@lvlup-sw/exarchos 2.0.1

package/scripts/validate-refactor.sh

@@ -0,0 +1,234 @@
+#!/usr/bin/env bash
+# Validate Refactor
+# Runs tests/lint/typecheck with structured pass/fail output.
+# Replaces validate phase prose checklist with deterministic validation.
+#
+# Usage: validate-refactor.sh --repo-root <path> [--skip-lint] [--skip-typecheck]
+#
+# Exit codes:
+#   0 = all checks pass
+#   1 = one or more checks failed
+#   2 = usage error (missing required args)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+# ============================================================
+# ARGUMENT PARSING
+# ============================================================
+
+REPO_ROOT=""
+SKIP_LINT=false
+SKIP_TYPECHECK=false
+
+usage() {
+    cat << 'USAGE'
+Usage: validate-refactor.sh --repo-root <path> [--skip-lint] [--skip-typecheck]
+
+Required:
+  --repo-root <path>    Path to the repository root (must contain package.json)
+
+Optional:
+  --skip-lint           Skip lint check
+  --skip-typecheck      Skip typecheck
+  --help                Show this help message
+
+Exit codes:
+  0  All checks pass
+  1  One or more checks failed
+  2  Usage error (missing required args)
+
+Checks performed:
+  - npm run test:run (required)
+  - npm run lint (skipped if missing or --skip-lint)
+  - npm run typecheck (skipped if missing or --skip-typecheck)
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --repo-root)
+            if [[ -z "${2:-}" ]]; then
+                echo "Error: --repo-root requires a path argument" >&2
+                exit 2
+            fi
+            REPO_ROOT="$2"
+            shift 2
+            ;;
+        --skip-lint)
+            SKIP_LINT=true
+            shift
+            ;;
+        --skip-typecheck)
+            SKIP_TYPECHECK=true
+            shift
+            ;;
+        --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Error: Unknown argument '$1'" >&2
+            usage >&2
+            exit 2
+            ;;
+    esac
+done
+
+if [[ -z "$REPO_ROOT" ]]; then
+    echo "Error: --repo-root is required" >&2
+    usage >&2
+    exit 2
+fi
+
+# ============================================================
+# CHECK FUNCTIONS
+# ============================================================
+
+CHECK_PASS=0
+CHECK_FAIL=0
+RESULTS=()
+
+check_pass() {
+    local name="$1"
+    RESULTS+=("- **PASS**: $name")
+    CHECK_PASS=$((CHECK_PASS + 1))
+}
+
+check_fail() {
+    local name="$1"
+    local detail="${2:-}"
+    if [[ -n "$detail" ]]; then
+        RESULTS+=("- **FAIL**: $name — $detail")
+    else
+        RESULTS+=("- **FAIL**: $name")
+    fi
+    CHECK_FAIL=$((CHECK_FAIL + 1))
+}
+
+check_skip() {
+    local name="$1"
+    RESULTS+=("- **SKIP**: $name")
+}
+
+# ============================================================
+# HELPER: Check if npm script exists in package.json
+# ============================================================
+
+has_npm_script() {
+    local script_name="$1"
+    if [[ -f "$REPO_ROOT/package.json" ]]; then
+        # Use node or jq to check; fall back to grep
+        if command -v jq &>/dev/null; then
+            jq -e ".scripts[\"$script_name\"]" "$REPO_ROOT/package.json" &>/dev/null
+            return $?
+        else
+            grep -q "\"$script_name\"" "$REPO_ROOT/package.json" 2>/dev/null
+            return $?
+        fi
+    fi
+    return 1
+}
+
+# ============================================================
+# CHECK 1: Tests (npm run test:run)
+# ============================================================
+
+check_tests() {
+    local output
+    if ! output="$(cd "$REPO_ROOT" && npm run test:run 2>&1)"; then
+        check_fail "Tests (npm run test:run)" "Tests failed"
+        return 1
+    fi
+    check_pass "Tests (npm run test:run)"
+    return 0
+}
+
+# ============================================================
+# CHECK 2: Lint (npm run lint)
+# ============================================================
+
+check_lint() {
+    if [[ "$SKIP_LINT" == true ]]; then
+        check_skip "Lint (--skip-lint)"
+        return 0
+    fi
+
+    if ! has_npm_script "lint"; then
+        check_skip "Lint (no lint script in package.json)"
+        return 0
+    fi
+
+    local output
+    if ! output="$(cd "$REPO_ROOT" && npm run lint 2>&1)"; then
+        check_fail "Lint (npm run lint)" "Lint errors found"
+        return 1
+    fi
+    check_pass "Lint (npm run lint)"
+    return 0
+}
+
+# ============================================================
+# CHECK 3: Typecheck (npm run typecheck)
+# ============================================================
+
+check_typecheck() {
+    if [[ "$SKIP_TYPECHECK" == true ]]; then
+        check_skip "Typecheck (--skip-typecheck)"
+        return 0
+    fi
+
+    if ! has_npm_script "typecheck"; then
+        check_skip "Typecheck (no typecheck script in package.json)"
+        return 0
+    fi
+
+    local output
+    if ! output="$(cd "$REPO_ROOT" && npm run typecheck 2>&1)"; then
+        check_fail "Typecheck (npm run typecheck)" "Type errors found"
+        return 1
+    fi
+    check_pass "Typecheck (npm run typecheck)"
+    return 0
+}
+
+# ============================================================
+# EXECUTE CHECKS
+# ============================================================
+
+check_tests || true
+check_lint || true
+check_typecheck || true
+
+# ============================================================
+# STRUCTURED OUTPUT
+# ============================================================
+
+echo "## Refactor Validation Report"
+echo ""
+echo "**Repository:** \`$REPO_ROOT\`"
+echo ""
+
+for result in "${RESULTS[@]}"; do
+    echo "$result"
+done
+
+echo ""
+TOTAL=$((CHECK_PASS + CHECK_FAIL))
+echo "---"
+echo ""
+
+if [[ $CHECK_FAIL -eq 0 ]]; then
+    echo "**Result: PASS** ($CHECK_PASS/$TOTAL checks passed)"
+    exit 0
+else
+    echo "**Result: FAIL** ($CHECK_FAIL/$TOTAL checks failed)"
+    exit 1
+fi

package/scripts/validate-rm.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# Validates rm commands - blocks those targeting outside current directory
+# Exit 0 = allow, Exit 2 = block with message to stderr
+
+set -euo pipefail
+
+# Read tool input from stdin
+INPUT=$(cat)
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty')
+
+# If not an rm command, allow it
+if [[ ! "$COMMAND" =~ ^[[:space:]]*(rm|/bin/rm|/usr/bin/rm)[[:space:]] ]]; then
+  exit 0
+fi
+
+# Extract the working directory
+CWD=$(echo "$INPUT" | jq -r '.cwd // empty')
+[[ -z "$CWD" ]] && CWD="$PWD"
+
+# Function to check if a path is inside CWD
+is_inside_cwd() {
+  local target="$1"
+  local resolved
+
+  # Handle relative paths
+  if [[ "$target" != /* ]]; then
+    target="$CWD/$target"
+  fi
+
+  # Resolve to absolute path (handle .., symlinks, etc)
+  # Use realpath if target exists, otherwise normalize manually
+  if [[ -e "$target" ]]; then
+    resolved=$(realpath "$target" 2>/dev/null) || resolved="$target"
+  else
+    # For non-existent paths, normalize parent + basename
+    local parent=$(dirname "$target")
+    local base=$(basename "$target")
+    if [[ -d "$parent" ]]; then
+      resolved="$(realpath "$parent")/$base"
+    else
+      resolved="$target"
+    fi
+  fi
+
+  # Check if resolved path starts with CWD
+  local resolved_cwd
+  resolved_cwd=$(realpath "$CWD" 2>/dev/null) || resolved_cwd="$CWD"
+
+  [[ "$resolved" == "$resolved_cwd" || "$resolved" == "$resolved_cwd"/* ]]
+}
+
+# Quick sanity check for obviously catastrophic commands
+# The path resolution below handles the full check
+NORMALIZED_CMD=$(echo "$COMMAND" | tr -s ' ')
+if [[ "$NORMALIZED_CMD" =~ rm[[:space:]]+-[rRf]*[[:space:]]+/[[:space:]]*$ ]] || \
+   [[ "$NORMALIZED_CMD" =~ rm[[:space:]]+-[rRf]*[[:space:]]+/\*[[:space:]]*$ ]]; then
+  echo "BLOCKED: rm targeting filesystem root" >&2
+  exit 2
+fi
+
+# Parse rm arguments to find target paths
+# Strip rm command and flags, get remaining arguments
+TARGETS=$(echo "$COMMAND" | sed -E 's/^[[:space:]]*(rm|\/bin\/rm|\/usr\/bin\/rm)[[:space:]]+//' | \
+  sed -E 's/-[rRfivI]+[[:space:]]*//g' | \
+  sed -E 's/--[a-z-]+[[:space:]]*//g' | \
+  xargs -n1 2>/dev/null || true)
+
+# If no targets found, allow (rm with no args will fail anyway)
+[[ -z "$TARGETS" ]] && exit 0
+
+# Check each target
+BLOCKED_PATHS=()
+while IFS= read -r target; do
+  [[ -z "$target" ]] && continue
+
+  # Skip if target contains unexpanded variables (could be dangerous)
+  if [[ "$target" == *'$'* ]]; then
+    BLOCKED_PATHS+=("$target (contains unexpanded variable)")
+    continue
+  fi
+
+  if ! is_inside_cwd "$target"; then
+    BLOCKED_PATHS+=("$target")
+  fi
+done <<< "$TARGETS"
+
+if [[ ${#BLOCKED_PATHS[@]} -gt 0 ]]; then
+  echo "BLOCKED: rm targets paths outside current directory ($CWD):" >&2
+  printf "  - %s\n" "${BLOCKED_PATHS[@]}" >&2
+  exit 2
+fi
+
+exit 0

package/scripts/verify-delegation-saga.sh

@@ -0,0 +1,240 @@
+#!/usr/bin/env bash
+# verify-delegation-saga.sh — Verify saga step ordering in delegation event streams
+# Reads a JSONL event file and validates that delegation saga events appear in correct order.
+#
+# Usage: verify-delegation-saga.sh --feature-id <id> [--state-dir <path>]
+#
+# Exit codes:
+#   0 = valid saga (or no team events to validate)
+#   1 = violations found
+#   2 = usage error (missing args, no event file, empty stream)
+
+set -euo pipefail
+
+# ============================================================
+# ARGUMENT PARSING
+# ============================================================
+
+FEATURE_ID=""
+STATE_DIR="${HOME}/.claude/workflow-state"
+
+usage() {
+    cat >&2 << 'USAGE'
+Usage: verify-delegation-saga.sh --feature-id <id> [--state-dir <path>]
+
+Required:
+  --feature-id <id>    Feature identifier (used to locate events JSONL file)
+
+Optional:
+  --state-dir <path>   Directory containing event files (default: ~/.claude/workflow-state/)
+  --help               Show this help message
+
+Exit codes:
+  0  Valid saga ordering (or no team events to validate)
+  1  Saga ordering violations found
+  2  Usage error (missing args, no event file, empty stream)
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --feature-id)
+            if [[ -z "${2:-}" ]]; then
+                echo "Error: --feature-id requires a value" >&2
+                exit 2
+            fi
+            FEATURE_ID="$2"
+            shift 2
+            ;;
+        --state-dir)
+            if [[ -z "${2:-}" ]]; then
+                echo "Error: --state-dir requires a path argument" >&2
+                exit 2
+            fi
+            STATE_DIR="$2"
+            shift 2
+            ;;
+        --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Error: Unknown argument '$1'" >&2
+            usage
+            exit 2
+            ;;
+    esac
+done
+
+if [[ -z "$FEATURE_ID" ]]; then
+    echo "Error: --feature-id is required" >&2
+    usage
+    exit 2
+fi
+
+# ============================================================
+# DEPENDENCY CHECK
+# ============================================================
+
+if ! command -v jq &>/dev/null; then
+    echo "Error: jq is required but not installed" >&2
+    exit 2
+fi
+
+# ============================================================
+# LOCATE EVENT FILE
+# ============================================================
+
+EVENT_FILE="${STATE_DIR}/${FEATURE_ID}.events.jsonl"
+
+if [[ ! -f "$EVENT_FILE" ]]; then
+    echo "Error: Event file not found: $EVENT_FILE" >&2
+    exit 2
+fi
+
+# Check for empty file
+if [[ ! -s "$EVENT_FILE" ]]; then
+    echo "Error: Event file is empty: $EVENT_FILE" >&2
+    exit 2
+fi
+
+# ============================================================
+# EXTRACT TEAM EVENTS
+# ============================================================
+
+# Filter to only team.* events, preserving order
+TEAM_EVENTS="$(jq -c 'select(.type | startswith("team."))' "$EVENT_FILE")"
+
+# If no team events exist, nothing to validate — exit clean
+if [[ -z "$TEAM_EVENTS" ]]; then
+    echo "No team events found in event stream. Skipping saga validation."
+    exit 0
+fi
+
+# ============================================================
+# VALIDATION STATE
+# ============================================================
+
+VIOLATIONS=()
+HAS_SPAWNED=false
+HAS_PLANNED=false
+HAS_DISBANDED=false
+DISBANDED_SEQUENCE=0
+
+# Track planned task IDs
+declare -a PLANNED_TASK_IDS=()
+
+# Track dispatched task IDs (from assignedTaskIds)
+declare -a DISPATCHED_TASK_IDS=()
+
+# ============================================================
+# RULE VALIDATION — Process events in sequence order
+# ============================================================
+
+while IFS= read -r event; do
+    event_type="$(echo "$event" | jq -r '.type')"
+    event_seq="$(echo "$event" | jq -r '.sequence')"
+
+    case "$event_type" in
+        team.spawned)
+            HAS_SPAWNED=true
+            ;;
+
+        team.task.planned)
+            # Rule 1: team.spawned must appear before any team.task.planned
+            if [[ "$HAS_SPAWNED" != true ]]; then
+                VIOLATIONS+=("VIOLATION: team.task.planned (seq $event_seq) appeared before team.spawned")
+            fi
+
+            # Rule 4: team.disbanded must be the last team event
+            if [[ "$HAS_DISBANDED" == true ]]; then
+                VIOLATIONS+=("VIOLATION: team.task.planned (seq $event_seq) appeared after team.disbanded (seq $DISBANDED_SEQUENCE)")
+            fi
+
+            # Track planned task IDs — support both single taskId and batched taskIds[]
+            while IFS= read -r tid; do
+                PLANNED_TASK_IDS+=("$tid")
+            done < <(echo "$event" | jq -r '(.data.taskIds // [])[] // empty, (.data.taskId // empty)')
+            HAS_PLANNED=true
+            ;;
+
+        team.teammate.dispatched)
+            # Rule 1: team.spawned must appear before dispatch
+            if [[ "$HAS_SPAWNED" != true ]]; then
+                VIOLATIONS+=("VIOLATION: team.teammate.dispatched (seq $event_seq) appeared before team.spawned")
+            fi
+
+            # Rule 2: team.task.planned must appear before any team.teammate.dispatched
+            if [[ "$HAS_PLANNED" != true ]]; then
+                VIOLATIONS+=("VIOLATION: team.teammate.dispatched (seq $event_seq) appeared before any team.task.planned")
+            fi
+
+            # Rule 4: team.disbanded must be the last team event
+            if [[ "$HAS_DISBANDED" == true ]]; then
+                VIOLATIONS+=("VIOLATION: team.teammate.dispatched (seq $event_seq) appeared after team.disbanded (seq $DISBANDED_SEQUENCE)")
+            fi
+
+            # Track dispatched task IDs for coverage check (safe on missing/null field)
+            while IFS= read -r tid; do
+                DISPATCHED_TASK_IDS+=("$tid")
+            done < <(echo "$event" | jq -r '(.data.assignedTaskIds // [])[]')
+            ;;
+
+        team.disbanded)
+            HAS_DISBANDED=true
+            DISBANDED_SEQUENCE="$event_seq"
+            ;;
+
+        # Other team.* events — no specific rules yet, but check disbanded constraint
+        team.*)
+            if [[ "$HAS_DISBANDED" == true ]]; then
+                VIOLATIONS+=("VIOLATION: $event_type (seq $event_seq) appeared after team.disbanded (seq $DISBANDED_SEQUENCE)")
+            fi
+            ;;
+    esac
+done <<< "$TEAM_EVENTS"
+
+# ============================================================
+# RULE 3: All dispatched task IDs must have been planned
+# ============================================================
+
+if [[ ${#DISPATCHED_TASK_IDS[@]} -gt 0 ]]; then
+    for dispatched_id in "${DISPATCHED_TASK_IDS[@]}"; do
+        found=false
+        if [[ ${#PLANNED_TASK_IDS[@]} -gt 0 ]]; then
+            for planned_id in "${PLANNED_TASK_IDS[@]}"; do
+                if [[ "$dispatched_id" == "$planned_id" ]]; then
+                    found=true
+                    break
+                fi
+            done
+        fi
+        if [[ "$found" != true ]]; then
+            VIOLATIONS+=("VIOLATION: Dispatched task '$dispatched_id' was never planned (no team.task.planned event with this taskId)")
+        fi
+    done
+fi
+
+# ============================================================
+# OUTPUT AND EXIT
+# ============================================================
+
+if [[ ${#VIOLATIONS[@]} -gt 0 ]]; then
+    echo "## Delegation Saga Validation"
+    echo ""
+    echo "**Status:** FAILED for feature \`$FEATURE_ID\`"
+    echo ""
+    echo "### Violations"
+    echo ""
+    for v in "${VIOLATIONS[@]}"; do
+        echo "- $v"
+    done
+    echo ""
+    echo "**Total:** ${#VIOLATIONS[@]} violation(s) found."
+    exit 1
+fi
+
+echo "## Delegation Saga Validation"
+echo ""
+echo "**Status:** PASSED for feature \`$FEATURE_ID\`"
+exit 0