@orchestrator-claude/cli 3.16.0 → 3.17.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.ts +1 -1
  2. package/dist/index.js +1 -1
  3. package/dist/templates/base/CLAUDE.md.hbs +1 -0
  4. package/dist/templates/base/claude/hooks/approval-guardian.sh +62 -0
  5. package/package.json +1 -1
  6. package/templates/base/CLAUDE.md.hbs +1 -0
  7. package/templates/base/claude/hooks/approval-guardian.sh +62 -0
package/dist/index.d.ts CHANGED
@@ -12,5 +12,5 @@
12
12
  /**
13
13
  * CLI version
14
14
  */
15
- export declare const CLI_VERSION = "3.16.0";
15
+ export declare const CLI_VERSION = "3.17.1";
16
16
  //# sourceMappingURL=index.d.ts.map
package/dist/index.js CHANGED
@@ -24,7 +24,7 @@ import { OutputFormatter } from './formatters/OutputFormatter.js';
24
24
  /**
25
25
  * CLI version
26
26
  */
27
- export const CLI_VERSION = '3.16.0';
27
+ export const CLI_VERSION = '3.17.1';
28
28
  /**
29
29
  * Main CLI function
30
30
  */
package/dist/templates/base/CLAUDE.md.hbs CHANGED
@@ -35,6 +35,7 @@ Workflow types: `feature_development`, `bug_fix`, `refactoring`, `emergency_debu
35
35
  |------|---------|-------------|
36
36
  | `ping-pong-enforcer` | After every Agent call | Calls `getNextAction` and injects result |
37
37
  | `gate-guardian` | Before `advancePhase` | Evaluates gate, blocks if it fails |
38
+ | `approval-guardian` | Before `approveAction`/`completeWorkflow` | Blocks auto-approve when workflow awaiting_approval |
38
39
  | `workflow-guard` | Before Write/Edit on src/ | Blocks code writes without an active workflow |
39
40
  | `dangling-workflow-guard` | On session Stop | Warns and completes dangling workflows |
40
41
  | `session-orchestrator` | On session Start | Injects workflow status context |
package/dist/templates/base/claude/hooks/approval-guardian.sh ADDED
@@ -0,0 +1,62 @@
1
+ #!/bin/bash
2
+ # approval-guardian.sh — TD-128 F-09 Hook
3
+ # Trigger: PreToolUse on mcp__orchestrator-tools__approveAction and mcp__orchestrator-extended__completeWorkflow
4
+ # Purpose: Block auto-approve and auto-complete when workflow is awaiting_approval.
5
+ # Requires explicit human confirmation before proceeding.
6
+ #
7
+ # Output: JSON with permissionDecision (deny/allow)
8
+
9
+ set -euo pipefail
10
+
11
+ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
12
+ source "$SCRIPT_DIR/orch-helpers.sh"
13
+
14
+ STDIN_DATA=$(orch_read_stdin)
15
+ TOOL_NAME=$(orch_json_field "$STDIN_DATA" "tool_name")
16
+ orch_log "APPROVAL-GUARDIAN: PreToolUse $TOOL_NAME triggered"
17
+
18
+ # Extract workflow ID from tool_input
19
+ WORKFLOW_ID=$(orch_json_field "$STDIN_DATA" "tool_input.workflowId")
20
+ [ -z "$WORKFLOW_ID" ] && WORKFLOW_ID=$(orch_json_field "$STDIN_DATA" "workflowId")
21
+
22
+ if [ -z "$WORKFLOW_ID" ]; then
23
+ # No workflow ID — allow (fail-open for non-workflow calls)
24
+ orch_log "APPROVAL-GUARDIAN: ALLOW (no workflowId)"
25
+ echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"No workflowId found, allowing."}}'
26
+ exit 0
27
+ fi
28
+
29
+ # Get auth token
30
+ TOKEN=$(orch_get_token 2>/dev/null) || TOKEN=""
31
+ if [ -z "$TOKEN" ]; then
32
+ # Can't check status — fail-open (auth issues shouldn't block workflow completion)
33
+ orch_log "APPROVAL-GUARDIAN: ALLOW (auth failed, fail-open)"
34
+ echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Auth failed, allowing."}}'
35
+ exit 0
36
+ fi
37
+
38
+ # Get workflow status
39
+ STATUS=$(curl -sf --max-time 5 "${API_URL}/api/v1/workflows/${WORKFLOW_ID}" \
40
+ -H "Authorization: Bearer $TOKEN" \
41
+ -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || STATUS=""
42
+
43
+ if [ -z "$STATUS" ]; then
44
+ orch_log "APPROVAL-GUARDIAN: ALLOW (could not fetch workflow status)"
45
+ echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Could not fetch workflow status, allowing."}}'
46
+ exit 0
47
+ fi
48
+
49
+ WORKFLOW_STATUS=$(orch_json_field "$STATUS" "status")
50
+ orch_log "APPROVAL-GUARDIAN: workflow=$WORKFLOW_ID status=$WORKFLOW_STATUS tool=$TOOL_NAME"
51
+
52
+ # Block approveAction AND completeWorkflow when awaiting_approval
53
+ if [ "$WORKFLOW_STATUS" = "awaiting_approval" ]; then
54
+ orch_log "APPROVAL-GUARDIAN: DENY (workflow awaiting_approval — human confirmation required for $TOOL_NAME)"
55
+ echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Approval Guardian: Workflow is awaiting human approval. You MUST ask the user for explicit confirmation before calling ${TOOL_NAME}.\",\"additionalContext\":\"Present the workflow summary to the user and ask: 'Do you approve advancing to IMPLEMENT?' Wait for their response. Do NOT auto-approve or auto-complete.\"}}"
56
+ exit 0
57
+ fi
58
+
59
+ # All other statuses: ALLOW
60
+ orch_log "APPROVAL-GUARDIAN: ALLOW ($TOOL_NAME, status=$WORKFLOW_STATUS)"
61
+ echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"${TOOL_NAME} allowed (status=${WORKFLOW_STATUS}).\"}}"
62
+ exit 0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@orchestrator-claude/cli",
3
- "version": "3.16.0",
3
+ "version": "3.17.1",
4
4
  "description": "Orchestrator CLI - Project scaffolding, migration and management",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
package/templates/base/CLAUDE.md.hbs CHANGED
@@ -35,6 +35,7 @@ Workflow types: `feature_development`, `bug_fix`, `refactoring`, `emergency_debu
35
35
  |------|---------|-------------|
36
36
  | `ping-pong-enforcer` | After every Agent call | Calls `getNextAction` and injects result |
37
37
  | `gate-guardian` | Before `advancePhase` | Evaluates gate, blocks if it fails |
38
+ | `approval-guardian` | Before `approveAction`/`completeWorkflow` | Blocks auto-approve when workflow awaiting_approval |
38
39
  | `workflow-guard` | Before Write/Edit on src/ | Blocks code writes without an active workflow |
39
40
  | `dangling-workflow-guard` | On session Stop | Warns and completes dangling workflows |
40
41
  | `session-orchestrator` | On session Start | Injects workflow status context |
package/templates/base/claude/hooks/approval-guardian.sh ADDED
@@ -0,0 +1,62 @@
1
+ #!/bin/bash
2
+ # approval-guardian.sh — TD-128 F-09 Hook
3
+ # Trigger: PreToolUse on mcp__orchestrator-tools__approveAction and mcp__orchestrator-extended__completeWorkflow
4
+ # Purpose: Block auto-approve and auto-complete when workflow is awaiting_approval.
5
+ # Requires explicit human confirmation before proceeding.
6
+ #
7
+ # Output: JSON with permissionDecision (deny/allow)
8
+
9
+ set -euo pipefail
10
+
11
+ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
12
+ source "$SCRIPT_DIR/orch-helpers.sh"
13
+
14
+ STDIN_DATA=$(orch_read_stdin)
15
+ TOOL_NAME=$(orch_json_field "$STDIN_DATA" "tool_name")
16
+ orch_log "APPROVAL-GUARDIAN: PreToolUse $TOOL_NAME triggered"
17
+
18
+ # Extract workflow ID from tool_input
19
+ WORKFLOW_ID=$(orch_json_field "$STDIN_DATA" "tool_input.workflowId")
20
+ [ -z "$WORKFLOW_ID" ] && WORKFLOW_ID=$(orch_json_field "$STDIN_DATA" "workflowId")
21
+
22
+ if [ -z "$WORKFLOW_ID" ]; then
23
+ # No workflow ID — allow (fail-open for non-workflow calls)
24
+ orch_log "APPROVAL-GUARDIAN: ALLOW (no workflowId)"
25
+ echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"No workflowId found, allowing."}}'
26
+ exit 0
27
+ fi
28
+
29
+ # Get auth token
30
+ TOKEN=$(orch_get_token 2>/dev/null) || TOKEN=""
31
+ if [ -z "$TOKEN" ]; then
32
+ # Can't check status — fail-open (auth issues shouldn't block workflow completion)
33
+ orch_log "APPROVAL-GUARDIAN: ALLOW (auth failed, fail-open)"
34
+ echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Auth failed, allowing."}}'
35
+ exit 0
36
+ fi
37
+
38
+ # Get workflow status
39
+ STATUS=$(curl -sf --max-time 5 "${API_URL}/api/v1/workflows/${WORKFLOW_ID}" \
40
+ -H "Authorization: Bearer $TOKEN" \
41
+ -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || STATUS=""
42
+
43
+ if [ -z "$STATUS" ]; then
44
+ orch_log "APPROVAL-GUARDIAN: ALLOW (could not fetch workflow status)"
45
+ echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Could not fetch workflow status, allowing."}}'
46
+ exit 0
47
+ fi
48
+
49
+ WORKFLOW_STATUS=$(orch_json_field "$STATUS" "status")
50
+ orch_log "APPROVAL-GUARDIAN: workflow=$WORKFLOW_ID status=$WORKFLOW_STATUS tool=$TOOL_NAME"
51
+
52
+ # Block approveAction AND completeWorkflow when awaiting_approval
53
+ if [ "$WORKFLOW_STATUS" = "awaiting_approval" ]; then
54
+ orch_log "APPROVAL-GUARDIAN: DENY (workflow awaiting_approval — human confirmation required for $TOOL_NAME)"
55
+ echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Approval Guardian: Workflow is awaiting human approval. You MUST ask the user for explicit confirmation before calling ${TOOL_NAME}.\",\"additionalContext\":\"Present the workflow summary to the user and ask: 'Do you approve advancing to IMPLEMENT?' Wait for their response. Do NOT auto-approve or auto-complete.\"}}"
56
+ exit 0
57
+ fi
58
+
59
+ # All other statuses: ALLOW
60
+ orch_log "APPROVAL-GUARDIAN: ALLOW ($TOOL_NAME, status=$WORKFLOW_STATUS)"
61
+ echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"${TOOL_NAME} allowed (status=${WORKFLOW_STATUS}).\"}}"
62
+ exit 0