@hivehub/rulebook 3.3.1 → 4.0.0

package/dist/core/agent-manager.d.ts

@@ -1,4 +1,8 @@
-import type { OpenSpecTask } from '../types.js';
+export interface AgentTask {
+    id: string;
+    title: string;
+    description: string;
+}
 export interface AgentOptions {
     dryRun?: boolean;
     tool?: string;
@@ -6,10 +10,9 @@ export interface AgentOptions {
     watchMode?: boolean;
     onLog?: (type: 'info' | 'success' | 'warning' | 'error' | 'tool', message: string) => void;
     onTaskStatusChange?: (taskId: string, status: string) => void;
-    onTasksReloaded?: (tasks: OpenSpecTask[]) => void;
+    onTasksReloaded?: (tasks: AgentTask[]) => void;
 }
 export declare class AgentManager {
-    private openspecManager;
     private logger;
     private configManager;
     private cliBridge;
@@ -18,8 +21,8 @@ export declare class AgentManager {
     private currentTool?;
     private onLog?;
     private onTaskStatusChange?;
-    private onTasksReloaded?;
     private initializePromise?;
+    private projectRoot;
     constructor(projectRoot: string);
     /**
      * Initialize agent manager (only once, thread-safe)
@@ -40,42 +43,19 @@ export declare class AgentManager {
     /**
      * Execute workflow for a single task
      */
-    executeTaskWorkflow(task: OpenSpecTask, options: AgentOptions): Promise<boolean>;
-    /**
-     * Run quality checks (lint, format)
-     */
+    executeTaskWorkflow(task: AgentTask, options: AgentOptions): Promise<boolean>;
     private runQualityChecks;
-    /**
-     * Run tests
-     */
     private runTests;
-    /**
-     * Check coverage
-     */
     private checkCoverage;
     /**
-     * Test workflows
-     */
-    private testWorkflows;
-    /**
-     * Commit changes
+     * Run the security gate using npm audit (or other available tools).
+     * Returns true if the gate passes, false if it fails.
+     * If no tool is available, logs a warning and returns true (skip).
      */
+    private runSecurityGate;
     private commitChanges;
-    /**
-     * Start watcher in background
-     */
     private startWatcherInBackground;
-    /**
-     * Cleanup resources
-     */
     private cleanup;
-    /**
-     * Delay execution
-     */
-    private delay;
-    /**
-     * Stop agent
-     */
     stop(): Promise<void>;
 }
 /**

package/dist/core/agent-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-manager.d.ts","sourceRoot":"","sources":["../../src/core/agent-manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9D,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,CAAC;CACnD;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,eAAe,CAA2C;IAClE,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAwB;IACtC,OAAO,CAAC,kBAAkB,CAAC,CAAqC;IAChE,OAAO,CAAC,eAAe,CAAC,CAAkC;IAC1D,OAAO,CAAC,iBAAiB,CAAC,CAAgB;gBAE9B,WAAW,EAAE,MAAM;IAO/B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAsCjC;;OAEG;IACG,UAAU,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuE3D;;OAEG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAqDnE;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAiF5D;;OAEG;IACG,mBAAmB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;IAyMtF;;OAEG;YACW,gBAAgB;IAoC9B;;OAEG;YACW,QAAQ;IAWtB;;OAEG;YACW,aAAa;IAW3B;;OAEG;YACW,aAAa;IAM3B;;OAEG;YACW,aAAa;IAS3B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAMhC;;OAEG;YACW,OAAO;IAUrB;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAI5B;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,CAEpE"}
+{"version":3,"file":"agent-manager.d.ts","sourceRoot":"","sources":["../../src/core/agent-manager.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3F,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9D,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;CAChD;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAwB;IACtC,OAAO,CAAC,kBAAkB,CAAC,CAAqC;IAChE,OAAO,CAAC,iBAAiB,CAAC,CAAgB;IAC1C,OAAO,CAAC,WAAW,CAAS;gBAEhB,WAAW,EAAE,MAAM;IAO/B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjC;;OAEG;IACG,UAAU,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6C3D;;OAEG;IACG,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDnE;;OAEG;IACG,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IA6C5D;;OAEG;IACG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC;YAiFrE,gBAAgB;YAkChB,QAAQ;YAWR,aAAa;IAqB3B;;;;OAIG;YACW,eAAe;YA8Hf,aAAa;IAS3B,OAAO,CAAC,wBAAwB;YAIlB,OAAO;IAUf,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAI5B;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,CAEpE"}

package/dist/core/agent-manager.js

@@ -1,11 +1,10 @@
 import chalk from 'chalk';
 import inquirer from 'inquirer';
-import { createOpenSpecManager } from './openspec-manager.js';
 import { initializeLogger } from './logger.js';
 import { createConfigManager } from './config-manager.js';
 import { createCLIBridge } from './cli-bridge.js';
+import { RalphParser } from '../agents/ralph-parser.js';
 export class AgentManager {
-    openspecManager;
     logger;
     configManager;
     cliBridge;
@@ -14,43 +13,35 @@ export class AgentManager {
     currentTool;
     onLog;
     onTaskStatusChange;
-    onTasksReloaded;
-    initializePromise; // Track initialization promise to prevent race conditions
+    initializePromise;
+    projectRoot;
     constructor(projectRoot) {
-        this.openspecManager = createOpenSpecManager(projectRoot);
+        this.projectRoot = projectRoot;
         this.logger = initializeLogger(projectRoot);
         this.configManager = createConfigManager(projectRoot);
-        this.config = {}; // Will be loaded in initialize()
+        this.config = {};
     }
     /**
      * Initialize agent manager (only once, thread-safe)
      */
     async initialize() {
-        // If already initializing or initialized, return the same promise
         if (this.initializePromise) {
-            // Update callbacks even if already initialized (they might have changed)
             if (this.cliBridge && this.onLog) {
                 this.cliBridge.setLogCallback(this.onLog);
-                this.openspecManager.setLogCallback(this.onLog);
             }
             return this.initializePromise;
         }
-        // Create and store the initialization promise
         this.initializePromise = (async () => {
             try {
                 this.config = await this.configManager.loadConfig();
                 this.cliBridge = createCLIBridge(this.logger, this.config);
-                // Pass onLog callback to CLI bridge if available
                 if (this.onLog) {
                     this.cliBridge.setLogCallback(this.onLog);
-                    this.openspecManager.setLogCallback(this.onLog);
                 }
-                await this.openspecManager.initialize();
                 this.logger.info('Agent Manager initialized');
             }
             catch (error) {
                 this.logger.error('Failed to initialize Agent Manager', { error: String(error) });
-                // Clear the promise so it can be retried
                 this.initializePromise = undefined;
                 throw error;
             }
@@ -62,10 +53,8 @@ export class AgentManager {
      */
     async startAgent(options = {}) {
         try {
-            // Set callbacks BEFORE initialize
             this.onLog = options.onLog;
             this.onTaskStatusChange = options.onTaskStatusChange;
-            this.onTasksReloaded = options.onTasksReloaded;
             await this.initialize();
             if (!this.onLog) {
                 console.log(chalk.bold.blue('\n🤖 Rulebook Autonomous Agent\n'));
@@ -73,7 +62,6 @@ export class AgentManager {
             else {
                 this.onLog('info', '🤖 Rulebook Autonomous Agent');
             }
-            // Detect and select CLI tool
             const selectedTool = await this.selectCLITool(options.tool);
             if (!selectedTool) {
                 const msg = 'No CLI tool selected. Exiting.';
@@ -87,30 +75,9 @@ export class AgentManager {
             }
             this.currentTool = selectedTool;
             this.isRunning = true;
-            // Sync task status first
-            if (this.onLog) {
-                this.onLog('info', '📋 Syncing task status...');
-            }
-            else {
-                console.log(chalk.gray('📋 Syncing task status...'));
-            }
-            await this.openspecManager.syncTaskStatus();
-            // Notify watcher with reloaded tasks
-            if (this.onTasksReloaded) {
-                const data = await this.openspecManager.loadOpenSpec();
-                this.onTasksReloaded(data.tasks);
-            }
-            if (this.onLog) {
-                this.onLog('success', '✅ Task status synced');
-            }
-            else {
-                console.log(chalk.green('✅ Task status synced\n'));
-            }
-            // Start watcher if requested
             if (options.watchMode) {
                 this.startWatcherInBackground();
             }
-            // Run main workflow loop
             await this.runAgentWorkflow(options);
         }
         catch (error) {
@@ -142,7 +109,6 @@ export class AgentManager {
             }
             return null;
         }
-        // If preferred tool is specified and available, use it
         if (preferredTool && availableTools.some((tool) => tool.name === preferredTool)) {
             const msg = `Using preferred tool: ${preferredTool}`;
             if (this.onLog) {
@@ -153,7 +119,6 @@ export class AgentManager {
             }
             return preferredTool;
         }
-        // If only one tool available, use it
         if (availableTools.length === 1) {
             const msg = `Using available tool: ${availableTools[0].name}`;
             if (this.onLog) {
@@ -164,7 +129,6 @@ export class AgentManager {
             }
             return availableTools[0].name;
         }
-        // Multiple tools available, let user choose
         const choices = availableTools.map((tool) => ({
             name: `${tool.name} ${tool.version ? `(${tool.version})` : ''}`,
             value: tool.name,
@@ -190,43 +154,15 @@ export class AgentManager {
             try {
                 iteration++;
                 this.logger.info(`Workflow iteration ${iteration}/${maxIterations}`);
-                // Get next task
-                const nextTask = await this.openspecManager.getNextTask();
-                if (!nextTask) {
-                    this.logger.info('No more tasks available');
-                    const msg = '✅ All tasks completed!';
-                    if (this.onLog) {
-                        this.onLog('success', msg);
-                    }
-                    else {
-                        console.log(chalk.green(`\n${msg}`));
-                    }
-                    break;
-                }
-                // Debug: Log task being executed
+                const msg = `🔄 Agent workflow iteration ${iteration}/${maxIterations} (use Ralph for task-driven automation)`;
                 if (this.onLog) {
-                    this.onLog('info', `[DEBUG] Agent picked task: ${nextTask.id} - ${nextTask.title.substring(0, 50)}`);
-                }
-                // Execute task workflow
-                const success = await this.executeTaskWorkflow(nextTask, options);
-                if (success) {
-                    await this.openspecManager.markTaskComplete(nextTask.id);
-                    this.logger.taskComplete(nextTask.id, nextTask.title, 0);
-                    // Notify watcher about completion
-                    if (this.onTaskStatusChange) {
-                        this.onTaskStatusChange(nextTask.id, 'completed');
-                    }
+                    this.onLog('info', msg);
                 }
                 else {
-                    await this.openspecManager.updateTaskStatus(nextTask.id, 'failed');
-                    this.logger.taskFailed(nextTask.id, nextTask.title, 'Task execution failed');
-                    // Notify watcher about failure
-                    if (this.onTaskStatusChange) {
-                        this.onTaskStatusChange(nextTask.id, 'failed');
-                    }
+                    console.log(chalk.gray(msg));
                 }
-                // Small delay between tasks
-                await this.delay(2000);
+                // Continue iterating — no unconditional break
+                // Loop exits naturally when: isRunning=false, maxIterations reached
             }
             catch (error) {
                 this.logger.error(`Workflow iteration ${iteration} failed`, { error: String(error) });
@@ -237,7 +173,6 @@ export class AgentManager {
                 else {
                     console.error(chalk.red('\n' + msg));
                 }
-                // Continue with next iteration unless it's a critical error
                 if (iteration >= maxIterations) {
                     break;
                 }
@@ -267,21 +202,9 @@ export class AgentManager {
             console.log(chalk.blue('\n' + msg));
         }
         try {
-            // Set task as in-progress
-            await this.openspecManager.setCurrentTask(task.id);
-            await this.openspecManager.updateTaskStatus(task.id, 'in-progress');
-            // Notify watcher about status change
             if (this.onTaskStatusChange) {
-                if (this.onLog) {
-                    this.onLog('info', `[DEBUG] Calling onTaskStatusChange for ${task.id}`);
-                }
                 this.onTaskStatusChange(task.id, 'in-progress');
             }
-            else {
-                if (this.onLog) {
-                    this.onLog('warning', '[DEBUG] onTaskStatusChange callback is undefined!');
-                }
-            }
             if (options.dryRun) {
                 if (this.onLog) {
                     this.onLog('warning', '🔍 DRY RUN MODE - No actual execution');
@@ -293,7 +216,6 @@ export class AgentManager {
                 }
                 return true;
             }
-            // Step 1: Send task to CLI
             if (this.onLog) {
                 this.onLog('info', '📤 Sending task to CLI...');
             }
@@ -301,111 +223,21 @@ export class AgentManager {
                 console.log(chalk.gray('📤 Sending task to CLI...'));
             }
             const taskResponse = await this.cliBridge.sendTaskCommand(this.currentTool, task);
-            if (this.onLog) {
-                this.onLog('info', '📥 Agent Response:');
-                this.onLog('info', '─'.repeat(80));
-                this.onLog('info', taskResponse.output || '(no output)');
-                this.onLog('info', '─'.repeat(80));
-                this.onLog('info', `Exit Code: ${taskResponse.exitCode} | Duration: ${Math.round(taskResponse.duration / 1000)}s`);
-                if (taskResponse.error) {
-                    this.onLog('warning', '⚠️ Error Output:');
-                    this.onLog('error', taskResponse.error);
-                }
-            }
-            else {
-                console.log(chalk.blue('\n📥 Agent Response:'));
-                console.log(chalk.gray('─'.repeat(80)));
-                console.log(taskResponse.output || '(no output)');
-                console.log(chalk.gray('─'.repeat(80)));
-                console.log(chalk.gray(`Exit Code: ${taskResponse.exitCode} | Duration: ${Math.round(taskResponse.duration / 1000)}s`));
-                if (taskResponse.error) {
-                    console.log(chalk.red('\n⚠️ Error Output:'));
-                    console.log(chalk.red(taskResponse.error));
-                }
-            }
             if (!taskResponse.success) {
                 throw new Error(`Task command failed: ${taskResponse.error}`);
             }
-            // Step 2: Continue implementation loop
-            if (this.onLog) {
-                this.onLog('info', '🔄 Continuing implementation...');
-            }
-            else {
-                console.log(chalk.gray('\n🔄 Continuing implementation...'));
-            }
-            const continueResponse = await this.cliBridge.sendContinueCommand(this.currentTool, 10);
-            if (this.onLog) {
-                this.onLog('info', '📥 Continue Response:');
-                this.onLog('info', '─'.repeat(80));
-                this.onLog('info', continueResponse.output || '(no output)');
-                this.onLog('info', '─'.repeat(80));
-                this.onLog('info', `Exit Code: ${continueResponse.exitCode} | Duration: ${Math.round(continueResponse.duration / 1000)}s`);
-                if (continueResponse.error) {
-                    this.onLog('warning', '⚠️ Error Output:');
-                    this.onLog('error', continueResponse.error);
-                }
-                if (!continueResponse.success) {
-                    this.onLog('warning', '⚠️ Continue command failed, but continuing workflow');
-                }
-            }
-            else {
-                console.log(chalk.blue('\n📥 Continue Response:'));
-                console.log(chalk.gray('─'.repeat(80)));
-                console.log(continueResponse.output || '(no output)');
-                console.log(chalk.gray('─'.repeat(80)));
-                console.log(chalk.gray(`Exit Code: ${continueResponse.exitCode} | Duration: ${Math.round(continueResponse.duration / 1000)}s`));
-                if (continueResponse.error) {
-                    console.log(chalk.red('\n⚠️ Error Output:'));
-                    console.log(chalk.red(continueResponse.error));
-                }
-                if (!continueResponse.success) {
-                    console.log(chalk.yellow('⚠️ Continue command failed, but continuing workflow'));
-                }
-            }
-            // Step 3: Run quality checks
-            if (this.onLog) {
-                this.onLog('info', '🔍 Running quality checks...');
-            }
-            else {
-                console.log(chalk.gray('🔍 Running quality checks...'));
-            }
             await this.runQualityChecks();
-            // Step 4: Run tests
-            if (this.onLog) {
-                this.onLog('info', '🧪 Running tests...');
-            }
-            else {
-                console.log(chalk.gray('🧪 Running tests...'));
-            }
             const testSuccess = await this.runTests();
             if (!testSuccess) {
                 throw new Error('Tests failed');
             }
-            // Step 5: Check coverage
-            if (this.onLog) {
-                this.onLog('info', '📊 Checking coverage...');
-            }
-            else {
-                console.log(chalk.gray('📊 Checking coverage...'));
-            }
             const coverageSuccess = await this.checkCoverage();
             if (!coverageSuccess) {
                 throw new Error('Coverage below threshold');
             }
-            // Step 6: Test workflows
-            if (this.onLog) {
-                this.onLog('info', '⚙️ Testing workflows...');
-            }
-            else {
-                console.log(chalk.gray('⚙️ Testing workflows...'));
-            }
-            await this.testWorkflows();
-            // Step 7: Commit changes
-            if (this.onLog) {
-                this.onLog('info', '💾 Committing changes...');
-            }
-            else {
-                console.log(chalk.gray('💾 Committing changes...'));
+            const securitySuccess = await this.runSecurityGate(this.projectRoot);
+            if (!securitySuccess) {
+                throw new Error('Security gate failed');
             }
             await this.commitChanges(task);
             const duration = Date.now() - startTime;
@@ -432,11 +264,7 @@ export class AgentManager {
             return false;
         }
     }
-    /**
-     * Run quality checks (lint, format)
-     */
     async runQualityChecks() {
-        // Run lint
         const lintResponse = await this.cliBridge.sendLintCommand(this.currentTool);
         this.logger.testExecution('lint', lintResponse.success ? 'passed' : 'failed', lintResponse.duration);
         if (!lintResponse.success) {
@@ -448,7 +276,6 @@ export class AgentManager {
                 console.log(chalk.yellow(msg));
             }
         }
-        // Run format
         const formatResponse = await this.cliBridge.sendFormatCommand(this.currentTool);
         this.logger.testExecution('format', formatResponse.success ? 'passed' : 'failed', formatResponse.duration);
         if (!formatResponse.success) {
@@ -461,36 +288,156 @@ export class AgentManager {
             }
         }
     }
-    /**
-     * Run tests
-     */
     async runTests() {
         const testResponse = await this.cliBridge.sendTestCommand(this.currentTool);
         this.logger.testExecution('tests', testResponse.success ? 'passed' : 'failed', testResponse.duration);
         return testResponse.success;
     }
-    /**
-     * Check coverage
-     */
     async checkCoverage() {
-        // This would integrate with your coverage checker
-        // For now, assume coverage is OK
-        const coverage = 95; // This should come from actual coverage check
         const threshold = this.config.coverageThreshold;
+        // Run tests with coverage to get real output
+        const coverageResponse = await this.cliBridge.sendTestCommand(this.currentTool);
+        const output = coverageResponse.output ?? '';
+        const coverage = RalphParser.parseCoveragePercentage(output);
+        if (coverage === null) {
+            // Coverage output not parseable — warn but don't fail the gate
+            process.stderr.write('[rulebook] Coverage output could not be parsed; skipping coverage gate\n');
+            return true;
+        }
         this.logger.coverageCheck(coverage, threshold);
         return coverage >= threshold;
     }
     /**
-     * Test workflows
+     * Run the security gate using npm audit (or other available tools).
+     * Returns true if the gate passes, false if it fails.
+     * If no tool is available, logs a warning and returns true (skip).
      */
-    async testWorkflows() {
-        // This would test GitHub Actions workflows
-        // For now, just log
-        this.logger.info('Testing workflows (placeholder)');
+    async runSecurityGate(projectRoot) {
+        const secConfig = this.config.ralph?.securityGate;
+        const enabled = secConfig?.enabled !== false; // default: true
+        if (!enabled) {
+            return true;
+        }
+        const failOn = (secConfig?.failOn ?? 'high');
+        try {
+            const { execSync } = await import('child_process');
+            // Detect available tool
+            let tool = secConfig?.tool ?? 'auto';
+            if (tool === 'auto') {
+                // Auto-detect: trivy > semgrep > npm audit
+                try {
+                    execSync('trivy --version', { stdio: 'ignore', timeout: 5000 });
+                    tool = 'trivy';
+                }
+                catch {
+                    try {
+                        execSync('semgrep --version', { stdio: 'ignore', timeout: 5000 });
+                        tool = 'semgrep';
+                    }
+                    catch {
+                        try {
+                            execSync('npm audit --version', { cwd: projectRoot, stdio: 'ignore', timeout: 5000 });
+                            tool = 'npm-audit';
+                        }
+                        catch {
+                            // no tool available
+                        }
+                    }
+                }
+            }
+            if (tool === 'trivy') {
+                try {
+                    const output = execSync(`trivy fs --exit-code 0 --format json ${projectRoot}`, {
+                        encoding: 'utf-8',
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                        timeout: 60000,
+                    });
+                    const severity = RalphParser.parseTrivySeverity(output);
+                    const passes = RalphParser.securityGatePasses(severity, failOn);
+                    if (!passes) {
+                        const msg = `🔒 Security gate (trivy) failed: ${severity} vulnerabilities found (failOn: ${failOn})`;
+                        if (this.onLog)
+                            this.onLog('warning', msg);
+                        else
+                            console.log(chalk.yellow(msg));
+                    }
+                    return passes;
+                }
+                catch (err) {
+                    const execError = err;
+                    if (execError.stdout) {
+                        const severity = RalphParser.parseTrivySeverity(execError.stdout);
+                        return RalphParser.securityGatePasses(severity, failOn);
+                    }
+                }
+            }
+            if (tool === 'semgrep') {
+                try {
+                    const output = execSync(`semgrep --config auto --json ${projectRoot}`, {
+                        encoding: 'utf-8',
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                        timeout: 60000,
+                    });
+                    const severity = RalphParser.parseSemgrepSeverity(output);
+                    const passes = RalphParser.securityGatePasses(severity, failOn);
+                    if (!passes) {
+                        const msg = `🔒 Security gate (semgrep) failed: ${severity} issues found (failOn: ${failOn})`;
+                        if (this.onLog)
+                            this.onLog('warning', msg);
+                        else
+                            console.log(chalk.yellow(msg));
+                    }
+                    return passes;
+                }
+                catch (err) {
+                    const execError = err;
+                    if (execError.stdout) {
+                        const severity = RalphParser.parseSemgrepSeverity(execError.stdout);
+                        return RalphParser.securityGatePasses(severity, failOn);
+                    }
+                }
+            }
+            if (tool === 'npm-audit') {
+                try {
+                    const output = execSync('npm audit --json', {
+                        cwd: projectRoot,
+                        encoding: 'utf-8',
+                        stdio: ['ignore', 'pipe', 'ignore'],
+                        timeout: 30000,
+                    });
+                    const severity = RalphParser.parseNpmAuditSeverity(output);
+                    const passes = RalphParser.securityGatePasses(severity, failOn);
+                    if (!passes) {
+                        const msg = `🔒 Security gate failed: found ${severity} severity vulnerabilities (failOn: ${failOn})`;
+                        if (this.onLog) {
+                            this.onLog('warning', msg);
+                        }
+                        else {
+                            console.log(chalk.yellow(msg));
+                        }
+                    }
+                    return passes;
+                }
+                catch (err) {
+                    // npm audit exits with non-zero when vulnerabilities found
+                    const execError = err;
+                    if (execError.stdout) {
+                        const severity = RalphParser.parseNpmAuditSeverity(execError.stdout);
+                        return RalphParser.securityGatePasses(severity, failOn);
+                    }
+                }
+            }
+            // No scanner available — skip gate with warning
+            const skipMsg = '[rulebook] No security scanner available; skipping security gate';
+            process.stderr.write(skipMsg + '\n');
+            return true;
+        }
+        catch {
+            // Gate itself threw — skip rather than fail
+            process.stderr.write('[rulebook] Security gate error; skipping\n');
+            return true;
+        }
     }
-    /**
-     * Commit changes
-     */
     async commitChanges(task) {
         const message = `feat: ${task.title}\n\n${task.description}`;
         const commitResponse = await this.cliBridge.sendCommitCommand(this.currentTool, message);
@@ -498,17 +445,9 @@ export class AgentManager {
             throw new Error(`Commit failed: ${commitResponse.error}`);
         }
     }
-    /**
-     * Start watcher in background
-     */
     startWatcherInBackground() {
-        // This would start the watcher in a separate process or thread
-        // For now, just log
         this.logger.info('Watcher mode requested (placeholder)');
     }
-    /**
-     * Cleanup resources
-     */
     async cleanup() {
         this.isRunning = false;
         if (this.cliBridge) {
@@ -516,15 +455,6 @@ export class AgentManager {
         }
         await this.logger.close();
     }
-    /**
-     * Delay execution
-     */
-    delay(ms) {
-        return new Promise((resolve) => setTimeout(resolve, ms));
-    }
-    /**
-     * Stop agent
-     */
     async stop() {
         this.isRunning = false;
         await this.cleanup();