@esoteric-logic/praxis-harness 2.11.0 → 2.12.0

package/kits/code-quality/hooks/pre-push.sh

@@ -1,5 +1,5 @@
-#!/bin/bash
-set -uo pipefail
+#!/usr/bin/env bash
+set -euo pipefail
 
 REPO_ROOT=$(git rev-parse --show-toplevel)
 KIT_DIR="$REPO_ROOT/.claude/kits/code-quality"
@@ -33,7 +33,7 @@ echo "------------------------"
 
 # Get changed files only (diff-scoped scanning)
 CHANGED=$(git diff --name-only origin/HEAD...HEAD 2>/dev/null || git diff --name-only HEAD~1...HEAD 2>/dev/null || echo "")
-if [ -z "$CHANGED" ]; then
+if [[ -z "$CHANGED" ]]; then
   echo "  No changed files detected — skipping gate"
   exit 0
 fi
@@ -46,7 +46,7 @@ GATE_FAILURES=()
 GATE_WARNINGS=()
 
 # -- SAST (OpenGrep) --
-if [ -s "$TMP/code-files.txt" ]; then
+if [[ -s "$TMP/code-files.txt" ]]; then
   echo "  SAST scan (OpenGrep)..."
   FILES=$(cat "$TMP/code-files.txt" | tr '\n' ' ')
   opengrep scan --config auto --json $FILES > "$TMP/sast.json" 2>/dev/null || true
@@ -54,8 +54,8 @@ if [ -s "$TMP/code-files.txt" ]; then
   CRITICAL=$(safe_jq '[.results[] | select(.extra.severity == "ERROR")] | length' "$TMP/sast.json")
   HIGH=$(safe_jq '[.results[] | select(.extra.severity == "WARNING")] | length' "$TMP/sast.json")
 
-  [ "$CRITICAL" -gt 0 ] && GATE_FAILURES+=("SAST: $CRITICAL critical findings")
-  [ "$HIGH" -gt 0 ]     && GATE_WARNINGS+=("SAST: $HIGH high findings")
+  [[ "$CRITICAL" -gt 0 ]] && GATE_FAILURES+=("SAST: $CRITICAL critical findings")
+  [[ "$HIGH" -gt 0 ]]     && GATE_WARNINGS+=("SAST: $HIGH high findings")
   echo "     Critical: $CRITICAL  High: $HIGH"
 fi &
 SAST_PID=$!
@@ -68,7 +68,7 @@ if [[ -s "$TMP/secrets.json" ]]; then
 else
   SECRETS=0
 fi
-[ "$SECRETS" -gt 0 ] && GATE_FAILURES+=("SECRETS: $SECRETS verified secrets found")
+[[ "$SECRETS" -gt 0 ]] && GATE_FAILURES+=("SECRETS: $SECRETS verified secrets found")
 echo "     Verified secrets: $SECRETS" &
 SECRETS_PID=$!
 
@@ -77,17 +77,17 @@ echo "  Dependency scan (OSV-Scanner)..."
 osv-scanner scan --format json "$REPO_ROOT" > "$TMP/sca.json" 2>/dev/null || true
 SCA_CRITICAL=$(safe_jq '[.vulns[]? | select(.database_specific.severity? == "CRITICAL")] | length' "$TMP/sca.json")
 SCA_HIGH=$(safe_jq '[.vulns[]? | select(.database_specific.severity? == "HIGH")] | length' "$TMP/sca.json")
-[ "$SCA_CRITICAL" -gt 0 ] && GATE_FAILURES+=("SCA: $SCA_CRITICAL critical CVEs in dependencies")
-[ "$SCA_HIGH" -gt 0 ]     && GATE_WARNINGS+=("SCA: $SCA_HIGH high CVEs in dependencies")
+[[ "$SCA_CRITICAL" -gt 0 ]] && GATE_FAILURES+=("SCA: $SCA_CRITICAL critical CVEs in dependencies")
+[[ "$SCA_HIGH" -gt 0 ]]     && GATE_WARNINGS+=("SCA: $SCA_HIGH high CVEs in dependencies")
 echo "     Critical CVEs: $SCA_CRITICAL  High CVEs: $SCA_HIGH" &
 SCA_PID=$!
 
 # -- IaC (Checkov) --
-if [ -s "$TMP/iac-files.txt" ]; then
+if [[ -s "$TMP/iac-files.txt" ]]; then
   echo "  IaC scan (Checkov)..."
   checkov -d "$REPO_ROOT" --output json --quiet --compact 2>/dev/null > "$TMP/iac.json" || true
   IaC_FAIL=$(safe_jq '.results.failed_checks | length' "$TMP/iac.json")
-  [ "$IaC_FAIL" -gt 0 ] && GATE_WARNINGS+=("IaC: $IaC_FAIL policy violations")
+  [[ "$IaC_FAIL" -gt 0 ]] && GATE_WARNINGS+=("IaC: $IaC_FAIL policy violations")
   echo "     Policy violations: $IaC_FAIL"
 fi &
 IaC_PID=$!
@@ -97,10 +97,10 @@ wait $SAST_PID $SECRETS_PID $SCA_PID $IaC_PID 2>/dev/null || true
 
 # -- COVERAGE --
 COVERAGE_THRESHOLD=$(safe_jq '.coverage.line_min' "$CONFIG" 80)
-if [ -f "$REPO_ROOT/coverage/coverage-summary.json" ]; then
+if [[ -f "$REPO_ROOT/coverage/coverage-summary.json" ]]; then
   COVERAGE=$(safe_jq '.total.lines.pct' "$REPO_ROOT/coverage/coverage-summary.json" 100)
   BELOW=$(echo "$COVERAGE < $COVERAGE_THRESHOLD" | bc -l 2>/dev/null || echo 0)
-  [ "$BELOW" = "1" ] && GATE_WARNINGS+=("COVERAGE: ${COVERAGE}% below threshold ${COVERAGE_THRESHOLD}%")
+  [[ "$BELOW" == "1" ]] && GATE_WARNINGS+=("COVERAGE: ${COVERAGE}% below threshold ${COVERAGE_THRESHOLD}%")
   echo "  Coverage: ${COVERAGE}% (threshold: ${COVERAGE_THRESHOLD}%)"
 fi
 
@@ -108,12 +108,12 @@ fi
 echo ""
 echo "------------------------"
 
-if [ ${#GATE_WARNINGS[@]} -gt 0 ]; then
+if [[ ${#GATE_WARNINGS[@]} -gt 0 ]]; then
   echo "Warnings:"
   for w in "${GATE_WARNINGS[@]}"; do echo "   $w"; done
 fi
 
-if [ ${#GATE_FAILURES[@]} -gt 0 ]; then
+if [[ ${#GATE_FAILURES[@]} -gt 0 ]]; then
   echo "Gate BLOCKED:"
   for f in "${GATE_FAILURES[@]}"; do echo "   $f"; done
   echo ""

package/kits/code-quality/install.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "Installing code-quality kit dependencies..."

package/kits/code-quality/teardown.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "Removing code-quality kit hooks..."
@@ -6,8 +6,8 @@ echo "Removing code-quality kit hooks..."
 REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo ".")
 HOOKS_DIR="$REPO_ROOT/.git/hooks"
 
-[ -f "$HOOKS_DIR/pre-push" ] && rm "$HOOKS_DIR/pre-push" && echo "  pre-push hook removed"
-[ -f "$HOOKS_DIR/post-commit" ] && rm "$HOOKS_DIR/post-commit" && echo "  post-commit hook removed"
+[[ -f "$HOOKS_DIR/pre-push" ]] && rm "$HOOKS_DIR/pre-push" && echo "  pre-push hook removed"
+[[ -f "$HOOKS_DIR/post-commit" ]] && rm "$HOOKS_DIR/post-commit" && echo "  post-commit hook removed"
 
 echo ""
 echo "Note: CLI tools (opengrep, trufflehog, osv-scanner, checkov) are system-level"

package/kits/data/install.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Installing data kit ==="

package/kits/data/teardown.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Removing data kit ==="

package/kits/infrastructure/install.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Installing infrastructure kit ==="

package/kits/infrastructure/teardown.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Removing infrastructure kit ==="

package/kits/security/install.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Installing security kit ==="

package/kits/security/teardown.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Removing security kit ==="

package/kits/web-designer/install.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Installing web-designer kit ==="

package/kits/web-designer/teardown.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 echo "=== Praxis: Removing web-designer kit dependencies ==="

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@esoteric-logic/praxis-harness",
-  "version": "2.11.0",
+  "version": "2.12.0",
   "description": "Layered Claude Code harness — workflow discipline, AI-Kits, persistent vault integration",
   "bin": {
     "praxis-harness": "./bin/praxis.js"

package/scripts/health-check.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # ════════════════════════════════════════════════════════════════
@@ -16,23 +16,29 @@ FAIL=0
 TOTAL=0
 
 check() {
+  local label="$2"
   TOTAL=$((TOTAL + 1))
-  if eval "$1" 2>/dev/null; then
-    echo "  ✓ $2"
+  if "$@" 2>/dev/null; then
+    echo "  ✓ $label"
     PASS=$((PASS + 1))
   else
-    echo "  ✗ $2"
+    echo "  ✗ $label"
     FAIL=$((FAIL + 1))
   fi
 }
 
+check_exists() { [[ -e "$1" ]]; }
+check_file()   { [[ -f "$1" ]]; }
+check_dir()    { [[ -d "$1" ]]; }
+check_cmd()    { command -v "$1" &>/dev/null; }
+
 echo "Praxis Health Check"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 
 # ─── CLAUDE.md symlink ───
 echo ""
 echo "Core:"
-check "[[ -e '$CLAUDE_DIR/CLAUDE.md' ]]" "CLAUDE.md installed"
+check check_exists "$CLAUDE_DIR/CLAUDE.md" "CLAUDE.md installed"
 
 # ─── Rules symlinks ───
 echo ""
@@ -41,7 +47,7 @@ if [[ -d "$PRAXIS_DIR/base/rules" ]]; then
   for rule in "$PRAXIS_DIR"/base/rules/*.md; do
     [[ -f "$rule" ]] || continue
     fname=$(basename "$rule")
-    check "[[ -e '$CLAUDE_DIR/rules/$fname' ]]" "rules/$fname installed"
+    check check_exists "$CLAUDE_DIR/rules/$fname" "rules/$fname installed"
   done
 fi
 
@@ -52,7 +58,7 @@ if [[ -d "$PRAXIS_DIR/base/commands" ]]; then
   for cmd in "$PRAXIS_DIR"/base/commands/*.md; do
     [[ -f "$cmd" ]] || continue
     fname=$(basename "$cmd")
-    check "[[ -e '$CLAUDE_DIR/commands/$fname' ]]" "commands/$fname installed"
+    check check_exists "$CLAUDE_DIR/commands/$fname" "commands/$fname installed"
   done
 fi
 
@@ -63,24 +69,24 @@ if [[ -d "$PRAXIS_DIR/base/skills" ]]; then
   for skill_dir in "$PRAXIS_DIR"/base/skills/*/; do
     [[ -d "$skill_dir" ]] || continue
     skill_name=$(basename "$skill_dir")
-    check "[[ -e '$CLAUDE_DIR/skills/$skill_name' ]]" "skills/$skill_name installed"
+    check check_exists "$CLAUDE_DIR/skills/$skill_name" "skills/$skill_name installed"
   done
 fi
 
 # ─── Kits symlink ───
 echo ""
 echo "Kits:"
-check "[[ -e '$CLAUDE_DIR/kits' ]]" "kits directory installed"
+check check_exists "$CLAUDE_DIR/kits" "kits directory installed"
 
 # ─── Config ───
 echo ""
 echo "Config:"
-check "[[ -f '$CONFIG_FILE' ]]" "praxis.config.json exists"
+check check_file "$CONFIG_FILE" "praxis.config.json exists"
 
 if [[ -f "$CONFIG_FILE" ]]; then
   VAULT_PATH=$(jq -r '.vault_path // empty' "$CONFIG_FILE" 2>/dev/null)
   if [[ -n "$VAULT_PATH" ]]; then
-    check "[[ -d '$VAULT_PATH' ]]" "vault_path ($VAULT_PATH) is a real directory"
+    check check_dir "$VAULT_PATH" "vault_path ($VAULT_PATH) is a real directory"
   else
     TOTAL=$((TOTAL + 1))
     echo "  ✗ vault_path not set in config"
@@ -91,10 +97,10 @@ fi
 # ─── Required tools ───
 echo ""
 echo "Tools:"
-check "command -v obsidian" "Obsidian CLI available"
-check "command -v node" "node available"
-check "command -v claude" "claude available"
-check "command -v jq" "jq available"
+check check_cmd obsidian "Obsidian CLI available"
+check check_cmd node "node available"
+check check_cmd claude "claude available"
+check check_cmd jq "jq available"
 
 # ─── MCP Servers (warn only) ───
 echo ""

package/scripts/install-tools.sh

@@ -17,7 +17,7 @@ for arg in "$@"; do
 done
 
 # Auto-detect if no flags
-if [ $# -eq 0 ]; then
+if [[ $# -eq 0 ]]; then
   command -v go &>/dev/null && INSTALL_GO=true
   command -v terraform &>/dev/null && INSTALL_TF=true
 fi
@@ -43,7 +43,7 @@ install_go()   { go install "$@" 2>/dev/null || true; }
 
 # ── Core (always) ──
 echo "── Installing core tools ──"
-if [ "$PKG" = "brew" ]; then
+if [[ "$PKG" == "brew" ]]; then
   install_brew shellcheck shfmt jq gitleaks
 else
   sudo apt-get update -qq
@@ -60,7 +60,7 @@ if $INSTALL_GO; then
   echo "── Installing Go quality tools ──"
   install_go golang.org/x/tools/cmd/goimports@latest
   install_go golang.org/x/vuln/cmd/govulncheck@latest
-  if [ "$PKG" = "brew" ]; then
+  if [[ "$PKG" == "brew" ]]; then
     install_brew golangci-lint
   else
     curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$(go env GOPATH)/bin" 2>/dev/null || true
@@ -71,7 +71,7 @@ fi
 if $INSTALL_TF; then
   echo ""
   echo "── Installing Terraform quality tools ──"
-  if [ "$PKG" = "brew" ]; then
+  if [[ "$PKG" == "brew" ]]; then
     install_brew tflint trivy infracost
   else
     echo "NOTE: Install tflint, trivy, infracost manually for Linux"
@@ -82,7 +82,7 @@ fi
 if command -v docker &>/dev/null; then
   echo ""
   echo "── Installing container tools ──"
-  if [ "$PKG" = "brew" ]; then
+  if [[ "$PKG" == "brew" ]]; then
     install_brew hadolint
   fi
 fi

package/scripts/lint-harness.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # ════════════════════════════════════════════════════════════════

package/scripts/onboard-mcp.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # ════════════════════════════════════════════════════════════════

package/scripts/test-harness.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # ════════════════════════════════════════════════════════════════

package/scripts/update.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # ════════════════════════════════════════════════════════════════