@polymorphism-tech/morph-spec 6.0.0 → 7.0.0

package/src/lib/tasks/tasks-json-parser.js

@@ -0,0 +1,185 @@
+/**
+ * tasks-json-parser.js — read, validate, query, mutate tasks.json
+ *
+ * Replaces the prior Markdown-based tasks.md parser for new features.
+ * Legacy features that still use tasks.md are handled by task-parser.js.
+ *
+ * Uses a minimal hand-rolled JSON Schema validator (no AJV dep) — sufficient
+ * for the controlled schema in framework/schemas/tasks.schema.json.
+ */
+
+import fs from 'fs-extra';
+import { readFileSync, existsSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SCHEMA_PATH = join(__dirname, '..', '..', '..', 'framework', 'schemas', 'tasks.schema.json');
+
+let cachedSchema = null;
+export function getSchema() {
+  if (cachedSchema) return cachedSchema;
+  cachedSchema = JSON.parse(readFileSync(SCHEMA_PATH, 'utf8'));
+  return cachedSchema;
+}
+
+const VALID_STATUS = ['pending', 'in_progress', 'done', 'skipped', 'blocked'];
+const VALID_EFFORT = ['S', 'M', 'L', 'XL'];
+const VALID_GROUP = ['backend', 'frontend', 'tests', 'infra', 'docs'];
+
+/**
+ * Validate a tasks.json structure.
+ * @returns {{ valid: boolean, errors: string[] }}
+ */
+export function validateTasksJson(data) {
+  const errors = [];
+  if (!data || typeof data !== 'object') {
+    errors.push('tasks.json must be an object');
+    return { valid: false, errors };
+  }
+  if (data.version !== '1.0') errors.push('version must be "1.0"');
+  if (typeof data.feature !== 'string' || !data.feature) {
+    errors.push('feature must be a non-empty string');
+  }
+  if (!Array.isArray(data.tasks)) {
+    errors.push('tasks must be an array');
+    return { valid: false, errors };
+  }
+
+  const ids = new Set();
+  for (const [i, task] of data.tasks.entries()) {
+    const ctx = `tasks[${i}]`;
+    if (!task.id || !/^T\d+$/.test(task.id)) {
+      errors.push(`${ctx}.id must match /^T\\d+$/`);
+    } else if (ids.has(task.id)) {
+      errors.push(`${ctx}.id duplicate: ${task.id}`);
+    }
+    ids.add(task.id);
+
+    if (typeof task.title !== 'string' || !task.title) errors.push(`${ctx}.title required`);
+    if (typeof task.description !== 'string' || !task.description) errors.push(`${ctx}.description required`);
+    if (!Array.isArray(task.dependencies)) {
+      errors.push(`${ctx}.dependencies must be array`);
+    } else {
+      for (const dep of task.dependencies) {
+        if (typeof dep !== 'string' || !/^T\d+$/.test(dep)) {
+          errors.push(`${ctx}.dependencies[${dep}] must match /^T\\d+$/`);
+        }
+      }
+    }
+    if (!VALID_EFFORT.includes(task.effort)) {
+      errors.push(`${ctx}.effort must be one of ${VALID_EFFORT.join(', ')}`);
+    }
+    if (typeof task.doneCriteria !== 'string' || !task.doneCriteria) {
+      errors.push(`${ctx}.doneCriteria required`);
+    }
+    if (!VALID_STATUS.includes(task.status)) {
+      errors.push(`${ctx}.status must be one of ${VALID_STATUS.join(', ')}`);
+    }
+    if (task.group !== undefined && !VALID_GROUP.includes(task.group)) {
+      errors.push(`${ctx}.group must be one of ${VALID_GROUP.join(', ')}`);
+    }
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+/**
+ * Read and parse tasks.json from disk. Throws on validation errors.
+ * @param {string} filePath - Absolute path to tasks.json
+ * @returns {Promise<object>}
+ */
+export async function parseTasksJson(filePath) {
+  const data = await fs.readJson(filePath);
+  const { valid, errors } = validateTasksJson(data);
+  if (!valid) {
+    throw new Error(`Invalid tasks.json:\n  ${errors.join('\n  ')}`);
+  }
+  return data;
+}
+
+/**
+ * Synchronous variant — used by hooks.
+ */
+export function parseTasksJsonSync(filePath) {
+  if (!existsSync(filePath)) {
+    throw new Error(`tasks.json not found: ${filePath}`);
+  }
+  const data = JSON.parse(readFileSync(filePath, 'utf8'));
+  const { valid, errors } = validateTasksJson(data);
+  if (!valid) {
+    throw new Error(`Invalid tasks.json:\n  ${errors.join('\n  ')}`);
+  }
+  return data;
+}
+
+/**
+ * @returns {object[]} tasks with status === 'pending'
+ */
+export function getPendingTasks(data) {
+  return data.tasks.filter(t => t.status === 'pending');
+}
+
+/**
+ * Tasks ready to run: pending AND all dependencies are 'done'.
+ */
+export function getReadyTasks(data) {
+  const doneIds = new Set(data.tasks.filter(t => t.status === 'done').map(t => t.id));
+  return data.tasks.filter(t =>
+    t.status === 'pending' && t.dependencies.every(dep => doneIds.has(dep))
+  );
+}
+
+/**
+ * Mutate `data` to set task status. Returns `data` for chaining.
+ */
+export function updateTaskStatus(data, taskId, newStatus) {
+  if (!VALID_STATUS.includes(newStatus)) {
+    throw new Error(`Invalid status: ${newStatus}`);
+  }
+  const task = data.tasks.find(t => t.id === taskId);
+  if (!task) throw new Error(`Task not found: ${taskId}`);
+  task.status = newStatus;
+  return data;
+}
+
+/**
+ * Write tasks.json to disk. Validates before writing.
+ */
+export async function writeTasksJson(filePath, data) {
+  const { valid, errors } = validateTasksJson(data);
+  if (!valid) {
+    throw new Error(`Cannot write invalid tasks.json:\n  ${errors.join('\n  ')}`);
+  }
+  await fs.writeJson(filePath, data, { spaces: 2 });
+}
+
+/**
+ * Group tasks by `group` field, falling back to 'backend' when absent.
+ * Returns `{ [group]: taskId[] }` shape matching the legacy parseAndGroupTasks output.
+ */
+export function groupTasks(data) {
+  const groups = {};
+  for (const task of data.tasks) {
+    const group = task.group || 'backend';
+    if (!groups[group]) groups[group] = [];
+    groups[group].push(task.id);
+  }
+  return groups;
+}
+
+/**
+ * Convert tasks.json to the legacy taskList shape used in state.json.
+ * Lets the rest of the codebase keep using feature.taskList while migration
+ * is in progress.
+ */
+export function toTaskList(data) {
+  return data.tasks.map(t => ({
+    id: t.id,
+    title: t.title,
+    status: t.status === 'done' ? 'completed' : t.status,
+    dependencies: [...t.dependencies],
+    files: t.outputs || [],
+    checkpoint: null,
+  }));
+}

package/src/scripts/setup-infra.js

@@ -185,6 +185,7 @@ export async function setupInfra(targetPath, { _exec = execSync, reinstall = fal
     const config = {
       framework: 'global',
       frameworkVersion: getInstalledCLIVersion(),
+      trust: 'auto',
       project: {
         name: dirName
       }
@@ -243,6 +244,30 @@ export async function setupInfra(targetPath, { _exec = execSync, reinstall = fal
     await copyFile(agentsSrc, agentsDest);
   }
 
+  // --- 8b. Copy framework/MORPH.md → .morph/framework/MORPH.md ---
+  log('Step 8b: Copying MORPH.md (NLH charter)...');
+  const morphMdSrc = join(FRAMEWORK_DIR, 'MORPH.md');
+  const morphMdDest = join(frameworkDestDir, 'MORPH.md');
+  if (await pathExists(morphMdSrc)) {
+    await copyFile(morphMdSrc, morphMdDest);
+  }
+
+  // --- 8c. Copy framework/phases.json → .morph/framework/phases.json ---
+  log('Step 8c: Copying phases.json...');
+  const phasesSrc = join(FRAMEWORK_DIR, 'phases.json');
+  const phasesDest = join(frameworkDestDir, 'phases.json');
+  if (await pathExists(phasesSrc)) {
+    await copyFile(phasesSrc, phasesDest);
+  }
+
+  // --- 8d. Copy framework/schemas → .morph/framework/schemas (JSON schemas) ---
+  log('Step 8d: Copying schemas...');
+  const schemasSrc = join(FRAMEWORK_DIR, 'schemas');
+  const schemasDest = join(frameworkDestDir, 'schemas');
+  if (await pathExists(schemasSrc)) {
+    await copyDirectory(schemasSrc, schemasDest);
+  }
+
   // --- 9. Copy framework/commands → .claude/commands ---
   log('Step 9: Setting up Claude Code integration...');
   const claudeDest = join(targetPath, '.claude');

package/src/utils/hooks-installer.js

@@ -22,13 +22,13 @@ const OLD_DISPATCH_COMMAND = 'node framework/hooks/agent-teams/dispatch.js';
 
 /**
  * Native permissions.deny entries managed by MORPH-SPEC.
- * These replace the protect-readonly-files.js PreToolUse hook,
- * using Claude Code's built-in permissions system instead.
+ *
+ * state.json is NOT in deny because the agent edits it directly as a
+ * fallback to the state-sync hook (per v7 hybrid state model). The
+ * framework/ tree remains read-only — only the installer touches it.
  */
-const MORPH_PERMISSIONS = [
-  // Core framework state and readonly files
-  'Write(.morph/state.json)',
-  'Edit(.morph/state.json)',
+const MORPH_DENY = [
+  // Framework files — installer-managed, immutable at runtime
   'Write(.morph/framework/**)',
   'Edit(.morph/framework/**)',
   // .claude/CLAUDE.md (managed copy — source is framework/CLAUDE.md)
@@ -45,6 +45,30 @@ const MORPH_PERMISSIONS = [
   'Edit(.claude/skills/**)',
 ];
 
+/**
+ * Native permissions.allow entries managed by MORPH-SPEC.
+ *
+ * Pre-authorizes operations the agent legitimately performs during the
+ * morph-spec flow, so the user does not get permission prompts on every
+ * proposal.md / spec.md / tasks.json write.
+ */
+const MORPH_ALLOW = [
+  // Feature artifacts — the agent's working directory during proposal/plan/implement/review
+  'Write(.morph/features/**)',
+  'Edit(.morph/features/**)',
+  // state.json — fallback path when state-sync hook can't cover a case
+  'Edit(.morph/state.json)',
+  // Long-lived architectural context — agent may reconcile during brainstorming
+  'Write(.morph/context/**)',
+  'Edit(.morph/context/**)',
+  // Folder creation under .morph
+  'Bash(mkdir:.morph/**)',
+  'Bash(ls:.morph/**)',
+];
+
+// Backwards-compat alias used by older tests
+const MORPH_PERMISSIONS = MORPH_DENY;
+
 /**
  * All MORPH-SPEC hook definitions.
  * Each entry maps to a Claude Code hook event.
@@ -88,6 +112,17 @@ const MORPH_HOOKS = [
     }]
   },
 
+  // === PostToolUse: Write|Edit|AskUserQuestion — state-sync (autonomous state.json updates) ===
+  {
+    event: 'PostToolUse',
+    matcher: 'Write|Edit|AskUserQuestion',
+    hooks: [{
+      type: 'command',
+      command: 'node framework/hooks/claude-code/core/state-sync.js',
+      timeout: 3000
+    }]
+  },
+
   // === PostToolUse: All — loop detection ===
   {
     event: 'PostToolUse',
@@ -179,17 +214,31 @@ export async function installClaudeHooks(targetPath) {
     installed++;
   }
 
-  // Install native permissions.deny entries (idempotent)
+  // Install native permissions (idempotent — preserve user-added entries)
   settings.permissions = settings.permissions || {};
   settings.permissions.deny = settings.permissions.deny || [];
-  // Remove previously managed permissions to avoid duplicates on re-install
+  settings.permissions.allow = settings.permissions.allow || [];
+
+  // Stale-entry cleanup: remove old morph-managed deny entries (e.g. state.json
+  // was previously in deny — v7 moves it to allow)
+  const STALE_DENY = [
+    'Write(.morph/state.json)',
+    'Edit(.morph/state.json)',
+  ];
   settings.permissions.deny = settings.permissions.deny.filter(
-    p => !MORPH_PERMISSIONS.includes(p)
+    p => !MORPH_DENY.includes(p) && !STALE_DENY.includes(p)
   );
-  for (const perm of MORPH_PERMISSIONS) {
+  for (const perm of MORPH_DENY) {
     settings.permissions.deny.push(perm);
   }
 
+  settings.permissions.allow = settings.permissions.allow.filter(
+    p => !MORPH_ALLOW.includes(p)
+  );
+  for (const perm of MORPH_ALLOW) {
+    settings.permissions.allow.push(perm);
+  }
+
   // JSON Schema for IDE auto-complete and validation
   settings['$schema'] = 'https://json.schemastore.org/claude-code-settings.json';