@pennyfarthing/core 7.9.2 → 7.9.5

package/pennyfarthing-dist/scripts/hooks/pre-commit.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+# pre-commit.sh - Git hook to enforce branch protection and agent validation
+#
+# Checks:
+# 1. Prevents direct commits to protected branches (main, develop)
+#    Exception: sprint/ folder commits allowed on develop
+# 2. Validates agent files when pennyfarthing-dist/agents/*.md is modified
+#
+# Installation:
+#   Installed to .git/hooks/pre-commit by pennyfarthing init or doctor --fix
+#   Or symlink: ln -sf ../../pennyfarthing-dist/scripts/hooks/pre-commit.sh .git/hooks/pre-commit
+
+set -uo pipefail
+
+# Find project root
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# Handle both direct execution and symlink from .git/hooks
+if [[ "$SCRIPT_DIR" == *".git/hooks"* ]]; then
+    PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+else
+    PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+fi
+
+# =============================================================================
+# Check 1: Branch Protection
+# =============================================================================
+
+BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+PROTECTED_BRANCHES="^(main|develop)$"
+
+if [[ $BRANCH =~ $PROTECTED_BRANCHES ]]; then
+    # Special case: Allow sprint/ folder commits on develop branch
+    if [[ $BRANCH == "develop" ]]; then
+        STAGED_FILES=$(git diff --cached --name-only)
+        NON_SPRINT_FILES=$(echo "$STAGED_FILES" | grep -v "^sprint/")
+
+        # If all staged files are in sprint/, allow the commit
+        if [ -z "$NON_SPRINT_FILES" ] && [ -n "$STAGED_FILES" ]; then
+            # Continue to agent validation check
+            :
+        else
+            echo ""
+            echo "COMMIT BLOCKED"
+            echo ""
+            echo "You are trying to commit directly to: $BRANCH"
+            echo "This violates the git workflow rules."
+            echo ""
+            echo "Protected branches: main, develop"
+            echo ""
+            echo "What to do:"
+            echo "1. Create a feature branch:"
+            echo "   git checkout -b <type>/<epic-story>-<description>"
+            echo ""
+            echo "2. Example:"
+            echo "   git checkout -b feat/8-2-add-authentication"
+            echo ""
+            echo "3. Then commit your changes on the feature branch"
+            echo ""
+            echo "Exception: Sprint tracking files (sprint/*) can be committed to develop"
+            echo ""
+            exit 1
+        fi
+    else
+        echo ""
+        echo "COMMIT BLOCKED - Cannot commit directly to $BRANCH"
+        echo ""
+        exit 1
+    fi
+fi
+
+# =============================================================================
+# Check 2: Agent File Validation
+# =============================================================================
+
+STAGED_FILES=$(git diff --cached --name-only 2>/dev/null || true)
+AGENT_FILES=$(echo "$STAGED_FILES" | grep "^pennyfarthing-dist/agents/.*\.md$" || true)
+
+if [[ -n "$AGENT_FILES" ]]; then
+    echo "Agent files staged for commit:"
+    echo "$AGENT_FILES" | sed 's/^/  /'
+    echo ""
+
+    VALIDATOR="$PROJECT_ROOT/pennyfarthing-dist/scripts/validation/validate-agent-schema.sh"
+
+    if [[ -x "$VALIDATOR" ]]; then
+        echo "Running agent schema validation..."
+        echo ""
+
+        if ! "$VALIDATOR"; then
+            echo ""
+            echo "COMMIT BLOCKED - Agent validation failed"
+            echo ""
+            echo "Fix the validation errors above and try again."
+            echo "Run 'just validate-agents -v' for detailed output."
+            echo ""
+            exit 1
+        fi
+
+        echo ""
+        echo "✓ Agent validation passed"
+    else
+        echo "Warning: Agent validator not found at $VALIDATOR"
+        echo "Skipping agent validation."
+    fi
+fi
+
+exit 0

package/pennyfarthing-dist/scripts/hooks/pre-edit-check.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env zsh
+# Pre-edit hook: Verify edits don't touch protected files
+# Called by Claude Code before Edit/Write tool calls
+#
+# Input: JSON via stdin with tool_name, tool_input
+# Output: Exit 0 to allow, Exit 2 to block (stderr shown to Claude)
+
+set -euo pipefail
+
+# Read input from stdin
+input=$(cat)
+
+# Extract file path from tool input
+file_path=$(echo "$input" | jq -r '.tool_input.file_path // .tool_input.path // ""')
+
+# Protected patterns (files that should never be edited automatically)
+protected_patterns=(
+    "*.env"
+    "*.pem"
+    "*.key"
+    "*credentials*"
+    "*secrets*"
+    ".git/*"
+    "node_modules/*"
+    "vendor/*"
+)
+
+# Pennyfarthing managed files protection
+# These are managed by `pennyfarthing update`, don't edit directly
+# EXCEPTION: If we ARE in the pennyfarthing library itself, allow edits
+is_pennyfarthing_lib=false
+if [[ -d "${CLAUDE_PROJECT_DIR:-$PWD}/pennyfarthing-dist" ]]; then
+    is_pennyfarthing_lib=true
+fi
+
+if [[ "$file_path" == *".claude/pennyfarthing/"* ]] && [[ "$is_pennyfarthing_lib" == "false" ]]; then
+    echo "BLOCKED: Cannot edit managed pennyfarthing files." >&2
+    echo "File: $file_path" >&2
+    echo "" >&2
+    echo "These files are managed by pennyfarthing and will be overwritten on update." >&2
+    echo "Instead:" >&2
+    echo "  - Put project-specific customizations in .claude/project/" >&2
+    echo "  - For framework changes, edit the pennyfarthing repo and run 'pennyfarthing update'" >&2
+    exit 2
+fi
+
+# Check if file matches any protected pattern
+for pattern in "${protected_patterns[@]}"; do
+    if [[ "$file_path" == $pattern ]]; then
+        echo "BLOCKED: Cannot edit protected file matching pattern: $pattern" >&2
+        echo "File: $file_path" >&2
+        exit 2
+    fi
+done
+
+# Additional check: warn on certain file types but allow
+warn_patterns=(
+    "*.md"
+    "*.json"
+)
+
+# For warnings, just log to stderr but allow (exit 0)
+for pattern in "${warn_patterns[@]}"; do
+    if [[ "$file_path" == $pattern ]]; then
+        # Could log warnings here if needed
+        :
+    fi
+done
+
+# Allow the edit
+exit 0

package/pennyfarthing-dist/scripts/hooks/pre-push.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+# pre-push.sh - Git hook to remind about Jira sync before push
+#
+# Checks if sprint files were modified and reminds to sync to Jira.
+#
+# Installation:
+#   Installed to .git/hooks/pre-push by pennyfarthing init or doctor --fix
+#   Or symlink: ln -sf ../../pennyfarthing-dist/scripts/hooks/pre-push.sh .git/hooks/pre-push
+
+set -uo pipefail
+
+# Find project root
+find_project_root() {
+    local dir="$PWD"
+    while [[ ! -d "$dir/.pennyfarthing" ]] && [[ "$dir" != "/" ]]; do
+        dir="$(dirname "$dir")"
+    done
+    if [[ -d "$dir/.pennyfarthing" ]]; then
+        echo "$dir"
+    else
+        return 1
+    fi
+}
+
+PROJECT_ROOT="$(find_project_root 2>/dev/null || echo "")"
+if [[ -z "$PROJECT_ROOT" ]]; then
+    exit 0
+fi
+
+SPRINT_FILE="$PROJECT_ROOT/sprint/current-sprint.yaml"
+
+# Check if there are uncommitted changes to sprint file
+if git diff --name-only | grep -q "sprint/current-sprint.yaml"; then
+    echo "Warning: current-sprint.yaml has uncommitted changes"
+    echo "   Consider committing before pushing"
+    echo ""
+fi
+
+# Get the range of commits being pushed
+REMOTE="$1"
+URL="$2"
+
+while read local_ref local_sha remote_ref remote_sha; do
+    if [ "$local_sha" != "0000000000000000000000000000000000000000" ]; then
+        # Check if sprint file changed in this push
+        if git diff --name-only "$remote_sha..$local_sha" 2>/dev/null | grep -q "sprint/current-sprint.yaml"; then
+            echo "Sprint changes detected in push"
+            echo "   Reminder: Sync to Jira if story statuses changed"
+            echo ""
+        fi
+    fi
+done
+
+exit 0

package/pennyfarthing-dist/scripts/hooks/question-reflector-check.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Question Reflector Enforcement Hook (Stop hook / PreToolUse hook)
+#
+# Thin wrapper that delegates to question_reflector_check.py for the actual logic.
+# This allows the hook to be written in Python for easier testing and maintenance.
+#
+# Input (stdin): JSON with transcript_path, stop_hook_active, etc.
+# Output (stdout): JSON decision to allow or block
+#
+# Story: MSSCI-12393
+#
+
+set -euo pipefail
+
+# Get the directory where this script lives
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Delegate to Python implementation
+exec python3 "$SCRIPT_DIR/question_reflector_check.py"