@jaguilar87/gaia-ops 4.4.0 → 4.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (371) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +12 -3
  3. package/ARCHITECTURE.md +9 -8
  4. package/CHANGELOG.md +34 -0
  5. package/README.md +43 -11
  6. package/agents/terraform-architect.md +1 -1
  7. package/bin/README.md +2 -2
  8. package/bin/gaia-doctor.js +18 -5
  9. package/bin/gaia-history.js +0 -1
  10. package/bin/gaia-metrics.js +2 -2
  11. package/bin/gaia-scan.py +23 -1
  12. package/bin/gaia-update.js +346 -54
  13. package/bin/pre-publish-validate.js +33 -10
  14. package/commands/gaia.md +37 -0
  15. package/config/README.md +3 -9
  16. package/config/context-contracts.json +47 -15
  17. package/config/surface-routing.json +9 -1
  18. package/dist/gaia-ops/.claude-plugin/plugin.json +22 -0
  19. package/dist/gaia-ops/agents/cloud-troubleshooter.md +73 -0
  20. package/dist/gaia-ops/agents/devops-developer.md +57 -0
  21. package/dist/gaia-ops/agents/gaia-system.md +58 -0
  22. package/dist/gaia-ops/agents/gitops-operator.md +60 -0
  23. package/dist/gaia-ops/agents/speckit-planner.md +71 -0
  24. package/dist/gaia-ops/agents/terraform-architect.md +60 -0
  25. package/dist/gaia-ops/commands/gaia.md +37 -0
  26. package/dist/gaia-ops/config/README.md +58 -0
  27. package/dist/gaia-ops/config/cloud/aws.json +140 -0
  28. package/dist/gaia-ops/config/cloud/gcp.json +145 -0
  29. package/dist/gaia-ops/config/context-contracts.json +131 -0
  30. package/dist/gaia-ops/config/git_standards.json +72 -0
  31. package/dist/gaia-ops/config/surface-routing.json +197 -0
  32. package/dist/gaia-ops/config/universal-rules.json +10 -0
  33. package/dist/gaia-ops/hooks/adapters/__init__.py +52 -0
  34. package/dist/gaia-ops/hooks/adapters/base.py +219 -0
  35. package/dist/gaia-ops/hooks/adapters/channel.py +17 -0
  36. package/dist/gaia-ops/hooks/adapters/claude_code.py +1477 -0
  37. package/dist/gaia-ops/hooks/adapters/types.py +194 -0
  38. package/dist/gaia-ops/hooks/adapters/utils.py +25 -0
  39. package/dist/gaia-ops/hooks/hooks.json +126 -0
  40. package/dist/gaia-ops/hooks/modules/__init__.py +15 -0
  41. package/dist/gaia-ops/hooks/modules/agents/__init__.py +29 -0
  42. package/dist/gaia-ops/hooks/modules/agents/contract_validator.py +647 -0
  43. package/dist/gaia-ops/hooks/modules/agents/response_contract.py +496 -0
  44. package/dist/gaia-ops/hooks/modules/agents/skill_injection_verifier.py +124 -0
  45. package/dist/gaia-ops/hooks/modules/agents/task_info_builder.py +74 -0
  46. package/dist/gaia-ops/hooks/modules/agents/transcript_analyzer.py +458 -0
  47. package/dist/gaia-ops/hooks/modules/agents/transcript_reader.py +152 -0
  48. package/dist/gaia-ops/hooks/modules/audit/__init__.py +28 -0
  49. package/dist/gaia-ops/hooks/modules/audit/event_detector.py +168 -0
  50. package/dist/gaia-ops/hooks/modules/audit/logger.py +131 -0
  51. package/dist/gaia-ops/hooks/modules/audit/metrics.py +134 -0
  52. package/dist/gaia-ops/hooks/modules/audit/workflow_auditor.py +576 -0
  53. package/dist/gaia-ops/hooks/modules/audit/workflow_recorder.py +296 -0
  54. package/dist/gaia-ops/hooks/modules/context/__init__.py +11 -0
  55. package/dist/gaia-ops/hooks/modules/context/anchor_tracker.py +317 -0
  56. package/dist/gaia-ops/hooks/modules/context/compact_context_builder.py +215 -0
  57. package/dist/gaia-ops/hooks/modules/context/context_cache.py +129 -0
  58. package/dist/gaia-ops/hooks/modules/context/context_freshness.py +145 -0
  59. package/dist/gaia-ops/hooks/modules/context/context_injector.py +427 -0
  60. package/dist/gaia-ops/hooks/modules/context/context_writer.py +518 -0
  61. package/dist/gaia-ops/hooks/modules/context/contracts_loader.py +161 -0
  62. package/dist/gaia-ops/hooks/modules/core/__init__.py +40 -0
  63. package/dist/gaia-ops/hooks/modules/core/hook_entry.py +78 -0
  64. package/dist/gaia-ops/hooks/modules/core/paths.py +160 -0
  65. package/dist/gaia-ops/hooks/modules/core/plugin_mode.py +149 -0
  66. package/dist/gaia-ops/hooks/modules/core/plugin_setup.py +558 -0
  67. package/dist/gaia-ops/hooks/modules/core/state.py +179 -0
  68. package/dist/gaia-ops/hooks/modules/core/stdin.py +24 -0
  69. package/dist/gaia-ops/hooks/modules/events/__init__.py +1 -0
  70. package/dist/gaia-ops/hooks/modules/events/event_writer.py +210 -0
  71. package/dist/gaia-ops/hooks/modules/identity/__init__.py +0 -0
  72. package/dist/gaia-ops/hooks/modules/identity/identity_provider.py +21 -0
  73. package/dist/gaia-ops/hooks/modules/identity/ops_identity.py +34 -0
  74. package/dist/gaia-ops/hooks/modules/identity/security_identity.py +10 -0
  75. package/dist/gaia-ops/hooks/modules/memory/__init__.py +8 -0
  76. package/dist/gaia-ops/hooks/modules/memory/episode_writer.py +227 -0
  77. package/dist/gaia-ops/hooks/modules/orchestrator/__init__.py +1 -0
  78. package/dist/gaia-ops/hooks/modules/orchestrator/delegate_mode.py +128 -0
  79. package/dist/gaia-ops/hooks/modules/scanning/__init__.py +8 -0
  80. package/dist/gaia-ops/hooks/modules/scanning/scan_trigger.py +84 -0
  81. package/dist/gaia-ops/hooks/modules/security/__init__.py +89 -0
  82. package/dist/gaia-ops/hooks/modules/security/approval_cleanup.py +87 -0
  83. package/dist/gaia-ops/hooks/modules/security/approval_constants.py +23 -0
  84. package/dist/gaia-ops/hooks/modules/security/approval_grants.py +912 -0
  85. package/dist/gaia-ops/hooks/modules/security/approval_messages.py +71 -0
  86. package/dist/gaia-ops/hooks/modules/security/approval_scopes.py +153 -0
  87. package/dist/gaia-ops/hooks/modules/security/blocked_commands.py +584 -0
  88. package/dist/gaia-ops/hooks/modules/security/blocked_message_formatter.py +86 -0
  89. package/dist/gaia-ops/hooks/modules/security/command_semantics.py +130 -0
  90. package/dist/gaia-ops/hooks/modules/security/gitops_validator.py +179 -0
  91. package/dist/gaia-ops/hooks/modules/security/mutative_verbs.py +850 -0
  92. package/dist/gaia-ops/hooks/modules/security/prompt_validator.py +40 -0
  93. package/dist/gaia-ops/hooks/modules/security/tiers.py +196 -0
  94. package/dist/gaia-ops/hooks/modules/session/__init__.py +10 -0
  95. package/dist/gaia-ops/hooks/modules/session/session_context_writer.py +100 -0
  96. package/dist/gaia-ops/hooks/modules/session/session_event_injector.py +158 -0
  97. package/dist/gaia-ops/hooks/modules/session/session_manager.py +31 -0
  98. package/dist/gaia-ops/hooks/modules/tools/__init__.py +25 -0
  99. package/dist/gaia-ops/hooks/modules/tools/bash_validator.py +708 -0
  100. package/dist/gaia-ops/hooks/modules/tools/cloud_pipe_validator.py +181 -0
  101. package/dist/gaia-ops/hooks/modules/tools/hook_response.py +55 -0
  102. package/dist/gaia-ops/hooks/modules/tools/shell_parser.py +227 -0
  103. package/dist/gaia-ops/hooks/modules/tools/task_validator.py +283 -0
  104. package/dist/gaia-ops/hooks/modules/validation/__init__.py +23 -0
  105. package/dist/gaia-ops/hooks/modules/validation/commit_validator.py +380 -0
  106. package/dist/gaia-ops/hooks/post_compact.py +43 -0
  107. package/dist/gaia-ops/hooks/post_tool_use.py +54 -0
  108. package/dist/gaia-ops/hooks/pre_tool_use.py +383 -0
  109. package/dist/gaia-ops/hooks/session_start.py +69 -0
  110. package/dist/gaia-ops/hooks/stop_hook.py +69 -0
  111. package/dist/gaia-ops/hooks/subagent_start.py +71 -0
  112. package/dist/gaia-ops/hooks/subagent_stop.py +288 -0
  113. package/dist/gaia-ops/hooks/task_completed.py +70 -0
  114. package/dist/gaia-ops/hooks/user_prompt_submit.py +177 -0
  115. package/dist/gaia-ops/settings.json +72 -0
  116. package/dist/gaia-ops/skills/README.md +109 -0
  117. package/dist/gaia-ops/skills/agent-protocol/SKILL.md +105 -0
  118. package/dist/gaia-ops/skills/agent-protocol/examples.md +170 -0
  119. package/dist/gaia-ops/skills/agent-response/SKILL.md +53 -0
  120. package/dist/gaia-ops/skills/approval/SKILL.md +85 -0
  121. package/dist/gaia-ops/skills/approval/examples.md +140 -0
  122. package/dist/gaia-ops/skills/approval/reference.md +57 -0
  123. package/dist/gaia-ops/skills/command-execution/SKILL.md +64 -0
  124. package/dist/gaia-ops/skills/command-execution/reference.md +83 -0
  125. package/dist/gaia-ops/skills/context-updater/SKILL.md +76 -0
  126. package/dist/gaia-ops/skills/context-updater/examples.md +71 -0
  127. package/dist/gaia-ops/skills/developer-patterns/SKILL.md +93 -0
  128. package/dist/gaia-ops/skills/developer-patterns/reference.md +112 -0
  129. package/dist/gaia-ops/skills/execution/SKILL.md +66 -0
  130. package/dist/gaia-ops/skills/fast-queries/SKILL.md +47 -0
  131. package/dist/gaia-ops/skills/gaia-patterns/SKILL.md +92 -0
  132. package/dist/gaia-ops/skills/gaia-patterns/reference.md +22 -0
  133. package/dist/gaia-ops/skills/git-conventions/SKILL.md +48 -0
  134. package/dist/gaia-ops/skills/gitops-patterns/SKILL.md +73 -0
  135. package/dist/gaia-ops/skills/gitops-patterns/reference.md +183 -0
  136. package/dist/gaia-ops/skills/investigation/SKILL.md +77 -0
  137. package/dist/gaia-ops/skills/orchestrator-approval/SKILL.md +64 -0
  138. package/dist/gaia-ops/skills/reference.md +134 -0
  139. package/dist/gaia-ops/skills/security-tiers/SKILL.md +61 -0
  140. package/dist/gaia-ops/skills/security-tiers/destructive-commands-reference.md +623 -0
  141. package/dist/gaia-ops/skills/security-tiers/reference.md +39 -0
  142. package/dist/gaia-ops/skills/skill-creation/SKILL.md +119 -0
  143. package/dist/gaia-ops/skills/specification/SKILL.md +186 -0
  144. package/dist/gaia-ops/skills/speckit-workflow/SKILL.md +165 -0
  145. package/dist/gaia-ops/skills/speckit-workflow/reference.md +117 -0
  146. package/dist/gaia-ops/skills/terraform-patterns/SKILL.md +63 -0
  147. package/dist/gaia-ops/skills/terraform-patterns/reference.md +93 -0
  148. package/dist/gaia-ops/speckit/README.md +516 -0
  149. package/dist/gaia-ops/speckit/scripts/.gitkeep +0 -0
  150. package/dist/gaia-ops/speckit/templates/adr-template.md +118 -0
  151. package/dist/gaia-ops/speckit/templates/agent-file-template.md +23 -0
  152. package/dist/gaia-ops/speckit/templates/plan-template.md +227 -0
  153. package/dist/gaia-ops/speckit/templates/spec-template.md +140 -0
  154. package/dist/gaia-ops/speckit/templates/tasks-template.md +257 -0
  155. package/dist/gaia-ops/tools/context/README.md +132 -0
  156. package/dist/gaia-ops/tools/context/__init__.py +42 -0
  157. package/dist/gaia-ops/tools/context/_paths.py +20 -0
  158. package/dist/gaia-ops/tools/context/context_provider.py +476 -0
  159. package/dist/gaia-ops/tools/context/context_section_reader.py +330 -0
  160. package/dist/gaia-ops/tools/context/deep_merge.py +159 -0
  161. package/dist/gaia-ops/tools/context/pending_updates.py +760 -0
  162. package/dist/gaia-ops/tools/context/surface_router.py +278 -0
  163. package/dist/gaia-ops/tools/fast-queries/README.md +65 -0
  164. package/dist/gaia-ops/tools/fast-queries/__init__.py +30 -0
  165. package/dist/gaia-ops/tools/fast-queries/appservices/quicktriage_devops_developer.sh +75 -0
  166. package/dist/gaia-ops/tools/fast-queries/cloud/aws/quicktriage_aws_troubleshooter.sh +32 -0
  167. package/dist/gaia-ops/tools/fast-queries/cloud/gcp/quicktriage_gcp_troubleshooter.sh +88 -0
  168. package/dist/gaia-ops/tools/fast-queries/gitops/quicktriage_gitops_operator.sh +48 -0
  169. package/dist/gaia-ops/tools/fast-queries/run_triage.sh +59 -0
  170. package/dist/gaia-ops/tools/fast-queries/terraform/quicktriage_terraform_architect.sh +80 -0
  171. package/dist/gaia-ops/tools/gaia_simulator/__init__.py +33 -0
  172. package/dist/gaia-ops/tools/gaia_simulator/cli.py +354 -0
  173. package/dist/gaia-ops/tools/gaia_simulator/extractor.py +457 -0
  174. package/dist/gaia-ops/tools/gaia_simulator/reporter.py +258 -0
  175. package/dist/gaia-ops/tools/gaia_simulator/routing_simulator.py +334 -0
  176. package/dist/gaia-ops/tools/gaia_simulator/runner.py +539 -0
  177. package/dist/gaia-ops/tools/gaia_simulator/skills_mapper.py +262 -0
  178. package/dist/gaia-ops/tools/memory/README.md +0 -0
  179. package/dist/gaia-ops/tools/memory/__init__.py +20 -0
  180. package/dist/gaia-ops/tools/memory/episodic.py +1196 -0
  181. package/dist/gaia-ops/tools/persist_transcript_analysis.py +85 -0
  182. package/dist/gaia-ops/tools/review/__init__.py +1 -0
  183. package/dist/gaia-ops/tools/review/review_engine.py +157 -0
  184. package/dist/gaia-ops/tools/scan/__init__.py +35 -0
  185. package/dist/gaia-ops/tools/scan/config.py +247 -0
  186. package/dist/gaia-ops/tools/scan/merge.py +212 -0
  187. package/dist/gaia-ops/tools/scan/orchestrator.py +549 -0
  188. package/dist/gaia-ops/tools/scan/registry.py +127 -0
  189. package/dist/gaia-ops/tools/scan/scanners/__init__.py +18 -0
  190. package/dist/gaia-ops/tools/scan/scanners/base.py +137 -0
  191. package/dist/gaia-ops/tools/scan/scanners/environment.py +324 -0
  192. package/dist/gaia-ops/tools/scan/scanners/git.py +570 -0
  193. package/dist/gaia-ops/tools/scan/scanners/infrastructure.py +875 -0
  194. package/dist/gaia-ops/tools/scan/scanners/orchestration.py +600 -0
  195. package/dist/gaia-ops/tools/scan/scanners/stack.py +1085 -0
  196. package/dist/gaia-ops/tools/scan/scanners/tools.py +260 -0
  197. package/dist/gaia-ops/tools/scan/setup.py +753 -0
  198. package/dist/gaia-ops/tools/scan/tests/__init__.py +1 -0
  199. package/dist/gaia-ops/tools/scan/tests/conftest.py +796 -0
  200. package/dist/gaia-ops/tools/scan/tests/test_environment.py +323 -0
  201. package/dist/gaia-ops/tools/scan/tests/test_git.py +419 -0
  202. package/dist/gaia-ops/tools/scan/tests/test_infrastructure.py +382 -0
  203. package/dist/gaia-ops/tools/scan/tests/test_integration.py +920 -0
  204. package/dist/gaia-ops/tools/scan/tests/test_merge.py +269 -0
  205. package/dist/gaia-ops/tools/scan/tests/test_orchestration.py +304 -0
  206. package/dist/gaia-ops/tools/scan/tests/test_stack.py +604 -0
  207. package/dist/gaia-ops/tools/scan/tests/test_tools.py +349 -0
  208. package/dist/gaia-ops/tools/scan/ui.py +624 -0
  209. package/dist/gaia-ops/tools/scan/verify.py +266 -0
  210. package/dist/gaia-ops/tools/scan/walk.py +118 -0
  211. package/dist/gaia-ops/tools/scan/workspace.py +85 -0
  212. package/dist/gaia-ops/tools/validation/README.md +244 -0
  213. package/dist/gaia-ops/tools/validation/__init__.py +17 -0
  214. package/dist/gaia-ops/tools/validation/approval_gate.py +321 -0
  215. package/dist/gaia-ops/tools/validation/validate_skills.py +189 -0
  216. package/dist/gaia-security/.claude-plugin/plugin.json +22 -0
  217. package/dist/gaia-security/config/universal-rules.json +10 -0
  218. package/dist/gaia-security/hooks/adapters/__init__.py +52 -0
  219. package/dist/gaia-security/hooks/adapters/base.py +219 -0
  220. package/dist/gaia-security/hooks/adapters/channel.py +17 -0
  221. package/dist/gaia-security/hooks/adapters/claude_code.py +1477 -0
  222. package/dist/gaia-security/hooks/adapters/types.py +194 -0
  223. package/dist/gaia-security/hooks/adapters/utils.py +25 -0
  224. package/dist/gaia-security/hooks/hooks.json +57 -0
  225. package/dist/gaia-security/hooks/modules/__init__.py +15 -0
  226. package/dist/gaia-security/hooks/modules/agents/__init__.py +29 -0
  227. package/dist/gaia-security/hooks/modules/agents/contract_validator.py +647 -0
  228. package/dist/gaia-security/hooks/modules/agents/response_contract.py +496 -0
  229. package/dist/gaia-security/hooks/modules/agents/skill_injection_verifier.py +124 -0
  230. package/dist/gaia-security/hooks/modules/agents/task_info_builder.py +74 -0
  231. package/dist/gaia-security/hooks/modules/agents/transcript_analyzer.py +458 -0
  232. package/dist/gaia-security/hooks/modules/agents/transcript_reader.py +152 -0
  233. package/dist/gaia-security/hooks/modules/audit/__init__.py +28 -0
  234. package/dist/gaia-security/hooks/modules/audit/event_detector.py +168 -0
  235. package/dist/gaia-security/hooks/modules/audit/logger.py +131 -0
  236. package/dist/gaia-security/hooks/modules/audit/metrics.py +134 -0
  237. package/dist/gaia-security/hooks/modules/audit/workflow_auditor.py +576 -0
  238. package/dist/gaia-security/hooks/modules/audit/workflow_recorder.py +296 -0
  239. package/dist/gaia-security/hooks/modules/context/__init__.py +11 -0
  240. package/dist/gaia-security/hooks/modules/context/anchor_tracker.py +317 -0
  241. package/dist/gaia-security/hooks/modules/context/compact_context_builder.py +215 -0
  242. package/dist/gaia-security/hooks/modules/context/context_cache.py +129 -0
  243. package/dist/gaia-security/hooks/modules/context/context_freshness.py +145 -0
  244. package/dist/gaia-security/hooks/modules/context/context_injector.py +427 -0
  245. package/dist/gaia-security/hooks/modules/context/context_writer.py +518 -0
  246. package/dist/gaia-security/hooks/modules/context/contracts_loader.py +161 -0
  247. package/dist/gaia-security/hooks/modules/core/__init__.py +40 -0
  248. package/dist/gaia-security/hooks/modules/core/hook_entry.py +78 -0
  249. package/dist/gaia-security/hooks/modules/core/paths.py +160 -0
  250. package/dist/gaia-security/hooks/modules/core/plugin_mode.py +149 -0
  251. package/dist/gaia-security/hooks/modules/core/plugin_setup.py +558 -0
  252. package/dist/gaia-security/hooks/modules/core/state.py +179 -0
  253. package/dist/gaia-security/hooks/modules/core/stdin.py +24 -0
  254. package/dist/gaia-security/hooks/modules/events/__init__.py +1 -0
  255. package/dist/gaia-security/hooks/modules/events/event_writer.py +210 -0
  256. package/dist/gaia-security/hooks/modules/identity/__init__.py +0 -0
  257. package/dist/gaia-security/hooks/modules/identity/identity_provider.py +21 -0
  258. package/dist/gaia-security/hooks/modules/identity/ops_identity.py +34 -0
  259. package/dist/gaia-security/hooks/modules/identity/security_identity.py +10 -0
  260. package/dist/gaia-security/hooks/modules/memory/__init__.py +8 -0
  261. package/dist/gaia-security/hooks/modules/memory/episode_writer.py +227 -0
  262. package/dist/gaia-security/hooks/modules/orchestrator/__init__.py +1 -0
  263. package/dist/gaia-security/hooks/modules/orchestrator/delegate_mode.py +128 -0
  264. package/dist/gaia-security/hooks/modules/scanning/__init__.py +8 -0
  265. package/dist/gaia-security/hooks/modules/scanning/scan_trigger.py +84 -0
  266. package/dist/gaia-security/hooks/modules/security/__init__.py +89 -0
  267. package/dist/gaia-security/hooks/modules/security/approval_cleanup.py +87 -0
  268. package/dist/gaia-security/hooks/modules/security/approval_constants.py +23 -0
  269. package/dist/gaia-security/hooks/modules/security/approval_grants.py +912 -0
  270. package/dist/gaia-security/hooks/modules/security/approval_messages.py +71 -0
  271. package/dist/gaia-security/hooks/modules/security/approval_scopes.py +153 -0
  272. package/dist/gaia-security/hooks/modules/security/blocked_commands.py +584 -0
  273. package/dist/gaia-security/hooks/modules/security/blocked_message_formatter.py +86 -0
  274. package/dist/gaia-security/hooks/modules/security/command_semantics.py +130 -0
  275. package/dist/gaia-security/hooks/modules/security/gitops_validator.py +179 -0
  276. package/dist/gaia-security/hooks/modules/security/mutative_verbs.py +850 -0
  277. package/dist/gaia-security/hooks/modules/security/prompt_validator.py +40 -0
  278. package/dist/gaia-security/hooks/modules/security/tiers.py +196 -0
  279. package/dist/gaia-security/hooks/modules/session/__init__.py +10 -0
  280. package/dist/gaia-security/hooks/modules/session/session_context_writer.py +100 -0
  281. package/dist/gaia-security/hooks/modules/session/session_event_injector.py +158 -0
  282. package/dist/gaia-security/hooks/modules/session/session_manager.py +31 -0
  283. package/dist/gaia-security/hooks/modules/tools/__init__.py +25 -0
  284. package/dist/gaia-security/hooks/modules/tools/bash_validator.py +708 -0
  285. package/dist/gaia-security/hooks/modules/tools/cloud_pipe_validator.py +181 -0
  286. package/dist/gaia-security/hooks/modules/tools/hook_response.py +55 -0
  287. package/dist/gaia-security/hooks/modules/tools/shell_parser.py +227 -0
  288. package/dist/gaia-security/hooks/modules/tools/task_validator.py +283 -0
  289. package/dist/gaia-security/hooks/modules/validation/__init__.py +23 -0
  290. package/dist/gaia-security/hooks/modules/validation/commit_validator.py +380 -0
  291. package/dist/gaia-security/hooks/post_tool_use.py +54 -0
  292. package/dist/gaia-security/hooks/pre_tool_use.py +383 -0
  293. package/dist/gaia-security/hooks/session_start.py +69 -0
  294. package/dist/gaia-security/hooks/stop_hook.py +69 -0
  295. package/dist/gaia-security/hooks/user_prompt_submit.py +177 -0
  296. package/dist/gaia-security/settings.json +58 -0
  297. package/git-hooks/commit-msg +41 -0
  298. package/hooks/README.md +8 -6
  299. package/hooks/adapters/channel.py +0 -25
  300. package/hooks/adapters/claude_code.py +364 -125
  301. package/hooks/elicitation_result.py +132 -0
  302. package/hooks/hooks.json +10 -1
  303. package/hooks/modules/README.md +3 -2
  304. package/hooks/modules/agents/contract_validator.py +3 -51
  305. package/hooks/modules/agents/response_contract.py +4 -8
  306. package/hooks/modules/agents/transcript_reader.py +4 -5
  307. package/hooks/modules/audit/__init__.py +4 -6
  308. package/hooks/modules/audit/event_detector.py +0 -2
  309. package/hooks/modules/audit/metrics.py +108 -187
  310. package/hooks/modules/audit/workflow_auditor.py +0 -4
  311. package/hooks/modules/audit/workflow_recorder.py +0 -5
  312. package/hooks/modules/context/compact_context_builder.py +1 -0
  313. package/hooks/modules/context/context_cache.py +129 -0
  314. package/hooks/modules/context/context_injector.py +18 -40
  315. package/hooks/modules/context/context_writer.py +1 -25
  316. package/hooks/modules/context/contracts_loader.py +7 -10
  317. package/hooks/modules/core/hook_entry.py +1 -0
  318. package/hooks/modules/core/paths.py +12 -13
  319. package/hooks/modules/core/plugin_mode.py +74 -4
  320. package/hooks/modules/core/plugin_setup.py +395 -23
  321. package/hooks/modules/events/__init__.py +1 -0
  322. package/hooks/modules/events/event_writer.py +210 -0
  323. package/hooks/modules/identity/ops_identity.py +18 -27
  324. package/hooks/modules/memory/episode_writer.py +1 -6
  325. package/hooks/modules/orchestrator/__init__.py +1 -0
  326. package/hooks/modules/orchestrator/delegate_mode.py +128 -0
  327. package/hooks/modules/security/__init__.py +2 -4
  328. package/hooks/modules/security/approval_constants.py +5 -1
  329. package/hooks/modules/security/approval_grants.py +189 -6
  330. package/hooks/modules/security/approval_messages.py +9 -21
  331. package/hooks/modules/security/blocked_commands.py +98 -34
  332. package/hooks/modules/security/command_semantics.py +0 -4
  333. package/hooks/modules/security/gitops_validator.py +1 -11
  334. package/hooks/modules/security/mutative_verbs.py +179 -38
  335. package/hooks/modules/security/tiers.py +1 -19
  336. package/hooks/modules/session/session_event_injector.py +1 -25
  337. package/hooks/modules/tools/bash_validator.py +310 -94
  338. package/hooks/modules/tools/shell_parser.py +0 -1
  339. package/hooks/modules/tools/task_validator.py +9 -29
  340. package/hooks/post_tool_use.py +0 -72
  341. package/hooks/pre_tool_use.py +42 -102
  342. package/hooks/session_start.py +4 -2
  343. package/hooks/subagent_start.py +6 -2
  344. package/hooks/subagent_stop.py +1 -13
  345. package/hooks/user_prompt_submit.py +119 -37
  346. package/index.js +1 -1
  347. package/package.json +5 -3
  348. package/skills/README.md +3 -5
  349. package/skills/agent-protocol/SKILL.md +17 -16
  350. package/skills/agent-protocol/examples.md +6 -6
  351. package/skills/agent-response/SKILL.md +11 -14
  352. package/skills/approval/SKILL.md +28 -13
  353. package/skills/approval/reference.md +2 -2
  354. package/skills/execution/SKILL.md +1 -1
  355. package/skills/gaia-patterns/SKILL.md +2 -3
  356. package/skills/orchestrator-approval/SKILL.md +22 -50
  357. package/skills/security-tiers/SKILL.md +1 -1
  358. package/templates/README.md +9 -9
  359. package/templates/managed-settings.template.json +43 -0
  360. package/tools/gaia_simulator/runner.py +34 -1
  361. package/tools/scan/orchestrator.py +13 -0
  362. package/tools/scan/scanners/base.py +8 -0
  363. package/tools/scan/scanners/git.py +78 -0
  364. package/tools/scan/scanners/infrastructure.py +65 -0
  365. package/tools/scan/scanners/stack.py +110 -0
  366. package/tools/scan/setup.py +120 -13
  367. package/tools/scan/workspace.py +85 -0
  368. package/config/context-contracts.aws.json +0 -42
  369. package/config/context-contracts.gcp.json +0 -39
  370. package/skills/project-dispatch/SKILL.md +0 -34
  371. package/templates/settings.template.json +0 -226
@@ -0,0 +1,257 @@
1
+ # Tasks: {FEATURE_NAME}
2
+
3
+ <!-- Feature: {feature-dir-absolute-path} -->
4
+ <!-- Tasks file: {this-file-absolute-path} -->
5
+
6
+ **Feature**: {feature-id}
7
+ **Date**: {date}
8
+ **Plan**: `{feature-dir}/plan.md`
9
+ **Total Tasks**: {count}
10
+
11
+ ---
12
+
13
+ ## Execution Contract
14
+
15
+ - Each task is self-contained: a `devops-developer` agent executes it without SpecKit knowledge
16
+ - Each task includes a verify command that proves completion
17
+ - When ALL acceptance criteria pass and verify succeeds, the executing agent MUST mark `[ ]` as `[x]` in this file
18
+ - Quality gate tasks validate the milestone before proceeding
19
+ - Tasks are grouped by milestone; milestones execute sequentially, tasks within a milestone may parallelize where marked [P]
20
+
21
+ ---
22
+
23
+ ## Task Format Reference
24
+
25
+ Every task MUST follow this structure exactly:
26
+
27
+ ```markdown
28
+ ### T{NNN}: {Title} [ ]
29
+ <!-- FR: {FR-numbers} -->
30
+ - **Description**: {What to do -- specific enough for an agent with no SpecKit context}
31
+ - **Files**: {Files to create/modify with paths relative to repo root}
32
+ - **Acceptance criteria**:
33
+ - {Specific testable criterion}
34
+ - {Another criterion}
35
+ - **Complexity**: {S|M|L}
36
+ - **Agent**: `{agent-name}`
37
+ - **Tier**: {T0|T1|T2|T3} ({reason})
38
+ - **Tags**: {#tag1 #tag2}
39
+ - **Verify**: `{command that proves it works}`
40
+ - **On completion**: Mark `[ ]` as `[x]` in this file
41
+ ```
42
+
43
+ **Required fields**: Description, Files, Acceptance criteria, Verify, On completion.
44
+ **Optional fields**: FR comment, Complexity, Agent, Tier, Tags.
45
+
46
+ **Quality gate tasks** end each milestone:
47
+
48
+ ```markdown
49
+ ### T{NNN}: Milestone {N} Quality Gate [ ]
50
+ <!-- FR: {all-FR-numbers-covered-by-this-milestone} -->
51
+ - **Description**: Verify all FRs covered by Milestone {N} are satisfied.
52
+ - **Files**: N/A (validation only)
53
+ - **Acceptance criteria**:
54
+ - All T{first}-T{last} verify commands pass
55
+ - {Milestone-specific validation}
56
+ - **Agent**: `devops-developer`
57
+ - **Tier**: T0 (read-only validation)
58
+ - **Tags**: #validation #quality-gate
59
+ - **Verify**: `{command that validates all milestone tasks}`
60
+ - **On completion**: Mark `[ ]` as `[x]` in this file
61
+ ```
62
+
63
+ ---
64
+
65
+ ## Task Generation Rules
66
+
67
+ When generating real tasks from plan.md and design artifacts:
68
+
69
+ 1. **From plan.md** (required):
70
+ - Extract tech stack, architecture, file structure
71
+ - Each architectural component becomes one or more tasks
72
+ - Setup tasks come first (project init, dependencies, config)
73
+
74
+ 2. **From contracts/** (if exists):
75
+ - Each contract file produces a contract test task [P]
76
+ - Each endpoint produces an implementation task
77
+
78
+ 3. **From data-model.md** (if exists):
79
+ - Each entity produces a model creation task [P]
80
+ - Relationships produce service layer tasks
81
+
82
+ 4. **From research.md** (if exists):
83
+ - Technical decisions inform setup and integration tasks
84
+
85
+ 5. **Ordering**:
86
+ - Setup before tests, tests before implementation (TDD), core before integration
87
+ - Dependencies block parallel execution
88
+ - Different files = can be parallel [P]; same file = sequential
89
+
90
+ 6. **Milestones**:
91
+ - Group related tasks into milestones (3-8 tasks per milestone)
92
+ - Each milestone ends with a quality gate task
93
+ - Milestone N+1 depends on Milestone N quality gate passing
94
+
95
+ 7. **Cross-spec dependencies**:
96
+ - If the feature shares contracts or schemas with other features, note the dependency at the top of the file and on each affected task
97
+
98
+ ---
99
+
100
+ ## Example Tasks
101
+
102
+ The following examples show the format for common task types. Replace with real tasks generated from your plan.md.
103
+
104
+ ### Example: Milestone 1 -- Foundation
105
+
106
+ ### T001: Create package structure [ ]
107
+ <!-- FR: FR-001 -->
108
+ - **Description**: Create the `src/myfeature/` package directory with `__init__.py`, establish the module hierarchy for core modules and tests.
109
+ - **Files**: `src/myfeature/__init__.py`, `src/myfeature/core/__init__.py`, `tests/myfeature/__init__.py`, `tests/myfeature/conftest.py`
110
+ - **Acceptance criteria**:
111
+ - `python3 -c "import src.myfeature"` succeeds without error
112
+ - Directory structure: `src/myfeature/`, `src/myfeature/core/`, `tests/myfeature/`
113
+ - `src/myfeature/__init__.py` exports `__version__` string
114
+ - **Complexity**: S
115
+ - **Agent**: `devops-developer`
116
+ - **Tier**: T3 (creates files)
117
+ - **Tags**: #python #setup #foundation
118
+ - **Verify**: `python3 -c "from src.myfeature import __version__; print(__version__)"`
119
+ - **On completion**: Mark `[ ]` as `[x]` in this file
120
+
121
+ ---
122
+
123
+ ### T002: Implement base interface [ ]
124
+ <!-- FR: FR-001, FR-002 -->
125
+ - **Description**: Create `src/myfeature/core/base.py` with the abstract base class. Define the contract methods and type hints per `contracts/interface.md`.
126
+ - **Files**: `src/myfeature/core/base.py`
127
+ - **Acceptance criteria**:
128
+ - Abstract base class importable via `from src.myfeature.core.base import BaseHandler`
129
+ - Subclass that does not implement `handle()` raises `TypeError` on instantiation
130
+ - Docstring documents the interface contract
131
+ - **Complexity**: S
132
+ - **Agent**: `devops-developer`
133
+ - **Tier**: T3
134
+ - **Tags**: #python #architecture #interface
135
+ - **Verify**: `python3 -c "from src.myfeature.core.base import BaseHandler; print('OK')"`
136
+ - **On completion**: Mark `[ ]` as `[x]` in this file
137
+
138
+ ---
139
+
140
+ ### T003: Milestone 1 Quality Gate [ ]
141
+ <!-- FR: FR-001, FR-002 -->
142
+ - **Description**: Verify all FRs covered by Milestone 1 are satisfied. Run import checks for all foundation modules.
143
+ - **Files**: N/A (validation only)
144
+ - **Acceptance criteria**:
145
+ - All T001-T002 verify commands pass
146
+ - Package structure is correct and importable
147
+ - Base interface enforces its contract
148
+ - **Agent**: `devops-developer`
149
+ - **Tier**: T0 (read-only validation)
150
+ - **Tags**: #validation #quality-gate
151
+ - **Verify**: `python3 -c "from src.myfeature.core.base import BaseHandler; print('M1 GATE PASS')"`
152
+ - **On completion**: Mark `[ ]` as `[x]` in this file
153
+
154
+ ---
155
+
156
+ ### Example: Parallel implementation tasks
157
+
158
+ ### T004: Implement handler A [P] [ ]
159
+ <!-- FR: FR-003 -->
160
+ - **Description**: Create `src/myfeature/handlers/handler_a.py` implementing `BaseHandler` for the A workflow. Include detection logic from plan.md section 3.2.
161
+ - **Files**: `src/myfeature/handlers/handler_a.py`
162
+ - **Acceptance criteria**:
163
+ - Class `HandlerA` extends `BaseHandler` and implements all abstract methods
164
+ - Detection logic returns correct results for known test fixtures
165
+ - Includes `_source` metadata
166
+ - **Complexity**: M
167
+ - **Agent**: `devops-developer`
168
+ - **Tier**: T3
169
+ - **Tags**: #python #handler #implementation
170
+ - **Verify**: `python3 -c "from src.myfeature.handlers.handler_a import HandlerA; print('OK')"`
171
+ - **On completion**: Mark `[ ]` as `[x]` in this file
172
+
173
+ ---
174
+
175
+ ### T005: Implement handler B [P] [ ]
176
+ <!-- FR: FR-004 -->
177
+ - **Description**: Create `src/myfeature/handlers/handler_b.py` implementing `BaseHandler` for the B workflow. This task is independent of T004 and can run in parallel.
178
+ - **Files**: `src/myfeature/handlers/handler_b.py`
179
+ - **Acceptance criteria**:
180
+ - Class `HandlerB` extends `BaseHandler` and implements all abstract methods
181
+ - Returns empty result when no B indicators found
182
+ - Includes `_source` metadata
183
+ - **Complexity**: M
184
+ - **Agent**: `devops-developer`
185
+ - **Tier**: T3
186
+ - **Tags**: #python #handler #implementation
187
+ - **Verify**: `python3 -c "from src.myfeature.handlers.handler_b import HandlerB; print('OK')"`
188
+ - **On completion**: Mark `[ ]` as `[x]` in this file
189
+
190
+ ---
191
+
192
+ ### Example: High-risk task
193
+
194
+ ### T006: Wire integration with external system [ ]
195
+ <!-- FR: FR-005 -->
196
+ - **Description**: Modify `src/myfeature/orchestrator.py` to call the external API. Use atomic write pattern. Preserve existing behavior for offline mode.
197
+ - **Files**: `src/myfeature/orchestrator.py`
198
+ - **Acceptance criteria**:
199
+ - External API called when available, graceful fallback when not
200
+ - Atomic write: output file is either fully written or not present
201
+ - Existing offline tests still pass
202
+ - **Complexity**: L
203
+ - **Agent**: `devops-developer`
204
+ - **Tier**: T3
205
+ - **Tags**: #python #integration #external-api
206
+ - **Verify**: `python3 -m pytest tests/myfeature/test_orchestrator.py -v --tb=short`
207
+ - **On completion**: Mark `[ ]` as `[x]` in this file
208
+ - **HIGH RISK**: Modifies integration point. Verify offline fallback still works.
209
+
210
+ ---
211
+
212
+ ## Dependency Graph
213
+
214
+ <!-- AGENT INSTRUCTION: Replace with actual dependencies when generating tasks.
215
+ - dependencies: maps each task to the list of tasks it requires first
216
+ - parallel_groups: lists sets of tasks that can run simultaneously
217
+ Omit a task from 'dependencies' if it has no prerequisites.
218
+ Keep valid YAML inside the fenced block.
219
+ -->
220
+ ```yaml
221
+ dependencies:
222
+ T002: [T001]
223
+ T003: [T001, T002]
224
+ T004: [T003]
225
+ T005: [T003]
226
+ T006: [T004, T005]
227
+ parallel_groups:
228
+ - [T004, T005]
229
+ ```
230
+
231
+ ---
232
+
233
+ ## Summary
234
+
235
+ <!-- AGENT INSTRUCTION: Replace with actual milestone summary table. -->
236
+
237
+ | Milestone | Tasks | Parallel | Complexity |
238
+ |---|---|---|---|
239
+ | M1: Foundation | T001-T003 | No (sequential) | 2S + 1QG |
240
+ | M2: Implementation | T004-T006 | Partial (T004, T005 parallel) | 2M + 1L |
241
+ | **Total** | **6** | | |
242
+
243
+ ---
244
+
245
+ ## FR Traceability Matrix
246
+
247
+ <!-- AGENT INSTRUCTION: Replace with actual FR traceability.
248
+ Every FR from spec.md MUST appear with at least one primary task and quality gate.
249
+ -->
250
+
251
+ | FR | Description | Primary Task(s) | Quality Gate |
252
+ |---|---|---|---|
253
+ | FR-001 | {requirement} | T001 | T003 |
254
+ | FR-002 | {requirement} | T002 | T003 |
255
+ | FR-003 | {requirement} | T004 | T006 |
256
+ | FR-004 | {requirement} | T005 | T006 |
257
+ | FR-005 | {requirement} | T006 | T006 |
@@ -0,0 +1,132 @@
1
+ # Context Module
2
+
3
+ **Purpose:** Context provisioning and enrichment for agents
4
+
5
+ ## Overview
6
+
7
+ This module manages the SSOT (Single Source of Truth) context that agents receive. It loads project configuration, filters by agent contract (defined in `config/context-contracts.json` + cloud extensions), and provides context to agents.
8
+ It also classifies the task into generic Gaia surfaces, emits an `investigation_brief`, and injects `write_permissions` so agents receive deterministic cross-surface guidance and writable-section ownership, not just raw project data.
9
+
10
+ ## Core Functions
11
+
12
+ ### `load_project_context(path)`
13
+ Loads the project-context.json file.
14
+
15
+ ```python
16
+ from tools.context.context_provider import load_project_context
17
+ context = load_project_context(Path(".claude/project-context/project-context.json"))
18
+ ```
19
+
20
+ ### `get_contract_context(project_context, agent_name, provider_contracts)`
21
+ Gets the specific context needed for an agent based on its contract.
22
+
23
+ ```python
24
+ from tools.context.context_provider import get_contract_context
25
+ contract_context = get_contract_context(
26
+ project_context,
27
+ "terraform-architect",
28
+ provider_contracts
29
+ )
30
+ ```
31
+
32
+ ### `get_context_update_contract(agent_name, provider_contracts)`
33
+ Gets the readable/writable section contract that governs `CONTEXT_UPDATE`.
34
+
35
+ ```python
36
+ from tools.context.context_provider import get_context_update_contract
37
+ update_contract = get_context_update_contract("terraform-architect", provider_contracts)
38
+ ```
39
+
40
+ ### `load_provider_contracts(cloud_provider)`
41
+ Loads cloud provider-specific agent contracts (GCP, AWS).
42
+
43
+ ```python
44
+ from tools.context.context_provider import load_provider_contracts
45
+ contracts = load_provider_contracts("gcp")
46
+ ```
47
+
48
+ ### `classify_surfaces(task, current_agent=...)`
49
+ Classifies a task into one or more active Gaia surfaces using generic signals.
50
+
51
+ ```python
52
+ from tools.context.surface_router import classify_surfaces
53
+ routing = classify_surfaces("Investigate rollout failure after CI image change", current_agent="gitops-operator")
54
+ ```
55
+
56
+ ### `build_investigation_brief(task, agent_name, contract_context)`
57
+ Builds the deterministic investigation brief injected into project context.
58
+
59
+ ```python
60
+ from tools.context.surface_router import build_investigation_brief
61
+ brief = build_investigation_brief("Review hook/skill drift", "gaia-system", contract_context={})
62
+ ```
63
+
64
+ ## Core Classes
65
+
66
+ ### `ContextSectionReader`
67
+ Selective context loading for token optimization.
68
+
69
+ ```python
70
+ from tools.context.context_section_reader import ContextSectionReader
71
+ reader = ContextSectionReader(project_context)
72
+ sections = reader.get_sections_for_agent("gitops-operator")
73
+ ```
74
+
75
+ ## Agent Contracts
76
+
77
+ Each agent receives specific v2 context sections (defined in `config/context-contracts.json` v3):
78
+
79
+ **terraform-architect:**
80
+ - project_identity, stack, git, environment, infrastructure, orchestration
81
+ - terraform_infrastructure, infrastructure_topology
82
+ - operational_guidelines, cluster_details, application_services, architecture_overview
83
+
84
+ **gitops-operator:**
85
+ - project_identity, stack, git, environment, infrastructure, orchestration
86
+ - gitops_configuration, cluster_details
87
+ - operational_guidelines, application_services, architecture_overview
88
+
89
+ **cloud-troubleshooter:**
90
+ - project_identity, stack, git, environment, infrastructure, orchestration
91
+ - cluster_details, infrastructure_topology, terraform_infrastructure
92
+ - gitops_configuration, application_services, monitoring_observability, architecture_overview
93
+
94
+ The same contracts are also exposed under `write_permissions`:
95
+ - `readable_sections`
96
+ - `writable_sections`
97
+
98
+ Agents should use the injected `write_permissions`, not a hardcoded table in a skill,
99
+ when deciding whether a `CONTEXT_UPDATE` is allowed.
100
+
101
+ ## Command Line Usage
102
+
103
+ ```bash
104
+ python3 tools/context/context_provider.py terraform-architect "Create a VPC" \
105
+ --context-file .claude/project-context/project-context.json
106
+ ```
107
+
108
+ ## Files
109
+
110
+ ```
111
+ context/
112
+ ├── __init__.py # Public exports (re-exports from context_provider + surface_router)
113
+ ├── _paths.py # Shared config directory resolution (resolve_config_dir)
114
+ ├── context_provider.py # Main context provisioning logic
115
+ ├── surface_router.py # Surface classification + investigation brief
116
+ ├── context_section_reader.py # Token-optimized context extraction
117
+ ├── context_selector.py # Context selection logic
118
+ ├── context_compressor.py # Context compression for token optimization
119
+ ├── context_lazy_loader.py # Lazy loading for large contexts
120
+ ├── deep_merge.py # Deep merge utility for contract merging
121
+ ├── pending_updates.py # Pending context update management
122
+ ├── benchmark_context.py # Performance benchmarking
123
+ └── README.md
124
+ ```
125
+
126
+ ## See Also
127
+
128
+ - `config/context-contracts.json` - Agent contracts (SSOT)
129
+ - `config/cloud/gcp.json` - GCP-specific contract extensions
130
+ - `config/cloud/aws.json` - AWS-specific contract extensions
131
+ - `hooks/modules/context/context_writer.py` - Context write operations
132
+ - `tests/tools/test_context_provider.py` - Test suite
@@ -0,0 +1,42 @@
1
+ """
2
+ Context Module: Context provisioning and enrichment
3
+
4
+ This module provides context loading, filtering, and enrichment for agents.
5
+ It manages the SSOT (Single Source of Truth) context contracts and ensures
6
+ agents receive the necessary context for execution.
7
+
8
+ Main functions:
9
+ - load_project_context(): Load project context from JSON
10
+ - get_contract_context(): Get context for an agent based on its contract
11
+ - get_context_update_contract(): Get readable/writable write permissions
12
+ - load_provider_contracts(): Load cloud provider-specific contracts
13
+ """
14
+
15
+ from . import context_provider
16
+ from .context_section_reader import ContextSectionReader
17
+
18
+ # Re-export key functions for convenience
19
+ from .context_provider import (
20
+ load_project_context,
21
+ get_contract_context,
22
+ get_context_update_contract,
23
+ load_provider_contracts,
24
+ )
25
+ from .surface_router import (
26
+ build_investigation_brief,
27
+ classify_surfaces,
28
+ load_surface_routing_config,
29
+ )
30
+
31
+ __all__ = [
32
+ "context_provider", # module
33
+ "ContextSectionReader",
34
+ # Main functions
35
+ "load_project_context",
36
+ "get_contract_context",
37
+ "get_context_update_contract",
38
+ "load_provider_contracts",
39
+ "build_investigation_brief",
40
+ "classify_surfaces",
41
+ "load_surface_routing_config",
42
+ ]
@@ -0,0 +1,20 @@
1
+ """Shared path resolution utilities for the context module."""
2
+
3
+ from __future__ import annotations
4
+
5
+ from pathlib import Path
6
+
7
+
8
+ def resolve_config_dir() -> Path:
9
+ """Resolve config directory from installed project or package checkout."""
10
+ installed_path = Path(".claude/config")
11
+ if installed_path.is_dir():
12
+ return installed_path
13
+
14
+ # context/ -> tools/ -> gaia-ops/
15
+ script_dir = Path(__file__).parent.parent.parent
16
+ package_path = script_dir / "config"
17
+ if package_path.is_dir():
18
+ return package_path
19
+
20
+ return Path(".claude/config")