@delorenj/pjangler 1.2.25 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.2.25",
+  "version": "1.3.0",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -11,7 +11,10 @@
   },
   "files": [
     "dist",
-    "templates",
+    "templates/commonproject/copier.yml",
+    "templates/commonproject/template",
+    "templates/hermes-agent/copier.yml",
+    "templates/hermes-agent/template",
     ".mise/scripts/versioning.sh",
     ".mise/scripts/link-agentfiles.sh"
   ],
@@ -27,7 +30,8 @@
     "start": "node dist/index.js",
     "mcp": "node dist/mcp-server.js",
     "typecheck": "tsc --noEmit",
-    "test": "npm run check:lock && npm run check:submodules && npm run check:tracked-secrets && node tests/release-regressions.mjs && node tests/submodule-contract-regressions.mjs && node tests/secret-publication-gate-regressions.mjs && node tests/bmad-version-surface-regressions.mjs && node tests/bmad-transaction-regressions.mjs && node tests/parity-migrate-regressions.mjs && node tests/pjan-43-regressions.mjs && node tests/skillex-init-regressions.mjs && node tests/fleet-shared-bloodbank-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs",
+    "test:bmad-installer-contract": "node tests/bmad-installer-contract-regressions.mjs",
+    "test": "npm run check:lock && npm run check:submodules && npm run check:tracked-secrets && node tests/portable-test-paths-regressions.mjs && node tests/release-regressions.mjs && node tests/submodule-contract-regressions.mjs && node tests/secret-publication-gate-regressions.mjs && node tests/bmad-version-surface-regressions.mjs && node tests/bmad-transaction-regressions.mjs && node tests/parity-migrate-regressions.mjs && node tests/pjan-57-lifecycle-recipes-regressions.mjs && node tests/pjan-57-dogfood-regressions.mjs && node tests/generated-project-lifecycle-regressions.mjs && node tests/pack-flatten-regressions.mjs && node tests/pack-flatten-cross-engine-regressions.mjs && node tests/registry-cache-parity-regressions.mjs && node tests/registry-root-ladder-regressions.mjs && node tests/pjan-23-regressions.mjs && node tests/pjan-24-regressions.mjs && node tests/pjan-28-regressions.mjs && node tests/pjan-30-regressions.mjs && node tests/pjan-31a-regressions.mjs && node tests/pjan-36-regressions.mjs && node tests/pjan-43-regressions.mjs && node tests/pjan-48-regressions.mjs && node tests/pjan-49-regressions.mjs && node tests/pjan-50-regressions.mjs && node tests/skillex-init-regressions.mjs && node tests/fleet-shared-bloodbank-regressions.mjs && node tests/mcp-catalog-regressions.mjs && node tests/mcp-server-regressions.mjs && node tests/project-registry-regressions.mjs && node tests/pg-registry-regressions.mjs && node tests/momo-lifecycle-plane-regressions.mjs",
     "migrate:up": "node-pg-migrate --migrations-dir migrations up",
     "migrate:down": "node-pg-migrate --migrations-dir migrations down",
     "migrate:create": "node-pg-migrate --migrations-dir migrations create",
@@ -62,6 +66,6 @@
     "url": "https://github.com/delorenj/pjangler.git"
   },
   "publishConfig": {
-    "registry": "https://npm.pkg.github.com"
+    "registry": "https://registry.npmjs.org"
   }
 }

package/templates/commonproject/copier.yml

@@ -2,10 +2,10 @@
 # https://copier.readthedocs.io/
 #
 # Generic base project template. Creates a project skeleton with:
-# - BMAD methodology (pre-initialized)
+# - minimal source inputs for pjangler-owned BMAD lifecycle initialization
 # - Plane project (auto-created in 33god workspace)
 # - mise environment management
-# - CLI coder configs (Claude, Codex, Gemini, etc.)
+# - six supported CLI projections (Claude, Codex, Gemini, Copilot, OpenCode, Kimi)
 
 _min_copier_version: "9.0.0"
 _subdirectory: template
@@ -116,11 +116,11 @@ _exclude:
 _tasks:
   - "cp ~/.config/git/ignore .gitignore 2>/dev/null || echo '# Add ignores here' > .gitignore"
   # Ensure secrets + per-dev agent-hook/skill overrides are ignored (appended after the base ignore).
-  - "printf '\\n# Secrets + per-dev agent-hook/skill overrides (see .agents/local.example.json)\\n.env\\n.env.*\\n!.env.op\\n.agents/local.json\\n.kimi-code/\\n.lastagent\\n**/.claude/settings.local.json\\n' >> .gitignore"
+  - "printf '\\n# Secrets + per-dev agent-hook/skill overrides (see .agents/local.example.json)\\n.env\\n.env.*\\n!.env.op\\n.agents/local.json\\n.lastagent\\n**/.claude/settings.local.json\\n\\n# PJAN-57: all six generated CLI configurations are durable project state.\\n!.claude/\\n!.claude/**\\n!.codex/\\n!.codex/**\\n!.gemini/\\n!.gemini/**\\n!.copilot/\\n!.copilot/**\\n!.opencode/\\n!.opencode/**\\n!.kimi-code/\\n!.kimi-code/**\\n' >> .gitignore"
   - "ln -sf AGENTS.md CLAUDE.md"
   - "ln -sf AGENTS.md GEMINI.md"
-  # Materialize the pinned Skillex BMAD manifest + symlink topology without
-  # copying pack content or disturbing project-specific, non-BMAD skills.
-  - "python3 .mise/scripts/provision-bmad-skills.py"
+  # Materialize the declared Skillex packs' manifest + symlink topology
+  # without copying pack content or disturbing project-specific skills.
+  - "python3 .mise/scripts/provision-packs.py"
   # Stamp the repo's absolute path into .project.json (the SOT) post-render.
   - "python3 -c \"import json,os,pathlib; p=pathlib.Path('.project.json'); d=json.loads(p.read_text()); d['repo_path']=os.getcwd(); p.write_text(json.dumps(d,indent=2)+chr(10))\""

package/templates/commonproject/template/.agents/hooks/README.md

@@ -12,11 +12,11 @@ master writes zero bytes).
 ## TL;DR
 
 ```bash
-mise run hooks-sync          # fan out the master -> claude + codex + hermes
-mise run hooks-check         # drift gate (read-only; used in CI)
-mise run hooks-uninstall     # remove codex + hermes injections
-mise run skills-sync         # sync .agents/skills.json -> local CLI skill dirs
-mise run hindsight-setup     # one-time: pull the shared CAF Hindsight key into .env
+mise run hooks:sync          # fan out the master -> claude + codex + hermes
+mise run hooks:check         # drift gate (read-only; used in CI)
+mise run hooks:uninstall     # remove codex + hermes injections
+mise run skills:sync         # sync .agents/skills.json -> local CLI skill dirs
+mise run hindsight:setup     # one-time: pull the shared CAF Hindsight key into .env
 ```
 
 You normally run nothing — `mise` does it on directory enter/leave (see
@@ -93,10 +93,10 @@ merged in automatically.
 
 - Project-local skills with the same name shadow the global ones.
 - No `defer_to_global` flag or bash cleanup scripts are needed anymore.
-- The manifest is the only hand-edited skill SSOT; run `mise run skills-sync`
+- The manifest is the only hand-edited skill SSOT; run `mise run skills:sync`
   after changing it, or just re-enter the repo.
 
-## Hindsight credentials — `mise run hindsight-setup`
+## Hindsight credentials — `mise run hindsight:setup`
 
 The hooks shell out to `hindsight`, which needs an API key for the self-hosted
 instance. Strategy: **one shared CAF-scoped key in 1Password**. `hindsight-setup`
@@ -105,7 +105,7 @@ gitignored `.env` (mise loads it, env vars outrank `~/.hindsight/config`). Point
 it at the right item if the default ref is wrong:
 
 ```bash
-HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight-setup
+HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight:setup
 ```
 
 Without a key the hooks **no-op gracefully** — recall/retain just do nothing.
@@ -113,10 +113,10 @@ Without a key the hooks **no-op gracefully** — recall/retain just do nothing.
 ## Adding / changing a hook
 
 1. Edit `hooks.master.json`.
-2. `mise run hooks-sync`.
+2. `mise run hooks:sync`.
 3. Commit the master **and** the regenerated `.claude/settings.json` together
    (codex/hermes targets are per-dev/per-deployment, not committed).
-4. CI runs `mise run hooks-check` — fails if the committed Claude settings drift.
+4. CI runs `mise run hooks:check` — fails if the committed Claude settings drift.
 
 ## Files
 

package/templates/commonproject/template/.agents/hooks/hooks.master.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "SINGLE SOURCE OF TRUTH for this repo's project-scoped agent hooks. Hand-edit ONLY this file, then run `mise run hooks-sync` (or re-cd into the repo) to regenerate every per-agent config. Generated files are NOT hand-edited. Pattern: the /ssot-fanout skill. See .agents/hooks/README.md.",
+  "$comment": "SINGLE SOURCE OF TRUTH for this repo's project-scoped agent hooks. Hand-edit ONLY this file, then run `mise run hooks:sync` (or re-cd into the repo) to regenerate every per-agent config. Generated files are NOT hand-edited. Pattern: the /ssot-fanout skill. See .agents/hooks/README.md.",
   "version": 1,
   "marker": "project-agent-hooks",
   "hooks": [

package/templates/commonproject/template/.agents/hooks/sync.py

@@ -515,7 +515,7 @@ def cmd_check(master: dict) -> int:
         current = target.read_text() if target.exists() else None
         if current != desired:
             warn(f"DRIFT: {target.relative_to(REPO_ROOT)} differs from hooks.master.json "
-                 f"(run `mise run hooks-sync`)")
+                 f"(run `mise run hooks:sync`)")
             rc = 1
         else:
             log(f"claude: in sync ({target.relative_to(REPO_ROOT)})")
@@ -538,7 +538,7 @@ def cmd_check(master: dict) -> int:
                 ]
                 if missing:
                     warn(f"DRIFT: codex hooks.json missing {len(missing)} project hook(s) "
-                         f"(run `mise run hooks-sync`)")
+                         f"(run `mise run hooks:sync`)")
                     rc = 1
                 else:
                     log(f"codex: in sync ({ct})")
@@ -558,7 +558,7 @@ def cmd_check(master: dict) -> int:
             missing = [c for c in want_cmds if c not in present]
             if begin not in present or missing:
                 warn(f"DRIFT: kimi config.toml missing the project hooks block "
-                     f"(run `mise run hooks-sync`)")
+                     f"(run `mise run hooks:sync`)")
                 rc = 1
             else:
                 log(f"kimi: in sync ({kt})")
@@ -574,7 +574,7 @@ def cmd_check(master: dict) -> int:
             missing = [c for _ev, c, _t in hermes_commands(master) if c not in present]
             if missing:
                 warn(f"DRIFT: hermes config.yaml missing {len(missing)} adapter hook(s) "
-                     f"(run `mise run hooks-sync`)")
+                     f"(run `mise run hooks:sync`)")
                 rc = 1
             else:
                 log(f"hermes: in sync ({hcfg.relative_to(REPO_ROOT)})")

package/templates/commonproject/template/.agents/local.example.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks or whole injected agents without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks-sync` (or re-cd into the repo) after editing.",
+  "$comment": "PER-DEV LOCAL OVERRIDES — copy this file to .agents/local.json (gitignored) and edit. Lets you opt out of individual hooks or whole injected agents without touching committed config. Hooks self-skip at RUNTIME via .agents/hooks/lib/hook-guard.sh (so even Claude's committed hooks honor it); codex/hermes injections additionally skip at INSTALL time. Re-run `mise run hooks:sync` (or re-cd into the repo) after editing.",
   "hooks": {
     "$disabled_help": "Hook ids from .agents/hooks/hooks.master.json: skill-check-reminder, hindsight-recall, hindsight-retain, hindsight-session-end. Listed ids are skipped at runtime across ALL agents.",
     "disabled": [],

package/templates/commonproject/template/.agents/skills.json

@@ -1,6 +1,7 @@
 {
-  "$schema": "https://raw.githubusercontent.com/skillex/schemas/main/skills.schema.json",
+  "$schema": "https://raw.githubusercontent.com/delorenj/skillex/main/skills.schema.json",
   "inherit_global": true,
   "registry": "https://github.com/delorenj/skillex.git",
+  "packs": [],
   "skills": []
 }

package/templates/commonproject/template/.env.op

@@ -1,2 +1,6 @@
-OPENROUTER_API_KEY=op://DeLoSecrets/openrouter/OpenCode
-TEST_SECRETS="Secrets have been overridden by op inject"
+# Optional 1Password environment materialization.
+# Add active assignments only when this project needs them, for example:
+# API_KEY=op://your-vault/your-item/credential
+#
+# A comment-only file is an intentional opt-out: the mise enter hook leaves
+# an existing .env byte-for-byte unchanged.

package/templates/commonproject/template/.github/workflows/code-review.yml.jinja

@@ -0,0 +1,48 @@
+# Automated pull-request review for {{ project_name }}.
+#
+# Rendered unconditionally by the CommonProject template: every project pjangler
+# creates gets code review on day one, with no opt-in question to forget.
+#
+# Auth: the `CLAUDE_CODE_OAUTH_TOKEN` repo secret (or an org-level secret this
+# repo inherits). It is a long-lived OAuth/session token, NOT a metered API key.
+# Until it is set the job runs and fails at the action step — see the "Code
+# Review" section of the CommonProject README.
+#
+# Trigger: `pull_request`, deliberately NOT `pull_request_target`. The latter
+# would hand repo secrets to code from forked PRs; nothing here needs it.
+#
+# NOTE FOR TEMPLATE MAINTAINERS: this is a Copier `.jinja` file and GitHub
+# Actions expression syntax collides with Jinja's variable delimiters. Every
+# GitHub expression below is wrapped in a Jinja raw block so it reaches the
+# generated repo verbatim instead of rendering to an empty string.
+name: Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+
+jobs:
+  claude-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: {% raw %}${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}{% endraw %}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review {% raw %}${{ github.repository }}/pull/${{ github.event.pull_request.number }}{% endraw %}'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options

package/templates/commonproject/template/.mise/scripts/hindsight-setup.sh

@@ -11,7 +11,7 @@
 # .env untouched. Never prints the secret.
 #
 # Override the 1Password reference if the item path differs:
-#   HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight-setup
+#   HINDSIGHT_OP_KEY_REF="op://DeLoSecrets/<item>/<field>" mise run hindsight:setup
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"

package/templates/commonproject/template/.mise/scripts/materialize-env.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+set -eu
+
+script_dir=$(CDPATH= cd "$(dirname "$0")" && pwd -P)
+project_dir=$(CDPATH= cd "$script_dir/../.." && pwd -P)
+source_file="$project_dir/.env.op"
+target_file="$project_dir/.env"
+
+# Missing, whitespace-only, and comment-only templates intentionally opt out.
+if [ ! -f "$source_file" ] || ! grep -Eq '^[[:space:]]*[A-Za-z_][A-Za-z0-9_]*[[:space:]]*=' "$source_file"; then
+  exit 0
+fi
+
+# Entering a project without the 1Password CLI must not damage an existing .env.
+if ! command -v op >/dev/null 2>&1; then
+  exit 0
+fi
+
+umask 077
+temp_file=$(mktemp "$project_dir/.env.inject.XXXXXX")
+cleanup() {
+  rm -f -- "$temp_file"
+}
+trap cleanup EXIT HUP INT TERM
+
+op inject -i "$source_file" -o "$temp_file" --force
+mv -f -- "$temp_file" "$target_file"
+trap - EXIT HUP INT TERM