@phuc1403/musketeer 0.5.0 → 0.7.0

package/src/provisioner/detect.js

@@ -1,93 +1,93 @@
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { spawnSync } = require('child_process');
-
-// Map of secret prereq name → environment variable that satisfies it.
-const SECRET_ENV = { 'anthropic-api-key': 'ANTHROPIC_API_KEY' };
-
-/**
- * Default command runner. Captures stdout+stderr (java prints version to stderr)
- * and never throws. Tests inject their own `ctx.run` to avoid touching the host.
- * @param {string} cmd
- * @returns {{code:number, stdout:string, stderr:string}}
- */
-function defaultRun(cmd) {
-  const r = spawnSync(cmd, { shell: true, encoding: 'utf8', windowsHide: true });
-  return {
-    code: typeof r.status === 'number' ? r.status : 1,
-    stdout: r.stdout || '',
-    stderr: r.stderr || '',
-  };
-}
-
-/** Extract a numeric version tuple from arbitrary command output. */
-function parseVersion(text) {
-  const m = String(text).match(/(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
-  if (!m) return null;
-  return [Number(m[1] || 0), Number(m[2] || 0), Number(m[3] || 0)];
-}
-
-/** found >= min ? (min may be "18" or "3.8") */
-function versionGte(found, min) {
-  if (!found) return false;
-  const want = parseVersion(min) || [0, 0, 0];
-  for (let i = 0; i < 3; i++) {
-    if (found[i] > want[i]) return true;
-    if (found[i] < want[i]) return false;
-  }
-  return true;
-}
-
-/**
- * Detect whether a single prereq is satisfied. Detection NEVER mutates the host.
- * @param {string} name prereq id
- * @param {object} prereq manifest prereq entry
- * @param {object} ctx { run, platform, projectDir }
- * @returns {{name:string, present:boolean, version:?string, reason:string}}
- */
-function detectPrereq(name, prereq, ctx) {
-  const run = ctx.run || defaultRun;
-
-  switch (prereq.kind) {
-    case 'secret': {
-      const envVar = SECRET_ENV[name];
-      const present = !!(envVar && process.env[envVar]);
-      return { name, present, version: null, reason: present ? `${envVar} set` : `${envVar} unset` };
-    }
-    case 'venv': {
-      const dir = path.join(ctx.projectDir, '.claude', 'skills', '.venv');
-      const present = fs.existsSync(dir);
-      return { name, present, version: null, reason: present ? 'venv exists' : 'venv missing' };
-    }
-    case 'mcp': {
-      const r = run('claude mcp list');
-      const present = r.code === 0 && /playwright/i.test(r.stdout + r.stderr);
-      return { name, present, version: null, reason: present ? 'mcp registered' : 'mcp not registered' };
-    }
-    case 'note':
-      // Nothing to probe directly; satisfied iff its `needs` are (handled by caller).
-      return { name, present: false, version: null, reason: 'note (self-bootstrap)' };
-    default: {
-      // package
-      if (!prereq.detect) return { name, present: false, version: null, reason: 'no detect command' };
-      let r = run(prereq.detect);
-      if (r.code !== 0 && name === 'python') r = run('python3 --version'); // unix fallback
-      const out = r.stdout + r.stderr;
-      const ver = parseVersion(out);
-      if (r.code !== 0) return { name, present: false, version: null, reason: 'not found' };
-      if (prereq.minVersion && !versionGte(ver, prereq.minVersion)) {
-        return {
-          name,
-          present: false,
-          version: ver ? ver.join('.') : null,
-          reason: `version ${ver ? ver.join('.') : '?'} < required ${prereq.minVersion}`,
-        };
-      }
-      return { name, present: true, version: ver ? ver.join('.') : null, reason: 'present' };
-    }
-  }
-}
-
-module.exports = { detectPrereq, parseVersion, versionGte, defaultRun, SECRET_ENV };
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+// Map of secret prereq name → environment variable that satisfies it.
+const SECRET_ENV = { 'anthropic-api-key': 'ANTHROPIC_API_KEY' };
+
+/**
+ * Default command runner. Captures stdout+stderr (java prints version to stderr)
+ * and never throws. Tests inject their own `ctx.run` to avoid touching the host.
+ * @param {string} cmd
+ * @returns {{code:number, stdout:string, stderr:string}}
+ */
+function defaultRun(cmd) {
+  const r = spawnSync(cmd, { shell: true, encoding: 'utf8', windowsHide: true });
+  return {
+    code: typeof r.status === 'number' ? r.status : 1,
+    stdout: r.stdout || '',
+    stderr: r.stderr || '',
+  };
+}
+
+/** Extract a numeric version tuple from arbitrary command output. */
+function parseVersion(text) {
+  const m = String(text).match(/(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!m) return null;
+  return [Number(m[1] || 0), Number(m[2] || 0), Number(m[3] || 0)];
+}
+
+/** found >= min ? (min may be "18" or "3.8") */
+function versionGte(found, min) {
+  if (!found) return false;
+  const want = parseVersion(min) || [0, 0, 0];
+  for (let i = 0; i < 3; i++) {
+    if (found[i] > want[i]) return true;
+    if (found[i] < want[i]) return false;
+  }
+  return true;
+}
+
+/**
+ * Detect whether a single prereq is satisfied. Detection NEVER mutates the host.
+ * @param {string} name prereq id
+ * @param {object} prereq manifest prereq entry
+ * @param {object} ctx { run, platform, projectDir }
+ * @returns {{name:string, present:boolean, version:?string, reason:string}}
+ */
+function detectPrereq(name, prereq, ctx) {
+  const run = ctx.run || defaultRun;
+
+  switch (prereq.kind) {
+    case 'secret': {
+      const envVar = SECRET_ENV[name];
+      const present = !!(envVar && process.env[envVar]);
+      return { name, present, version: null, reason: present ? `${envVar} set` : `${envVar} unset` };
+    }
+    case 'venv': {
+      const dir = path.join(ctx.projectDir, '.claude', 'skills', '.venv');
+      const present = fs.existsSync(dir);
+      return { name, present, version: null, reason: present ? 'venv exists' : 'venv missing' };
+    }
+    case 'mcp': {
+      const r = run('claude mcp list');
+      const present = r.code === 0 && /playwright/i.test(r.stdout + r.stderr);
+      return { name, present, version: null, reason: present ? 'mcp registered' : 'mcp not registered' };
+    }
+    case 'note':
+      // Nothing to probe directly; satisfied iff its `needs` are (handled by caller).
+      return { name, present: false, version: null, reason: 'note (self-bootstrap)' };
+    default: {
+      // package
+      if (!prereq.detect) return { name, present: false, version: null, reason: 'no detect command' };
+      let r = run(prereq.detect);
+      if (r.code !== 0 && name === 'python') r = run('python3 --version'); // unix fallback
+      const out = r.stdout + r.stderr;
+      const ver = parseVersion(out);
+      if (r.code !== 0) return { name, present: false, version: null, reason: 'not found' };
+      if (prereq.minVersion && !versionGte(ver, prereq.minVersion)) {
+        return {
+          name,
+          present: false,
+          version: ver ? ver.join('.') : null,
+          reason: `version ${ver ? ver.join('.') : '?'} < required ${prereq.minVersion}`,
+        };
+      }
+      return { name, present: true, version: ver ? ver.join('.') : null, reason: 'present' };
+    }
+  }
+}
+
+module.exports = { detectPrereq, parseVersion, versionGte, defaultRun, SECRET_ENV };

package/src/self-update.js

@@ -1,73 +1,77 @@
-'use strict';
-
-// Self-update gate for `musketeer muster`. Before the picker applies the bundled
-// template, make sure the CLI is at the latest PUBLISHED version — otherwise
-// "muster" would refresh installed skills to a stale package's template.
-//
-// When behind: promote (npm i -g @latest), then re-exec `musketeer muster` so the
-// picker runs under the freshly-installed template. A running Node process can't
-// reliably hot-swap its own package files mid-run, so re-exec is the safe path.
-//
-// Guards:
-//   MUSKETEER_REEXEC=1        set on the child so it never re-checks (no loop)
-//   MUSKETEER_NO_SELF_UPDATE=1 user opt-out (offline / pinned version)
-
-const { spawnSync } = require('child_process');
-const { fetchLatest, compareVersions, defaultRun } = require('./promote');
-const pkg = require('../package.json');
-
-/**
- * Decide whether muster should self-update first. Pure — injectable exec/env.
- * @param {{exec?:Function, current?:string, name?:string, env?:object}} [o]
- * @returns {{action:'proceed'|'update', latest:?string}}
- */
-function decide(o = {}) {
-  const exec = o.exec || defaultRun;
-  const current = o.current || pkg.version;
-  const name = o.name || pkg.name;
-  const env = o.env || process.env;
-
-  if (env.MUSKETEER_REEXEC === '1' || env.MUSKETEER_NO_SELF_UPDATE === '1') {
-    return { action: 'proceed', latest: null };
-  }
-  const latest = fetchLatest(exec, name);
-  if (!latest) return { action: 'proceed', latest: null }; // offline / unknown — proceed as-is
-  if (compareVersions(latest, current) <= 0) return { action: 'proceed', latest }; // already latest
-  return { action: 'update', latest };
-}
-
-/**
- * Ensure the CLI is latest before muster applies the template.
- * @param {object} [io] injectable { log, exec, spawn, env, name, current } for tests
- * @returns {?number} an exit code if it re-exec'd a fresh muster (caller should
- *   exit with it); null to mean "proceed in-process".
- */
-function ensureLatest(io = {}) {
-  const log = io.log || ((m) => process.stdout.write(m + '\n'));
-  const exec = io.exec || defaultRun;
-  const spawn = io.spawn || spawnSync;
-  const env = io.env || process.env;
-  const name = io.name || pkg.name;
-  const current = io.current || pkg.version;
-
-  const d = decide({ exec, current, name, env });
-  if (d.action === 'proceed') return null;
-
-  log(`Updating musketeer ${current} → ${d.latest} before muster…`);
-  const ins = exec(`npm i -g ${name}@latest`);
-  if (ins.code !== 0) {
-    log('Self-update failed — continuing with the current version.');
-    if (ins.stderr) log(ins.stderr.trim());
-    return null;
-  }
-
-  // Re-exec the now-latest binary's muster, inheriting the TTY for the picker.
-  const r = spawn('musketeer', ['muster'], {
-    stdio: 'inherit',
-    shell: true,
-    env: { ...env, MUSKETEER_REEXEC: '1' },
-  });
-  return typeof r.status === 'number' ? r.status : 0;
-}
-
-module.exports = { decide, ensureLatest };
+'use strict';
+
+// Self-update gate for `musketeer muster`. Before the picker applies the bundled
+// template, make sure the CLI is at the latest PUBLISHED version — otherwise
+// "muster" would refresh installed skills to a stale package's template.
+//
+// When behind: promote (npm i -g @latest), then re-exec `musketeer muster` so the
+// picker runs under the freshly-installed template. A running Node process can't
+// reliably hot-swap its own package files mid-run, so re-exec is the safe path.
+//
+// Guards:
+//   MUSKETEER_REEXEC=1        set on the child so it never re-checks (no loop)
+//   MUSKETEER_NO_SELF_UPDATE=1 user opt-out (offline / pinned version)
+
+const { spawnSync } = require('child_process');
+const { fetchLatest, compareVersions, defaultRun } = require('./promote');
+const pkg = require('../package.json');
+
+/**
+ * Decide whether muster should self-update first. Pure — injectable exec/env.
+ * @param {{exec?:Function, current?:string, name?:string, env?:object}} [o]
+ * @returns {{action:'proceed'|'update', latest:?string}}
+ */
+function decide(o = {}) {
+  const exec = o.exec || defaultRun;
+  const current = o.current || pkg.version;
+  const name = o.name || pkg.name;
+  const env = o.env || process.env;
+
+  if (env.MUSKETEER_REEXEC === '1' || env.MUSKETEER_NO_SELF_UPDATE === '1') {
+    return { action: 'proceed', latest: null };
+  }
+  const latest = fetchLatest(exec, name);
+  if (!latest) return { action: 'proceed', latest: null }; // offline / unknown — proceed as-is
+  if (compareVersions(latest, current) <= 0) return { action: 'proceed', latest }; // already latest
+  return { action: 'update', latest };
+}
+
+/**
+ * Ensure the CLI is latest before muster applies the template.
+ * @param {object} [io] injectable { log, exec, spawn, env, name, current } for tests
+ * @returns {?number} an exit code if it re-exec'd a fresh muster (caller should
+ *   exit with it); null to mean "proceed in-process".
+ */
+function ensureLatest(io = {}) {
+  const log = io.log || ((m) => process.stdout.write(m + '\n'));
+  const exec = io.exec || defaultRun;
+  const spawn = io.spawn || spawnSync;
+  const env = io.env || process.env;
+  const name = io.name || pkg.name;
+  const current = io.current || pkg.version;
+
+  const d = decide({ exec, current, name, env });
+  if (d.action === 'proceed') return null;
+
+  log(`Updating musketeer ${current} → ${d.latest} before muster…`);
+  const ins = exec(`npm i -g ${name}@latest`);
+  if (ins.code !== 0) {
+    log('Self-update failed — continuing with the current version.');
+    if (ins.stderr) log(ins.stderr.trim());
+    return null;
+  }
+
+  // Re-exec the now-latest binary's muster, inheriting the TTY for the picker.
+  // The caller's flags come along: dropping them here would send a scripted
+  // `muster --keep` back to the interactive picker, which is the one place it
+  // cannot run.
+  const args = io.args || [];
+  const r = spawn('musketeer', ['muster', ...args], {
+    stdio: 'inherit',
+    shell: true,
+    env: { ...env, MUSKETEER_REEXEC: '1' },
+  });
+  return typeof r.status === 'number' ? r.status : 0;
+}
+
+module.exports = { decide, ensureLatest };

package/template/.claude/hooks/block-unsafe-adr-title.cjs

@@ -1,70 +1,85 @@
-#!/usr/bin/env node
-// PreToolUse guard: block an `adr new` title that adr-tools' own script cannot
-// handle safely.
-//
-// adr-new builds the ADR file with `sed -e "s|TITLE|$title|"`, substituting the
-// title in unescaped and using `|` as the delimiter. Two failure modes follow,
-// verified directly against /usr/bin/adr-new:
-//   - `|` in the title breaks sed's own syntax: it exits 1, but only after
-//     creating a zero-byte ADR file that already burned that number.
-//   - `&` in a sed replacement means "the whole match" — it does NOT error.
-//     "Use Kafka & Queues" silently becomes the title "Use Kafka TITLE Queues",
-//     written straight into the file and the generated index.
-// A title starting with `-` is a third case: adr-new parses its own flags with
-// getopts, so without a `--` separator the title is read as an unknown option
-// and the ADR is silently never created (clean failure, still worth catching
-// early with a clearer reason than adr-tools' own "no title given").
-//
-// Blocking, not warning: `|` wastes an ADR number and `&` corrupts data with no
-// error at all, so there is nothing later in the pipeline that will catch it.
-
-let raw = "";
-process.stdin.on("data", (chunk) => (raw += chunk));
-process.stdin.on("end", () => {
-  let input;
-  try {
-    input = JSON.parse(raw || "{}");
-  } catch {
-    process.exit(0); // unparseable payload — fail open, don't block legit work
-  }
-
-  const command = (input && input.tool_input && input.tool_input.command) || "";
-  if (!/\badr\s+new\b/.test(command)) process.exit(0);
-
-  // The skill always places `--` immediately before a quoted title. Extract
-  // that argument; anything else about the command's shape is not this hook's
-  // concern.
-  const afterDashDash = command.match(/--\s+(["'])((?:(?!\1).)*)\1/);
-  const title = afterDashDash ? afterDashDash[2] : null;
-
-  let reason = null;
-  if (!afterDashDash) {
-    reason =
-      "no `--` before the title (or no quoted title found after it). Without `--`, " +
-      "adr-new's getopts can read a title starting with `-` as a flag and silently " +
-      "create nothing. Always: adr new [-s STEM]... -- \"Title\".";
-  } else if (title.includes("|")) {
-    reason =
-      "the title contains `|`. adr-new substitutes it into `sed -e \"s|TITLE|$title|\"`, " +
-      "using `|` as sed's own delimiter — this breaks sed's syntax and exits non-zero, " +
-      "but only after creating a zero-byte ADR file that already consumed that number.";
-  } else if (title.includes("&")) {
-    reason =
-      "the title contains `&`. In a sed replacement `&` means \"the whole match\", so " +
-      "adr-new writes it as literal text into the title (e.g. \"Use Kafka & Queues\" " +
-      "becomes \"Use Kafka TITLE Queues\") and exits 0 — nothing else will catch this.";
-  }
-
-  if (reason) {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: `Refusing this \`adr new\` call: ${reason} Rename the title and retry.`,
-        },
-      })
-    );
-  }
-  process.exit(0);
-});
+#!/usr/bin/env node
+// PreToolUse guard: block an `adr new` title the tool cannot render safely.
+//
+// The tool builds the ADR by running plain JS string replacements over the
+// template, in a fixed order: DATE, TITLE, NUMBER, STATUS. `String.replace`
+// with a string pattern rewrites the FIRST occurrence, and by the time STATUS
+// is substituted the title is already sitting in the document — on line 1,
+// ahead of the real `STATUS` placeholder in the `## Status` section.
+//
+// So an uppercase STATUS inside the title captures the substitution meant for
+// the status line. Verified against @meza/adr-tools 2.0.4:
+//   adr new -q -- "Use STATUS codes for errors"
+// writes `# 1: Use Accepted codes for errors` and leaves the real status as the
+// literal word STATUS — exit 0, no warning, wrong data in the index.
+//
+// Only STATUS is blocked, and only in uppercase:
+//   - the replacement is case-sensitive, so "Use status codes" is fine;
+//   - DATE is substituted before the title is inserted, so it cannot be caught;
+//   - NUMBER and TITLE are substituted at points that precede the title text in
+//     the template shipped with this skill, so the real placeholder always wins.
+//     That last one holds because of where the tokens sit in
+//     `references/adr-template.md` — revisit this guard if that file is ever
+//     reordered so `## Status` precedes the heading.
+//
+// A title starting with `-` is the second case: the tool parses its own flags
+// with commander, so without a `--` separator the title is read as an unknown
+// option. That one fails cleanly (exit 1, no file created), but it is still
+// worth catching early with a clearer reason than "unknown option".
+//
+// Blocking, not warning: the STATUS case corrupts data with no error at all, so
+// there is nothing later in the pipeline that will catch it.
+//
+// The `|` and `&` characters used to be blocked here too. Those were hazards of
+// the old bash implementation, which substituted the title into
+// `sed -e "s|TITLE|$title|"`. Substitution is JS now, and both characters were
+// re-verified as harmless, so blocking them would only refuse valid titles.
+
+const { invokesAdr } = require("./lib/adr/command-scan.cjs");
+
+let raw = "";
+process.stdin.on("data", (chunk) => (raw += chunk));
+process.stdin.on("end", () => {
+  let input;
+  try {
+    input = JSON.parse(raw || "{}");
+  } catch {
+    process.exit(0); // unparseable payload — fail open, don't block legit work
+  }
+
+  const command = (input && input.tool_input && input.tool_input.command) || "";
+  if (!invokesAdr(command, "new")) process.exit(0);
+
+  // The skill always places `--` immediately before a quoted title. Extract
+  // that argument; anything else about the command's shape is not this hook's
+  // concern.
+  const afterDashDash = command.match(/--\s+(["'])((?:(?!\1).)*)\1/);
+  const title = afterDashDash ? afterDashDash[2] : null;
+
+  let reason = null;
+  if (!afterDashDash) {
+    reason =
+      "no `--` before the title (or no quoted title found after it). Without `--`, " +
+      "a title starting with `-` is parsed as an unknown option and no ADR is " +
+      'created. Always: adr new -q [-s STEM]... -- "Title".';
+  } else if (title.includes("STATUS")) {
+    reason =
+      "the title contains `STATUS` in uppercase. The tool substitutes STATUS into the " +
+      'template after the title is already in the document, so "Use STATUS codes" ' +
+      'becomes "Use Accepted codes" and the real Status section is left as the literal ' +
+      "word STATUS — it exits 0, so nothing else will catch this. Lowercase `status` is fine.";
+  }
+
+  if (reason) {
+    process.stdout.write(
+      JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: `Refusing this \`adr new\` call: ${reason} Rename the title and retry.`,
+        },
+      })
+    );
+  }
+  process.exit(0);
+});