@monster-orange/den 0.4.11 → 0.4.13

package/src/shared/agents/default-pack/be-dev.md

@@ -1,5 +1,6 @@
 ---
 name: be-dev
+role: sde
 description: Implements back-end stories, test first, keeping contracts stable.
 context:
   [

package/src/shared/agents/default-pack/devops.md

@@ -1,5 +1,6 @@
 ---
 name: devops
+role: sde
 description: Builds and maintains pipelines, environments and service configuration.
 context: [the story, the workspace's service manifests, CI configuration]
 ---

package/src/shared/agents/default-pack/fe-dev.md

@@ -1,5 +1,6 @@
 ---
 name: fe-dev
+role: sde
 description: Implements front-end stories, test first, to the design system.
 context:
   [

package/src/shared/agents/default-pack/orchestrator.md

@@ -1,5 +1,6 @@
 ---
 name: orchestrator
+role: orchestrator
 description: Takes the next ready story, picks the persona for it and starts that agent.
 standing: true
 context: [ready work items, running agents in the workspace]
@@ -9,7 +10,8 @@ You are the orchestrator. Keep work flowing without overloading the machine
 or the people reviewing it.
 
 - Take the next ready story, in priority order. Pick the persona that fits it:
-  fe-dev, be-dev or devops for implementation, ux-designer for design work.
+  fe-dev, be-dev or devops for implementation, ux-designer for design work,
+  tester to run the suites.
 - Start one agent per story, in its own worktree, and link it to the story.
 - Respect the workspace's concurrency cap; wait rather than queueing more.
 - When a pull request is opened, ask the reviewer for a review. Never approve

package/src/shared/agents/default-pack/planner.md

@@ -1,5 +1,6 @@
 ---
 name: planner
+role: planner
 description: Writes stories and their acceptance criteria for the workspace.
 standing: true
 context: [the workspace's specs and docs, open work items, the design system]

package/src/shared/agents/default-pack/reviewer.md

@@ -1,5 +1,6 @@
 ---
 name: reviewer
+role: reviewer
 description: Reviews a pull request adversarially. Never approves or merges.
 context: [the pull request and its story, the repo's conventions and tests]
 ---

package/src/shared/agents/default-pack/tester.md

@@ -0,0 +1,16 @@
+---
+name: tester
+role: tester
+description: Runs the test suites and reports failures with repro steps.
+context: [the story and its acceptance criteria, the repo's test commands]
+---
+
+You are the tester. Find out what is broken before anyone ships it.
+
+- Run the workspace's unit, integration and end-to-end suites, as the repo
+  documents them.
+- For each failure, write the exact repro: the smallest failing command, what
+  it printed, and what you expected.
+- Separate real failures from flaky ones; run a suspected flake again before
+  reporting it.
+- Don't fix code. Report what you found to the person or agent who asked.

package/src/shared/agents/default-pack/ux-designer.md

@@ -1,5 +1,6 @@
 ---
 name: ux-designer
+role: designer
 description: Designs flows and screens with the design system, on request.
 context: [the story, the design system, existing screens of the product]
 ---

package/src/shared/agents/den-claude.ts

@@ -61,11 +61,26 @@ import {
   type LaunchOutput,
   type Runtime,
   type RuntimeDetect,
+  type RuntimeModel,
+  type RuntimePermissions,
 } from "./runtime.js";
+import { PERMISSION_INTENTS, type PermissionIntent } from "./permissions.js";
 import { builtinEntry } from "./catalog.js";
 import { catalogFind } from "./catalog-runtime.js";
 import { locateRuntime, type RuntimeFind } from "./runtime-search.js";
 import { claudeProjectsDir } from "../usage/paths.js";
+import { cleanName, transcriptTitle } from "./transcript-follow.js";
+
+/**
+ * `/rename "x"` keeps the quotes in customTitle: one matching pair around
+ * the whole name goes, for display only (0.4.13). Nothing inside: null.
+ */
+export function unquoteTitle(name: string | null): string | null {
+  if (!name || name.length < 2) return name;
+  const q = name[0];
+  if ((q !== '"' && q !== "'") || name[name.length - 1] !== q) return name;
+  return cleanName(name.slice(1, -1));
+}
 
 export const DEN_CLAUDE_ID = "den-claude";
 const BIN = "claude";
@@ -89,12 +104,91 @@ export const PERMISSION_MODES = [
 ] as const;
 export const DEFAULT_PERMISSION_MODE = "default";
 
-/** The persona's permission mode, checked; a bad one names the key. */
+/**
+ * Den's permission intents (AG-13) as Claude Code's modes:
+ * https://code.claude.com/docs/en/iam (permission modes): `default` asks
+ * on first use of each tool, `acceptEdits` accepts file edits for the
+ * session, `bypassPermissions` skips every prompt.
+ */
+export const INTENT_MODE: Record<PermissionIntent, string> = {
+  ask: "default",
+  edits: "acceptEdits",
+  all: "bypassPermissions",
+};
+
+/**
+ * One plain command prefix as Claude Code allow rules (the same docs,
+ * Bash rules): the command alone, and the command with arguments (`*`
+ * matches any run of characters). Deny rules (Den's state dir) still win:
+ * Claude Code checks deny before allow.
+ */
+export const COMMAND_RULES = ["Bash({c})", "Bash({c} *)"];
+
+/** How den-claude expresses permission intents (AG-13.2). */
+export const DEN_CLAUDE_PERMISSIONS: RuntimePermissions = {
+  modes: {
+    ask: "--permission-mode default: asks before edits and commands",
+    edits:
+      "--permission-mode acceptEdits: file edits run without asking; commands ask",
+    all: "--permission-mode bypassPermissions: nothing asks",
+  },
+  commandRules: COMMAND_RULES,
+};
+
+/** A command prefix's allow rules (permissions.ts checked it). */
+export function allowRules(commands: readonly string[]): string[] {
+  return commands.flatMap((c) =>
+    COMMAND_RULES.map((r) => r.split("{c}").join(c)),
+  );
+}
+
+/**
+ * Claude Code's models (AG-12.3): the aliases `claude --model` takes,
+ * each "latest" (the alias tracks its newest model) or pinned to one full
+ * model id. Claude Code has no command that lists models, so the list
+ * ships with each Den release (https://code.claude.com/docs/en/model-config:
+ * aliases opus, sonnet, haiku, or a full model name). Newest first.
+ */
+export const DEN_CLAUDE_MODELS: readonly RuntimeModel[] = [
+  {
+    id: "opus",
+    label: "Opus",
+    versions: [
+      "claude-opus-5-5",
+      "claude-opus-5",
+      "claude-opus-4-8",
+      "claude-opus-4-7",
+      "claude-opus-4-6",
+    ],
+    latest: "claude-opus-5-5",
+  },
+  {
+    id: "sonnet",
+    label: "Sonnet",
+    versions: ["claude-sonnet-5-5", "claude-sonnet-5", "claude-sonnet-4-6"],
+    latest: "claude-sonnet-5-5",
+  },
+  {
+    id: "haiku",
+    label: "Haiku",
+    versions: ["claude-haiku-5-5", "claude-haiku-4-5"],
+    latest: "claude-haiku-5-5",
+  },
+];
+
+/**
+ * The mode to launch with: the agent's intent (Start › Advanced), else the
+ * persona's `permission_mode`: one of Den's intents, or one of Claude
+ * Code's own modes (as before AG-13). A bad one names the key.
+ */
 function permissionMode(input: LaunchInput): string {
+  if (input.permission) return INTENT_MODE[input.permission];
   const m = input.persona.permissionMode ?? DEFAULT_PERMISSION_MODE;
+  if ((PERMISSION_INTENTS as readonly string[]).includes(m))
+    return INTENT_MODE[m as PermissionIntent];
   if (!(PERMISSION_MODES as readonly string[]).includes(m))
     throw new LaunchError(
-      `${input.persona.source}: permission_mode "${m.replace(/[^\x20-\x7e]/g, "?").slice(0, 40)}" must be one of ${PERMISSION_MODES.join(", ")}`,
+      `${input.persona.source}: permission_mode "${m.replace(/[^\x20-\x7e]/g, "?").slice(0, 40)}" must be one of ${[...PERMISSION_INTENTS, ...PERMISSION_MODES].join(", ")}`,
     );
   return m;
 }
@@ -243,7 +337,9 @@ function common(input: LaunchInput): {
         }),
       )
     : null;
-  const settings = input.stateDir || hooks ? settingsPath(input) : null;
+  const allow = allowRules(input.allow ?? []);
+  const settings =
+    input.stateDir || hooks || allow.length ? settingsPath(input) : null;
   return {
     argv: [
       "--mcp-config",
@@ -267,13 +363,18 @@ function common(input: LaunchInput): {
         ? {
             [settings]: `${JSON.stringify(
               {
-                ...(input.stateDir
+                ...(input.stateDir || allow.length
                   ? {
                       permissions: {
-                        deny: stateDirDenyRules(
-                          input.stateDir,
-                          input.env?.HOME,
-                        ),
+                        ...(allow.length ? { allow } : {}),
+                        ...(input.stateDir
+                          ? {
+                              deny: stateDirDenyRules(
+                                input.stateDir,
+                                input.env?.HOME,
+                              ),
+                            }
+                          : {}),
                       },
                     }
                   : {}),
@@ -288,7 +389,9 @@ function common(input: LaunchInput): {
     warnings:
       mode === "bypassPermissions"
         ? [
-            `⚠ persona ${input.persona.id} sets permission_mode: bypassPermissions: Claude Code will not ask before running any tool`,
+            input.permission === "all"
+              ? `⚠ agent ${input.agentId} starts with auto-approve all (bypassPermissions): Claude Code will not ask before running any tool`
+              : `⚠ persona ${input.persona.id} sets permission_mode: bypassPermissions: Claude Code will not ask before running any tool`,
           ]
         : [],
   };
@@ -313,6 +416,31 @@ export function firstPromptArg(text: string | undefined): string[] {
   return [t.startsWith("-") ? `Prompt: ${t}` : t];
 }
 
+const TOKEN_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+
+/**
+ * Claude Code's transcript for conversation `token`: <token>.jsonl in any
+ * project under its projects dir, or null (a bad token, none written yet).
+ */
+export function transcriptFile(
+  token: string | undefined,
+  env: NodeJS.ProcessEnv = process.env,
+): string | null {
+  if (!token || !TOKEN_RE.test(token)) return null;
+  const root = claudeProjectsDir(env);
+  let projects: string[] = [];
+  try {
+    projects = fs.readdirSync(root);
+  } catch {
+    return null;
+  }
+  for (const p of projects) {
+    const file = path.join(root, p, `${token}.jsonl`);
+    if (fs.existsSync(file)) return file;
+  }
+  return null;
+}
+
 export const denClaude: Runtime = {
   id: DEN_CLAUDE_ID,
   label: DEN_CLAUDE_CATALOG.name,
@@ -321,6 +449,9 @@ export const denClaude: Runtime = {
   denTools: true,
   firstPrompt: true,
   find: DEN_CLAUDE_FIND,
+  models: () =>
+    DEN_CLAUDE_MODELS.map((m) => ({ ...m, versions: [...m.versions] })),
+  permissions: DEN_CLAUDE_PERMISSIONS,
   detect,
   launch(input): LaunchOutput {
     const bin = binFor(input);
@@ -355,17 +486,20 @@ export const denClaude: Runtime = {
   },
   // Its transcript, <token>.jsonl in any project under its projects dir.
   conversationExists(token, env = process.env) {
-    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(token)) return false;
-    const root = claudeProjectsDir(env);
-    let projects: string[] = [];
+    return transcriptFile(token, env) !== null;
+  },
+  // AG-4b, unofficial (catalog sessionName): `/rename` appends a
+  // {"type":"custom-title","customTitle":…} record to the transcript; the
+  // latest one, read on from the last ask (never the whole file), less one
+  // pair of surrounding quotes. Null on any failure: it must never break a
+  // pane.
+  sessionName(rec, env = process.env) {
     try {
-      projects = fs.readdirSync(root);
+      const file = transcriptFile(rec.resumeToken, env);
+      return file ? unquoteTitle(transcriptTitle(file)) : null;
     } catch {
-      return false;
+      return null;
     }
-    return projects.some((p) =>
-      fs.existsSync(path.join(root, p, `${token}.jsonl`)),
-    );
   },
   launchFailures: {
     noConversation: /no conversation found/i,

package/src/shared/agents/permissions.ts

@@ -0,0 +1,108 @@
+/**
+ * Permissions as intent (AG-13): what a person chooses, before any
+ * runtime's syntax.
+ *
+ *   ask    Ask for everything (the default)
+ *   edits  Auto-approve edits in the worktree
+ *   all    Auto-approve all (a session started so is always tagged)
+ *
+ * And extra allowed commands: plain command prefixes ("npm test"), one per
+ * entry, no patterns. Each runtime translates both into its own launch
+ * config (den-claude.ts); a runtime that can't express one says so, and it
+ * is never silently dropped. What a persona pack shares is this intent
+ * only, never vendor syntax.
+ */
+
+export const PERMISSION_INTENTS = ["ask", "edits", "all"] as const;
+export type PermissionIntent = (typeof PERMISSION_INTENTS)[number];
+export const DEFAULT_INTENT: PermissionIntent = "ask";
+
+/**
+ * A persona's `permission_mode` as an intent. Den's three intents are
+ * themselves; Claude Code's own modes from before AG-13 read as the intent
+ * they meant (default, acceptEdits, bypassPermissions). Anything else
+ * (Claude Code's plan, a typo) is not an intent: undefined, and the
+ * runtime decides (den-claude refuses a mode it doesn't know).
+ */
+export function intentOf(
+  mode: string | undefined,
+): PermissionIntent | undefined {
+  if (mode === undefined) return DEFAULT_INTENT;
+  if ((PERMISSION_INTENTS as readonly string[]).includes(mode))
+    return mode as PermissionIntent;
+  if (mode === "default") return "ask";
+  if (mode === "acceptEdits") return "edits";
+  if (mode === "bypassPermissions") return "all";
+  return undefined;
+}
+
+/** The most extra commands one persona or launch takes. */
+export const MAX_COMMANDS = 32;
+/** The longest command prefix. */
+export const MAX_COMMAND_LEN = 120;
+/**
+ * What a plain prefix is made of: letters, digits, spaces and . _ / : = @
+ * % + , -. No shell syntax (quotes, ;, &, |, $, backticks, redirects) and
+ * no pattern characters (* ? [ ] ^ ( ) { }): Den translates a prefix, it
+ * never passes one through a shell.
+ */
+const PREFIX_RE = /^[A-Za-z0-9][A-Za-z0-9 ._/:=@%+,-]*$/;
+const PATTERN_RE = /[*?[\]^$(){}|]/;
+
+export type CommandProblem = "pattern" | "invalid" | "long";
+
+/** Why `c` isn't a plain prefix, or null when it is. */
+export function commandProblem(c: string): CommandProblem | null {
+  if ([...c].length > MAX_COMMAND_LEN) return "long";
+  if (PATTERN_RE.test(c)) return "pattern";
+  if (!PREFIX_RE.test(c) || /\s{2,}/.test(c) || c !== c.trim())
+    return "invalid";
+  return null;
+}
+
+const shown = (v: unknown) =>
+  (JSON.stringify(v) ?? "undefined").replace(/[^\x20-\x7e]/g, "?").slice(0, 60);
+
+/**
+ * A list of extra allowed commands, checked: an array of plain prefixes
+ * (each trimmed, duplicates dropped), at most MAX_COMMANDS. undefined or
+ * null is none. Anything else throws, naming the entry and why.
+ */
+export function checkCommands(v: unknown, where: string): string[] {
+  if (v === undefined || v === null) return [];
+  if (!Array.isArray(v))
+    throw new Error(`${where}: must be a list of command prefixes`);
+  if (v.length > MAX_COMMANDS)
+    throw new Error(`${where}: at most ${MAX_COMMANDS} commands`);
+  const out: string[] = [];
+  v.forEach((x, i) => {
+    if (typeof x !== "string")
+      throw new Error(`${where}[${i}]: must be a string`);
+    const c = x.trim();
+    const why = c ? commandProblem(c) : "invalid";
+    if (why === "pattern")
+      throw new Error(
+        `${where}[${i}]: ${shown(c)} is a pattern: use a plain prefix ("npm test")`,
+      );
+    if (why === "long")
+      throw new Error(`${where}[${i}]: at most ${MAX_COMMAND_LEN} characters`);
+    if (why)
+      throw new Error(
+        `${where}[${i}]: ${shown(c)} must be a plain prefix: letters, digits, single spaces and . _ / : = @ % + , -`,
+      );
+    if (!out.includes(c)) out.push(c);
+  });
+  return out;
+}
+
+/** An intent, checked; a usage message naming `where` otherwise. */
+export function checkIntent(v: unknown, where: string): PermissionIntent {
+  if (
+    typeof v === "string" &&
+    (PERMISSION_INTENTS as readonly string[]).includes(v)
+  )
+    return v as PermissionIntent;
+  throw new Error(
+    `${where}: ${shown(v)} must be one of ${PERMISSION_INTENTS.join(", ")}`,
+  );
+}