@orchestrator-claude/cli 3.17.1 → 3.19.0

package/templates/base/claude/hooks/dangling-workflow-guard.sh

@@ -1,57 +0,0 @@
-#!/bin/bash
-# dangling-workflow-guard.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
-# Trigger: Stop
-# Purpose: Before conversation ends, check for workflows in in_progress state.
-#          Blocks stop and instructs LLM to call completeWorkflow.
-#
-# Output: JSON with decision: "block" + reason (forces LLM to continue)
-# Exit 0 with block JSON = prevent stop
-# Check stop_hook_active to prevent infinite loops
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/orch-helpers.sh"
-
-STDIN_DATA=$(orch_read_stdin)
-orch_log "DANGLING-GUARD: Stop hook triggered"
-
-# Prevent infinite loops
-STOP_ACTIVE=$(orch_json_field "$STDIN_DATA" "stop_hook_active")
-if [ "$STOP_ACTIVE" = "true" ]; then
-  orch_log "DANGLING-GUARD: stop_hook_active=true, allowing stop to prevent loop"
-  exit 0
-fi
-
-# Find active workflow
-WORKFLOW_ID=$(orch_get_active_workflow 2>/dev/null) || WORKFLOW_ID=""
-
-if [ -z "$WORKFLOW_ID" ]; then
-  orch_log "DANGLING-GUARD: No active workflow, clean exit"
-  exit 0
-fi
-
-# Get workflow status
-TOKEN=$(orch_get_token 2>/dev/null) || TOKEN=""
-if [ -z "$TOKEN" ]; then
-  orch_log "DANGLING-GUARD: Auth failed, allowing stop"
-  exit 0
-fi
-
-STATUS_RESP=$(curl -sf --max-time 5 "${API_URL}/api/v1/workflows/${WORKFLOW_ID}/status" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || STATUS_RESP=""
-
-PHASE=$(orch_json_field "$STATUS_RESP" "currentPhase")
-STATUS=$(orch_json_field "$STATUS_RESP" "status")
-
-orch_log "DANGLING-GUARD: workflow=$WORKFLOW_ID status=$STATUS phase=$PHASE"
-
-if [ "$STATUS" = "in_progress" ] || [ "$STATUS" = "awaiting_agent" ] || [ "$STATUS" = "awaiting_approval" ]; then
-  orch_log "DANGLING-GUARD: BLOCK stop (workflow still active)"
-  echo "{\"decision\":\"block\",\"reason\":\"[DANGLING-GUARD] Workflow ${WORKFLOW_ID} is still ${STATUS} (phase: ${PHASE}). You must call mcp__orchestrator-extended__completeWorkflow({ workflowId: '${WORKFLOW_ID}' }) before ending the session.\"}"
-  exit 0
-fi
-
-orch_log "DANGLING-GUARD: Workflow completed or not active, allowing stop"
-exit 0

package/templates/base/claude/hooks/gate-guardian.sh

@@ -1,84 +0,0 @@
-#!/bin/bash
-# gate-guardian.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
-# Trigger: PreToolUse on mcp__orchestrator-tools__advancePhase
-# Purpose: Guard IMPLEMENT phase advance (requires human approval). ALLOWs all other phases.
-# Note: POST /gate/evaluate endpoint removed (TD-127). Phase transitions are now handled
-# atomically by setPendingAction() via the ping-pong-enforcer hook.
-#
-# Output: JSON with permissionDecision (deny/allow) + additionalContext
-# Exit 0 with JSON = structured decision
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/orch-helpers.sh"
-
-STDIN_DATA=$(orch_read_stdin)
-orch_log "GATE-GUARDIAN: PreToolUse advancePhase triggered"
-
-# Extract parameters
-WORKFLOW_ID=$(orch_json_field "$STDIN_DATA" "tool_input.workflowId")
-TARGET_PHASE=$(orch_json_field "$STDIN_DATA" "tool_input.targetPhase")
-[ -z "$WORKFLOW_ID" ] && WORKFLOW_ID=$(orch_json_field "$STDIN_DATA" "workflowId")
-[ -z "$TARGET_PHASE" ] && TARGET_PHASE=$(orch_json_field "$STDIN_DATA" "targetPhase")
-
-orch_log "GATE-GUARDIAN: workflow=$WORKFLOW_ID targetPhase=$TARGET_PHASE"
-
-# ADR-013 Phase 6: Check workflow mode before gate evaluation
-# quick and interactive modes skip gate evaluation entirely
-if [ -n "$WORKFLOW_ID" ]; then
-  MODE=$(orch_get_workflow_mode "$WORKFLOW_ID" 2>/dev/null) || MODE=""
-  orch_log "GATE-GUARDIAN: workflow=$WORKFLOW_ID mode=${MODE:-legacy}"
-
-  if [ "$MODE" = "quick" ]; then
-    orch_log "GATE-GUARDIAN: ALLOW (quick mode skips gate evaluation)"
-    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Gate to '${TARGET_PHASE}' allowed: quick mode skips gate evaluation.\"}}"
-    exit 0
-  fi
-
-  if [ "$MODE" = "interactive" ]; then
-    orch_log "GATE-GUARDIAN: ALLOW (interactive mode skips gate evaluation, artifact gates not required)"
-    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Gate to '${TARGET_PHASE}' allowed: interactive mode skips artifact gate evaluation.\"}}"
-    exit 0
-  fi
-fi
-
-# FAIL-CLOSED: if we can't parse input, DENY
-if [ -z "$WORKFLOW_ID" ] || [ -z "$TARGET_PHASE" ]; then
-  orch_log "GATE-GUARDIAN: DENY (could not parse input)"
-  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Gate Guardian: Could not parse workflowId or targetPhase.","additionalContext":"Ensure you pass both workflowId and targetPhase to advancePhase."}}'
-  exit 0
-fi
-
-# Get auth token — FAIL-CLOSED on auth failure
-TOKEN=$(orch_get_token 2>/dev/null) || TOKEN=""
-if [ -z "$TOKEN" ]; then
-  orch_log "GATE-GUARDIAN: DENY (auth failed)"
-  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Gate Guardian: Authentication failed.","additionalContext":"Check ORCHESTRATOR_ADMIN_EMAIL, ORCHESTRATOR_ADMIN_PASSWORD, ORCHESTRATOR_PROJECT_ID env vars."}}'
-  exit 0
-fi
-
-# Special handling for IMPLEMENT phase: require approval
-TARGET_LOWER=$(echo "$TARGET_PHASE" | tr '[:upper:]' '[:lower:]')
-if [ "$TARGET_LOWER" = "implement" ]; then
-  orch_log "GATE-GUARDIAN: Checking approval for IMPLEMENT phase"
-
-  PENDING=$(curl -sf --max-time 5 "${API_URL}/api/v1/workflows/${WORKFLOW_ID}/pending-action" \
-    -H "Authorization: Bearer $TOKEN" \
-    -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || PENDING=""
-
-  if [ -n "$PENDING" ]; then
-    PENDING_STATUS=$(orch_json_field "$PENDING" "status")
-    if [ "$PENDING_STATUS" != "approved" ] && [ "$PENDING_STATUS" != "awaiting_agent" ]; then
-      orch_log "GATE-GUARDIAN: DENY (IMPLEMENT requires approval, status=$PENDING_STATUS)"
-      echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Gate Guardian: IMPLEMENT requires human approval. Status: ${PENDING_STATUS}.\",\"additionalContext\":\"Ask the user for approval first. Then call mcp__orchestrator-tools__approveAction.\"}}"
-      exit 0
-    fi
-  fi
-fi
-
-# Non-IMPLEMENT phases: ALLOW directly.
-# Phase transitions are handled atomically by setPendingAction() via ping-pong-enforcer.
-orch_log "GATE-GUARDIAN: ALLOW (non-IMPLEMENT phase, no gate evaluation required)"
-echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Gate to '${TARGET_PHASE}' allowed.\"}}"
-exit 0

package/templates/base/claude/hooks/orch-helpers.sh

@@ -1,135 +0,0 @@
-#!/bin/bash
-# orch-helpers.sh — Shared helper functions for Orchestrator hooks
-# ADR-013: Deterministic Orchestration
-# Sourced by all hooks. NOT called directly.
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-STATE_DIR="$PROJECT_ROOT/.orchestrator/.state"
-DEBUG_LOG="$STATE_DIR/hook-debug.log"
-
-# API Configuration (from .env or defaults)
-API_URL="${ORCHESTRATOR_API_URL:-http://localhost:3001}"
-AUTH_EMAIL="${ORCHESTRATOR_ADMIN_EMAIL:-${ORCHESTRATOR_AUTH_EMAIL:-admin@orchestrator.local}}"
-AUTH_PASSWORD="${ORCHESTRATOR_ADMIN_PASSWORD:-${ORCHESTRATOR_AUTH_PASSWORD:-admin123}}"
-PROJECT_ID="${ORCHESTRATOR_PROJECT_ID}"
-
-mkdir -p "$STATE_DIR"
-
-orch_log() {
-  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$DEBUG_LOG" 2>/dev/null || true
-}
-
-# Read stdin (Claude Code passes JSON via stdin)
-orch_read_stdin() {
-  if [ ! -t 0 ]; then
-    cat
-  else
-    echo ""
-  fi
-}
-
-# Get cached JWT token (login if expired)
-orch_get_token() {
-  local cached="$STATE_DIR/jwt-token"
-  if [ -f "$cached" ]; then
-    local age
-    age=$(( $(date +%s) - $(stat -c%Y "$cached" 2>/dev/null || stat -f%m "$cached" 2>/dev/null || echo 0) ))
-    if [ "$age" -lt 3500 ]; then
-      cat "$cached"
-      return
-    fi
-  fi
-
-  [ -z "$PROJECT_ID" ] && return 1
-
-  local resp
-  resp=$(curl -sf --max-time 5 -X POST "${API_URL}/api/v1/auth/login" \
-    -H "Content-Type: application/json" \
-    -H "X-Project-ID: $PROJECT_ID" \
-    -d "{\"email\":\"${AUTH_EMAIL}\",\"password\":\"${AUTH_PASSWORD}\"}" 2>/dev/null) || return 1
-
-  local token
-  token=$(echo "$resp" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);console.log(j.accessToken||j.data?.accessToken||'')}catch{console.log('')}})" 2>/dev/null)
-
-  if [ -n "$token" ] && [ "$token" != "" ]; then
-    echo "$token" > "$cached"
-    echo "$token"
-  else
-    return 1
-  fi
-}
-
-# Get the active (non-terminal) workflow ID
-# Checks in_progress, awaiting_agent, and awaiting_approval statuses
-orch_get_active_workflow() {
-  local token
-  token=$(orch_get_token) || return 1
-
-  local status id
-  for status in in_progress awaiting_agent awaiting_approval; do
-    local resp
-    resp=$(curl -sf --max-time 3 "${API_URL}/api/v1/workflows?status=${status}&limit=1" \
-      -H "Authorization: Bearer $token" \
-      -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || continue
-
-    id=$(echo "$resp" | node -e "
-      let d='';
-      process.stdin.on('data',c=>d+=c);
-      process.stdin.on('end',()=>{
-        try {
-          const j=JSON.parse(d);
-          const wfs=j.data||j;
-          const wf=Array.isArray(wfs)?wfs[0]:wfs;
-          const id=wf?.id||'';
-          if(id) console.log(id); else process.exit(1);
-        } catch { process.exit(1); }
-      });" 2>/dev/null) && [ -n "$id" ] && echo "$id" && return 0
-  done
-  return 1
-}
-
-# Call getNextAction for a workflow
-orch_get_next_action() {
-  local workflow_id="$1"
-  local token
-  token=$(orch_get_token) || return 1
-
-  curl -sf --max-time 5 "${API_URL}/api/v1/workflows/${workflow_id}/pending-action" \
-    -H "Authorization: Bearer $token" \
-    -H "X-Project-ID: $PROJECT_ID" 2>/dev/null
-}
-
-# ADR-013 Phase 6: Get the mode of a workflow (quick/standard/full/interactive)
-# Returns the mode string, or empty string for legacy workflows (mode=null)
-# Returns exit code 1 on network/auth error
-orch_get_workflow_mode() {
-  local workflow_id="$1"
-  local token
-  token=$(orch_get_token) || return 1
-
-  local resp
-  resp=$(curl -sf --max-time 3 "${API_URL}/api/v1/workflows/${workflow_id}/status" \
-    -H "Authorization: Bearer $token" \
-    -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || return 1
-
-  orch_json_field "$resp" "mode"
-}
-
-# Extract a field from JSON string using node
-orch_json_field() {
-  local json="$1"
-  local field="$2"
-  echo "$json" | node -e "
-    let d='';
-    process.stdin.on('data',c=>d+=c);
-    process.stdin.on('end',()=>{
-      try {
-        const j=JSON.parse(d);
-        const parts='${field}'.split('.');
-        let v=j;
-        for(const p of parts) v=v?.[p];
-        console.log(v||'');
-      } catch { console.log(''); }
-    });" 2>/dev/null
-}

package/templates/base/claude/hooks/ping-pong-enforcer.sh

@@ -1,58 +0,0 @@
-#!/bin/bash
-# ping-pong-enforcer.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
-# Trigger: PostToolUse on Task (Agent tool)
-# Purpose: After ANY sub-agent returns, call getNextAction and inject
-#          the result as additionalContext into the main conversation.
-#
-# Output: JSON with additionalContext containing next action instructions
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/orch-helpers.sh"
-
-orch_log "PING-PONG: PostToolUse Agent triggered"
-
-# Find active workflow
-WORKFLOW_ID=$(orch_get_active_workflow 2>/dev/null) || WORKFLOW_ID=""
-
-if [ -z "$WORKFLOW_ID" ]; then
-  orch_log "PING-PONG: No active workflow, skipping"
-  exit 0
-fi
-
-orch_log "PING-PONG: Active workflow=$WORKFLOW_ID"
-
-# Call getNextAction
-NEXT_ACTION=$(orch_get_next_action "$WORKFLOW_ID" 2>/dev/null) || NEXT_ACTION=""
-
-if [ -z "$NEXT_ACTION" ]; then
-  orch_log "PING-PONG: getNextAction failed or empty"
-  echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PostToolUse\",\"additionalContext\":\"[PING-PONG] Workflow ${WORKFLOW_ID} is active but getNextAction returned empty. Check workflow status with mcp__orchestrator-tools__getStatus.\"}}"
-  exit 0
-fi
-
-# Extract key fields for the context message
-HAS_ACTION=$(orch_json_field "$NEXT_ACTION" "hasAction")
-AGENT=$(orch_json_field "$NEXT_ACTION" "pendingAction.agent")
-STATUS=$(orch_json_field "$NEXT_ACTION" "pendingAction.status")
-PROMPT=$(orch_json_field "$NEXT_ACTION" "pendingAction.prompt")
-
-orch_log "PING-PONG: hasAction=$HAS_ACTION agent=$AGENT status=$STATUS"
-
-if [ "$HAS_ACTION" = "true" ]; then
-  if [ "$STATUS" = "awaiting_agent" ]; then
-    CONTEXT="[PING-PONG] Next action for workflow ${WORKFLOW_ID}: Invoke agent '${AGENT}' via Agent tool. Status: awaiting_agent."
-    [ -n "$PROMPT" ] && CONTEXT="${CONTEXT} Prompt: ${PROMPT}"
-  elif [ "$STATUS" = "awaiting_approval" ]; then
-    CONTEXT="[PING-PONG] Workflow ${WORKFLOW_ID} requires human approval before continuing. Ask the user to approve, then call mcp__orchestrator-tools__approveAction."
-  else
-    CONTEXT="[PING-PONG] Workflow ${WORKFLOW_ID} pending action: agent=${AGENT}, status=${STATUS}."
-  fi
-else
-  CONTEXT="[PING-PONG] No pending actions for workflow ${WORKFLOW_ID}. If current phase is implement, call mcp__orchestrator-extended__completeWorkflow to finalize."
-fi
-
-# Output structured JSON
-echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PostToolUse\",\"additionalContext\":$(echo "$CONTEXT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.stringify(d)))" 2>/dev/null)}}"
-exit 0

package/templates/base/claude/hooks/post-phase-checkpoint.sh

@@ -1,203 +0,0 @@
-#!/bin/bash
-# Post-Phase Checkpoint Hook (RFC-012 compatible)
-# Registers a checkpoint in PostgreSQL via the Orchestrator REST API.
-# Replaces the deprecated orchestrator-index.json approach (TD-105 F-04).
-#
-# Triggered by: PostToolUse on Task tool (after agent completes)
-# Behavior: Infers the just-completed phase from the active workflow state
-#           and registers a checkpoint via the REST API.
-#
-# Required env vars:
-#   ORCHESTRATOR_API_URL        - Base URL (e.g. http://localhost:3000)
-#   ORCHESTRATOR_PROJECT_TOKEN  - Bearer token for API authentication
-#
-# Optional env vars:
-#   ORCHESTRATOR_PROJECT_ID     - Project ID for project-scoped workflow query
-#   ORCH_CHECKPOINT_DEBUG=1     - Enable verbose logging
-#
-# Always exits 0 (non-blocking).
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-STATE_DIR="$SCRIPT_DIR/../../.orchestrator/.state"
-LOG_FILE="${STATE_DIR}/checkpoint-hook.log"
-LAST_PHASE_FILE="${STATE_DIR}/last-checkpointed-phase"
-DEBUG="${ORCH_CHECKPOINT_DEBUG:-0}"
-
-mkdir -p "$STATE_DIR"
-
-log_info()  { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [INFO]  $1" >> "$LOG_FILE"; }
-log_warn()  { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [WARN]  $1" >> "$LOG_FILE"; echo "[WARN]  $1" >&2; }
-log_debug() { [ "$DEBUG" = "1" ] && echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] [DEBUG] $1" >> "$LOG_FILE" || true; }
-
-# ── prerequisites ─────────────────────────────────────────────────────────────
-
-check_prerequisites() {
-  if ! command -v curl &>/dev/null; then
-    log_warn "curl not found. Checkpoints disabled."
-    return 1
-  fi
-  if ! command -v jq &>/dev/null; then
-    log_warn "jq not found. Checkpoints disabled."
-    return 1
-  fi
-  if [ -z "${ORCHESTRATOR_API_URL:-}" ]; then
-    log_debug "ORCHESTRATOR_API_URL not set. Checkpoints disabled."
-    return 1
-  fi
-  if [ -z "${ORCHESTRATOR_PROJECT_TOKEN:-}" ]; then
-    log_debug "ORCHESTRATOR_PROJECT_TOKEN not set. Checkpoints disabled."
-    return 1
-  fi
-  return 0
-}
-
-# ── API helpers ────────────────────────────────────────────────────────────────
-
-get_active_workflow() {
-  local project_id="${ORCHESTRATOR_PROJECT_ID:-}"
-  local url="${ORCHESTRATOR_API_URL}/api/v1/workflows?status=in_progress&limit=1"
-  [ -n "$project_id" ] && url="${url}&projectId=${project_id}"
-
-  local tmpfile
-  tmpfile=$(mktemp 2>/dev/null) || return 1
-
-  curl -sf \
-    -H "Authorization: Bearer ${ORCHESTRATOR_PROJECT_TOKEN}" \
-    -H "Content-Type: application/json" \
-    "${url}" \
-    -o "$tmpfile" 2>/dev/null || { rm -f "$tmpfile"; return 1; }
-
-  local result
-  result=$(node -e "
-    const fs=require('fs');
-    try {
-      const d=fs.readFileSync('${tmpfile}','utf8');
-      const j=JSON.parse(d);
-      const wf=Array.isArray(j)?j[0]:j;
-      if(wf&&wf.id){ process.stdout.write(JSON.stringify(wf)); process.exit(0); }
-      process.exit(1);
-    } catch { process.exit(1); }" 2>/dev/null)
-  local rc=$?
-  rm -f "$tmpfile"
-  [ $rc -eq 0 ] && echo "$result" || return 1
-}
-
-create_checkpoint() {
-  local workflow_id="$1"
-  local phase="$2"
-  local description="$3"
-
-  local body
-  body=$(jq -n \
-    --arg phase "$phase" \
-    --arg desc "$description" \
-    '{ phase: $phase, description: $desc }')
-
-  local http_code
-  http_code=$(curl -sf -o /dev/null -w "%{http_code}" \
-    -X POST \
-    -H "Authorization: Bearer ${ORCHESTRATOR_PROJECT_TOKEN}" \
-    -H "Content-Type: application/json" \
-    -d "$body" \
-    "${ORCHESTRATOR_API_URL}/api/v1/workflows/${workflow_id}/checkpoints" 2>/dev/null) || echo ""
-
-  echo "$http_code"
-}
-
-# ── dedup guard ────────────────────────────────────────────────────────────────
-
-get_saved_last_phase() {
-  [ -f "$LAST_PHASE_FILE" ] && cat "$LAST_PHASE_FILE" || echo ""
-}
-
-save_last_phase() {
-  echo "$1" > "$LAST_PHASE_FILE"
-}
-
-# ── phase inference ────────────────────────────────────────────────────────────
-
-# When workflow is at PLAN, it means SPECIFY just completed, etc.
-get_completed_phase() {
-  local current="$1"
-  local status="$2"
-  case "$status" in
-    "completed") echo "implement"; return ;;
-  esac
-  case "${current,,}" in
-    "plan")      echo "specify" ;;
-    "tasks")     echo "plan"    ;;
-    "implement") echo "tasks"   ;;
-    *)           echo ""        ;;
-  esac
-}
-
-# ── main ───────────────────────────────────────────────────────────────────────
-
-main() {
-  log_debug "Hook triggered"
-
-  if ! check_prerequisites; then
-    exit 0
-  fi
-
-  local workflow_json
-  workflow_json=$(get_active_workflow 2>/dev/null) || workflow_json=""
-
-  if [ -z "$workflow_json" ]; then
-    log_debug "No active workflow found via API."
-    exit 0
-  fi
-
-  local workflow_id current_phase workflow_status
-  workflow_id=$(echo "$workflow_json"     | jq -r '.id // empty'           2>/dev/null || echo "")
-  current_phase=$(echo "$workflow_json"  | jq -r '.currentPhase // empty'  2>/dev/null || echo "")
-  workflow_status=$(echo "$workflow_json" | jq -r '.status // empty'        2>/dev/null || echo "")
-
-  if [ -z "$workflow_id" ] || [ -z "$current_phase" ]; then
-    log_debug "Could not parse workflow ID or phase."
-    exit 0
-  fi
-
-  local completed_phase
-  completed_phase=$(get_completed_phase "$current_phase" "$workflow_status")
-
-  if [ -z "$completed_phase" ]; then
-    log_debug "No completed phase inferred from current_phase=${current_phase}."
-    exit 0
-  fi
-
-  # Dedup guard — skip if we already checkpointed this phase
-  local saved_last
-  saved_last=$(get_saved_last_phase)
-  if [ "$completed_phase" = "$saved_last" ]; then
-    log_debug "Phase ${completed_phase} already checkpointed. Skipping."
-    exit 0
-  fi
-
-  local description="Auto-checkpoint after ${completed_phase} phase"
-  local http_code
-  http_code=$(create_checkpoint "$workflow_id" "$completed_phase" "$description")
-
-  case "$http_code" in
-    201|200)
-      save_last_phase "$completed_phase"
-      log_info "Checkpoint registered: workflow=${workflow_id}, phase=${completed_phase}"
-      ;;
-    409)
-      save_last_phase "$completed_phase"
-      log_info "Checkpoint already exists (409): phase=${completed_phase}"
-      ;;
-    "")
-      log_warn "API unreachable. Checkpoint skipped for phase=${completed_phase}."
-      ;;
-    *)
-      log_warn "Unexpected HTTP ${http_code} creating checkpoint for phase=${completed_phase}."
-      ;;
-  esac
-
-  exit 0
-}
-
-main "$@"

package/templates/base/claude/hooks/prompt-orchestrator.sh

@@ -1,41 +0,0 @@
-#!/bin/bash
-# prompt-orchestrator.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
-# Trigger: UserPromptSubmit
-# Purpose: On every user prompt, inject orchestrator context.
-#          If no workflow active, remind about workflow requirement.
-#          If workflow active, inject current state.
-#
-# Output: JSON with additionalContext (never blocks prompts)
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/orch-helpers.sh"
-
-orch_log "PROMPT-ORCH: UserPromptSubmit triggered"
-
-# Find active workflow
-WORKFLOW_ID=$(orch_get_active_workflow 2>/dev/null) || WORKFLOW_ID=""
-
-if [ -z "$WORKFLOW_ID" ]; then
-  # No workflow — inject reminder (lightweight, no API calls)
-  orch_log "PROMPT-ORCH: No active workflow, injecting reminder"
-  echo '{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"[ORCHESTRATOR] No active workflow. If this request involves creating, modifying, or fixing code, you must start a workflow first (detectWorkflow → startWorkflow). The workflow-guard hook will block writes to src/ without a workflow."}}'
-  exit 0
-fi
-
-# Active workflow — inject state
-NEXT_ACTION=$(orch_get_next_action "$WORKFLOW_ID" 2>/dev/null) || NEXT_ACTION=""
-HAS_ACTION=$(orch_json_field "$NEXT_ACTION" "hasAction")
-AGENT=$(orch_json_field "$NEXT_ACTION" "pendingAction.agent")
-PA_STATUS=$(orch_json_field "$NEXT_ACTION" "pendingAction.status")
-
-if [ "$HAS_ACTION" = "true" ]; then
-  CONTEXT="[ORCHESTRATOR] Active workflow: ${WORKFLOW_ID}. Next: invoke '${AGENT}' (${PA_STATUS})."
-else
-  CONTEXT="[ORCHESTRATOR] Active workflow: ${WORKFLOW_ID}. No pending actions."
-fi
-
-orch_log "PROMPT-ORCH: workflow=$WORKFLOW_ID hasAction=$HAS_ACTION"
-echo "{\"hookSpecificOutput\":{\"hookEventName\":\"UserPromptSubmit\",\"additionalContext\":$(echo "$CONTEXT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.stringify(d)))" 2>/dev/null)}}"
-exit 0

package/templates/base/claude/hooks/session-orchestrator.sh

@@ -1,54 +0,0 @@
-#!/bin/bash
-# session-orchestrator.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
-# Trigger: SessionStart
-# Purpose: On session start, check for active workflow and inject context.
-#          Helps the LLM resume work from where it left off.
-#
-# Output: JSON with additionalContext containing workflow state
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/orch-helpers.sh"
-
-orch_log "SESSION-ORCH: SessionStart hook triggered"
-
-# Find active workflow
-WORKFLOW_ID=$(orch_get_active_workflow 2>/dev/null) || WORKFLOW_ID=""
-
-if [ -z "$WORKFLOW_ID" ]; then
-  orch_log "SESSION-ORCH: No active workflow"
-  echo '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"[ORCHESTRATOR] No active workflow. For feature requests, bug fixes, or refactoring, start with:\n1. mcp__orchestrator-tools__detectWorkflow\n2. mcp__orchestrator-tools__startWorkflow\n3. Follow the nextStep returned\n\nDirect implementation is blocked by the workflow-guard hook."}}'
-  exit 0
-fi
-
-# Get workflow details
-TOKEN=$(orch_get_token 2>/dev/null) || TOKEN=""
-if [ -z "$TOKEN" ]; then
-  echo "{\"hookSpecificOutput\":{\"hookEventName\":\"SessionStart\",\"additionalContext\":\"[ORCHESTRATOR] Active workflow: ${WORKFLOW_ID} (could not fetch details — auth failed).\"}}"
-  exit 0
-fi
-
-STATUS_RESP=$(curl -sf --max-time 5 "${API_URL}/api/v1/workflows/${WORKFLOW_ID}/status" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || STATUS_RESP=""
-
-PHASE=$(orch_json_field "$STATUS_RESP" "currentPhase")
-STATUS=$(orch_json_field "$STATUS_RESP" "status")
-WF_TYPE=$(orch_json_field "$STATUS_RESP" "type")
-
-# Get next action
-NEXT_ACTION=$(orch_get_next_action "$WORKFLOW_ID" 2>/dev/null) || NEXT_ACTION=""
-HAS_ACTION=$(orch_json_field "$NEXT_ACTION" "hasAction")
-AGENT=$(orch_json_field "$NEXT_ACTION" "pendingAction.agent")
-PA_STATUS=$(orch_json_field "$NEXT_ACTION" "pendingAction.status")
-
-CONTEXT="[ORCHESTRATOR] Active workflow: ${WORKFLOW_ID}\nType: ${WF_TYPE}\nPhase: ${PHASE}\nStatus: ${STATUS}"
-
-if [ "$HAS_ACTION" = "true" ]; then
-  CONTEXT="${CONTEXT}\nNext action: invoke '${AGENT}' (${PA_STATUS})"
-fi
-
-orch_log "SESSION-ORCH: Injecting workflow context (wf=$WORKFLOW_ID phase=$PHASE)"
-echo "{\"hookSpecificOutput\":{\"hookEventName\":\"SessionStart\",\"additionalContext\":$(echo "$CONTEXT" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.stringify(d)))" 2>/dev/null)}}"
-exit 0