@moreih29/nexus-core 0.1.2 → 0.3.0

package/skills/nx-sync/body.md

@@ -8,7 +8,7 @@ Scans the current project state and synchronizes .nexus/context/ design document
 - NEVER modify source code — this skill updates documentation only
 - NEVER guess information that cannot be confirmed from sources — mark as "needs verification" instead
 - MUST preserve existing content structure — update sections, don't rewrite entire files unnecessarily
-- NEVER use deprecated MCP knowledge tools — use Read and Write native tools only
+- NEVER use deprecated MCP knowledge tools — use the harness's file-reading and file-creation primitives only
 
 ## Guidelines
 
@@ -31,7 +31,7 @@ Collect information from all available sources:
 
 ### Step 2: Read Current Context
 
-Read all files in `.nexus/context/` using the Read tool:
+Read all files in `.nexus/context/` using the harness's file-reading primitive:
 
 - List files: `ls .nexus/context/`
 - Read each file to understand current documented state
@@ -45,13 +45,13 @@ Spawn Writer agent to update affected context documents:
 
 ```
 Agent({ subagent_type: "claude-nexus:writer", name: "writer-sync-context",
-  prompt: "Update .nexus/context/ documents based on the following changes. Read current files with the Read tool, then write updates with the Write tool. Changes: {change_manifest}" })
+  prompt: "Update .nexus/context/ documents based on the following changes. Read current files with the harness's file-reading primitive, then write updates with the harness's file-creation primitive. Changes: {change_manifest}" })
 ```
 
 The Writer agent:
-- Reads each relevant context file with the Read tool
+- Reads each relevant context file with the harness's file-reading primitive
 - Applies targeted updates — changes only the sections that are stale
-- Writes the updated file back with the Write tool
+- Writes the updated file back with the harness's file-creation primitive
 - Does not rewrite files that are already accurate
 
 ### Step 4: Report

package/skills/nx-sync/meta.yml

@@ -1,6 +1,7 @@
 name: nx-sync
 description: Context knowledge synchronization — scans project state and updates
   .nexus/context/ design documents
+summary: "Context knowledge synchronization"
 triggers:
   - sync
 id: nx-sync

package/vocabulary/capabilities.yml

@@ -1,32 +1,65 @@
-# Capabilities restrict an agent's access to harness-provided tools.
-# NOT constraints on nexus-core's own scripts/ or tooling.
+# Harness-neutral capability definitions.
+# Each entry describes WHAT is denied in semantic terms.
+# Consumers (claude-nexus, opencode-nexus, nexus-code) maintain their own
+# local map from these ids/classes to concrete tool names in their own repo.
+# nexus-core does not and must not know those tool names.
 
 capabilities:
   - id: no_file_edit
-    description: "Agent cannot create or modify files in the user's workspace"
-    harness_mapping:
-      claude_code:
-        - Edit
-        - Write
-        - NotebookEdit
-      opencode:
-        - edit
-        - write
-        - patch
-        - multiedit
+    description: "Agent cannot create, modify, or delete files in the user's workspace."
+    intent: workspace_write_denial
+    blocks_semantic_classes:
+      - file_creation
+      - file_modification
+      - file_deletion
+      - partial_file_edit
+      - structured_document_edit
+    prose_guidance: |
+      Block any tool whose primary effect is to alter content at a workspace
+      file path. This includes: creating new files at arbitrary paths, rewriting
+      whole file contents, applying partial edits (diffs, patches, find-replace,
+      multi-edit batches), deleting or truncating files, and cell-level edits in
+      structured documents such as notebooks.
+      Read-only operations are NOT blocked: reading file contents, querying
+      metadata, listing directories, and running code-intelligence queries that
+      do not mutate files.
 
   - id: no_task_create
-    description: "Agent cannot create new tasks in the Nexus task pipeline"
-    harness_mapping:
-      claude_code:
-        - mcp__plugin_claude-nexus_nx__nx_task_add
-      opencode:
-        - nx_task_add
+    description: "Agent cannot create new tasks in the Nexus task pipeline."
+    intent: task_pipeline_append_denial
+    blocks_semantic_classes:
+      - nexus_task_creation
+    prose_guidance: |
+      Block any tool that appends a new task to the Nexus task pipeline (the
+      mechanism by which Lead-owned work is enqueued for execution). Tools that
+      read, list, or query existing tasks are NOT blocked. Tools that modify
+      existing task state belong to a separate capability (no_task_update) and
+      are not governed here.
 
   - id: no_task_update
-    description: "Agent cannot update the state of existing Nexus tasks"
-    harness_mapping:
-      claude_code:
-        - mcp__plugin_claude-nexus_nx__nx_task_update
-      opencode:
-        - nx_task_update
+    description: "Agent cannot update the state of existing Nexus tasks."
+    intent: task_pipeline_mutate_denial
+    blocks_semantic_classes:
+      - nexus_task_state_transition
+      - nexus_task_metadata_modification
+    prose_guidance: |
+      Block any tool that mutates an existing Nexus task: changing its status,
+      editing its description, reassigning ownership, closing it, or modifying
+      any field on its record. Tools that read, list, or query tasks are NOT
+      blocked. Creation of new tasks is governed by no_task_create, not here.
+
+  - id: no_shell_exec
+    description: "Agent cannot execute arbitrary shell commands or spawn subprocesses."
+    intent: shell_execution_denial
+    blocks_semantic_classes:
+      - shell_command_exec
+      - subprocess_spawn
+      - interactive_shell_session
+    prose_guidance: |
+      Block any tool whose primary effect is to run a command-line invocation,
+      shell script, or spawn a subprocess on the user's machine. This includes
+      general-purpose shell runners, background process managers, shell output
+      readers, and shell-session kill operations. Tools that read files, query
+      metadata, or call specialized non-shell APIs (HTTP, language-server
+      queries, sandboxed code evaluators that do not spawn user-machine
+      processes) are NOT blocked.

package/skills/nx-setup/body.md

@@ -1,196 +0,0 @@
-## Role
-
-Interactive project setup wizard — configure Nexus for a new project with minimal token cost. Every step is a concrete choice via `AskUserQuestion`, with no open-ended exploration.
-
-## Constraints
-
-- NEVER accept free-text input — every step must use `AskUserQuestion` with explicit options.
-- NEVER skip the "Skip" option — all steps are optional.
-- NEVER modify files outside the selected scope without explicit user confirmation.
-- NEVER overwrite an existing `statusLine` field in settings.json without explicit user confirmation.
-
-## Guidelines
-
-## Trigger
-- Direct invocation: `/claude-nexus:nx-setup`
-
----
-
-## Steps
-
-### Step 1: Scope Selection
-
-```
-AskUserQuestion({
-  questions: [{
-    question: "Where should the Nexus configuration be applied?",
-    header: "Scope",
-    multiSelect: false,
-    options: [
-      { label: "User (Global)", description: "Apply to all projects (~/.claude/CLAUDE.md, ~/.claude/settings.json statusline)" },
-      { label: "Project", description: "Apply to this project only (CLAUDE.md, .claude/settings.local.json)" }
-    ]
-  }]
-})
-```
-
-All file write paths for subsequent steps are determined by this selection:
-- User: `~/.claude/CLAUDE.md`, `~/.claude/settings.json` (statusline wrapper)
-- Project: `./CLAUDE.md`, `./.claude/settings.local.json`
-
-### Step 2: Statusline
-
-```
-AskUserQuestion({
-  questions: [{
-    question: "Enable the Nexus statusline? (model, branch, context usage, rate limits)",
-    header: "Statusline",
-    multiSelect: false,
-    options: [
-      { label: "Enable (Recommended)", description: "2 lines: model+branch+git, context+usage meters" },
-      { label: "Skip", description: "Skip statusline configuration" }
-    ]
-  }]
-})
-```
-
-**Create wrapper script** (for Enable, run via Bash tool):
-```bash
-mkdir -p ~/.claude/hooks
-cat > ~/.claude/hooks/nexus-statusline.sh << 'EOF'
-#!/bin/bash
-SCRIPT=$(ls -1d "$HOME/.claude/plugins/cache/nexus/claude-nexus"/*/scripts/statusline.cjs 2>/dev/null | sort -V | tail -1)
-[ -n "$SCRIPT" ] && exec node "$SCRIPT"
-EOF
-chmod +x ~/.claude/hooks/nexus-statusline.sh
-```
-
-**On selection, depending on scope:**
-
-**(1) User scope:**
-- Create wrapper script (run step above)
-- If `statusLine` field is **absent** in `~/.claude/settings.json`: add statusLine setting directly:
-  ```json
-  { "statusLine": { "type": "command", "command": "bash $HOME/.claude/hooks/nexus-statusline.sh" } }
-  ```
-- If `statusLine` field **already exists** in `~/.claude/settings.json`: create wrapper only, do not modify settings.json — ask user to confirm replacement (see "Statusline coexistence handling" below)
-
-**(2) Project scope:**
-- Create wrapper script (run step above)
-- If `statusLine` field is **absent** in `.claude/settings.local.json`: add statusLine setting directly:
-  ```json
-  { "statusLine": { "type": "command", "command": "bash $HOME/.claude/hooks/nexus-statusline.sh" } }
-  ```
-- If `statusLine` field **already exists** in `.claude/settings.local.json`: create wrapper only, do not modify settings.local.json — ask user to confirm replacement (see "Statusline coexistence handling" below)
-**(3) Skip:**
-- Do not create wrapper or modify settings.json.
-
-**Statusline coexistence handling:**
-
-Run only if settings.json modification was deferred above (i.e., wrapper was created but existing statusLine was detected).
-If statusLine settings were already applied above, skip this sub-step.
-
-Specifically, treat an existing statusline setting as detected if any of the following are true:
-- `~/.claude/hooks/statusline.sh` file exists
-- Or the scope-appropriate settings.json (`~/.claude/settings.json` or `.claude/settings.local.json`) already has a `statusLine` field
-
-If detected:
-
-```
-AskUserQuestion({
-  questions: [{
-    question: "An existing statusline configuration was detected. Replace it with the Nexus statusline?",
-    header: "Statusline",
-    multiSelect: false,
-    options: [
-      { label: "Replace (Recommended)", description: "Replace with Nexus statusline (wrapper script configuration)" },
-      { label: "Keep Existing", description: "Keep existing statusline. Nexus wrapper is created but settings.json is not modified." }
-    ]
-  }]
-})
-```
-
-- "Replace (Recommended)": replace the `statusLine` in the scope-appropriate settings.json with the Nexus wrapper (wrapper script already created above)
-- "Keep Existing": keep the existing `statusLine` in settings.json (wrapper script already created above — user can switch manually later)
-
-If no existing statusline configuration is detected, skip this sub-step.
-
-### Step 3: Recommended Plugin
-
-Check if `context7@claude-plugins-official` is in `enabledPlugins` (global or project settings.json).
-
-**Already installed:**
-
-Notify and skip:
-```
-"Recommended plugin already installed: context7 ✓"
-```
-
-**Not installed:**
-
-```
-AskUserQuestion({
-  questions: [{
-    question: "Install the context7 plugin? It enables agents to look up library docs in real time.",
-    header: "Plugin",
-    multiSelect: false,
-    options: [
-      { label: "Install (Recommended)", description: "context7 — real-time library documentation lookup (Upstash Context7)" },
-      { label: "Skip", description: "Skip recommended plugin installation" }
-    ]
-  }]
-})
-```
-
-**If "Install":**
-Add to `enabledPlugins` in the scope-appropriate settings.json (`~/.claude/settings.json` or `.claude/settings.local.json`):
-```json
-{
-  "context7@claude-plugins-official": true
-}
-```
-Claude Code will automatically install the plugin at the start of the next session.
-
-**If "Skip":** proceed to the next step.
-
-Note: Once added to `enabledPlugins`, Claude Code automatically installs the plugin at the start of the next session.
-
-### Step 4: Knowledge Init
-
-```
-AskUserQuestion({
-  questions: [{
-    question: "Auto-generate project core knowledge?",
-    header: "Init",
-    multiSelect: false,
-    options: [
-      { label: "Yes (Recommended)", description: "Analyze existing docs (README, CLAUDE.md, etc.) to generate knowledge files in .nexus/memory/ and .nexus/context/" },
-      { label: "Skip", description: "Run manually later with /claude-nexus:nx-init" }
-    ]
-  }]
-})
-```
-
-If "Yes": invoke `Skill({ skill: "claude-nexus:nx-init" })`.
-If "Skip": proceed to next step.
-
-### Step 5: Complete
-
-Output a setup completion message:
-- Summary of applied settings
-- Brief introduction to available skills/agents
-- "To get started, describe a task, or use [plan] for planning, [run] for execution, [rule] for saving rules"
-
----
-
-## Key Principles
-
-1. **Every step uses AskUserQuestion** — no free-text input
-2. **Minimize tokens** — limit each step to concrete choices to prevent unnecessary exploration
-3. **Always provide a Skip option** — nothing is forced
-4. **Extensible structure** — includes recommended plugin step, expandable to additional categories in the future
-
-## State Management
-
-Setup operates via sequential AskUserQuestion calls with no state file.
-Configuration results are written to the scope-appropriate settings file at each step.

package/skills/nx-setup/meta.yml

@@ -1,4 +0,0 @@
-name: nx-setup
-description: Interactive project setup wizard for Nexus configuration.
-manual_only: true
-id: nx-setup