mergedProfile = mergeMissing(existingProfile, desiredProfile);
@@ -327,6 +626,8 @@ async function executeSafeReadinessFixes(rootDir, options) {
 }
 
 export {
+  assessClaudeCommandAdapters,
+  assessHooksHealth,
   refreshRepositoryProfile,
   executeSafeReadinessFixes
 };