@orchestrator-claude/definitions 3.12.0 → 3.12.2

package/hooks/track-agent-invocation.sh

@@ -1,7 +1,6 @@
 #!/bin/bash
-# Track Agent Invocation Hook (v2 — REST API)
-# Defense-in-depth: agents self-report via MCP, this hook is a safety net.
-# Registers agent invocations via REST API (PostgreSQL).
+# Track Agent Invocation Hook
+# Registers agent invocations in orchestrator-index.json
 #
 # Usage (called by Claude Code hooks):
 #   track-agent-invocation.sh start    (reads stdin JSON)
@@ -14,67 +13,14 @@ set -e
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+INDEX_FILE="$PROJECT_ROOT/.orchestrator/orchestrator-index.json"
 STATE_DIR="$PROJECT_ROOT/.orchestrator/.state"
 INVOCATION_FILE="$STATE_DIR/current-invocation"
 DEBUG_LOG="$STATE_DIR/hook-debug.log"
 
-# API Configuration
-API_URL="${ORCHESTRATOR_API_URL:-http://localhost:3001}"
-AUTH_EMAIL="${ORCHESTRATOR_AUTH_EMAIL:-admin@orchestrator.local}"
-AUTH_PASSWORD="${ORCHESTRATOR_AUTH_PASSWORD:-admin123}"
-PROJECT_ID="${ORCHESTRATOR_PROJECT_ID:-d001d65d-25f5-4d13-b1dc-d006873e949c}"
-
 # Ensure state directory exists
 mkdir -p "$STATE_DIR"
 
-# Log rotation: max 1MB, keep 3 rotated copies
-MAX_LOG_SIZE=1048576  # 1MB in bytes
-if [ -f "$DEBUG_LOG" ]; then
-  LOG_SIZE=$(stat -f%z "$DEBUG_LOG" 2>/dev/null || stat -c%s "$DEBUG_LOG" 2>/dev/null || echo 0)
-  if [ "$LOG_SIZE" -gt "$MAX_LOG_SIZE" ]; then
-    [ -f "${DEBUG_LOG}.2" ] && mv "${DEBUG_LOG}.2" "${DEBUG_LOG}.3"
-    [ -f "${DEBUG_LOG}.1" ] && mv "${DEBUG_LOG}.1" "${DEBUG_LOG}.2"
-    mv "$DEBUG_LOG" "${DEBUG_LOG}.1"
-  fi
-fi
-
-log() {
-  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$DEBUG_LOG"
-}
-
-# Auth function: login and cache JWT
-get_token() {
-  local cached="$STATE_DIR/jwt-token"
-  if [ -f "$cached" ]; then
-    local age=$(( $(date +%s) - $(stat -c%Y "$cached" 2>/dev/null || stat -f%m "$cached" 2>/dev/null || echo 0) ))
-    if [ "$age" -lt 3500 ]; then  # Refresh if > ~58 min
-      cat "$cached"
-      return
-    fi
-  fi
-  local resp
-  resp=$(curl -s -f -X POST "${API_URL}/api/v1/auth/login" \
-    -H "Content-Type: application/json" \
-    -d "{\"email\":\"${AUTH_EMAIL}\",\"password\":\"${AUTH_PASSWORD}\"}" 2>/dev/null) || return 1
-  local token
-  token=$(echo "$resp" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);console.log(j.data?.accessToken||j.accessToken||j.token||'')}catch{console.log('')}})" 2>/dev/null)
-  if [ -n "$token" ]; then
-    echo "$token" > "$cached"
-    echo "$token"
-  fi
-}
-
-# Get active workflow ID from REST API
-get_workflow_id() {
-  local token
-  token=$(get_token) || return 1
-  local resp
-  resp=$(curl -s -f "${API_URL}/api/v1/workflows?status=in_progress" \
-    -H "Authorization: Bearer $token" \
-    -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || return 1
-  echo "$resp" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);const wfs=j.data||j;const wf=Array.isArray(wfs)?wfs[0]:wfs;console.log(wf?.id||'')}catch{console.log('')}})" 2>/dev/null
-}
-
 ACTION="${1:-}"
 
 # Read stdin into variable (Claude Code passes JSON via stdin)
@@ -88,6 +34,7 @@ case "$ACTION" in
     # Extract agent info from stdin JSON
     # Structure: { "tool_name": "Task", "tool_input": { "subagent_type": "...", ... } }
     if [ -n "$STDIN_DATA" ]; then
+      # Debug: log received data
       echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] START stdin: $STDIN_DATA" >> "$DEBUG_LOG"
 
       AGENT_NAME=$(echo "$STDIN_DATA" | node -e "
@@ -96,6 +43,7 @@ case "$ACTION" in
         process.stdin.on('end', () => {
           try {
             const json = JSON.parse(data);
+            // Try different structures
             const type = json.tool_input?.subagent_type
                       || json.subagent_type
                       || json.tool_input?.type
@@ -128,6 +76,7 @@ case "$ACTION" in
         });
       ")
     elif [ -n "$CLAUDE_TOOL_INPUT" ]; then
+      # Fallback to environment variable
       echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] START env: $CLAUDE_TOOL_INPUT" >> "$DEBUG_LOG"
 
       AGENT_NAME=$(echo "$CLAUDE_TOOL_INPUT" | node -e "
@@ -148,35 +97,124 @@ case "$ACTION" in
       PHASE="unknown"
     fi
 
-    TOKEN=$(get_token) || { log "ERROR: Auth failed"; exit 0; }
-    WORKFLOW_ID=$(get_workflow_id) || { log "SKIP: No active workflow"; exit 0; }
-
+    # Generate invocation ID
+    INVOCATION_ID="inv-$(date +%s)-$(head -c 4 /dev/urandom | xxd -p)"
     STARTED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-    INVOCATION_ID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || uuidgen 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())' 2>/dev/null || echo "inv-$(date +%s)-$(head -c 4 /dev/urandom | xxd -p)")
+
+    # Get workflow ID from index
+    WORKFLOW_ID=""
+    if [ -f "$INDEX_FILE" ]; then
+      WORKFLOW_ID=$(node -e "
+        const fs = require('fs');
+        try {
+          const idx = JSON.parse(fs.readFileSync('$INDEX_FILE', 'utf8'));
+          console.log(idx.activeWorkflow?.id || 'wf-standalone-' + Date.now());
+        } catch { console.log('wf-standalone-' + Date.now()); }
+      ")
+    fi
+
+    # Save invocation state
     echo "$INVOCATION_ID" > "$INVOCATION_FILE"
 
-    # Register via REST API
-    curl -s -f -X POST "${API_URL}/api/v1/invocations/start" \
-      -H "Content-Type: application/json" \
-      -H "Authorization: Bearer $TOKEN" \
-      -H "X-Project-ID: $PROJECT_ID" \
-      -d "{\"agentType\":\"${AGENT_NAME}\",\"workflowId\":\"${WORKFLOW_ID}\",\"phase\":\"${PHASE}\",\"startedAt\":\"${STARTED_AT}\"}" >> "$DEBUG_LOG" 2>&1 || true
+    # Update orchestrator-index.json
+    if [ -f "$INDEX_FILE" ]; then
+      node -e "
+        const fs = require('fs');
+        const indexPath = '$INDEX_FILE';
+        const idx = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+
+        if (!idx.agentInvocations) idx.agentInvocations = [];
+
+        idx.agentInvocations.push({
+          id: '$INVOCATION_ID',
+          agentName: '$AGENT_NAME',
+          phase: '$PHASE',
+          workflowId: '$WORKFLOW_ID',
+          startedAt: '$STARTED_AT',
+          completedAt: null,
+          status: 'running',
+          durationMs: 0
+        });
 
-    log "START: agent=$AGENT_NAME phase=$PHASE workflow=$WORKFLOW_ID"
+        fs.writeFileSync(indexPath, JSON.stringify(idx, null, 2));
+        console.log(JSON.stringify({ invocationId: '$INVOCATION_ID', startedAt: '$STARTED_AT' }));
+      "
+    else
+      echo '{"invocationId": "'$INVOCATION_ID'", "startedAt": "'$STARTED_AT'", "warning": "No index file found"}'
+    fi
     ;;
 
   complete)
+    # Get invocation ID from state file
     INVOCATION_ID=""
     if [ -f "$INVOCATION_FILE" ]; then
       INVOCATION_ID=$(cat "$INVOCATION_FILE")
-      rm -f "$INVOCATION_FILE"
     fi
 
+    if [ -z "$INVOCATION_ID" ]; then
+      echo '{"success": false, "error": "No invocation ID found"}'
+      exit 0  # Don't fail the hook
+    fi
+
+    # Debug log
     if [ -n "$STDIN_DATA" ]; then
       echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] COMPLETE stdin: $STDIN_DATA" >> "$DEBUG_LOG"
     fi
 
-    log "COMPLETE: invocation=$INVOCATION_ID (agent self-reports via MCP; hook is safety net)"
+    # Determine status - default to success
+    STATUS="success"
+    SUMMARY="Completed"
+
+    COMPLETED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+    # Update orchestrator-index.json
+    if [ -f "$INDEX_FILE" ]; then
+      node -e "
+        const fs = require('fs');
+        const indexPath = '$INDEX_FILE';
+        const idx = JSON.parse(fs.readFileSync(indexPath, 'utf8'));
+
+        const invocations = idx.agentInvocations || [];
+        const invIdx = invocations.findIndex(i => i.id === '$INVOCATION_ID');
+
+        if (invIdx === -1) {
+          console.log(JSON.stringify({ success: false, error: 'Invocation not found' }));
+          process.exit(0);
+        }
+
+        const inv = invocations[invIdx];
+        const startTime = new Date(inv.startedAt).getTime();
+        const endTime = new Date('$COMPLETED_AT').getTime();
+        const durationMs = endTime - startTime;
+
+        invocations[invIdx] = {
+          ...inv,
+          completedAt: '$COMPLETED_AT',
+          status: '$STATUS' === 'success' ? 'completed' : 'failed',
+          durationMs,
+          result: {
+            status: '$STATUS',
+            summary: '$SUMMARY'
+          }
+        };
+
+        idx.agentInvocations = invocations;
+
+        // Update statistics
+        if (idx.statistics) {
+          idx.statistics.totalInvocations = invocations.length;
+          idx.statistics.lastActivity = '$COMPLETED_AT';
+        }
+
+        fs.writeFileSync(indexPath, JSON.stringify(idx, null, 2));
+        console.log(JSON.stringify({ success: true, durationMs }));
+      "
+    else
+      echo '{"success": false, "error": "No index file found"}'
+    fi
+
+    # Clean up state file
+    rm -f "$INVOCATION_FILE"
     ;;
 
   *)

package/hooks/workflow-guard.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# workflow-guard.sh — ADR-013 Phase 5 Hook (JSON Structured Output)
+# Trigger: PreToolUse on Write|Edit
+# Purpose: Block writes to src/ and tests/ when no active workflow exists.
+#
+# Output: JSON with permissionDecision (deny/allow) + additionalContext
+# Exit 0 with JSON = structured decision
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/orch-helpers.sh"
+
+STDIN_DATA=$(orch_read_stdin)
+
+# Extract file path (Claude Code wraps in tool_input)
+FILE_PATH=$(orch_json_field "$STDIN_DATA" "tool_input.file_path")
+[ -z "$FILE_PATH" ] && FILE_PATH=$(orch_json_field "$STDIN_DATA" "file_path")
+[ -z "$FILE_PATH" ] && FILE_PATH=$(orch_json_field "$STDIN_DATA" "input.file_path")
+
+orch_log "workflow-guard: file_path=$FILE_PATH"
+
+# Explicit bypass via env var (for direct implementation without dogfooding)
+if [ "${SKIP_WORKFLOW_GUARD:-}" = "true" ]; then
+  orch_log "workflow-guard: ALLOW (SKIP_WORKFLOW_GUARD=true)"
+  echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","additionalContext":"Workflow guard bypassed via SKIP_WORKFLOW_GUARD=true."}}'
+  exit 0
+fi
+
+# Only guard src/ and tests/ paths (production code)
+case "$FILE_PATH" in
+  */src/*|*/tests/*)
+    ;;
+  *)
+    orch_log "workflow-guard: ALLOW (non-guarded path)"
+    exit 0
+    ;;
+esac
+
+# Allow config and non-code files
+case "$FILE_PATH" in
+  *.json|*.yml|*.yaml|*.md|*.env|*.env.*)
+    orch_log "workflow-guard: ALLOW (config/doc file)"
+    exit 0
+    ;;
+esac
+
+# Check for active workflow
+WORKFLOW_ID=$(orch_get_active_workflow 2>/dev/null) || WORKFLOW_ID=""
+
+if [ -n "$WORKFLOW_ID" ]; then
+  # Check if running inside a sub-agent (agent_id present) or main agent (absent)
+  AGENT_ID=$(orch_json_field "$STDIN_DATA" "agent_id")
+
+  if [ -n "$AGENT_ID" ]; then
+    # Sub-agent writing — ALLOW
+    AGENT_TYPE=$(orch_json_field "$STDIN_DATA" "agent_type")
+    orch_log "workflow-guard: ALLOW (sub-agent: ${AGENT_TYPE:-unknown}, workflow: $WORKFLOW_ID)"
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Active workflow: ${WORKFLOW_ID}. Sub-agent ${AGENT_TYPE:-unknown} write allowed.\"}}"
+    exit 0
+  fi
+
+  # Main agent writing directly — check if SKIP_SUBAGENT_GUARD allows it
+  if [ "${SKIP_SUBAGENT_GUARD:-}" = "true" ]; then
+    orch_log "workflow-guard: ALLOW (SKIP_SUBAGENT_GUARD=true, workflow: $WORKFLOW_ID)"
+    echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"allow\",\"additionalContext\":\"Active workflow: ${WORKFLOW_ID}. Direct write allowed via SKIP_SUBAGENT_GUARD.\"}}"
+    exit 0
+  fi
+
+  # Main agent writing directly — DENY, must use sub-agent
+  orch_log "workflow-guard: DENY (main agent direct write, no sub-agent invocation)"
+  echo "{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Workflow Guard: Direct code writes are blocked. You must invoke a sub-agent (e.g. implementer) to write code. The sub-agent will have write access.\",\"additionalContext\":\"Use the Agent tool to spawn an implementer sub-agent for code changes. The workflow-guard allows writes only from sub-agents (identified by agent_id in hook input).\"}}"
+  exit 0
+fi
+
+# No active workflow — DENY with structured instructions
+orch_log "workflow-guard: DENY (no active workflow)"
+echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Workflow Guard: No active workflow. Direct implementation is not allowed.","additionalContext":"You MUST start a workflow before writing code:\n1. mcp__orchestrator-tools__detectWorkflow({ prompt: \"...\" })\n2. mcp__orchestrator-tools__startWorkflow({ workflowType: \"...\", prompt: \"...\" })\n3. Follow the nextStep returned by startWorkflow\n\nThe workflow-guard hook blocks all writes to src/ and tests/ without an active workflow."}}'
+exit 0

package/manifest.json

@@ -1,8 +1,8 @@
 {
   "schema": "orchestrator-definitions/v1",
   "namespace": "orchestrator",
-  "version": "3.12.0",
-  "generatedAt": "2026-03-15T00:48:41.789Z",
+  "version": "3.12.2",
+  "generatedAt": "2026-03-15T23:15:56.132Z",
   "definitions": {
     "agents": [
       {
@@ -234,26 +234,34 @@
     ],
     "hooks": [
       {
-        "slug": "post-agent-artifact-relay",
-        "file": "hooks/post-agent-artifact-relay.sh",
+        "slug": "dangling-workflow-guard",
+        "file": "hooks/dangling-workflow-guard.sh",
         "version": "1.0.0",
-        "checksum": "sha256:59988e41d1530dcc36e62f7fed0bac2a1857c126e09296b261df3589a7de7af1",
+        "checksum": "sha256:34b195e03357e1d264328d7345832845beae11d2846c8e22810e427b20c75a0c",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "post-artifact-generate",
-        "file": "hooks/post-artifact-generate.sh",
+        "slug": "gate-guardian",
+        "file": "hooks/gate-guardian.sh",
         "version": "1.0.0",
-        "checksum": "sha256:891d4be3bf636f482d93473de0e221215a76373f45d6c832f19128864045665b",
+        "checksum": "sha256:7a5add785c53b4040bfde3ba68af8d2f43f65ecc101b600793f6f47a3e411f15",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "post-implement-validate",
-        "file": "hooks/post-implement-validate.sh",
+        "slug": "orch-helpers",
+        "file": "hooks/orch-helpers.sh",
         "version": "1.0.0",
-        "checksum": "sha256:051012b51361c1e6954194273adfbf30d6d323e037468370b40962c7b654b389",
+        "checksum": "sha256:0038a622374b5c88b9c674a8fc49744a72752c390db3e45a00948e6676e42959",
+        "supersedes": null,
+        "metadata": {}
+      },
+      {
+        "slug": "ping-pong-enforcer",
+        "file": "hooks/ping-pong-enforcer.sh",
+        "version": "1.0.0",
+        "checksum": "sha256:d2a5a10ea253da2ead5e203d64690129a56f377ecabe7ea4d43cd9c99d4cad95",
         "supersedes": null,
         "metadata": {}
       },
@@ -261,23 +269,23 @@
         "slug": "post-phase-checkpoint",
         "file": "hooks/post-phase-checkpoint.sh",
         "version": "1.0.0",
-        "checksum": "sha256:580da7b8c319cbc419d5002f59beca3b5f09163f1f84bb549ad0bbf7dac96821",
+        "checksum": "sha256:f75c815334e371bf508642b9591d94a548e1221c65ff7f34af9e430ec6e88722",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "pre-agent-invoke",
-        "file": "hooks/pre-agent-invoke.sh",
+        "slug": "prompt-orchestrator",
+        "file": "hooks/prompt-orchestrator.sh",
         "version": "1.0.0",
-        "checksum": "sha256:059c2fa044f9cd03fdc15aaee49281eadec4651415f00855ebe5782b44e114ed",
+        "checksum": "sha256:93835c7798185a9c8f8bf84a029c660b2bbe34801cd34c5be6b2b7a1f07a0b8b",
         "supersedes": null,
         "metadata": {}
       },
       {
-        "slug": "pre-phase-advance",
-        "file": "hooks/pre-phase-advance.sh",
+        "slug": "session-orchestrator",
+        "file": "hooks/session-orchestrator.sh",
         "version": "1.0.0",
-        "checksum": "sha256:ac9d7e98111776f578c613619d875b9d853817448448c64eab3cfcb3f85ba321",
+        "checksum": "sha256:143024a68b8438a0724fd93dd9b6eb1688bcc89c1a846ae7f6c389361b469f65",
         "supersedes": null,
         "metadata": {}
       },
@@ -285,7 +293,15 @@
         "slug": "track-agent-invocation",
         "file": "hooks/track-agent-invocation.sh",
         "version": "1.0.0",
-        "checksum": "sha256:c6e664831354b80b2eb1bae2dabfd13c6554fd8c258972e0b037bccb7dae3b0f",
+        "checksum": "sha256:6a9343b032dd72e391fc4c476af480ee3055a5a25ec60d3524b0b0d804a80c6d",
+        "supersedes": null,
+        "metadata": {}
+      },
+      {
+        "slug": "workflow-guard",
+        "file": "hooks/workflow-guard.sh",
+        "version": "1.0.0",
+        "checksum": "sha256:170a15396a61c537df4c8adc093d7ac36faab6e7de761ff8d283828c53e4a332",
         "supersedes": null,
         "metadata": {}
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestrator-claude/definitions",
-  "version": "3.12.0",
+  "version": "3.12.2",
   "description": "Built-in definitions (agents, skills, hooks, workflows, KB seeds) for the Orchestrator ecosystem",
   "type": "module",
   "main": "dist/index.js",

package/hooks/post-agent-artifact-relay.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-# Post-Agent Artifact Relay Hook (DEPRECATED — ADR-012)
-#
-# With ADR-012 F1, agents store artifacts directly via MCP artifactStore.
-# This hook is no longer needed. Kept as documentation.
-#
-# Previous behavior: relayed artifacts from filesystem staging to MinIO.
-# Now: agents call mcp__orchestrator-extended__artifactStore directly.
-
-# No-op: agents handle artifact storage directly
-exit 0

package/hooks/post-artifact-generate.sh

@@ -1,39 +0,0 @@
-#!/bin/bash
-# Post-Artifact Generate Hook
-# Executado apos geracao de um artefato
-# Valida artefato, atualiza indice, cria checkpoint
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-# Recebe evento via stdin ou argumento
-if [ -n "$1" ]; then
-    EVENT="$1"
-else
-    EVENT=$(cat)
-fi
-
-# Verifica se temos o handler compilado
-HANDLER="$PROJECT_ROOT/dist/hook.js"
-
-if [ ! -f "$HANDLER" ]; then
-    echo '{"success": false, "error": "Hook handler not compiled. Run npm run build first."}' >&2
-    exit 1
-fi
-
-# Executa o handler TypeScript
-echo "$EVENT" | node "$HANDLER" post-artifact
-
-EXIT_CODE=$?
-
-# Log do resultado
-if [ $EXIT_CODE -eq 0 ]; then
-    echo "[post-artifact-generate] Artifact processed successfully" >&2
-else
-    echo "[post-artifact-generate] Warning: Artifact processing had issues" >&2
-fi
-
-# Este hook nao bloqueia, apenas avisa
-exit 0

package/hooks/post-implement-validate.sh

@@ -1,102 +0,0 @@
-#!/bin/bash
-# Post-Implement Validation Hook (v2 — REST API)
-# Validates workflow consistency after IMPLEMENT phase.
-# Defense-in-depth: agents track progress via MCP, this validates externally.
-#
-# Exit codes:
-#   0 = Validation passed or skipped
-#   1 = Warning detected (TDD violation detected)
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-STATE_DIR="$PROJECT_ROOT/.orchestrator/.state"
-
-# API Configuration
-API_URL="${ORCHESTRATOR_API_URL:-http://localhost:3001}"
-AUTH_EMAIL="${ORCHESTRATOR_AUTH_EMAIL:-admin@orchestrator.local}"
-AUTH_PASSWORD="${ORCHESTRATOR_AUTH_PASSWORD:-admin123}"
-PROJECT_ID="${ORCHESTRATOR_PROJECT_ID:-d001d65d-25f5-4d13-b1dc-d006873e949c}"
-
-# Colors
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-log_info() { echo -e "${GREEN}[post-implement-validate]${NC} $1" >&2; }
-log_warn() { echo -e "${YELLOW}[post-implement-validate] WARNING:${NC} $1" >&2; }
-
-# Auth: get cached token
-get_token() {
-  mkdir -p "$STATE_DIR"
-  local cached="$STATE_DIR/jwt-token"
-  if [ -f "$cached" ]; then
-    local age=$(( $(date +%s) - $(stat -c%Y "$cached" 2>/dev/null || stat -f%m "$cached" 2>/dev/null || echo 0) ))
-    if [ "$age" -lt 3500 ]; then
-      cat "$cached"
-      return
-    fi
-  fi
-  local resp
-  resp=$(curl -s -f -X POST "${API_URL}/api/v1/auth/login" \
-    -H "Content-Type: application/json" \
-    -d "{\"email\":\"${AUTH_EMAIL}\",\"password\":\"${AUTH_PASSWORD}\"}" 2>/dev/null) || return 1
-  local token
-  token=$(echo "$resp" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);console.log(j.data?.accessToken||j.accessToken||j.token||'')}catch{console.log('')}})" 2>/dev/null)
-  if [ -n "$token" ]; then
-    echo "$token" > "$cached"
-    echo "$token"
-  fi
-}
-
-# Get workflow status from REST API
-TOKEN=$(get_token) || { exit 0; }  # Can't auth → skip silently
-
-WORKFLOW_RESP=$(curl -s -f "${API_URL}/api/v1/workflows?status=in_progress" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "X-Project-ID: $PROJECT_ID" 2>/dev/null) || { exit 0; }
-
-# Extract workflow info
-WORKFLOW_INFO=$(echo "$WORKFLOW_RESP" | node -e "
-  let d='';
-  process.stdin.on('data',c=>d+=c);
-  process.stdin.on('end',()=>{
-    try {
-      const j=JSON.parse(d);
-      const wfs=j.data||j;
-      const wf=Array.isArray(wfs)?wfs[0]:wfs;
-      if(!wf){console.log('{}');return;}
-      console.log(JSON.stringify({
-        id:wf.id||'',
-        phase:wf.currentPhase||wf.phase||'',
-        status:wf.status||''
-      }));
-    }catch{console.log('{}')}
-  });
-" 2>/dev/null)
-
-CURRENT_PHASE=$(echo "$WORKFLOW_INFO" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{console.log(JSON.parse(d).phase||'unknown')}catch{console.log('unknown')}})" 2>/dev/null)
-STATUS=$(echo "$WORKFLOW_INFO" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{console.log(JSON.parse(d).status||'unknown')}catch{console.log('unknown')}})" 2>/dev/null)
-
-# Count source and test files
-TS_FILES_COUNT=0
-if [ -d "$PROJECT_ROOT/src" ]; then
-  TS_FILES_COUNT=$(find "$PROJECT_ROOT/src" -name "*.ts" 2>/dev/null | wc -l | tr -d ' ')
-fi
-TEST_FILES_COUNT=0
-if [ -d "$PROJECT_ROOT/tests" ]; then
-  TEST_FILES_COUNT=$(find "$PROJECT_ROOT/tests" \( -name "*.test.ts" -o -name "*.spec.ts" \) 2>/dev/null | wc -l | tr -d ' ')
-fi
-
-log_info "Phase: $CURRENT_PHASE | Status: $STATUS | Src: $TS_FILES_COUNT | Tests: $TEST_FILES_COUNT"
-
-# TDD check: source files without tests
-if [ "$TS_FILES_COUNT" -gt 5 ] && [ "$TEST_FILES_COUNT" -eq 0 ]; then
-  log_warn "Found $TS_FILES_COUNT source files but no test files. TDD may not have been followed."
-  exit 1
-fi
-
-log_info "Validation passed."
-exit 0

package/hooks/pre-agent-invoke.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-# Pre-Agent Invoke Hook
-# Executado antes de invocar um subagent
-# Valida contexto e injeta informacoes da KB
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-# Recebe evento via stdin ou argumento
-if [ -n "$1" ]; then
-    EVENT="$1"
-else
-    EVENT=$(cat)
-fi
-
-# Verifica se temos o handler compilado
-HANDLER="$PROJECT_ROOT/dist/hook.js"
-
-if [ ! -f "$HANDLER" ]; then
-    echo '{"success": false, "error": "Hook handler not compiled. Run npm run build first."}' >&2
-    exit 1
-fi
-
-# Executa o handler TypeScript
-echo "$EVENT" | node "$HANDLER" pre-agent-invoke
-
-EXIT_CODE=$?
-
-# Exit code determina se agente pode prosseguir
-# 0 = permitido
-# 1 = bloqueado
-exit $EXIT_CODE

package/hooks/pre-phase-advance.sh

@@ -1,40 +0,0 @@
-#!/bin/bash
-# Pre-Phase Advance Hook
-# Executado antes de avancar para proxima fase
-# Avalia gate e cria checkpoint
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-# Recebe evento via stdin ou argumento
-if [ -n "$1" ]; then
-    EVENT="$1"
-else
-    EVENT=$(cat)
-fi
-
-# Verifica se temos o handler compilado
-HANDLER="$PROJECT_ROOT/dist/hook.js"
-
-if [ ! -f "$HANDLER" ]; then
-    echo '{"success": false, "error": "Hook handler not compiled. Run npm run build first."}' >&2
-    exit 1
-fi
-
-# Executa o handler TypeScript
-echo "$EVENT" | node "$HANDLER" pre-phase-advance
-
-EXIT_CODE=$?
-
-# Exit code determina se fase pode avancar
-# 0 = gate passou, pode avancar
-# 1 = gate falhou, bloqueado
-if [ $EXIT_CODE -eq 0 ]; then
-    echo "[pre-phase-advance] Gate passed, advancing phase" >&2
-else
-    echo "[pre-phase-advance] Gate failed, phase advance blocked" >&2
-fi
-
-exit $EXIT_CODE