@lovrozagar/grunt 0.3.6 → 0.3.8

package/.agents/skills/cascade/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: cascade
+description: >
+  Session mode. /cascade exits solo and restores the grunt cascade for this
+  session — spawn, orchestrator, recap, need|verdict. Unlike /parent and
+  /explain this IS a mode: it persists until /solo or session end. Not a
+  sticky second mode — exit solo / restore cascade.
+---
+Exit solo / restore cascade. Not a sticky second mode.
+
+Session mode, not one-turn. Persists until `/solo` or session end.
+
+This session: cascade restored. You are the parent orchestrator.
+
+- Spawn grunt|implementer|thinker.
+- Recap tags. Recap `[orchestrator]:` `[grunt]:` `[implementer]:` `[thinker]:` `[handoff]:`.
+- Spawn-first rule. `need:`/`verdict:` grammar.
+- Voice unchanged: `.rulesync/reference/output.md`. `/explain` is still the voice escape.
+
+Fat-tool caps stay on — token guards, not cascade.
+
+Claude/Codex/Grok: `/cascade` via submit hook unlinks `.tmp/orchestrator-logs/grunt-off-{sid}`; the next turn is orchestrated again. Already orchestrated: no-op. Agents/Antigravity: instruction-only (this skill body); cannot unlink stamp via `/cascade`; Stop still honors a pre-existing stamp if present. Session-scoped, never global.
+
+After `/solo`, or when spawn/recap/need|verdict must resume.

package/.claude/skills/cascade/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: cascade
+description: >
+  Session mode. /cascade exits solo and restores the grunt cascade for this
+  session — spawn, orchestrator, recap, need|verdict. Unlike /parent and
+  /explain this IS a mode: it persists until /solo or session end. Not a
+  sticky second mode — exit solo / restore cascade.
+---
+Exit solo / restore cascade. Not a sticky second mode.
+
+Session mode, not one-turn. Persists until `/solo` or session end.
+
+This session: cascade restored. You are the parent orchestrator.
+
+- Spawn grunt|implementer|thinker.
+- Recap tags. Recap `[orchestrator]:` `[grunt]:` `[implementer]:` `[thinker]:` `[handoff]:`.
+- Spawn-first rule. `need:`/`verdict:` grammar.
+- Voice unchanged: `.rulesync/reference/output.md`. `/explain` is still the voice escape.
+
+Fat-tool caps stay on — token guards, not cascade.
+
+Claude/Codex/Grok: `/cascade` via submit hook unlinks `.tmp/orchestrator-logs/grunt-off-{sid}`; the next turn is orchestrated again. Already orchestrated: no-op. Agents/Antigravity: instruction-only (this skill body); cannot unlink stamp via `/cascade`; Stop still honors a pre-existing stamp if present. Session-scoped, never global.
+
+After `/solo`, or when spawn/recap/need|verdict must resume.

package/.grok/skills/cascade/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: cascade
+description: >
+  Session mode. /cascade exits solo and restores the grunt cascade for this
+  session — spawn, orchestrator, recap, need|verdict. Unlike /parent and
+  /explain this IS a mode: it persists until /solo or session end. Not a
+  sticky second mode — exit solo / restore cascade.
+---
+Exit solo / restore cascade. Not a sticky second mode.
+
+Session mode, not one-turn. Persists until `/solo` or session end.
+
+This session: cascade restored. You are the parent orchestrator.
+
+- Spawn grunt|implementer|thinker.
+- Recap tags. Recap `[orchestrator]:` `[grunt]:` `[implementer]:` `[thinker]:` `[handoff]:`.
+- Spawn-first rule. `need:`/`verdict:` grammar.
+- Voice unchanged: `.rulesync/reference/output.md`. `/explain` is still the voice escape.
+
+Fat-tool caps stay on — token guards, not cascade.
+
+Claude/Codex/Grok: `/cascade` via submit hook unlinks `.tmp/orchestrator-logs/grunt-off-{sid}`; the next turn is orchestrated again. Already orchestrated: no-op. Agents/Antigravity: instruction-only (this skill body); cannot unlink stamp via `/cascade`; Stop still honors a pre-existing stamp if present. Session-scoped, never global.
+
+After `/solo`, or when spawn/recap/need|verdict must resume.

package/.rulesync/reference/map.md

@@ -23,13 +23,13 @@ Cheap outline. Not a file dump.
 - `.grok/hooks/orchestrate-parent.js` + `orchestrate-parent.json` — parent spawn/fat/stop/plan-write / SubagentStop intercept
 - `.grok/hooks/rtk.json` — RTK
 - `.grok/skills/{write-plan,implement-plan,shared}/` — hand-only (no rulesync SSOT); point to cascade, do not paste
-- `.grok/skills/{parent,explain,handoff,solo,commit,commit-and-push}/` — generated from `.rulesync/skills/`; do not hand-edit
+- `.grok/skills/{parent,explain,handoff,solo,cascade,commit,commit-and-push}/` — generated from `.rulesync/skills/`; do not hand-edit
 - `.grok/parent.md` — 1-line pointer to orchestrator agent; not SessionStart
 - `.grok/roles/*.toml`
 - `.grok/global-settings.toml` — merged into `~/.grok/config.toml` by `scripts/sync-global-settings.mjs` (not auto-loaded; project config cannot set `[features]`)
 - `.rulesync/global-settings/` — host manifest and reserved noop payloads
 - `.rulesync/mcp-policy.jsonc` — MCP deny-default SSOT (`default: deny`, `allow: []`)
-- `.rulesync/skills/{parent,explain,handoff,solo,commit,commit-and-push}/` — skill SSOT; `rulesync -f skills` emits `.grok/skills/`, `.claude/skills/`, `.agents/skills/` byte-equal. `/cascade` has no skill (hook-only: a `grunt`-adjacent listing entry risks mis-routing `Skill` vs `Agent`)
+- `.rulesync/skills/{parent,explain,handoff,solo,cascade,commit,commit-and-push}/` — skill SSOT; `rulesync -f skills` emits `.grok/skills/`, `.claude/skills/`, `.agents/skills/` byte-equal. `/cascade` = exit solo / restore cascade (not a sticky second mode)
 
 ## Scripts
 - `scripts/check-globals.mjs` — `$HOME/.grok/config.toml` `[agent].name==orchestrator` + `[features].two_pass_compaction==true`; project `.grok/config.toml` must not have `[features]`/`[agent]`; wired as `sync:globals:check` (also after emit-mcp in `rulesync:check`)
@@ -58,7 +58,7 @@ Cheap outline. Not a file dump.
 
 ## Generated (do not hand-edit; committed, not gitignored)
 - `AGENTS.md`, `CLAUDE.md`
-- `.claude/skills/*`, `.agents/skills/*`, `.grok/skills/{parent,explain,handoff,solo,commit,commit-and-push}/` (from `.rulesync/skills/`)
+- `.claude/skills/*`, `.agents/skills/*`, `.grok/skills/{parent,explain,handoff,solo,cascade,commit,commit-and-push}/` (from `.rulesync/skills/`)
 - `.grok/agents/*`
 - `.claude/agents/*`
 - `.codex/agents/*`

package/.rulesync/skills/cascade/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: cascade
+description: >
+  Session mode. /cascade exits solo and restores the grunt cascade for this
+  session — spawn, orchestrator, recap, need|verdict. Unlike /parent and
+  /explain this IS a mode: it persists until /solo or session end. Not a
+  sticky second mode — exit solo / restore cascade.
+---
+Exit solo / restore cascade. Not a sticky second mode.
+
+Session mode, not one-turn. Persists until `/solo` or session end.
+
+This session: cascade restored. You are the parent orchestrator.
+
+- Spawn grunt|implementer|thinker.
+- Recap tags. Recap `[orchestrator]:` `[grunt]:` `[implementer]:` `[thinker]:` `[handoff]:`.
+- Spawn-first rule. `need:`/`verdict:` grammar.
+- Voice unchanged: `.rulesync/reference/output.md`. `/explain` is still the voice escape.
+
+Fat-tool caps stay on — token guards, not cascade.
+
+Claude/Codex/Grok: `/cascade` via submit hook unlinks `.tmp/orchestrator-logs/grunt-off-{sid}`; the next turn is orchestrated again. Already orchestrated: no-op. Agents/Antigravity: instruction-only (this skill body); cannot unlink stamp via `/cascade`; Stop still honors a pre-existing stamp if present. Session-scoped, never global.
+
+After `/solo`, or when spawn/recap/need|verdict must resume.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lovrozagar/grunt",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "Multi-agent orchestrator SoT — deep-merge rulesync trees, product scripts, and generate pipeline into a consumer repo",
   "keywords": [
     "agents",

package/scripts/hooks-union.mjs

@@ -8,8 +8,8 @@
  * Grok SessionStart stays empty on orchestrate-parent.json.
  *
  * Consumer extras (if those scripts exist): SessionStart, check-behind,
- * validate+sim, platform/** deny. Gemini: SessionStart + AfterTool only;
- * check-behind / path deny stay caveats.
+ * validate+sim. Path deny from consumer `.rulesync/permissions.json`.
+ * Gemini: SessionStart + AfterTool only; check-behind / path deny stay caveats.
  *
  *   node scripts/hooks-union.mjs           apply then check
  *   node scripts/hooks-union.mjs --check   keep-list only
@@ -40,7 +40,6 @@ export const AUTORUN_NEEDLES = [
   "sim.mjs",
 ];
 export const GRUNT_NEEDLES = ["scrub-spawn-prompt.mjs", "gate-fat-tools.mjs"];
-export const PLATFORM_DENY = ["Write(platform/**)", "Edit(platform/**)"];
 export const GIT_HOOKS = [
   "scripts/git-hooks/pre-commit",
   "scripts/git-hooks/pre-commit.mjs",
@@ -52,7 +51,7 @@ export const POST_WRITE_MATCHER = "Write|Edit|write|search_replace";
 const CAVEAT_BEHIND =
   "NOT ported: PreToolUse check-behind.mjs. Gemini has no confirmed before-tool deny event.";
 const CAVEAT_PERMS =
-  "NOT ported: Write/Edit(platform/**). Gemini tool controls are name-scoped, not path-scoped.";
+  "path-scoped permissions.deny not ported; Gemini is name-scoped";
 
 export function parseArgv(argv) {
   const args = Array.isArray(argv) ? argv : [];
@@ -83,8 +82,13 @@ function hasScript(root, name) {
   return fs.existsSync(path.join(root, "scripts", name));
 }
 
-function hasPlatform(root) {
-  return fs.existsSync(path.join(root, "platform"));
+function withoutWritePath(arr) {
+  return arr.filter((x) => typeof x === "string" && !x.startsWith("Write("));
+}
+
+function loadConsumerDeny(root) {
+  const data = loadJson(path.join(root, ".rulesync/permissions.json"));
+  return Array.isArray(data.deny) ? withoutWritePath(data.deny) : [];
 }
 
 function presentAutorun(root) {
@@ -229,8 +233,11 @@ function applyClaude(root) {
   const post = desiredPost(root);
   if (post) hooks.PostToolUse = upsertGroups(hooks.PostToolUse, post);
   const permissions = isPlainObject(live.permissions) ? { ...live.permissions } : {};
-  const deny = Array.isArray(permissions.deny) ? [...permissions.deny] : [];
-  permissions.deny = hasPlatform(root) ? uniq([...deny, ...PLATFORM_DENY]) : deny;
+  const liveDeny = Array.isArray(permissions.deny) ? permissions.deny : [];
+  permissions.deny = uniq([
+    ...liveDeny.filter((x) => typeof x !== "string" || !x.startsWith("Write(")),
+    ...loadConsumerDeny(root),
+  ]);
   const next = { ...live, permissions, hooks };
   saveJson(abs, next);
 }
@@ -313,11 +320,7 @@ export function checkUnion(opts = {}) {
     {
       id: "claude",
       path: ".claude/settings.json",
-      needles: [
-        ...GRUNT_NEEDLES,
-        ...autorun,
-        ...(hasPlatform(root) ? PLATFORM_DENY : []),
-      ],
+      needles: [...GRUNT_NEEDLES, ...autorun, ...loadConsumerDeny(root)],
     },
     {
       id: "codex",