@imdeadpool/guardex 5.0.11 → 5.0.13

package/templates/scripts/codex-agent.sh

@@ -12,6 +12,8 @@ AUTO_CLEANUP_RAW="${MUSAFETY_CODEX_AUTO_CLEANUP:-true}"
 AUTO_WAIT_FOR_MERGE_RAW="${MUSAFETY_CODEX_WAIT_FOR_MERGE:-true}"
 OPENSPEC_AUTO_INIT_RAW="${MUSAFETY_OPENSPEC_AUTO_INIT:-true}"
 OPENSPEC_PLAN_SLUG_OVERRIDE="${MUSAFETY_OPENSPEC_PLAN_SLUG:-}"
+OPENSPEC_CHANGE_SLUG_OVERRIDE="${MUSAFETY_OPENSPEC_CHANGE_SLUG:-}"
+OPENSPEC_CAPABILITY_SLUG_OVERRIDE="${MUSAFETY_OPENSPEC_CAPABILITY_SLUG:-}"
 
 normalize_bool() {
   local raw="${1:-}"
@@ -150,6 +152,27 @@ resolve_openspec_plan_slug() {
   sanitize_slug "${branch_name//\//-}" "$task_slug"
 }
 
+resolve_openspec_change_slug() {
+  local branch_name="$1"
+  local task_slug
+  task_slug="$(sanitize_slug "$TASK_NAME" "task")"
+  if [[ -n "$OPENSPEC_CHANGE_SLUG_OVERRIDE" ]]; then
+    sanitize_slug "$OPENSPEC_CHANGE_SLUG_OVERRIDE" "$task_slug"
+    return 0
+  fi
+  sanitize_slug "${branch_name//\//-}" "$task_slug"
+}
+
+resolve_openspec_capability_slug() {
+  local task_slug
+  task_slug="$(sanitize_slug "$TASK_NAME" "task")"
+  if [[ -n "$OPENSPEC_CAPABILITY_SLUG_OVERRIDE" ]]; then
+    sanitize_slug "$OPENSPEC_CAPABILITY_SLUG_OVERRIDE" "$task_slug"
+    return 0
+  fi
+  sanitize_slug "$task_slug" "general-behavior"
+}
+
 hydrate_local_helper_in_worktree() {
   local worktree="$1"
   local relative_path="$2"
@@ -192,13 +215,6 @@ resolve_start_base_branch() {
     return 0
   fi
 
-  local current_branch
-  current_branch="$(git -C "$repo_root" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
-  if [[ -n "$current_branch" && "$current_branch" != "HEAD" ]]; then
-    printf '%s' "$current_branch"
-    return 0
-  fi
-
   printf 'dev'
 }
 
@@ -338,30 +354,20 @@ has_origin_remote() {
 }
 
 resolve_worktree_base_branch() {
-  local wt="$1"
+  local _wt="$1"
   if [[ "$BASE_BRANCH_EXPLICIT" -eq 1 && -n "$BASE_BRANCH" ]]; then
     printf '%s' "$BASE_BRANCH"
     return 0
   fi
 
-  local branch
-  branch="$(git -C "$wt" rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
-  if [[ -z "$branch" || "$branch" == "HEAD" ]]; then
-    return 0
-  fi
-
-  local stored_base
-  stored_base="$(git -C "$repo_root" config --get "branch.${branch}.musafetyBase" || true)"
-  if [[ -n "$stored_base" ]]; then
-    printf '%s' "$stored_base"
-    return 0
-  fi
-
   local configured_base
   configured_base="$(git -C "$repo_root" config --get multiagent.baseBranch || true)"
   if [[ -n "$configured_base" ]]; then
     printf '%s' "$configured_base"
+    return 0
   fi
+
+  printf 'dev'
 }
 
 sync_worktree_with_base() {
@@ -443,6 +449,43 @@ ensure_openspec_plan_workspace() {
   echo "[codex-agent] OpenSpec plan workspace: ${wt}/openspec/plan/${plan_slug}"
 }
 
+ensure_openspec_change_workspace() {
+  local wt="$1"
+  local branch="$2"
+
+  if [[ "$OPENSPEC_AUTO_INIT" -ne 1 ]]; then
+    return 0
+  fi
+
+  hydrate_local_helper_in_worktree "$wt" "scripts/openspec/init-change-workspace.sh"
+
+  local openspec_script="${wt}/scripts/openspec/init-change-workspace.sh"
+  if [[ ! -f "$openspec_script" ]]; then
+    echo "[codex-agent] Missing OpenSpec change init script in sandbox: ${openspec_script}" >&2
+    echo "[codex-agent] Run 'gx setup --target ${repo_root}' and retry." >&2
+    return 1
+  fi
+  if [[ ! -x "$openspec_script" ]]; then
+    chmod +x "$openspec_script" 2>/dev/null || true
+  fi
+
+  local change_slug capability_slug init_output=""
+  change_slug="$(resolve_openspec_change_slug "$branch")"
+  capability_slug="$(resolve_openspec_capability_slug)"
+  if ! init_output="$(
+    cd "$wt"
+    bash "scripts/openspec/init-change-workspace.sh" "$change_slug" "$capability_slug" 2>&1
+  )"; then
+    printf '%s\n' "$init_output" >&2
+    echo "[codex-agent] OpenSpec workspace initialization failed for change '${change_slug}'." >&2
+    return 1
+  fi
+  if [[ -n "$init_output" ]]; then
+    printf '%s\n' "$init_output"
+  fi
+  echo "[codex-agent] OpenSpec change workspace: ${wt}/openspec/changes/${change_slug}"
+}
+
 worktree_has_changes() {
   local wt="$1"
   if ! git -C "$wt" diff --quiet -- . ":(exclude).omx/state/agent-file-locks.json"; then
@@ -598,12 +641,18 @@ looks_like_conflict_failure() {
 run_finish_flow() {
   local wt="$1"
   local branch="$2"
+  local finish_base_branch=""
   local finish_output=""
   local -a finish_args
 
   finish_args=(--branch "$branch")
-  if [[ "$BASE_BRANCH_EXPLICIT" -eq 1 ]]; then
-    finish_args+=(--base "$BASE_BRANCH")
+  if [[ "$BASE_BRANCH_EXPLICIT" -eq 1 && -n "$BASE_BRANCH" ]]; then
+    finish_base_branch="$BASE_BRANCH"
+  else
+    finish_base_branch="$(resolve_worktree_base_branch "$wt")"
+  fi
+  if [[ -n "$finish_base_branch" ]]; then
+    finish_args+=(--base "$finish_base_branch")
   fi
   if [[ "$AUTO_CLEANUP" -eq 1 ]]; then
     finish_args+=(--cleanup)
@@ -613,9 +662,11 @@ run_finish_flow() {
   fi
 
   if has_origin_remote; then
-    if command -v gh >/dev/null 2>&1 || command -v "${MUSAFETY_GH_BIN:-gh}" >/dev/null 2>&1; then
-      finish_args+=(--via-pr)
+    if ! command -v "${MUSAFETY_GH_BIN:-gh}" >/dev/null 2>&1 && ! command -v gh >/dev/null 2>&1; then
+      echo "[codex-agent] Auto-finish requires GitHub CLI for PR flow; command not found: ${MUSAFETY_GH_BIN:-gh}" >&2
+      return 2
     fi
+    finish_args+=(--via-pr)
   else
     echo "[codex-agent] No origin remote detected; skipping auto-finish merge/PR pipeline." >&2
     return 2
@@ -631,7 +682,7 @@ run_finish_flow() {
   if [[ "$AUTO_REVIEW_ON_CONFLICT" -eq 1 ]] && looks_like_conflict_failure "$finish_output"; then
     echo "[codex-agent] Auto-finish hit conflicts. Launching Codex conflict-review pass in sandbox..." >&2
     local review_prompt
-    review_prompt="Resolve git conflicts for branch ${branch} against ${BASE_BRANCH:-base branch}, then commit the resolution in this sandbox worktree and exit."
+    review_prompt="Resolve git conflicts for branch ${branch} against ${finish_base_branch:-dev}, then commit the resolution in this sandbox worktree and exit."
 
     (
       cd "$wt"
@@ -665,6 +716,10 @@ if [[ -z "$worktree_branch" || "$worktree_branch" == "HEAD" ]]; then
   exit 1
 fi
 
+if ! ensure_openspec_change_workspace "$worktree_path" "$worktree_branch"; then
+  exit 1
+fi
+
 if ! ensure_openspec_plan_workspace "$worktree_path" "$worktree_branch"; then
   exit 1
 fi
@@ -735,7 +790,7 @@ else
     if [[ "$auto_finish_completed" -eq 1 ]]; then
       echo "[codex-agent] Branch kept intentionally. Cleanup on demand: gx cleanup --branch \"${worktree_branch}\""
     else
-      echo "[codex-agent] If finished, merge with: bash scripts/agent-branch-finish.sh --branch \"${worktree_branch}\" --via-pr"
+      echo "[codex-agent] If finished, merge with: bash scripts/agent-branch-finish.sh --branch \"${worktree_branch}\" --base dev --via-pr --wait-for-merge"
       echo "[codex-agent] Cleanup on demand: gx cleanup --branch \"${worktree_branch}\""
     fi
   fi

package/templates/scripts/openspec/init-change-workspace.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 1 || $# -gt 2 ]]; then
+  echo "Usage: $0 <change-slug> [capability-slug]"
+  echo "Example: $0 add-dashboard-live-usage runtime-migration"
+  exit 1
+fi
+
+CHANGE_SLUG="$1"
+CAPABILITY_SLUG="${2:-$CHANGE_SLUG}"
+
+if [[ "$CHANGE_SLUG" =~ [^a-z0-9-] ]]; then
+  echo "Error: change slug must be kebab-case (lowercase letters, numbers, hyphens)."
+  exit 1
+fi
+
+if [[ "$CAPABILITY_SLUG" =~ [^a-z0-9-] ]]; then
+  echo "Error: capability slug must be kebab-case (lowercase letters, numbers, hyphens)."
+  exit 1
+fi
+
+CHANGE_DIR="openspec/changes/${CHANGE_SLUG}"
+SPEC_DIR="${CHANGE_DIR}/specs/${CAPABILITY_SLUG}"
+TODAY="$(date -u +%Y-%m-%d)"
+
+mkdir -p "$SPEC_DIR"
+
+if [[ ! -f "${CHANGE_DIR}/.openspec.yaml" ]]; then
+  cat > "${CHANGE_DIR}/.openspec.yaml" <<YAMLEOF
+schema: spec-driven
+created: ${TODAY}
+YAMLEOF
+fi
+
+if [[ ! -f "${CHANGE_DIR}/proposal.md" ]]; then
+  cat > "${CHANGE_DIR}/proposal.md" <<PROPOSALEOF
+## Why
+
+- TODO: describe the user/problem outcome this change addresses.
+
+## What Changes
+
+- TODO: summarize the intended behavior and scope.
+
+## Impact
+
+- TODO: call out risks, rollout notes, and affected surfaces.
+PROPOSALEOF
+fi
+
+if [[ ! -f "${CHANGE_DIR}/tasks.md" ]]; then
+  cat > "${CHANGE_DIR}/tasks.md" <<TASKSEOF
+## 1. Specification
+
+- [ ] 1.1 Finalize proposal scope and acceptance criteria for \`${CHANGE_SLUG}\`.
+- [ ] 1.2 Define normative requirements in \`specs/${CAPABILITY_SLUG}/spec.md\`.
+
+## 2. Implementation
+
+- [ ] 2.1 Implement scoped behavior changes.
+- [ ] 2.2 Add/update focused regression coverage.
+
+## 3. Verification
+
+- [ ] 3.1 Run targeted project verification commands.
+- [ ] 3.2 Run \`openspec validate ${CHANGE_SLUG} --type change --strict\`.
+- [ ] 3.3 Run \`openspec validate --specs\`.
+TASKSEOF
+fi
+
+if [[ ! -f "${SPEC_DIR}/spec.md" ]]; then
+  cat > "${SPEC_DIR}/spec.md" <<SPECEOF
+## ADDED Requirements
+
+### Requirement: ${CAPABILITY_SLUG} behavior
+The system SHALL enforce ${CAPABILITY_SLUG} behavior as defined by this change.
+
+#### Scenario: Baseline acceptance
+- **WHEN** ${CAPABILITY_SLUG} behavior is exercised
+- **THEN** the expected outcome is produced
+- **AND** regressions are covered by tests.
+SPECEOF
+fi
+
+echo "[guardex] OpenSpec change workspace ready: ${CHANGE_DIR}"
+echo "[guardex] OpenSpec change spec scaffold: ${SPEC_DIR}/spec.md"