@orchestrator-claude/cli 3.17.1 → 3.18.0

package/templates/base/claude/hooks/track-agent-invocation.sh

@@ -1,230 +0,0 @@
-#!/bin/bash
-# Track Agent Invocation Hook
-# Registers agent invocations in orchestrator-index.json
-#
-# Usage (called by Claude Code hooks):
-#   track-agent-invocation.sh start    (reads stdin JSON)
-#   track-agent-invocation.sh complete (reads stdin JSON)
-#
-# Claude Code passes JSON via stdin with structure:
-#   { "tool_name": "Task", "tool_input": { "subagent_type": "...", ... } }
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-INDEX_FILE="$PROJECT_ROOT/.orchestrator/orchestrator-index.json"
-STATE_DIR="$PROJECT_ROOT/.orchestrator/.state"
-INVOCATION_FILE="$STATE_DIR/current-invocation"
-DEBUG_LOG="$STATE_DIR/hook-debug.log"
-
-# Ensure state directory exists
-mkdir -p "$STATE_DIR"
-
-ACTION="${1:-}"
-
-# Read stdin into variable (Claude Code passes JSON via stdin)
-STDIN_DATA=""
-if [ ! -t 0 ]; then
-  STDIN_DATA=$(cat)
-fi
-
-case "$ACTION" in
-  start)
-    # Extract agent info from stdin JSON
-    # Structure: { "tool_name": "Task", "tool_input": { "subagent_type": "...", ... } }
-    if [ -n "$STDIN_DATA" ]; then
-      # Debug: log received data
-      echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] START stdin: $STDIN_DATA" >> "$DEBUG_LOG"
-
-      AGENT_NAME=$(echo "$STDIN_DATA" | node -e "
-        let data = '';
-        process.stdin.on('data', chunk => data += chunk);
-        process.stdin.on('end', () => {
-          try {
-            const json = JSON.parse(data);
-            // Try different structures
-            const type = json.tool_input?.subagent_type
-                      || json.subagent_type
-                      || json.tool_input?.type
-                      || 'unknown';
-            console.log(type);
-          } catch { console.log('unknown'); }
-        });
-      ")
-      PHASE=$(echo "$STDIN_DATA" | node -e "
-        let data = '';
-        process.stdin.on('data', chunk => data += chunk);
-        process.stdin.on('end', () => {
-          try {
-            const json = JSON.parse(data);
-            const type = json.tool_input?.subagent_type
-                      || json.subagent_type
-                      || json.tool_input?.type
-                      || 'unknown';
-            const phaseMap = {
-              'specifier': 'specify',
-              'planner': 'plan',
-              'task-generator': 'tasks',
-              'implementer': 'implement',
-              'researcher': 'research',
-              'reviewer': 'review',
-              'orchestrator': 'orchestrate'
-            };
-            console.log(phaseMap[type] || type);
-          } catch { console.log('unknown'); }
-        });
-      ")
-    elif [ -n "$CLAUDE_TOOL_INPUT" ]; then
-      # Fallback to environment variable
-      echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] START env: $CLAUDE_TOOL_INPUT" >> "$DEBUG_LOG"
-
-      AGENT_NAME=$(echo "$CLAUDE_TOOL_INPUT" | node -e "
-        let data = '';
-        process.stdin.on('data', chunk => data += chunk);
-        process.stdin.on('end', () => {
-          try {
-            const json = JSON.parse(data);
-            const type = json.subagent_type || json.tool_input?.subagent_type || 'unknown';
-            console.log(type);
-          } catch { console.log('unknown'); }
-        });
-      ")
-      PHASE="unknown"
-    else
-      echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] START no input received" >> "$DEBUG_LOG"
-      AGENT_NAME="unknown"
-      PHASE="unknown"
-    fi
-
-    # Generate invocation ID
-    INVOCATION_ID="inv-$(date +%s)-$(head -c 4 /dev/urandom | xxd -p)"
-    STARTED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-    # Get workflow ID from index
-    WORKFLOW_ID=""
-    if [ -f "$INDEX_FILE" ]; then
-      WORKFLOW_ID=$(node -e "
-        const fs = require('fs');
-        try {
-          const idx = JSON.parse(fs.readFileSync('$INDEX_FILE', 'utf8'));
-          console.log(idx.activeWorkflow?.id || 'wf-standalone-' + Date.now());
-        } catch { console.log('wf-standalone-' + Date.now()); }
-      ")
-    fi
-
-    # Save invocation state
-    echo "$INVOCATION_ID" > "$INVOCATION_FILE"
-
-    # Update orchestrator-index.json
-    if [ -f "$INDEX_FILE" ]; then
-      node -e "
-        const fs = require('fs');
-        const indexPath = '$INDEX_FILE';
-        const idx = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
-
-        if (!idx.agentInvocations) idx.agentInvocations = [];
-
-        idx.agentInvocations.push({
-          id: '$INVOCATION_ID',
-          agentName: '$AGENT_NAME',
-          phase: '$PHASE',
-          workflowId: '$WORKFLOW_ID',
-          startedAt: '$STARTED_AT',
-          completedAt: null,
-          status: 'running',
-          durationMs: 0
-        });
-
-        fs.writeFileSync(indexPath, JSON.stringify(idx, null, 2));
-        console.log(JSON.stringify({ invocationId: '$INVOCATION_ID', startedAt: '$STARTED_AT' }));
-      "
-    else
-      echo '{"invocationId": "'$INVOCATION_ID'", "startedAt": "'$STARTED_AT'", "warning": "No index file found"}'
-    fi
-    ;;
-
-  complete)
-    # Get invocation ID from state file
-    INVOCATION_ID=""
-    if [ -f "$INVOCATION_FILE" ]; then
-      INVOCATION_ID=$(cat "$INVOCATION_FILE")
-    fi
-
-    if [ -z "$INVOCATION_ID" ]; then
-      echo '{"success": false, "error": "No invocation ID found"}'
-      exit 0  # Don't fail the hook
-    fi
-
-    # Debug log
-    if [ -n "$STDIN_DATA" ]; then
-      echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] COMPLETE stdin: $STDIN_DATA" >> "$DEBUG_LOG"
-    fi
-
-    # Determine status - default to success
-    STATUS="success"
-    SUMMARY="Completed"
-
-    COMPLETED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-    # Update orchestrator-index.json
-    if [ -f "$INDEX_FILE" ]; then
-      node -e "
-        const fs = require('fs');
-        const indexPath = '$INDEX_FILE';
-        const idx = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
-
-        const invocations = idx.agentInvocations || [];
-        const invIdx = invocations.findIndex(i => i.id === '$INVOCATION_ID');
-
-        if (invIdx === -1) {
-          console.log(JSON.stringify({ success: false, error: 'Invocation not found' }));
-          process.exit(0);
-        }
-
-        const inv = invocations[invIdx];
-        const startTime = new Date(inv.startedAt).getTime();
-        const endTime = new Date('$COMPLETED_AT').getTime();
-        const durationMs = endTime - startTime;
-
-        invocations[invIdx] = {
-          ...inv,
-          completedAt: '$COMPLETED_AT',
-          status: '$STATUS' === 'success' ? 'completed' : 'failed',
-          durationMs,
-          result: {
-            status: '$STATUS',
-            summary: '$SUMMARY'
-          }
-        };
-
-        idx.agentInvocations = invocations;
-
-        // Update statistics
-        if (idx.statistics) {
-          idx.statistics.totalInvocations = invocations.length;
-          idx.statistics.lastActivity = '$COMPLETED_AT';
-        }
-
-        fs.writeFileSync(indexPath, JSON.stringify(idx, null, 2));
-        console.log(JSON.stringify({ success: true, durationMs }));
-      "
-    else
-      echo '{"success": false, "error": "No index file found"}'
-    fi
-
-    # Clean up state file
-    rm -f "$INVOCATION_FILE"
-    ;;
-
-  *)
-    echo "Usage: $0 {start|complete}"
-    echo ""
-    echo "This script is called by Claude Code hooks."
-    echo "It reads JSON from stdin with structure:"
-    echo '  { "tool_name": "Task", "tool_input": { "subagent_type": "...", ... } }'
-    echo ""
-    echo "Debug log: $DEBUG_LOG"
-    exit 0
-    ;;
-esac

package/templates/base/claude/hooks/workflow-guard.sh

@@ -1,79 +0,0 @@
-#!/bin/bash
-# workflow-guard.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
-# Trigger: PreToolUse on Write|Edit
-# Purpose: Block writes to src/ and tests/ when no active workflow exists.
-#
-# Output: JSON with permissionDecision (deny/allow) + additionalContext
-# Exit 0 with JSON = structured decision
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/orch-helpers.sh"
-
-STDIN_DATA=$(orch_read_stdin)
-
-# Extract file path (Claude Code wraps in tool_input)
-FILE_PATH=$(orch_json_field "$STDIN_DATA" "tool_input.file_path")
-[ -z "$FILE_PATH" ] && FILE_PATH=$(orch_json_field "$STDIN_DATA" "file_path")
-[ -z "$FILE_PATH" ] && FILE_PATH=$(orch_json_field "$STDIN_DATA" "input.file_path")
-
-orch_log "workflow-guard: file_path=$FILE_PATH"
-
-# Explicit bypass via env var (for direct implementation without dogfooding)
-if [ "${SKIP_WORKFLOW_GUARD:-}" = "true" ]; then
-  orch_log "workflow-guard: ALLOW (SKIP_WORKFLOW_GUARD=true)"
-  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Workflow guard bypassed via SKIP_WORKFLOW_GUARD=true."}}'
-  exit 0
-fi
-
-# Only guard src/ and tests/ paths (production code)
-case "$FILE_PATH" in
-  */src/*|*/tests/*)
-    ;;
-  *)
-    orch_log "workflow-guard: ALLOW (non-guarded path)"
-    exit 0
-    ;;
-esac
-
-# Allow config and non-code files
-case "$FILE_PATH" in
-  *.json|*.yml|*.yaml|*.md|*.env|*.env.*)
-    orch_log "workflow-guard: ALLOW (config/doc file)"
-    exit 0
-    ;;
-esac
-
-# Check for active workflow
-WORKFLOW_ID=$(orch_get_active_workflow 2>/dev/null) || WORKFLOW_ID=""
-
-if [ -n "$WORKFLOW_ID" ]; then
-  # Check if running inside a sub-agent (agent_id present) or main agent (absent)
-  AGENT_ID=$(orch_json_field "$STDIN_DATA" "agent_id")
-
-  if [ -n "$AGENT_ID" ]; then
-    # Sub-agent writing — ALLOW
-    AGENT_TYPE=$(orch_json_field "$STDIN_DATA" "agent_type")
-    orch_log "workflow-guard: ALLOW (sub-agent: ${AGENT_TYPE:-unknown}, workflow: $WORKFLOW_ID)"
-    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Active workflow: ${WORKFLOW_ID}. Sub-agent ${AGENT_TYPE:-unknown} write allowed.\"}}"
-    exit 0
-  fi
-
-  # Main agent writing directly — check if SKIP_SUBAGENT_GUARD allows it
-  if [ "${SKIP_SUBAGENT_GUARD:-}" = "true" ]; then
-    orch_log "workflow-guard: ALLOW (SKIP_SUBAGENT_GUARD=true, workflow: $WORKFLOW_ID)"
-    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Active workflow: ${WORKFLOW_ID}. Direct write allowed via SKIP_SUBAGENT_GUARD.\"}}"
-    exit 0
-  fi
-
-  # Main agent writing directly — DENY, must use sub-agent
-  orch_log "workflow-guard: DENY (main agent direct write, no sub-agent invocation)"
-  echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Workflow Guard: Direct code writes are blocked. You must invoke a sub-agent (e.g. implementer) to write code. The sub-agent will have write access.\",\"additionalContext\":\"Use the Agent tool to spawn an implementer sub-agent for code changes. The workflow-guard allows writes only from sub-agents (identified by agent_id in hook input).\"}}"
-  exit 0
-fi
-
-# No active workflow — DENY with structured instructions
-orch_log "workflow-guard: DENY (no active workflow)"
-echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Workflow Guard: No active workflow. Direct implementation is not allowed.","additionalContext":"You MUST start a workflow before writing code:\n1. mcp__orchestrator-tools__detectWorkflow({ prompt: \"...\" })\n2. mcp__orchestrator-tools__startWorkflow({ workflowType: \"...\", prompt: \"...\" })\n3. Follow the nextStep returned by startWorkflow\n\nThe workflow-guard hook blocks all writes to src/ and tests/ without an active workflow."}}'
-exit 0