@khoavu882/doflow 2.0.0-beta.4 → 2.0.0

package/core/harnesses/shared/hooks/policies/lib.sh

@@ -1,13 +1,16 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
 # lib.sh — shared constants and helpers for the Canonical Policy Library
 #
-# Usage: source "$(dirname "$0")/lib.sh"
+# Usage: source "<policy-dir>/lib.sh"
 #
 # All hooks must:
 #   1. source this file at the top
 #   2. call require_jq immediately after
 #   3. capture stdin once: INPUT=$(cat)
 #   4. use: json_field "$INPUT" ".field_name"
+
+_DOFLOW_SRC=${BASH_SOURCE[0]//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_LIB_DIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_LIB_DIR=. ;; esac
 #
 # Deployment:
 #   This file is installed by the doflow CLI and overwritten on update — do
@@ -15,7 +18,7 @@
 #
 # Consolidation note (022-normalize-hooks, Phase B): this is the single
 # canonical copy every front door's dispatched policy script sources — the
-# claude/gemini/kiro/codex copies it replaces were already byte-identical
+# claude/kiro/codex copies it replaces were already byte-identical
 # except for one Claude-only default (see DOFLOW_AGENT below), confirmed via
 # diff before consolidating.
 
@@ -23,16 +26,33 @@ set -euo pipefail
 
 # ── State directories ────────────────────────────────────────────────────────
 
-# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports.
-DOFLOW_HOME="${XDG_CONFIG_HOME:-$HOME/.config}/doflow"
-STATE_DIR="$DOFLOW_HOME/session-env"
-SESSION_DIR="$STATE_DIR/sessions"
-PROJECTS_DIR="$STATE_DIR/projects"
+# XDG-compliant, agent-agnostic store shared by every harness DoFlow supports, under the config home
+# (doflow_config_home: an absolute XDG_CONFIG_HOME, else an absolute HOME + /.config, else none). With
+# no config home every state path below is empty, sourcing this file still never exits, and each state
+# function returns 0 at once: session work is skipped and a guard reaches its own decision (086 IC-010).
+# BEGIN doflow-config-home v1 (rule: src/runtime/config-home.js; checked by test/guards/settings.test.js)
+doflow_config_home() {
+  DOFLOW_HOME=""
+  case "${XDG_CONFIG_HOME:-}" in
+    /*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${XDG_CONFIG_HOME}/doflow"; return 0 ;; esac ;;
+  esac
+  case "${HOME:-}" in
+    /*) DOFLOW_HOME="${HOME}/.config/doflow" ;;
+    [A-Za-z]:[\\/]*) case "${OSTYPE:-}" in msys*|cygwin*|win32*) DOFLOW_HOME="${HOME}/.config/doflow" ;; esac ;;
+  esac
+  return 0
+}
+# END doflow-config-home v1
+doflow_config_home
+STATE_DIR="${DOFLOW_HOME:+$DOFLOW_HOME/session-env}"
+SESSION_DIR="${STATE_DIR:+$STATE_DIR/sessions}"
+PROJECTS_DIR="${STATE_DIR:+$STATE_DIR/projects}"
 # shellcheck disable=SC2034  # used by session-context.sh and stop-check.sh which source this file
-SESSIONS_LOG="$DOFLOW_HOME/sessions.log"
+SESSIONS_LOG="${DOFLOW_HOME:+$DOFLOW_HOME/sessions.log}"
 
 # Identifies which harness is running. A front door sets this before sourcing
-# this file (e.g. `export DOFLOW_AGENT=gemini; exec bash .../policies/...sh`);
+# this file (e.g. `export DOFLOW_AGENT=codex; exec bash .../policies/...sh`);
 # "unknown" here — not any one harness's name — is the honest fallback when a
 # front door omits it, since every prior per-harness copy of this file
 # defaulted to "claude-code" regardless of which harness actually shipped it.
@@ -251,18 +271,22 @@ has_uncommitted_changes() {
 # ── Directory helpers ─────────────────────────────────────────────────────────
 
 # Create and return the session-scoped state directory for a given session_id.
-# Safe to call multiple times (mkdir -p is idempotent).
+# Safe to call multiple times (mkdir -p is idempotent). Prints nothing and creates nothing when
+# there is no config home (SESSION_DIR empty).
 ensure_session_dir() {
   local session_id="$1"
+  [ -n "$SESSION_DIR" ] || return 0
   mkdir -p "$SESSION_DIR/$session_id"
   echo "$SESSION_DIR/$session_id"
 }
 
 # Create and return the project-scoped state directory for a given cwd.
-# Shared across all sessions in the same directory.
+# Shared across all sessions in the same directory. Prints nothing and creates nothing when there
+# is no config home (PROJECTS_DIR empty).
 ensure_project_dir() {
   local cwd="$1"
   local hash
+  [ -n "$PROJECTS_DIR" ] || return 0
   hash=$(cwd_hash "$cwd")
   mkdir -p "$PROJECTS_DIR/$hash"
   echo "$PROJECTS_DIR/$hash"
@@ -291,30 +315,16 @@ require_jq() {
   fi
 }
 
-# ── Session role ──────────────────────────────────────────────────────────────
-
-# Print `main` or `worker` for this session, read from DOFLOW_SESSION_ROLE (matched
-# case-insensitively). Unset or empty is `main`; a value that is neither `main` nor
-# `worker` is `worker` and writes one line to stderr. A worker never writes or claims the
-# project's compact summary or warning. Always returns 0. bash 3.2 safe (no ${var,,}).
-doflow_session_role() {
-  local role
-  role=$(printf '%s' "${DOFLOW_SESSION_ROLE:-}" | tr '[:upper:]' '[:lower:]') || role=""
-  case "$role" in
-    ""|main) printf 'main\n' ;;
-    worker) printf 'worker\n' ;;
-    *)
-      echo "[doflow] unknown DOFLOW_SESSION_ROLE; treating session as worker" >&2
-      printf 'worker\n'
-      ;;
-  esac
-  return 0
-}
+# ── Session role and identity ─────────────────────────────────────────────────
+
+# doflow_session_role and doflow_identity live in identity.sh, their only definition (IC-009).
+. "$_DOFLOW_LIB_DIR/identity.sh"
 
 # Start storage cleanup without changing the hook's output, status, or latency.
 storage_upkeep_async() {
-  local cwd="${1:-}" root run home config_dir
+  local cwd="${1:-}" root run home config_dir detach=""
   [ -n "$cwd" ] || return 0
+  command -v setsid >/dev/null 2>&1 && detach="setsid"
   home="${HOME:-}"
   config_dir="${CLAUDE_CONFIG_DIR:-$home/.claude}"
   root=$(nudge_repo_root "$cwd" 2>/dev/null) || root="$cwd"
@@ -327,7 +337,9 @@ storage_upkeep_async() {
     # Background the fully redirected subshell; an inner `&` leaves this shell
     # holding the hook's captured stdout open until the dispatcher exits. The
     # storage verb takes its project from the working directory: run it at the root.
-    ( cd "$root" 2>/dev/null && nohup "$run" storage --action upkeep </dev/null >/dev/null 2>&1 ) >/dev/null 2>&1 &
+    # setsid (absent on macOS) moves the upkeep out of the hook's session, so a harness that
+    # signals the hook's process group when the hook exits does not take the upkeep with it.
+    ( cd "$root" 2>/dev/null && nohup $detach "$run" storage --action upkeep </dev/null >/dev/null 2>&1 ) >/dev/null 2>&1 3>&- 5>&- &
     return 0
   done
   return 0
@@ -377,7 +389,7 @@ nudge_repo_root() {
 # file that cannot be read, is empty or holds anything else is `off`.
 nudge_setting() {
   local root="${1:-}" file line=""
-  for file in "${root:+$root/.doflow/prompt-nudge}" "$DOFLOW_HOME/prompt-nudge"; do
+  for file in "${root:+$root/.doflow/prompt-nudge}" "${DOFLOW_HOME:+$DOFLOW_HOME/prompt-nudge}"; do
     [ -n "$file" ] && [ -e "$file" ] || continue
     line=""
     { IFS= read -r line || true; } 2>/dev/null < "$file" || line=""
@@ -404,17 +416,20 @@ nudge_safe_id() {
   return 0
 }
 
-# Print the marker path for a session id. The caller checks nudge_safe_id first.
+# Print the marker path for a session id. The caller checks nudge_safe_id first. With no config
+# home there is no marker path and nothing is printed.
 nudge_marker_file() {
+  [ -n "$STATE_DIR" ] || return 0
   printf '%s\n' "$STATE_DIR/nudge/$1"
 }
 
 # Create the marker for <id> holding <nudged|suppressed>. Succeeds only when this call
 # created it: the create is exclusive, so a second call for the same id fails and
 # leaves the first content. After a create, markers untouched for over 30 days are
-# removed. Silent on every failure.
+# removed. Silent on every failure. With no config home it creates nothing and returns 0 at once.
 nudge_mark() {
-  local id="${1:-}" word="${2:-}" dir="$STATE_DIR/nudge" file
+  local id="${1:-}" word="${2:-}" dir="${STATE_DIR:+$STATE_DIR/nudge}" file
+  [ -n "$dir" ] || return 0
   nudge_safe_id "$id" || return 1
   case "$word" in nudged|suppressed) ;; *) return 1 ;; esac
   file="$dir/$id"
@@ -450,7 +465,8 @@ nudge_feature_active() {
 # S3: succeed when a `/do-*` skill already ran this session, read from the run ledger:
 # the lexically last <config>/state/runs/*.jsonl, whose last line's timestamp is not
 # earlier than the session's captured_at (both YYYY-MM-DDTHH:MM:SSZ). Config dir:
-# $DOFLOW_CONFIG_DIR, else the nearest `.doflow` at or above <cwd>, else $HOME/.doflow.
+# $DOFLOW_CONFIG_DIR, else the nearest non-nested `.doflow` at or above <cwd>, else $HOME/.doflow
+# (none when HOME is unset or empty).
 # Without a captured_at the ledger counts when it is named for today's UTC date; a last
 # line without a usable timestamp counts too. No ledger, or an empty one, does not.
 nudge_ledger_active() {
@@ -460,10 +476,19 @@ nudge_ledger_active() {
   if [ -n "${DOFLOW_CONFIG_DIR:-}" ]; then
     config="$DOFLOW_CONFIG_DIR"
   else
-    config="$HOME/.doflow"
+    config="${HOME:+$HOME/.doflow}"
     # The ancestor in the walk's own spelling (`\` read as `/`), the form its test succeeded on.
-    if dir=$(nudge_find_up "$cwd" .doflow -d); then config="${dir//\\//}/.doflow"; fi
+    if dir=$(nudge_find_up "$cwd" .doflow -d); then
+      while :; do
+        dir="${dir//\\//}"
+        case "$dir/" in
+          */.doflow/*) dir=$(nudge_find_up "${dir%/*}" .doflow -d) || break ;;
+          *) config="$dir/.doflow"; break ;;
+        esac
+      done
+    fi
   fi
+  [ -n "$config" ] || return 1
   for f in "$config"/state/runs/*.jsonl; do
     [ -f "$f" ] && ledger="$f"
   done
@@ -491,7 +516,7 @@ nudge_registry() {
     "${policy_dir:+$policy_dir/../../../runtime/core/registry/workflows.json}" \
     "${policy_dir:+$policy_dir/../../../../registry/workflows.json}" \
     "${root:+$root/.doflow/runtime/core/registry/workflows.json}" \
-    "$HOME/.doflow/runtime/core/registry/workflows.json"; do
+    "${HOME:+$HOME/.doflow/runtime/core/registry/workflows.json}"; do
     if [ -n "$candidate" ] && [ -f "$candidate" ]; then
       printf '%s\n' "$candidate"
       return 0

package/core/harnesses/shared/hooks/policies/mcp-tool-guard.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+case "${OSTYPE:-}" in msys*|cygwin*|win32*) if command -v jq >/dev/null 2>&1; then jq() { command jq -b "$@"; }; fi ;; esac # native jq.exe ends lines with CRLF unless -b
+_DOFLOW_SRC=${0//\\//}; case $_DOFLOW_SRC in */*) _DOFLOW_POLDIR=${_DOFLOW_SRC%/*} ;; *) _DOFLOW_POLDIR=. ;; esac
 # mcp-tool-guard.sh — Canonical Policy Library: PreToolUse(mcp_*) hook
 #
 # Intercepts every MCP tool call and blocks matches against mcp-policy.conf, the
@@ -13,57 +15,67 @@
 # Canonical Policy Script Contract (design.md §4):
 #   env    DOFLOW_PROJECT_DIR, DOFLOW_AGENT (both optional; not required to
 #          evaluate this policy)
-#   stdin  a PreToolUse-shaped JSON payload; tool name is read from the union
-#          of field names harnesses use (tool_name/tool/toolName/name), since
-#          a native front door (Claude/Codex/Kiro) execs this script directly
-#          with no payload translation of its own.
-#   exit   0 = allow, non-zero = deny with the reason on stderr.
-#
-# Reconciliation note (022-normalize-hooks, Phase A): MCP tool-name
-# vocabularies differ per harness — Claude/Codex/Kiro use a double-underscore
-# "mcp__<server>__<tool>" convention, Gemini documents a single-underscore
-# "mcp_<server>_<tool>" convention. A single-underscore prefix check ("^mcp_")
-# matches both conventions (the double-underscore form is a superset match of
-# the single-underscore prefix), so this script uses that one generic check
-# instead of hardcoding either harness's exact convention.
+#   stdin  a native payload with envelope v1 under doflow_event; only the
+#          envelope's operation and tool fields are used.
+#   exit   exit 2 + doflow_decide deny = deny; other faults per IC-011.
 #
 # mcp-policy.conf's shape (TAB-separated regex<TAB>reason, '#'-comments,
 # blank lines skipped) is identical across every harness that ships one today
-# (claude/codex/gemini/kiro) — reconciliation found no divergence to resolve
+# (claude/codex/kiro) — reconciliation found no divergence to resolve
 # there.
 
 set -uo pipefail
 
-command -v jq >/dev/null 2>&1 || exit 0          # no jq -> cannot evaluate -> allow
-
 INPUT=$(cat)
+if [ -f "$_DOFLOW_POLDIR/contract.sh" ]; then
+  . "$_DOFLOW_POLDIR/contract.sh"
+else
+  doflow_decision_init() { :; }
+  doflow_decide() { :; }
+  doflow_read_envelope() { DF_ENV_CLASS=missing; DF_ENV_CODE=contract-missing; }
+  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure mcp-tool-guard contract-missing ) >/dev/null 2>&1 || true
+  if [[ "${DOFLOW_AGENT:-}" =~ ^[a-z]+$ ]]; then
+    printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update -t %s\n' "$DOFLOW_AGENT" >&2
+  else
+    printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update\n' >&2
+  fi
+  doflow_decide deny contract-missing
+  exit 2
+fi
+doflow_decision_init mcp-tool-guard 1
+command -v jq >/dev/null 2>&1 || {
+  doflow_decide error dependency-missing:jq
+  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure mcp-tool-guard dependency-missing:jq ) >/dev/null 2>&1 || true
+  exit 0
+}
+DF_ENV_CLASS=missing DF_ENV_CODE=envelope-missing
+doflow_read_envelope || true
 
 TOOL_NAME=""
-for field in '.tool_name' '.tool' '.toolName' '.name'; do
-  TOOL_NAME=$(printf '%s' "$INPUT" | jq -r "${field} // empty" 2>/dev/null)
-  [ -n "$TOOL_NAME" ] && break
-done
-
-# Fast exit for non-MCP tool events (also covers "tool name unresolved").
-# "mcp_" (single underscore) matches both Claude/Codex/Kiro's "mcp__" and
-# Gemini's "mcp_" naming conventions. Matched case-insensitively: the caller
-# (stream-hook-runner.js's MCP_TOOL_PATTERN) classifies case-insensitively
-# before ever routing here, so this check must not be stricter than the
-# classification that decided to invoke it (022-code-review finding).
-shopt -s nocasematch 2>/dev/null || true
-case "$TOOL_NAME" in
-  mcp_*) ;;
-  *) exit 0 ;;
-esac
-shopt -u nocasematch 2>/dev/null || true
+if [ "$DF_ENV_CLASS" = v1 ]; then
+  [ "$DF_ENV_OP" = mcp ] || exit 0
+  TOOL_NAME=$DF_ENV_TOOL
+elif [ "$DF_ENV_CLASS" = unsupported ]; then
+  doflow_decide unsupported envelope-version
+  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure mcp-tool-guard unsupported:envelope-version ) >/dev/null 2>&1 || true
+  exit 0
+else
+  if [ "${DF_ENV_CODE:-envelope-missing}" != contract-missing ]; then
+    ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure mcp-tool-guard envelope-missing ) >/dev/null 2>&1 || true
+  fi
+  if [[ "${DOFLOW_AGENT:-}" =~ ^[a-z]+$ ]]; then printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update -t %s\n' "$DOFLOW_AGENT" >&2; else printf '[mcp-tool-guard] DoFlow hooks out of step; run: doflow update\n' >&2; fi
+  doflow_decide deny "${DF_ENV_CODE:-envelope-missing}"
+  exit 2
+fi
 
-POLICY_FILE="$(dirname "$0")/mcp-policy.conf"
+POLICY_FILE="$_DOFLOW_POLDIR/mcp-policy.conf"
 
 # If policy file is missing, allow everything (fail open — don't block the agent).
 if [ ! -f "$POLICY_FILE" ]; then
   # The policy file ships with DoFlow, so a missing one means a broken install: record it on this
   # machine (feature 046, IC-018) and fail open exactly as before. Subshell, output discarded.
-  ( . "$(dirname "$0")/capture-failure.sh"; doflow_capture_failure mcp-tool-guard policy-file-missing ) >/dev/null 2>&1 || true
+  ( . "$_DOFLOW_POLDIR/capture-failure.sh"; doflow_capture_failure mcp-tool-guard policy-file-missing ) >/dev/null 2>&1 || true
+  doflow_decide error mcp-policy-missing
   exit 0
 fi
 
@@ -83,6 +95,7 @@ while IFS=$'\t' read -r pattern reason || [ -n "$pattern" ]; do
 
   if [ "$matched" = "true" ]; then
     echo "[mcp-tool-guard] ${reason:-MCP tool call blocked by mcp-tool-guard} (tool: $TOOL_NAME)" >&2
+    doflow_decide deny blocked-pattern
     exit 2
   fi
 done < "$POLICY_FILE"