@hegemonart/get-design-done 1.0.7

package/scripts/aggregate-agent-metrics.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+/**
+ * aggregate-agent-metrics.js — Incremental per-agent aggregator.
+ *
+ * Reads: .design/telemetry/costs.jsonl (append-only ledger from hooks/budget-enforcer.js)
+ *        agents/{agent}.md (frontmatter source for default-tier, parallel-safe, reads-only,
+ *        typical-duration-seconds)
+ * Writes: .design/agent-metrics.json (atomic overwrite via tmp-file + rename)
+ *
+ * Invoked:
+ *   1. Detached child of hooks/budget-enforcer.js after every telemetry write.
+ *   2. Directly by /gdd:optimize skill as an explicit refresh step.
+ *   3. Manually: `node scripts/aggregate-agent-metrics.js`
+ *
+ * OPT-09 contract: fields must match Phase 11 reflector's expectations
+ * (see .planning/phases/11-self-improvement/11-02-PLAN.md).
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const CWD = process.cwd();
+const TELEMETRY_PATH = path.join(CWD, '.design', 'telemetry', 'costs.jsonl');
+const METRICS_PATH = path.join(CWD, '.design', 'agent-metrics.json');
+const AGENTS_DIR = path.join(CWD, 'agents');
+
+// ---- frontmatter reader (no YAML dep) ----
+function readAgentFrontmatter(agentName) {
+  const p = path.join(AGENTS_DIR, `${agentName}.md`);
+  if (!fs.existsSync(p)) return {};
+  try {
+    const content = fs.readFileSync(p, 'utf8');
+    const fm = content.match(/^---\s*\n([\s\S]*?)\n---/);
+    if (!fm) return {};
+    const body = fm[1];
+    const get = (key) => {
+      const m = body.match(new RegExp(`^${key}:\\s*"?([^"\\n]+)"?`, 'm'));
+      return m ? m[1].trim() : null;
+    };
+    const defaultTier = get('default-tier');
+    const parallelSafe = get('parallel-safe');
+    const readsOnly = get('reads-only');
+    const typicalDuration = get('typical-duration-seconds');
+    return {
+      default_tier: defaultTier || null,
+      parallel_safe: parallelSafe === null ? null : /^(true|yes)$/i.test(parallelSafe),
+      reads_only: readsOnly === null ? null : /^(true|yes)$/i.test(readsOnly),
+      typical_duration_seconds: typicalDuration === null ? null : Number(typicalDuration) || null,
+    };
+  } catch {
+    return {};
+  }
+}
+
+// ---- telemetry reader ----
+function readTelemetryRows() {
+  if (!fs.existsSync(TELEMETRY_PATH)) return [];
+  const raw = fs.readFileSync(TELEMETRY_PATH, 'utf8');
+  const out = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch {
+      // tolerant: skip malformed lines (partial write, truncation)
+    }
+  }
+  return out;
+}
+
+// ---- aggregator ----
+function aggregate(rows) {
+  const byAgent = new Map();
+  for (const r of rows) {
+    const agent = r.agent || 'unknown';
+    if (!byAgent.has(agent)) {
+      byAgent.set(agent, {
+        total_spawns: 0,
+        total_cost_usd: 0,
+        total_tokens_in: 0,
+        total_tokens_out: 0,
+        cache_hits: 0,
+        lazy_skips: 0,
+      });
+    }
+    const a = byAgent.get(agent);
+    a.total_spawns += 1;
+    a.total_cost_usd += Number(r.est_cost_usd || 0);
+    a.total_tokens_in += Number(r.tokens_in || 0);
+    a.total_tokens_out += Number(r.tokens_out || 0);
+    if (r.cache_hit === true) a.cache_hits += 1;
+    if (r.lazy_skipped === true) a.lazy_skips += 1;
+  }
+
+  const out = {};
+  for (const [agent, a] of byAgent.entries()) {
+    const fm = readAgentFrontmatter(agent);
+    const spawns = a.total_spawns || 1; // guard div-by-zero
+    out[agent] = {
+      typical_duration_seconds: fm.typical_duration_seconds,
+      default_tier: fm.default_tier,
+      parallel_safe: fm.parallel_safe,
+      reads_only: fm.reads_only,
+      total_spawns: a.total_spawns,
+      total_cost_usd: Number(a.total_cost_usd.toFixed(6)),
+      total_tokens_in: a.total_tokens_in,
+      total_tokens_out: a.total_tokens_out,
+      cache_hit_rate: Number((a.cache_hits / spawns).toFixed(4)),
+      lazy_skip_rate: Number((a.lazy_skips / spawns).toFixed(4)),
+    };
+  }
+  return out;
+}
+
+// ---- atomic write ----
+function writeAtomic(filePath, content) {
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
+  fs.writeFileSync(tmp, content, 'utf8');
+  fs.renameSync(tmp, filePath);
+}
+
+// ---- main ----
+function main() {
+  const rows = readTelemetryRows();
+  const agents = aggregate(rows);
+  const payload = {
+    generated_at: new Date().toISOString(),
+    agents,
+  };
+  writeAtomic(METRICS_PATH, JSON.stringify(payload, null, 2) + '\n');
+}
+
+try {
+  main();
+} catch (err) {
+  // Fail open: aggregator must never block the hook or /gdd:optimize flow.
+  process.stderr.write(`aggregate-agent-metrics: ${err.message}\n`);
+  process.exit(0);
+}

package/scripts/apply-branch-protection.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# apply-branch-protection.sh — manually apply branch protection to `main`.
+# Per D-16: this script is run by the repo admin locally, NOT from CI.
+# Usage:
+#   bash scripts/apply-branch-protection.sh --advisory
+#   bash scripts/apply-branch-protection.sh --enforcing
+#   bash scripts/apply-branch-protection.sh --disable
+
+set -euo pipefail
+
+MODE="${1:-}"
+REPO="${GITHUB_REPOSITORY:-hegemonart/get-design-done}"
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "ERROR: gh CLI not found. Install from https://cli.github.com/"
+  exit 1
+fi
+
+case "$MODE" in
+  --advisory)
+    echo "Applying ADVISORY branch protection to $REPO main..."
+    gh api -X PUT "repos/${REPO}/branches/main/protection" \
+      -H "Accept: application/vnd.github+json" \
+      -f "required_status_checks=null" \
+      -F "enforce_admins=false" \
+      -f "required_pull_request_reviews=null" \
+      -F "restrictions=null" \
+      -F "required_linear_history=false" \
+      -F "allow_force_pushes=true" \
+      -F "allow_deletions=false"
+    echo "Advisory mode applied. CI checks will run but not block merges."
+    ;;
+  --enforcing)
+    echo "Applying ENFORCING branch protection to $REPO main..."
+    # Status check names must match the `name:` field of each job exactly.
+    # See reference/BRANCH-PROTECTION.md §Phase B for the authoritative list.
+    gh api -X PUT "repos/${REPO}/branches/main/protection" \
+      -H "Accept: application/vnd.github+json" \
+      --input - <<'JSON'
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": [
+      "Lint (markdown + frontmatter + stale-refs)",
+      "Validate (schemas + plugin + shellcheck)",
+      "Test (Node 22 / ubuntu-latest)",
+      "Test (Node 22 / macos-latest)",
+      "Test (Node 22 / windows-latest)",
+      "Test (Node 24 / ubuntu-latest)",
+      "Test (Node 24 / macos-latest)",
+      "Test (Node 24 / windows-latest)",
+      "Security (secrets + injection scan)",
+      "Size budget (blocking)"
+    ]
+  },
+  "enforce_admins": false,
+  "required_pull_request_reviews": null,
+  "restrictions": null,
+  "required_linear_history": true,
+  "allow_force_pushes": false,
+  "allow_deletions": false
+}
+JSON
+    echo "Enforcing mode applied. CI must pass before merge; linear history required."
+    ;;
+  --disable)
+    echo "Removing branch protection from $REPO main..."
+    gh api -X DELETE "repos/${REPO}/branches/main/protection" || true
+    echo "Protection removed."
+    ;;
+  *)
+    echo "Usage: $0 --advisory | --enforcing | --disable"
+    exit 1
+    ;;
+esac

package/scripts/bootstrap-manifest.txt

@@ -0,0 +1,3 @@
+get-design-done-bootstrap
+v1
+awesome-design-md@VoltAgent

package/scripts/bootstrap.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# get-design-done bootstrap
+# Auto-provisions companion resources that get-design-done references but which
+# are not Claude Code plugins (so they cannot be listed in `dependencies`).
+#
+# Runs on SessionStart. Idempotent: uses a marker in ${CLAUDE_PLUGIN_DATA} so it
+# only performs network work on first install or when the bundled manifest changes.
+#
+# Resources provisioned:
+#   - ~/.claude/libs/awesome-design-md  (VoltAgent/awesome-design-md)
+#
+# Resources NOT provisioned (install separately, see README):
+#   - emil-design-eng skill — no canonical upstream
+#   - refero MCP — optional, add to your Claude config if you have access
+
+set -u
+
+PLUGIN_DATA="${CLAUDE_PLUGIN_DATA:-$HOME/.claude/plugins/data/get-design-done}"
+PLUGIN_DATA="${PLUGIN_DATA//\\//}"  # Normalize Windows backslashes to forward slashes
+PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
+PLUGIN_ROOT="${PLUGIN_ROOT//\\//}"  # Normalize Windows backslashes to forward slashes
+MANIFEST="${PLUGIN_ROOT}/scripts/bootstrap-manifest.txt"
+MARKER="${PLUGIN_DATA}/bootstrap-manifest.txt"
+
+mkdir -p "${PLUGIN_DATA}" "${HOME}/.claude/libs" "${HOME}/.claude/skills"
+
+# Skip if bundled manifest matches the last-run marker (no-op on every other session).
+if [[ -f "${MANIFEST}" && -f "${MARKER}" ]] && diff -q "${MANIFEST}" "${MARKER}" >/dev/null 2>&1; then
+  exit 0
+fi
+
+log() { printf '[get-design-done bootstrap] %s\n' "$*" >&2; }
+
+clone_or_update() {
+  local repo_url="$1"
+  local target="$2"
+  if [[ -d "${target}/.git" ]]; then
+    log "updating ${target}"
+    git -C "${target}" pull --quiet --ff-only 2>/dev/null || log "pull failed for ${target} (continuing)"
+  elif [[ -d "${target}" ]]; then
+    log "${target} exists and is not a git checkout — skipping"
+  else
+    log "cloning ${repo_url} -> ${target}"
+    git clone --quiet --depth 1 "${repo_url}" "${target}" || log "clone failed for ${repo_url}"
+  fi
+}
+
+# Required library: awesome-design-md
+clone_or_update "https://github.com/VoltAgent/awesome-design-md.git" "${HOME}/.claude/libs/awesome-design-md"
+
+# Soft notice for companion skills we cannot auto-install.
+if [[ ! -d "${HOME}/.claude/skills/emil-design-eng" ]]; then
+  log "optional: emil-design-eng skill not found in ~/.claude/skills. See get-design-done README for install options."
+fi
+
+# Phase 10.1: ensure .design/budget.json exists with defaults (D-12)
+DESIGN_DIR="$(pwd)/.design"
+mkdir -p "${DESIGN_DIR}"
+if [ ! -f "${DESIGN_DIR}/budget.json" ]; then
+  cat > "${DESIGN_DIR}/budget.json" <<'BUDGET_EOF'
+{
+  "per_task_cap_usd": 2.00,
+  "per_phase_cap_usd": 20.00,
+  "tier_overrides": {},
+  "auto_downgrade_on_cap": true,
+  "cache_ttl_seconds": 3600,
+  "enforcement_mode": "enforce"
+}
+BUDGET_EOF
+fi
+
+# Phase 10.1: ensure .design/telemetry/ directory is writable
+mkdir -p "${DESIGN_DIR}/telemetry"
+
+# Record success so we don't re-run until the bundled manifest changes.
+if [[ -f "${MANIFEST}" ]]; then
+  cp "${MANIFEST}" "${MARKER}"
+fi
+
+exit 0