@miller-tech/uap 1.11.0 → 1.13.0

package/templates/hooks/forgecode.plugin.sh

@@ -1,128 +1,429 @@
 # UAP ForgeCode Integration Plugin
-// Auto-generated by: uap hooks install forgecode  
-// Add this line to ~/.zshrc after installing UAP: source "$PWD/.forge/forgecode.plugin.sh"
+# Auto-generated by: uap hooks install forgecode
+# Add this line to ~/.zshrc after installing UAP: source "$PWD/.forge/forgecode.plugin.sh"
 
 _uap_forgecode_session_start() {
-  # Load recent memory context from UAP database before : command execution
-  
+  # Load recent memory context from UAP database before command execution
+
   local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
-  
-  if [ ! -f "\$PROJECT_DIR/./agents/data/memory/short_term.db" ]; then exit 0; fi
+  local DB_PATH="\$PROJECT_DIR/agents/data/memory/short_term.db"
+  local COORD_DB="\$PROJECT_DIR/agents/data/coordination/coordination.db"
+  local POLICY_DB="\$PROJECT_DIR/agents/data/memory/policies.db"
+  local AGENT_ID="forgecode-\$(date +%s | tail -c 7)"
+
+  if [ ! -f "\$DB_PATH" ]; then return 0; fi
 
   # Clean stale agents from coordination DB (heartbeat >24h old)
-  if [ -f "\$PROJECT_DIR/./agents/data/coordination/coordination.db" ] && command -v sqlite3 &> /dev/null; then
-    sqlite3 "\$PROJECT_DIR/./agents/data/coordination/coordination.db" "
+  if [ -f "\$COORD_DB" ] && command -v sqlite3 &> /dev/null; then
+    sqlite3 "\$COORD_DB" "
       DELETE FROM work_claims WHERE agent_id IN (
         SELECT id FROM agent_registry
-        WHERE status IN ('active','idle') AND last_heartbeat < datetime('now','-24 hours');
+        WHERE status IN ('active','idle') AND last_heartbeat < datetime('now','-24 hours')
       );
+      DELETE FROM work_announcements WHERE agent_id IN (
+        SELECT id FROM agent_registry
+        WHERE status IN ('active','idle') AND last_heartbeat < datetime('now','-24 hours')
+      ) AND completed_at IS NULL;
       UPDATE agent_registry SET status='failed'
         WHERE status IN ('active','idle') AND last_heartbeat < datetime('now','-24 hours');
     " 2>/dev/null || true
+
+    # Register this agent
+    sqlite3 "\$COORD_DB" "
+      INSERT OR REPLACE INTO agent_registry (id, name, session_id, status, capabilities, started_at, last_heartbeat)
+      VALUES ('\$AGENT_ID', 'forgecode', '\$AGENT_ID', 'active', '[]', datetime('now'), datetime('now'));
+    " 2>/dev/null || true
+
+    # Auto-announce session
+    sqlite3 "\$COORD_DB" "
+      INSERT INTO work_announcements (agent_id, agent_name, intent_type, resource, description, announced_at)
+      VALUES ('\$AGENT_ID', 'forgecode', 'editing', 'session-scope', 'Session \$AGENT_ID active', datetime('now'));
+    " 2>/dev/null || true
+
+    # Detect overlaps from other agents
+    local OVERLAPS=\$(sqlite3 "\$COORD_DB" "
+      SELECT agent_id || ' on ' || resource || ' (' || intent_type || ')'
+      FROM work_announcements
+      WHERE completed_at IS NULL AND agent_id != '\$AGENT_ID'
+      ORDER BY announced_at DESC LIMIT 5;
+    " 2>/dev/null || true)
+
+    if [ -n "\$OVERLAPS" ]; then
+      echo "[UAP-ForgeCode] OVERLAP DETECTED: \$OVERLAPS" >&2
+    fi
+
+    export UAP_AGENT_ID="\$AGENT_ID"
+  fi
+
+  # Policy summary with enforcement details
+  if [ -f "\$POLICY_DB" ] && command -v sqlite3 &> /dev/null; then
+    local ACTIVE_POLICIES=\$(sqlite3 "\$POLICY_DB" "SELECT COUNT(*) FROM policies WHERE isActive=1;" 2>/dev/null || echo 0)
+    local REQUIRED_POLICIES=\$(sqlite3 "\$POLICY_DB" "SELECT COUNT(*) FROM policies WHERE isActive=1 AND level='REQUIRED';" 2>/dev/null || echo 0)
+    echo "[UAP-ForgeCode] Policies: \$ACTIVE_POLICIES active (\$REQUIRED_POLICIES REQUIRED)" >&2
+
+    # Inject full policy enforcement context
+    local POLICY_LIST=\$(sqlite3 "\$POLICY_DB" "
+      SELECT '[' || level || '] ' || name || ' (' || category || ')'
+      FROM policies WHERE isActive=1 ORDER BY level DESC, priority DESC;
+    " 2>/dev/null || true)
+
+    if [ -n "\$POLICY_LIST" ]; then
+      echo "[UAP-ForgeCode] Active policy enforcement:" >&2
+      echo "\$POLICY_LIST" | while IFS= read -r line; do
+        echo "[UAP-ForgeCode]   \$line" >&2
+      done
+    fi
   fi
 
   # Inject recent memory context via environment variable for ForgeCode to read
   local MEMORIES=""
-  
+
   if command -v sqlite3 &> /dev/null; then
-    MEMORIES=\$(sqlite3 "\$PROJECT_DIR/./agents/data/memory/short_term.db" "
+    MEMORIES=\$(sqlite3 "\$DB_PATH" "
       SELECT type, substr(content,1,80) FROM memories
       WHERE timestamp >= datetime('now', '-1 day')
       ORDER BY id DESC LIMIT 5;
     " 2>/dev/null || true)
-    
+
     if [ -n "\$MEMORIES" ]; then
-      export UAP_CONTEXT="\$MEMORIES"  
-      echo "[UAP-ForgCode] ✅ Memory context loaded for session (\$(echo \"\$MEMORIES\" | wc -l)) recent items)" >&2
+      export UAP_CONTEXT="\$MEMORIES"
+      echo "[UAP-ForgeCode] Memory context loaded (\$(echo \"\$MEMORIES\" | wc -l) recent items)" >&2
     fi
   fi
-  
+
   # Load open loops/high importance decisions from session memories
   local OPEN_LOOPS=""
-  
+
   if command -v sqlite3 &> /dev/null; then
-    OPEN_LOOPS=\$(sqlite3 "\$PROJECT_DIR/./agents/data/memory/short_term.db" "
+    OPEN_LOOPS=\$(sqlite3 "\$DB_PATH" "
       SELECT content FROM session_memories
       WHERE type IN ('action','goal','decision') AND importance >= 7
       ORDER BY id DESC LIMIT 5;
     " 2>/dev/null || true)
-    
+
     if [ -n "\$OPEN_LOOPS" ]; then
-      export UAP_OPEN_LOOPS="\$OPEN_LOOPS"  
-      echo "[UAP-ForgCode] ℹ️ Open loops detected (\$(echo \"\$OPEN_LOOPS\" | grep -c .)) high-priority items pending" >&2
+      export UAP_OPEN_LOOPS="\$OPEN_LOOPS"
+      echo "[UAP-ForgeCode] Open loops: \$(echo \"\$OPEN_LOOPS\" | grep -c .) high-priority items pending" >&2
     fi
   fi
-  
+
   # Warn about stale worktrees if any exist
-  local WORKTREES_DIR="\$PROJECT_DIR/.worktrees"  
+  local WORKTREES_DIR="\$PROJECT_DIR/.worktrees"
   if [ -d "\$WORKTREES_DIR" ]; then
     local STALE_COUNT=\$(find "\$WORKTREES_DIR" -maxdepth 1 -mindepth 1 -type d 2>/dev/null | wc -l)
-    if [ "\$STALE_COUNT" -gt 0 ] && command -v find &> /dev/null; then
-      echo "[UAP-ForgCode] ⚠️ Stale worktrees: \$STALE_COUNT (run 'uap worktree list' to cleanup)" >&2
+    if [ "\$STALE_COUNT" -gt 0 ]; then
+      echo "[UAP-ForgeCode] Worktrees: \$STALE_COUNT active (run 'uap worktree list' to review)" >&2
     fi
-  fi  
+  fi
 }
 
 _uap_forgecode_pre_compact() {
   # Save compaction marker before model switches in ForgeCode session
-  
+
+  local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
+  local DB_PATH="\$PROJECT_DIR/agents/data/memory/short_term.db"
+  local COORD_DB="\$PROJECT_DIR/agents/data/coordination/coordination.db"
+
+  if [ ! -f "\$DB_PATH" ]; then return 0; fi
+
+  local TIMESTAMP=\$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+  # Record compaction event in memory database
+  sqlite3 "\$DB_PATH" "INSERT OR IGNORE INTO memories (timestamp, type, content) VALUES ('\${TIMESTAMP}', 'action', '[pre-compact] Context saved before model switch');" 2>/dev/null || true
+
+  # Flush pending deploys before session ends
+  if [ -f "\$COORD_DB" ] && command -v sqlite3 &> /dev/null; then
+    local PENDING=\$(sqlite3 "\$COORD_DB" "SELECT COUNT(*) FROM deploy_queue WHERE status='pending';" 2>/dev/null || echo 0)
+    if [ "\$PENDING" -gt 0 ] 2>/dev/null && [ -f "\$PROJECT_DIR/dist/bin/cli.js" ]; then
+      echo "[UAP-ForgeCode] Flushing \$PENDING pending deploy actions..." >&2
+      node "\$PROJECT_DIR/dist/bin/cli.js" deploy flush 2>/dev/null || true
+    fi
+  fi
+
+  # Close announcements and deregister agent
+  if [ -f "\$COORD_DB" ] && [ -n "\${UAP_AGENT_ID:-}" ]; then
+    sqlite3 "\$COORD_DB" "
+      UPDATE work_announcements SET completed_at=datetime('now') WHERE agent_id='\$UAP_AGENT_ID' AND completed_at IS NULL;
+      UPDATE agent_registry SET status='completed' WHERE id='\$UAP_AGENT_ID';
+    " 2>/dev/null || true
+  fi
+
+  echo "[UAP-ForgeCode] Pre-compaction marker saved at \$TIMESTAMP" >&2
+}
+
+_uap_forgecode_pre_edit_guard() {
+  # Guard against edits outside worktrees. Call before any file edit.
+  # Usage: _uap_forgecode_pre_edit_guard "/path/to/file"
+  # Returns 0 if allowed, 1 if blocked.
+
+  local FILE_PATH="\$1"
+  local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
+
+  if [ -z "\$FILE_PATH" ]; then
+    echo "[UAP-ForgeCode] pre-edit-guard: no file path provided" >&2
+    return 1
+  fi
+
+  # Exempt paths that don't require worktree enforcement
+  case "\$FILE_PATH" in
+    */agents/data/*|*/node_modules/*|*/.uap-backups/*|*/.uap/*|*/.git/*|*/dist/*)
+      return 0
+      ;;
+  esac
+
+  # Check if path is inside .worktrees/
+  if echo "\$FILE_PATH" | grep -q '\.worktrees/' 2>/dev/null; then
+    return 0
+  fi
+
+  echo "[UAP-ForgeCode] WORKTREE VIOLATION: Edit blocked for '\$FILE_PATH'" >&2
+  echo "[UAP-ForgeCode] File is not inside .worktrees/ and is not an exempt path." >&2
+  echo "[UAP-ForgeCode] Run 'uap worktree create <slug>' first, then edit inside .worktrees/NNN-<slug>/." >&2
+  return 1
+}
+
+_uap_forgecode_pre_bash_guard() {
+  # Guard against dangerous bash commands. Call before executing commands.
+  # Usage: _uap_forgecode_pre_bash_guard "command string"
+  # Returns 0 if allowed, 1 if blocked.
+
+  local CMD="\$1"
+  local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
+
+  if [ -z "\$CMD" ]; then
+    return 0
+  fi
+
+  # Block terraform apply/destroy
+  if echo "\$CMD" | grep -qE 'terraform\s+(apply|destroy)' 2>/dev/null; then
+    echo "[UAP-ForgeCode] BLOCKED: terraform apply/destroy requires explicit approval outside ForgeCode." >&2
+    return 1
+  fi
+
+  # Block git push --force
+  if echo "\$CMD" | grep -qE 'git\s+push\s+.*--force' 2>/dev/null; then
+    echo "[UAP-ForgeCode] BLOCKED: git push --force is prohibited. Use regular push or --force-with-lease." >&2
+    return 1
+  fi
+
+  # Block git commit on master/main outside worktrees
+  if echo "\$CMD" | grep -qE 'git\s+commit' 2>/dev/null; then
+    local CURRENT_BRANCH=\$(git -C "\$PROJECT_DIR" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
+    local IN_WORKTREE="false"
+    if echo "\$PWD" | grep -q '\.worktrees/' 2>/dev/null; then
+      IN_WORKTREE="true"
+    fi
+    if [ "\$IN_WORKTREE" = "false" ] && echo "\$CURRENT_BRANCH" | grep -qE '^(main|master)\$' 2>/dev/null; then
+      echo "[UAP-ForgeCode] BLOCKED: git commit on \$CURRENT_BRANCH outside a worktree is prohibited." >&2
+      echo "[UAP-ForgeCode] Create a worktree first: uap worktree create <slug>" >&2
+      return 1
+    fi
+  fi
+
+  # Block git push to master/main
+  if echo "\$CMD" | grep -qE 'git\s+push\s+(origin\s+)?(main|master)' 2>/dev/null; then
+    echo "[UAP-ForgeCode] BLOCKED: Direct push to main/master is prohibited. Use a PR workflow." >&2
+    return 1
+  fi
+
+  # Block sed/awk editing package.json version
+  if echo "\$CMD" | grep -qE '(sed|awk).*package\.json.*version|version.*package\.json.*(sed|awk)' 2>/dev/null; then
+    echo "[UAP-ForgeCode] BLOCKED: Manual version edits in package.json are prohibited." >&2
+    echo "[UAP-ForgeCode] Use: npm run version:patch / version:minor / version:major" >&2
+    return 1
+  fi
+
+  return 0
+}
+
+_uap_forgecode_post_edit_reminder() {
+  # Remind about build gates and backups after file edits.
+  # Usage: _uap_forgecode_post_edit_reminder "/path/to/file"
+
+  local FILE_PATH="\$1"
+  local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
+
+  if [ -z "\$FILE_PATH" ]; then
+    return 0
+  fi
+
+  # TypeScript build gate reminder
+  case "\$FILE_PATH" in
+    *.ts|*.tsx)
+      echo "[UAP-ForgeCode] BUILD GATE: '\$FILE_PATH' was edited. Run 'npm run build' before editing the next file." >&2
+      ;;
+  esac
+
+  # Check if backup exists for today
+  local TODAY=\$(date +%Y-%m-%d)
+  local BASENAME=\$(basename "\$FILE_PATH")
+  local BACKUP_DIR="\$PROJECT_DIR/.uap-backups/\$TODAY"
+
+  if [ ! -d "\$BACKUP_DIR" ] || [ ! -f "\$BACKUP_DIR/\$BASENAME" ]; then
+    echo "[UAP-ForgeCode] BACKUP MISSING: No backup found for '\$BASENAME' in .uap-backups/\$TODAY/" >&2
+    echo "[UAP-ForgeCode] Run: mkdir -p .uap-backups/\$TODAY && cp \$FILE_PATH .uap-backups/\$TODAY/" >&2
+  fi
+}
+
+_uap_forgecode_completion_gate() {
+  # Check completion gates before claiming DONE.
+  # Prints a checklist of required items.
+  # Usage: _uap_forgecode_completion_gate
+
   local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
-  
-  if [ ! -f "\$PROJECT_DIR/./agents/data/memory/short_term.db" ]; then exit 0; fi
 
+  echo "[UAP-ForgeCode] === COMPLETION GATE CHECKLIST ===" >&2
+
+  # Check for code changes
+  local CODE_CHANGES=\$(git -C "\$PROJECT_DIR" diff --name-only HEAD 2>/dev/null || true)
+  local STAGED_CHANGES=\$(git -C "\$PROJECT_DIR" diff --cached --name-only 2>/dev/null || true)
+  local ALL_CHANGES="\$CODE_CHANGES\$STAGED_CHANGES"
+
+  if [ -z "\$ALL_CHANGES" ]; then
+    echo "[UAP-ForgeCode]   [?] No code changes detected (clean working tree)" >&2
+    return 0
+  fi
+
+  # Check for test file changes
+  local TEST_CHANGES=""
+  if [ -n "\$CODE_CHANGES" ]; then
+    TEST_CHANGES=\$(echo "\$CODE_CHANGES" | grep -E '\.test\.(ts|tsx|js|jsx)\$' 2>/dev/null || true)
+  fi
+  if [ -z "\$TEST_CHANGES" ] && [ -n "\$STAGED_CHANGES" ]; then
+    TEST_CHANGES=\$(echo "\$STAGED_CHANGES" | grep -E '\.test\.(ts|tsx|js|jsx)\$' 2>/dev/null || true)
+  fi
+
+  if [ -n "\$TEST_CHANGES" ]; then
+    echo "[UAP-ForgeCode]   [OK] Test files modified" >&2
+  else
+    echo "[UAP-ForgeCode]   [FAIL] No test files changed — at least 2 new tests required" >&2
+  fi
+
+  # Check for version bump (look for package.json version change in recent commits)
+  local VERSION_BUMPED="false"
+  if git -C "\$PROJECT_DIR" log --oneline -5 2>/dev/null | grep -qiE 'version|bump|release' 2>/dev/null; then
+    VERSION_BUMPED="true"
+  fi
+
+  if [ "\$VERSION_BUMPED" = "true" ]; then
+    echo "[UAP-ForgeCode]   [OK] Version bump detected in recent commits" >&2
+  else
+    echo "[UAP-ForgeCode]   [WARN] No version bump detected — run npm run version:patch/minor/major" >&2
+  fi
+
+  # Check build status
+  if [ -f "\$PROJECT_DIR/dist/bin/cli.js" ]; then
+    echo "[UAP-ForgeCode]   [OK] Build artifacts exist (dist/)" >&2
+  else
+    echo "[UAP-ForgeCode]   [FAIL] No build artifacts — run 'npm run build'" >&2
+  fi
+
+  # Check for TypeScript changes without build
+  local TS_CHANGES=""
+  if [ -n "\$ALL_CHANGES" ]; then
+    TS_CHANGES=\$(echo "\$ALL_CHANGES" | grep -E '\.(ts|tsx)\$' 2>/dev/null || true)
+  fi
+
+  if [ -n "\$TS_CHANGES" ]; then
+    echo "[UAP-ForgeCode]   [REMIND] TypeScript files changed — verify 'npm run build' passes" >&2
+    echo "[UAP-ForgeCode]   [REMIND] Run 'tsc --noEmit' for type-check" >&2
+  fi
+
+  echo "[UAP-ForgeCode] === Run all gates: npm run build && npm test ===" >&2
+}
+
+_uap_forgecode_session_end() {
+  # Clean up session resources on ForgeCode session end.
+  # Usage: _uap_forgecode_session_end
+
+  local PROJECT_DIR="${FORGE_UAP_PROJECT:-.}"
+  local DB_PATH="\$PROJECT_DIR/agents/data/memory/short_term.db"
+  local COORD_DB="\$PROJECT_DIR/agents/data/coordination/coordination.db"
   local TIMESTAMP=\$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-  
-  # Record compaction event in memory database for session tracking  
-  sqlite3 "\$PROJECT_DIR/./agents/data/memory/short_term.db" "INSERT OR IGNORE INTO memories (timestamp, type, content) VALUES ('\${TIMESTAMP}', 'action', '[pre-compact] Context saved before model switch');" 2>/dev/null || true
-  
-  echo "[UAP-ForgCode] ✅ Pre-compaction marker saved at \$TIMESTAMP" >&2
+
+  # Store session end marker in memory DB
+  if [ -f "\$DB_PATH" ] && command -v sqlite3 &> /dev/null; then
+    sqlite3 "\$DB_PATH" "
+      INSERT OR IGNORE INTO memories (timestamp, type, content)
+      VALUES ('\$TIMESTAMP', 'action', '[session-end] ForgeCode session ended at \$TIMESTAMP');
+    " 2>/dev/null || true
+    echo "[UAP-ForgeCode] Session end marker stored at \$TIMESTAMP" >&2
+  fi
+
+  # Clean up agent registration and work claims
+  if [ -f "\$COORD_DB" ] && command -v sqlite3 &> /dev/null && [ -n "\${UAP_AGENT_ID:-}" ]; then
+    sqlite3 "\$COORD_DB" "
+      UPDATE work_announcements SET completed_at=datetime('now')
+        WHERE agent_id='\$UAP_AGENT_ID' AND completed_at IS NULL;
+      DELETE FROM work_claims WHERE agent_id='\$UAP_AGENT_ID';
+      UPDATE agent_registry SET status='completed'
+        WHERE id='\$UAP_AGENT_ID';
+    " 2>/dev/null || true
+    echo "[UAP-ForgeCode] Agent \$UAP_AGENT_ID deregistered" >&2
+  fi
+
+  # Clean up old backups (older than 7 days)
+  local BACKUP_DIR="\$PROJECT_DIR/.uap-backups"
+  if [ -d "\$BACKUP_DIR" ]; then
+    find "\$BACKUP_DIR" -maxdepth 1 -mindepth 1 -type d -mtime +7 -exec rm -rf {} \; 2>/dev/null || true
+    echo "[UAP-ForgeCode] Cleaned up backups older than 7 days" >&2
+  fi
+
+  unset UAP_AGENT_ID
+  unset UAP_CONTEXT
+  unset UAP_OPEN_LOOPS
 }
 
-# Auto-register hooks with ForgeCode's : command via environment variables  
+# Auto-register hooks with ForgeCode's : command via environment variables
 _uap_forgecode_register() {
   # Add to ~/.zshrc if not already present (user confirmation required)
   local ZSHRC="\$HOME/.zshrc"
-  
+
   if [ -f "\$ZSHRC" ] && ! grep -q "UAP_FORGE_CODE_PLUGIN" "\$ZSHRC"; then
     echo '# UAP ForgeCode Integration' >> "\$ZSHRC"
-    echo 'source "$PWD/.forge/forgecode.plugin.sh"' >> "\$ZSHRC"  
+    echo 'source "$PWD/.forge/forgecode.plugin.sh"' >> "\$ZSHRC"
     echo '[UAP-ForgCode] Added plugin source to ~/.zshrc - run "source \$HOME/.zshrc" or restart terminal to activate' >&2
   fi
-  
+
   # Create config file for ForgeCode settings
   local CONFIG_PATH="\$PROJECT_DIR/.forge/settings.local.json"
-  
+
   if [ ! -f "\$CONFIG_PATH" ]; then
     cat > "\$CONFIG_PATH" <<EOF
 {
   "uapIntegration": {
     "enabled": true,
     "memoryDbPath": "./agents/data/memory/short_term.db",
-    "coordinationDbPath": "./agents/data/coordination/coordination.db",  
-    "hooksEnabled": ["sessionStart", "preCompact"]
+    "coordinationDbPath": "./agents/data/coordination/coordination.db",
+    "hooksEnabled": ["sessionStart", "preCompact", "preEditGuard", "preBashGuard", "postEditReminder", "completionGate", "sessionEnd"]
   },
   "worktrees": {
     "enabled": true,
     "directory": ".worktrees"
   }
 }
-EOF 
-    echo "[UAP-ForgCode] ✅ Created .forge/settings.local.json with UAP integration config" >&2  
+EOF
+    echo "[UAP-ForgCode] Created .forge/settings.local.json with UAP integration config" >&2
   fi
-  
+
   # Add to gitignore if not present
   local GITIGNORE="\$PROJECT_DIR/.gitignore"
   if [ -f "\$GITIGNORE" ] && ! grep -q "settings.local.json" "\$GITIGNORE"; then
-    echo "# UAP ForgeCode settings (auto-generated)" >> "\$GITIGNORE"  
+    echo "# UAP ForgeCode settings (auto-generated)" >> "\$GITIGNORE"
     echo ".forge/settings.local.json" >> "\$GITIGNORE"
-    echo "[UAP-ForgCode] ✅ Added .forge/ to gitignore for local config files" >&2
+    echo "[UAP-ForgCode] Added .forge/ to gitignore for local config files" >&2
   fi
-  
+
   # Auto-activate hooks in current session if running interactively
-  _uap_forgecode_session_start &>/dev/null || true  
+  _uap_forgecode_session_start &>/dev/null || true
 }
 
 # Export functions so they can be sourced by other scripts
 export -f _uap_forgecode_session_start \
            _uap_forgecode_pre_compact \
+           _uap_forgecode_pre_edit_guard \
+           _uap_forgecode_pre_bash_guard \
+           _uap_forgecode_post_edit_reminder \
+           _uap_forgecode_completion_gate \
+           _uap_forgecode_session_end \
            _uap_forgecode_register;

package/templates/hooks/post-compact.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+# UAP Post-Compact Compliance Re-injection — INFORMATIONAL hook
+# Event: PostCompact
+# Re-injects policy awareness after context compaction.
+# Always exits 0 (never blocks).
+set -euo pipefail
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-${FACTORY_PROJECT_DIR:-${CURSOR_PROJECT_DIR:-.}}}"
+DB_PATH="${PROJECT_DIR}/agents/data/memory/short_term.db"
+COORD_DB="${PROJECT_DIR}/agents/data/coordination/coordination.db"
+
+output=""
+
+# ─── Active Policy Summary ──────────────────────────────────────
+output+="<system-reminder>"$'\n'
+output+="## UAP COMPLIANCE RESTORED (Post-Compact)"$'\n'
+output+=""$'\n'
+output+="Context was compacted. All policies remain in effect:"$'\n'
+output+=""$'\n'
+output+="### BLOCKING HOOKS (hard enforcement):"$'\n'
+output+="- **Worktree File Guard**: Edit/Write operations BLOCKED outside .worktrees/"$'\n'
+output+="- **Dangerous Command Guard**: terraform apply/destroy, git push --force, direct master commits BLOCKED"$'\n'
+output+="- **Completion Gate**: Stop/completion checked for test, build, version gates"$'\n'
+output+=""$'\n'
+output+="### ACTIVE POLICIES [all REQUIRED]:"$'\n'
+output+="1. worktree-enforcement — All file changes in .worktrees/NNN-<slug>/"$'\n'
+output+="2. worktree-file-guard — Edit/Write paths must be inside worktrees"$'\n'
+output+="3. pre-edit-build-gate — npm run build before/after .ts edits"$'\n'
+output+="4. completion-gate — 2+ tests, build, lint, version bump before DONE"$'\n'
+output+="5. semver-versioning — npm run version:patch/minor/major (no manual edits)"$'\n'
+output+="6. mandatory-file-backup — Backup files before modification"$'\n'
+output+="7. iac-state-parity — All infra changes reflected in IaC"$'\n'
+output+="8. iac-pipeline-enforcement — No local terraform apply/destroy"$'\n'
+output+="9. kubectl-verify-backport — kubectl changes backported to IaC"$'\n'
+output+="10. definition-of-done-iac — Pipeline apply + kubectl verify required"$'\n'
+output+="11. image-asset-verification — Script-based, not vision-based [RECOMMENDED]"$'\n'
+output+=""$'\n'
+output+="### MANDATORY BEFORE WORK:"$'\n'
+output+="- Verify you are in a worktree: pwd must contain .worktrees/"$'\n'
+output+="- Run: uap task ready"$'\n'
+output+="- Query memory: uap memory query \"<current task>\""$'\n'
+output+=""$'\n'
+
+# ─── Restore session context from memory ─────────────────────────
+if [ -f "$DB_PATH" ]; then
+  recent=$(sqlite3 "$DB_PATH" "
+    SELECT type || ': ' || substr(content, 1, 100) FROM memories
+    WHERE timestamp >= datetime('now', '-2 hours')
+    ORDER BY id DESC LIMIT 5;
+  " 2>/dev/null || true)
+
+  if [ -n "$recent" ]; then
+    output+="### Recent Memory (last 2h):"$'\n'
+    output+="$recent"$'\n'
+    output+=""$'\n'
+  fi
+
+  # Session decisions
+  decisions=$(sqlite3 "$DB_PATH" "
+    SELECT substr(content, 1, 120) FROM session_memories
+    WHERE type = 'decision' AND importance >= 6
+    ORDER BY id DESC LIMIT 3;
+  " 2>/dev/null || true)
+
+  if [ -n "$decisions" ]; then
+    output+="### Recent Decisions:"$'\n'
+    output+="$decisions"$'\n'
+    output+=""$'\n'
+  fi
+fi
+
+# ─── Multi-agent coordination status ────────────────────────────
+if [ -f "$COORD_DB" ]; then
+  active_work=$(sqlite3 "$COORD_DB" "
+    SELECT agent_id || ' editing ' || resource
+    FROM work_announcements
+    WHERE completed_at IS NULL
+    ORDER BY announced_at DESC LIMIT 5;
+  " 2>/dev/null || true)
+
+  if [ -n "$active_work" ]; then
+    output+="### Active Work (coordinate — do not conflict):"$'\n'
+    output+="$active_work"$'\n'
+    output+=""$'\n'
+  fi
+fi
+
+# ─── Worktree status ────────────────────────────────────────────
+CURRENT_BRANCH=$(git -C "$PROJECT_DIR" rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
+IS_WORKTREE="false"
+if echo "$PROJECT_DIR" | grep -q '\.worktrees/'; then
+  IS_WORKTREE="true"
+fi
+GIT_DIR=$(git -C "$PROJECT_DIR" rev-parse --git-dir 2>/dev/null || true)
+GIT_COMMON=$(git -C "$PROJECT_DIR" rev-parse --git-common-dir 2>/dev/null || true)
+if [ -n "$GIT_DIR" ] && [ -n "$GIT_COMMON" ] && [ "$GIT_DIR" != "$GIT_COMMON" ]; then
+  IS_WORKTREE="true"
+fi
+
+if [ "$IS_WORKTREE" = "false" ] && { [ "$CURRENT_BRANCH" = "main" ] || [ "$CURRENT_BRANCH" = "master" ]; }; then
+  output+="### ⚠ WORKTREE VIOLATION: You are on $CURRENT_BRANCH in the project root."$'\n'
+  output+="Run: uap worktree create <slug> BEFORE any file edits."$'\n'
+  output+=""$'\n'
+else
+  output+="### Worktree: ACTIVE (branch: $CURRENT_BRANCH)"$'\n'
+  output+=""$'\n'
+fi
+
+output+="</system-reminder>"$'\n'
+
+echo "$output"

package/templates/hooks/post-tool-use-edit-write.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# UAP Build Gate Reminder — INFORMATIONAL hook
+# Event: PostToolUse (matcher: Edit|Write)
+# Reminds about pre-edit build gate after .ts file modifications.
+# Enforces: pre-edit-build-gate policy.
+# Always exits 0 (never blocks).
+set -euo pipefail
+
+# Read tool input from stdin (JSON)
+INPUT=$(cat)
+
+# Extract file_path from tool_input
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.filePath // empty' 2>/dev/null || true)
+
+# If we can't determine the file path, exit silently
+if [ -z "$FILE_PATH" ]; then
+  exit 0
+fi
+
+# Only remind for TypeScript files
+if echo "$FILE_PATH" | grep -qE '\.tsx?$'; then
+  echo "[BUILD GATE] TypeScript file modified: $(basename "$FILE_PATH"). Run 'npm run build' before editing the next file. See policies/pre-edit-build-gate.md"
+fi
+
+# Remind about file backup policy for any file edit
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-.}"
+BACKUP_DIR="${PROJECT_DIR}/.uap-backups/$(date +%Y-%m-%d)"
+RELATIVE_PATH="${FILE_PATH#"$PROJECT_DIR"/}"
+
+# Check if backup exists for this file
+if [ ! -f "${BACKUP_DIR}/${RELATIVE_PATH}" ] 2>/dev/null; then
+  # Only warn for source files, not generated or runtime files
+  if ! echo "$FILE_PATH" | grep -qE '(node_modules|dist|\.uap-backups|agents/data|\.git)/'; then
+    echo "[BACKUP REMINDER] No backup found for $(basename "$FILE_PATH"). Policy requires: mkdir -p $(dirname "${BACKUP_DIR}/${RELATIVE_PATH}") && cp \"$FILE_PATH\" \"${BACKUP_DIR}/${RELATIVE_PATH}\""
+  fi
+fi
+
+exit 0

package/templates/hooks/pre-compact.sh

@@ -56,6 +56,20 @@ if [ -f "${PROJECT_DIR}/dist/bin/cli.js" ]; then
   node "${PROJECT_DIR}/dist/bin/cli.js" dash session --compact 2>/dev/null || true
 fi
 
+# Flush pending deploy queue before session ends
+if [ -f "$COORD_DB" ]; then
+  PENDING_DEPLOYS=$(sqlite3 "$COORD_DB" "
+    SELECT COUNT(*) FROM deploy_queue WHERE status='pending';
+  " 2>/dev/null || echo "0")
+
+  if [ "$PENDING_DEPLOYS" -gt 0 ] 2>/dev/null; then
+    echo "[UAP] Flushing $PENDING_DEPLOYS pending deploy actions before compaction..." >&2
+    if [ -f "${PROJECT_DIR}/dist/bin/cli.js" ]; then
+      node "${PROJECT_DIR}/dist/bin/cli.js" deploy flush 2>/dev/null || true
+    fi
+  fi
+fi
+
 # Clean up agents with recent heartbeats (likely from this session being compacted)
 if [ -f "$COORD_DB" ]; then
   sqlite3 "$COORD_DB" "