@hegemonart/get-design-done 1.31.5 → 1.33.0

package/scripts/lib/health-mirror/index.cjs

@@ -8,13 +8,14 @@
 // Surface:
 //   async getHealthChecks(rootDir) → { checks: HealthCheck[] }
 //
-// The 6 checks (in stable order) are:
+// The 7 checks (in stable order) are:
 //   1. claude_md            — CLAUDE.md presence
 //   2. planning_dir         — .planning/ presence
 //   3. design_dir           — .design/ presence
 //   4. package_json         — package.json present AND parseable
 //   5. issue_reporter       — kill-switch state (Plan 30-06 / D-08)
 //   6. figma_extract        — extract readiness + Free-tier signal (Plan 31-09)
+//   7. skill_discipline     — using-gdd bootstrap + SessionStart inject (Plan 32-07)
 //
 // Check 5 was added in Plan 30-06 — surfaces the report-issue kill-switch
 // (env or config disable) so users can verify why the command is
@@ -34,6 +35,17 @@
 // logged, or placed in the detail. The Free-tier state is derived from a LOCAL
 // signal only (a prior pull's _meta.json recording a 403/skip on the Variables
 // endpoint) — never a live network call (health-mirror is pure read-only).
+//
+// Check 7 was added in Plan 32-07 — surfaces whether the skill-discipline
+// bootstrap (Phase 32) is live so a user can confirm the using-gdd SessionStart
+// inject is wired. The detail line is one of three exact strings:
+//   - "skill-discipline: ready"            (using-gdd present AND hooks.json
+//                                           SessionStart wires inject-using-gdd.sh)
+//   - "skill-discipline: missing using-gdd" (skills/using-gdd/SKILL.md absent)
+//   - "skill-discipline: hook not wired"    (skill present but no SessionStart
+//                                           inject-using-gdd entry)
+// status: 'ok' when ready, 'warn' otherwise. PURE read-only (rootDir-relative
+// file + JSON inspection only) — NEVER throws, NEVER networks.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -174,9 +186,75 @@ async function getHealthChecks(rootDir) {
     checks.push({ name: 'figma_extract', status, detail });
   }
 
+  // 7. skill_discipline — using-gdd bootstrap + SessionStart inject (Plan 32-07).
+  // Reports exactly one of three states. PURE read-only: file existence +
+  // hooks.json JSON inspection only. NEVER throws, NEVER networks (every read
+  // is wrapped defensively like the figma_extract check above).
+  {
+    const skillPresent = fileExists(
+      path.join(rootDir, 'skills', 'using-gdd', 'SKILL.md')
+    );
+    const hookWired = skillPresent && sessionStartWiresInject(rootDir);
+
+    let detail;
+    let status;
+    if (!skillPresent) {
+      detail = 'skill-discipline: missing using-gdd';
+      status = 'warn';
+    } else if (!hookWired) {
+      detail = 'skill-discipline: hook not wired';
+      status = 'warn';
+    } else {
+      detail = 'skill-discipline: ready';
+      status = 'ok';
+    }
+    checks.push({ name: 'skill_discipline', status, detail });
+  }
+
   return { checks };
 }
 
+/**
+ * Does hooks/hooks.json wire the inject-using-gdd SessionStart entry?
+ * PURE read-only JSON inspection. Defensive: a missing/garbage hooks.json or an
+ * unexpected shape returns false (→ "hook not wired") rather than throwing — the
+ * health probe must never crash on this check. NEVER networks.
+ *
+ * @param {string} rootDir project root passed to getHealthChecks
+ * @returns {boolean} true iff a SessionStart hook command references inject-using-gdd
+ */
+function sessionStartWiresInject(rootDir) {
+  try {
+    const p = path.join(rootDir, 'hooks', 'hooks.json');
+    let hooks;
+    try {
+      hooks = JSON.parse(fs.readFileSync(p, 'utf8'));
+    } catch {
+      return false; // missing/garbage hooks.json → not wired
+    }
+    const sessionStart =
+      hooks && hooks.hooks && Array.isArray(hooks.hooks.SessionStart)
+        ? hooks.hooks.SessionStart
+        : [];
+    for (const entry of sessionStart) {
+      const inner = entry && Array.isArray(entry.hooks) ? entry.hooks : [];
+      for (const h of inner) {
+        if (
+          h &&
+          typeof h.command === 'string' &&
+          /inject-using-gdd/.test(h.command)
+        ) {
+          return true;
+        }
+      }
+    }
+    return false;
+  } catch {
+    // Absolute safety net — never crash the health probe on this check.
+    return false;
+  }
+}
+
 /**
  * Free-tier signal (LOCAL only — never a network call). The raw-pull stage
  * (scripts/lib/figma-extract/pull.cjs) writes a _meta.json per file key under

package/scripts/lib/skill-behavior/runner.cjs

@@ -0,0 +1,187 @@
+/**
+ * runner.cjs — manifest-driven pressure-scenario runner (Plan 33-01).
+ *
+ * The ROOT engine of Phase 33: every later plan (33-03 scenarios, 33-04 A/B,
+ * 33-05 telemetry) builds on this. It loads a parsed pressure-scenario
+ * manifest, invokes an agent via an INJECTABLE `invokeAgent(prompt, opts) ->
+ * { text }` seam, runs N attempts (default 3), scores each response against
+ * the manifest's expected_compliance[] (must-match regexes) and
+ * expected_violations[] (failure regexes), applies a STRICT 2/3 majority
+ * rule, and emits a structured result.
+ *
+ * D-03 — invoker-agnostic, NO direct Anthropic SDK dependency:
+ *   This file deps on node:fs + node:path ONLY. It NEVER requires the
+ *   Anthropic SDK package. The default invoker is the deterministic stub at
+ *   ./stub-invoker.cjs so CI/tests run with no API key and no network. A
+ *   maintainer later wires a real invoker (peer-CLI ACP spawn or a thin keyed
+ *   SDK adapter) by passing opts.invokeAgent. (The guard test asserts the
+ *   exact package name never appears in this source.)
+ *
+ * Purity / injectability:
+ *   invokeAgent, the clock (now), and fs are all injectable via opts so every
+ *   test drives the stub with a fixed clock.
+ *
+ * Result (EXACT shape):
+ *   {
+ *     scenario: string,            // = manifest.name
+ *     attempts: Array<{            // one entry per attempt (length === attempts)
+ *       text: string,
+ *       pass: boolean,             // ALL compliance matched AND zero violations
+ *       compliance_hits: number,   // # expected_compliance regexes matching this text
+ *       violation_hits: number,    // # expected_violations regexes matching this text
+ *     }>,
+ *     pass: boolean,               // MAJORITY: (#passing attempts) * 2 > attempts.length
+ *     compliance_hits: number,     // aggregate sum across attempts
+ *     violation_hits: number,      // aggregate sum across attempts
+ *   }
+ *
+ * Pattern reference (NOT a dependency): scripts/lib/event-chain.cjs shows the
+ * house CommonJS idiom (defensive fs, pure functions). Style mirrored, not imported.
+ */
+
+'use strict';
+
+const nodeFs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_ATTEMPTS = 3;
+
+/**
+ * Load a pressure-scenario manifest. Accepts either an already-parsed object
+ * (returned as-is) or a path to a JSON file (read + parsed via the injectable
+ * fs). Keeping this injectable lets later plans (33-03) load real manifest
+ * files while tests pass inline objects.
+ *
+ * @param {object | string} input  parsed manifest OR a path to a JSON manifest
+ * @param {{ fs?: typeof import('node:fs') }} [deps]
+ * @returns {object} the parsed manifest
+ */
+function loadManifest(input, deps) {
+  if (input && typeof input === 'object') {
+    return input;
+  }
+  if (typeof input === 'string') {
+    const fs = (deps && deps.fs) || nodeFs;
+    const abs = path.isAbsolute(input) ? input : path.resolve(process.cwd(), input);
+    const raw = fs.readFileSync(abs, 'utf8');
+    return JSON.parse(raw);
+  }
+  throw new TypeError('loadManifest: input must be a parsed manifest object or a path string');
+}
+
+/**
+ * Compile an array of regex SOURCE strings into RegExp objects. Manifests
+ * author patterns as plain strings (NOT pre-compiled) so they stay JSON-safe;
+ * the runner owns compilation.
+ *
+ * @param {unknown} sources
+ * @returns {RegExp[]}
+ */
+function compilePatterns(sources) {
+  if (!Array.isArray(sources)) return [];
+  return sources.map((src) => new RegExp(String(src)));
+}
+
+/**
+ * Coerce an invoker's `.text` to a string. A non-string (or absent) value
+ * becomes '' so scoring never throws and is treated as a compliance-miss.
+ *
+ * @param {unknown} response
+ * @returns {string}
+ */
+function textOf(response) {
+  if (response && typeof response.text === 'string') return response.text;
+  return '';
+}
+
+/**
+ * Score a single response text against pre-compiled compliance/violation
+ * regexes.
+ *
+ * @param {string} text
+ * @param {RegExp[]} complianceRes
+ * @param {RegExp[]} violationRes
+ * @returns {{ text: string, pass: boolean, compliance_hits: number, violation_hits: number }}
+ */
+function scoreAttempt(text, complianceRes, violationRes) {
+  const compliance_hits = complianceRes.filter((re) => re.test(text)).length;
+  const violation_hits = violationRes.filter((re) => re.test(text)).length;
+  // An attempt PASSES iff ALL compliance regexes matched AND zero violations did.
+  const pass = compliance_hits === complianceRes.length && violation_hits === 0;
+  return { text, pass, compliance_hits, violation_hits };
+}
+
+/**
+ * Run a pressure scenario: invoke the seam N times, score each response, and
+ * apply a strict majority rule.
+ *
+ * @param {object} manifest  parsed pressure-scenario manifest
+ *   { name, target_skill, pressures[], setup_prompt, expected_compliance[], expected_violations[] }
+ * @param {{
+ *   invokeAgent?: (prompt: string, opts: object) => { text: string },
+ *   attempts?: number,
+ *   now?: () => number,
+ *   fs?: typeof import('node:fs'),
+ * }} [opts]
+ * @returns {{
+ *   scenario: string,
+ *   attempts: Array<{ text: string, pass: boolean, compliance_hits: number, violation_hits: number }>,
+ *   pass: boolean,
+ *   compliance_hits: number,
+ *   violation_hits: number,
+ * }}
+ */
+function runScenario(manifest, opts) {
+  const o = opts || {};
+  // D-03: default to the deterministic stub invoker — never the real SDK.
+  const invokeAgent = o.invokeAgent || require('./stub-invoker.cjs').invokeAgent;
+  const attempts =
+    Number.isInteger(o.attempts) && o.attempts > 0 ? o.attempts : DEFAULT_ATTEMPTS;
+  // Injectable clock (reserved for future telemetry timestamps; called so the
+  // seam is exercised and a fixed now() is honored).
+  const now = typeof o.now === 'function' ? o.now : Date.now;
+
+  const complianceRes = compilePatterns(manifest && manifest.expected_compliance);
+  const violationRes = compilePatterns(manifest && manifest.expected_violations);
+  const scenario = manifest && manifest.name;
+  const prompt = (manifest && manifest.setup_prompt) || '';
+
+  const attemptResults = [];
+  for (let i = 0; i < attempts; i++) {
+    now(); // exercise the injectable clock (deterministic under a fixed now)
+    let text = '';
+    try {
+      // Pass the scenario key through so the stub (or a real invoker) can key on it.
+      const response = invokeAgent(prompt, { scenario, attempt: i });
+      text = textOf(response);
+    } catch (_err) {
+      // A thrown invoker must NOT crash the run — record a failed empty attempt.
+      text = '';
+    }
+    attemptResults.push(scoreAttempt(text, complianceRes, violationRes));
+  }
+
+  const passed = attemptResults.filter((a) => a.pass).length;
+  // STRICT majority: 2/3 and 3/3 pass; 0/3 and 1/3 fail.
+  const pass = passed * 2 > attemptResults.length;
+
+  const compliance_hits = attemptResults.reduce((sum, a) => sum + a.compliance_hits, 0);
+  const violation_hits = attemptResults.reduce((sum, a) => sum + a.violation_hits, 0);
+
+  return {
+    scenario,
+    attempts: attemptResults,
+    pass,
+    compliance_hits,
+    violation_hits,
+  };
+}
+
+module.exports = {
+  runScenario,
+  loadManifest,
+  // Exposed for unit-level reuse / later plans; not part of the core contract.
+  scoreAttempt,
+  compilePatterns,
+  DEFAULT_ATTEMPTS,
+};

package/scripts/lib/skill-behavior/stub-invoker.cjs

@@ -0,0 +1,95 @@
+/**
+ * stub-invoker.cjs — deterministic, scenario-keyed agent invoker (Plan 33-01).
+ *
+ * The DEFAULT invokeAgent seam for `runner.cjs` (D-03): the runner is
+ * invoker-agnostic and exposes an injectable `invokeAgent(prompt, opts) ->
+ * { text }` seam. A maintainer later wires a REAL invoker (a peer-CLI ACP
+ * spawn of a local `claude`/`codex`, or a thin keyed SDK adapter); this stub
+ * is what every Phase-33 CI/structural test drives so runs are reproducible
+ * with NO API key and NO network.
+ *
+ * Determinism contract:
+ *   * NO randomness, NO network, NO @anthropic-ai/sdk.
+ *   * A canned response is resolved by a KEY derived from
+ *     opts.scenario || opts.stubKey, falling back to scanning `prompt` for a
+ *     registered key marker.
+ *   * An UNKNOWN key returns a neutral { text: '' } so the runner never throws.
+ *
+ * Tests MAY instead pass their own inline invokeAgent to runScenario — both
+ * paths are valid (D-03). This module is the no-arg default.
+ */
+
+'use strict';
+
+// Internal canned-response table: key -> response text. Seeded with one
+// illustrative scenario; callers extend it via register().
+const TABLE = new Map([
+  // A neutral, compliance-shaped sample so the default stub is non-empty for a
+  // known demo key. Real scenarios register their own canned text.
+  [
+    'runner-demo',
+    'A <HARD-GATE> blocks me — I must write the brief before any other stage.',
+  ],
+]);
+
+/**
+ * Seed or overwrite a canned response for a scenario key.
+ *
+ * @param {string} key   scenario name / stub key
+ * @param {string} text  canned response text the stub returns for that key
+ * @returns {void}
+ */
+function register(key, text) {
+  if (typeof key !== 'string' || key.length === 0) {
+    throw new TypeError('register: key must be a non-empty string');
+  }
+  TABLE.set(key, typeof text === 'string' ? text : String(text == null ? '' : text));
+}
+
+/**
+ * Resolve a response key from opts, then (as a fallback) by scanning the
+ * prompt for any registered key as a substring marker.
+ *
+ * @param {string} prompt
+ * @param {{scenario?: string, stubKey?: string} | undefined} opts
+ * @returns {string | undefined}
+ */
+function resolveKey(prompt, opts) {
+  if (opts && typeof opts.scenario === 'string' && opts.scenario.length > 0) {
+    return opts.scenario;
+  }
+  if (opts && typeof opts.stubKey === 'string' && opts.stubKey.length > 0) {
+    return opts.stubKey;
+  }
+  if (typeof prompt === 'string' && prompt.length > 0) {
+    for (const key of TABLE.keys()) {
+      if (prompt.includes(key)) return key;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Deterministic invokeAgent-shaped function. Returns a canned { text } for a
+ * known scenario key, or a neutral { text: '' } for an unknown key (so the
+ * runner can score it as a compliance-miss without throwing).
+ *
+ * @param {string} prompt
+ * @param {{scenario?: string, stubKey?: string}} [opts]
+ * @returns {{ text: string }}
+ */
+function invokeAgent(prompt, opts) {
+  const key = resolveKey(prompt, opts);
+  if (key !== undefined && TABLE.has(key)) {
+    return { text: TABLE.get(key) };
+  }
+  // Unknown key -> neutral default; never throw.
+  return { text: '' };
+}
+
+module.exports = {
+  invokeAgent,
+  register,
+  // Exposed for advanced callers/tests that want to inspect or reset seeds.
+  _table: TABLE,
+};