@pmelab/gtd 17.3.0 → 18.1.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gtd",
-  "version": "17.3.0",
+  "version": "18.1.0",
   "description": "Drive the gtd loop inside Claude Code: agent turns run as subagents, gtd decides every beat",
   "author": {
     "name": "Philipp Melab"

package/README.md

@@ -28,11 +28,18 @@ Git history; keep secrets in an environment setting (see
 Also install all three skill sources the bundled workflow names in its prompts —
 none is optional. See
 [Setup](https://github.com/pmelab/gtd/blob/main/docs/setup.md) for the list, the
-install flags, and the never-install-the-plugin caveat. Each bundled agent step
-has its own addressable `.gtdrc` `skills:` entry — see
+install flags, and the never-install-the-plugin caveat. Skills are declared per
+scope, and restricted per turn where the driver can; each bundled scope has its
+own addressable `.gtdrc` `skills:` entry — see
 [Configuration](https://github.com/pmelab/gtd/blob/main/docs/configuration.md#the-skills-key)
 to repoint one to a set your own harness has instead.
 
+Each scope also declares which files its agent turns may read and write;
+`gtd land` refuses a turn that wrote outside its scope, and a driver can pass
+the read side to its agent. `read` is not a security boundary unless your driver
+enforces it at the OS level. See
+[Configuration](https://github.com/pmelab/gtd/blob/main/docs/configuration.md#file-access).
+
 > **A repository's `gtd.config.ts` is code, and gtd runs it.** A custom workflow
 > is a TypeScript module, and every gtd command that looks at workflow state —
 > `gtd next` and `gtd lsp` included, not just `gtd land` — evaluates it. Treat

package/claude/hooks/access.ts

@@ -0,0 +1,58 @@
+import { isAbsolute, relative, resolve } from "node:path"
+
+import { globMatches } from "../../src/replay/Glob.js"
+
+export type AccessDef = { read: string[] | null; write: string[] | null }
+
+const READ = new Set(["Read"])
+const WRITE: Record<string, string> = {
+  Edit: "file_path",
+  MultiEdit: "file_path",
+  Write: "file_path",
+  NotebookEdit: "notebook_path",
+}
+
+// Repo-relative form of a path; undefined when it lies outside the repo.
+const inRepo = (p: string, root: string): string | undefined => {
+  const rel = relative(root, isAbsolute(p) ? p : resolve(root, p))
+  return rel === ".." || rel.startsWith("../") || isAbsolute(rel) ? undefined : rel
+}
+
+const deny = (verb: string, path: string, globs: string[]) =>
+  `gtd access: ${verb} of ${path} is outside this step's ${verb} access (${globs.join(", ") || "none"})`
+
+// Bash is deliberately not inspected: access is best effort at the tool level,
+// and `gtd land` is the backstop for writes.
+export function accessDenial(
+  tool: string,
+  input: Record<string, unknown>,
+  access: AccessDef,
+  root: string,
+): string | undefined {
+  if (READ.has(tool)) return check("read", input.file_path, access.read, root)
+  const key = WRITE[tool]
+  if (key) return check("write", input[key], access.write, root)
+  if (tool === "Glob" || tool === "Grep") return searchDenial(input.path, access.read, root)
+  return undefined
+}
+
+function check(verb: string, raw: unknown, globs: string[] | null, root: string) {
+  if (globs === null || typeof raw !== "string") return undefined
+  const rel = inRepo(raw, root)
+  if (rel === undefined || globs.some((g) => globMatches(rel, g))) return undefined
+  return deny(verb, rel, globs)
+}
+
+// A search is allowed only from a root that sits inside the literal directory
+// prefix of some read glob, so it cannot enumerate files outside the access.
+function searchDenial(raw: unknown, globs: string[] | null, root: string) {
+  if (globs === null) return undefined
+  const rel = typeof raw === "string" && raw ? inRepo(raw, root) : ""
+  if (rel === undefined) return undefined
+  const inside = globs.some((g) => {
+    const prefix = g.split("*")[0]!
+    const dir = prefix.slice(0, prefix.lastIndexOf("/") + 1).replace(/\/$/, "")
+    return dir === "" || rel === dir || rel.startsWith(`${dir}/`)
+  })
+  return inside ? undefined : deny("read", rel || ".", globs)
+}

package/claude/hooks/drive.ts

@@ -1,4 +1,6 @@
+import { ACCESS_REFUSAL } from "../../src/wire/constants.js"
 import type { Stop } from "../types"
+import type { AccessDef } from "./access"
 
 // The subset of `gtd next --json` this driver reads. Absent optional fields
 // are simply missing; booleans may arrive as strings.
@@ -13,7 +15,9 @@ export type Beat = {
   memory?: string
   model?: string
   system?: string
+  skills?: string[]
   validate?: string
+  access?: AccessDef
   judge?: unknown
   changes?: { status: string; path: string }[]
   session?: { id?: string; resume?: boolean | string }
@@ -33,6 +37,9 @@ export type Turn = {
   label?: string
   model?: string
   system?: string
+  skills: readonly string[]
+  scope: string
+  access?: AccessDef
 }
 
 export type TurnEnd = { ok: true } | { ok: false; why: string }
@@ -80,7 +87,7 @@ export async function drive(io: Io, landTurn?: string): Promise<Stop> {
     const acted = await act(io, b, beat, judged, beat === 1 ? landTurn : undefined)
     if (acted.stop) return acted.stop
     judged = acted.verdict ? b.state : undefined
-    const landed = await land(io, b, acted.verdict)
+    const landed = await land(io, b, acted.verdict, true)
     if (landed) return landed
   }
 }
@@ -120,7 +127,7 @@ async function message(io: Io, b: Beat, beat: number, judged: string | undefined
 }
 
 async function agent(io: Io, b: Beat, landTurn: string | undefined): Promise<Acted> {
-  const memory = b.memory ?? b.session?.id ?? b.state ?? "root"
+  const memory = memoryOf(b)
   const t =
     landTurn === memory
       ? ({ ok: true } as const)
@@ -131,6 +138,9 @@ async function agent(io: Io, b: Beat, landTurn: string | undefined): Promise<Act
           label: b.label,
           model: b.model || undefined,
           system: b.system || undefined,
+          skills: b.skills ?? [],
+          scope: memory.split("#")[0]!,
+          access: b.access,
         })
   if (!t.ok) return failed(b, t.why)
   return b.validate ? validated(io, b, b.validate, memory) : {}
@@ -148,8 +158,25 @@ async function validated(io: Io, b: Beat, validate: string, memory: string): Pro
   }
 }
 
-async function land(io: Io, b: Beat, verdict: string | undefined): Promise<Stop | undefined> {
-  const l = await io.land(verdict)
+const memoryOf = (b: Beat) => b.memory ?? b.session?.id ?? b.state ?? "root"
+
+// A prompt beat whose turn wrote outside its access gets one recovery turn
+// with the refusal text; a second refusal is an error, not another loop.
+async function land(
+  io: Io,
+  b: Beat,
+  verdict: string | undefined,
+  mayRecover: boolean,
+): Promise<Stop | undefined> {
+  let l: Landing
+  try {
+    l = await io.land(verdict)
+  } catch (e) {
+    const text = e instanceof Error ? e.message : String(e)
+    if (b.kind !== "prompt" || !text.includes(ACCESS_REFUSAL)) throw e
+    if (!mayRecover) return { kind: "error", text, ...where(b) }
+    return recover(io, b, verdict, text)
+  }
   const code = await io.sh(l.script, b.log)
   if (code !== 0) return { kind: "error", text: `landing script exited ${code}`, ...where(b) }
   if (!isTrue(l.settled)) return undefined
@@ -157,6 +184,22 @@ async function land(io: Io, b: Beat, verdict: string | undefined): Promise<Stop
   return { kind: "done", text, ...where(b) }
 }
 
+async function recover(
+  io: Io,
+  b: Beat,
+  verdict: string | undefined,
+  text: string,
+): Promise<Stop | undefined> {
+  const memory = memoryOf(b)
+  const r = await io.resume(memory, text)
+  if (!r.ok) return { kind: "error", text: r.why, ...where(b) }
+  if (b.validate) {
+    const v = await validated(io, b, b.validate, memory)
+    if (v.stop) return v.stop
+  }
+  return land(io, b, verdict, false)
+}
+
 // What a reload that cut the loop off does next. Only a turn the agent
 // finished lands; any other end runs it again. A script cut off may have run
 // partly, and running it again is not safe to assume, so a person decides.

package/claude/hooks/persona.ts

@@ -0,0 +1,28 @@
+import type { Turn } from "./drive"
+
+const NEUTRAL = "You are a coding agent working on the task you are given."
+
+// `general-purpose` cannot carry a restriction, so every prompt turn gets a
+// registered persona. The name hashes everything the spec depends on: a
+// `.gtdrc` change or gtd upgrade mid-session must register a fresh one.
+export async function personaSpec(t: Pick<Turn, "scope" | "system" | "skills">) {
+  const key = JSON.stringify([t.scope, t.system ?? "", t.skills])
+  const digest = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", new TextEncoder().encode(key)),
+  )
+  const name =
+    "p-" + Array.from(digest.slice(0, 6), (b) => b.toString(16).padStart(2, "0")).join("")
+  return {
+    name,
+    prompt: t.system || NEUTRAL,
+    skills: [...t.skills],
+    disallowedTools: ["Skill"],
+    permissionMode: "bypassPermissions",
+  }
+}
+
+export function resumable(entry: unknown, persona: string): string | undefined {
+  if (typeof entry !== "object" || entry === null) return undefined
+  const e = entry as { agentId?: unknown; persona?: unknown }
+  return typeof e.agentId === "string" && e.persona === persona ? e.agentId : undefined
+}

package/claude/hooks/register.tsx

@@ -2,10 +2,13 @@ import { atom, read, update } from "claude-code"
 import type { EngineInterface, Register } from "claude-code"
 
 import type { Run, Stop } from "../types"
+import { accessDenial } from "./access"
+import type { AccessDef } from "./access"
 import { afterReload, drive, isTrue } from "./drive"
-import type { Beat, Io, Landing, TurnEnd } from "./drive"
+import type { Beat, Io, Landing, Turn, TurnEnd } from "./drive"
 import { enter } from "./entry"
 import { subagentModel } from "./models"
+import { personaSpec, resumable } from "./persona"
 import { JUDGE_SYSTEM, judgePrompt, toVerdicts } from "./judge"
 import type { Judgment } from "./judge"
 import { catchFrom, throwTo } from "./handoff"
@@ -25,6 +28,7 @@ import {
   pushText,
   runningLine,
   question,
+  restartLine,
   RELOAD_CUT_SCRIPT,
   SAFE,
   SHIP,
@@ -37,7 +41,10 @@ type $ = EngineInterface
 
 const run = atom({ plugin: "gtd", key: "run" } as const, { isRunning: false, beat: 0 } as Run)
 // memory scope (`<scope>#<hash7>`) -> the subagent holding that conversation
-const scopes = atom({ plugin: "gtd", key: "scopes" } as const, {} as Record<string, string>)
+const scopes = atom(
+  { plugin: "gtd", key: "scopes" } as const,
+  {} as Record<string, { agentId: string; persona: string }>,
+)
 const agents = atom({ plugin: "gtd", key: "agents" } as const, [] as string[])
 
 const TEN_MINUTES = 600_000
@@ -61,6 +68,11 @@ let isShipping = false
 // subagents answering into a file: what each may touch (see tool.call)
 const delegates = new Map<string, { file: string; mayRun: RegExp | undefined }>()
 const ours = new Set<string>()
+// What each turn agent may read and write; reset on every spawn and resume,
+// since the steering file can differ per step.
+const accesses = new Map<string, AccessDef>()
+const setAccess = (id: string, a: AccessDef | undefined) =>
+  void (a ? accesses.set(id, a) : accesses.delete(id))
 const waiting = new Map<string, (end: TurnEnd) => void>()
 const ended = new Map<string, TurnEnd>()
 const personas = new Set<string>()
@@ -82,23 +94,19 @@ async function gtd($: $, args: string[], stdin?: string) {
   return r.stdout
 }
 
-// One agent type per system prompt. A registered type's prompt replaces the
-// session's system prompt, as `--system-prompt` does for the sh driver.
-async function persona($: $, system: string) {
-  const bytes = new TextEncoder().encode(system)
-  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))
-  const name =
-    "p-" + Array.from(digest.slice(0, 6), (b) => b.toString(16).padStart(2, "0")).join("")
-  if (!personas.has(name)) {
+// One agent type per scope, system prompt and skill list. A registered type's
+// prompt replaces the session's system prompt, as `--system-prompt` does for
+// the sh driver.
+async function persona($: $, t: Pick<Turn, "scope" | "system" | "skills">) {
+  const spec = await personaSpec(t)
+  if (!personas.has(spec.name)) {
     await $.agent.register({
-      name,
+      ...spec,
       description: "gtd workflow persona, spawned by the gtd driver only",
-      prompt: system,
-      permissionMode: "bypassPermissions",
     })
-    personas.add(name)
+    personas.add(spec.name)
   }
-  return `gtd:${name}`
+  return `gtd:${spec.name}`
 }
 
 async function send($: $, agentId: string, text: string) {
@@ -162,8 +170,12 @@ function io($: $): Io {
       }
     },
     turn: async (t) => {
-      const known = (await read($, scopes))[t.memory]
+      const entry = (await read($, scopes))[t.memory]
+      const name = (await personaSpec(t)).name
+      const known = resumable(entry, name)
+      if (t.resume && entry && !known) $.ui.log(restartLine(t.scope))
       if (t.resume && known) {
+        setAccess(known, t.access)
         const end = send($, known, t.prompt)
         await update($, run, (r) => ({ ...r, inflight: { agentId: known, memory: t.memory } }))
         const ended = await end
@@ -172,7 +184,7 @@ function io($: $): Io {
       // No live conversation for this scope (fresh scope, or this session never
       // held it): start one, as the sh driver falls back to `--session-id`.
       const spawned = await $.agent.spawn({
-        subagentType: t.system ? await persona($, t.system) : "general-purpose",
+        subagentType: await persona($, t),
         prompt: t.prompt,
         description: t.label || "gtd",
         model: subagentModel(t.model, {
@@ -184,13 +196,14 @@ function io($: $): Io {
       const id = spawned.agentId
       if (!id) return { ok: false, why: spawned.deny ?? "subagent spawn refused" }
       ours.add(id)
+      setAccess(id, t.access)
       await update($, agents, (list) => [...list, id].slice(-200))
-      await update($, scopes, (s) => ({ ...s, [t.memory]: id }))
+      await update($, scopes, (s) => ({ ...s, [t.memory]: { agentId: id, persona: name } }))
       await update($, run, (r) => ({ ...r, inflight: { agentId: id, memory: t.memory } }))
       return settle($, await turnEnd(id))
     },
     resume: async (memory, text) => {
-      const id = (await read($, scopes))[memory]
+      const id = (await read($, scopes))[memory]?.agentId
       const end = id ? await send($, id, text) : undefined
       return end ?? { ok: false, why: `no live subagent for ${memory}` }
     },
@@ -740,6 +753,9 @@ export const register: Register = (on) => {
   // would still be writing the tree gtd is committing.
   on("tool.call", ($, e, next) => {
     if (!e.agentId || !ours.has(e.agentId)) return next(e)
+    const access = accesses.get(e.agentId)
+    const denial = access && accessDenial(String(e.tool), e, access, root)
+    if (denial) return { deny: denial }
     const delegated = delegates.get(e.agentId)
     if (delegated) {
       if (e.tool === "Write" && e.file_path !== delegated.file) {

package/claude/hooks/wording.ts

@@ -77,6 +77,9 @@ export function runningLine(label: string, beat: number, elapsedMs: number) {
 // One line per beat, for the status line and the transcript.
 export const beatLine = (beat: number, b: Beat) => `▸ ${step(b)} · step ${beat}`
 
+export const restartLine = (scope: string) =>
+  `${scope}: skills or system changed — started a fresh subagent`
+
 // What a push to a phone says when gtd stops: the step, and where to act on it.
 export function pushText(stop: Stop, repo: string, url?: string) {
   const at = `${repo}: ${headline(stop).replace(/^\S+ /, "")}`

package/claude/types/index.d.ts

@@ -28,6 +28,10 @@ export type Run = {
 
 declare module "claude-code" {
   interface PluginState {
-    gtd: { run: Run; scopes: Record<string, string>; agents: string[] }
+    gtd: {
+      run: Run
+      scopes: Record<string, { agentId: string; persona: string }>
+      agents: string[]
+    }
   }
 }