@polymorphism-tech/morph-spec 8.1.0 → 8.1.2

package/framework/hooks/shared/activity-logger.js

@@ -1,160 +1,160 @@
-/**
- * Activity Logger — Session-scoped hook event log
- *
- * Writes hook activity to .morph/logs/activity.json for live consumption
- * by `morph-spec monitor`.
- *
- * Design constraints:
- * - Synchronous only (hooks run in process, no async overhead)
- * - Fail-silent (never throws — hooks must not be blocked by logger)
- * - ≤5ms per call (no retries, no network)
- * - Windows-safe paths via path.join
- */
-
-import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from 'fs';
-import { join } from 'path';
-
-const LOGS_DIR = '.morph/logs';
-const ACTIVITY_FILE = join(LOGS_DIR, 'activity.json');
-
-function getActivityPath(projectPath) {
-  return join(projectPath || process.cwd(), ACTIVITY_FILE);
-}
-
-function ensureLogsDir(projectPath) {
-  const dir = join(projectPath || process.cwd(), LOGS_DIR);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-}
-
-function readRaw(activityPath) {
-  try {
-    if (!existsSync(activityPath)) return null;
-    return JSON.parse(readFileSync(activityPath, 'utf-8'));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Log a hook firing event to the session activity log.
- *
- * @param {string} name   - Hook name (e.g. 'dispatch.js', 'enrich-prompt')
- * @param {string} event  - Claude Code event (e.g. 'PostToolUse', 'UserPromptSubmit')
- * @param {string} result - Outcome summary (e.g. 'ok', 'blocked', 'checkpoint_saved')
- * @param {string} [projectPath] - Project root (defaults to cwd)
- */
-export function logHookActivity(name, event, result, projectPath) {
-  try {
-    const activityPath = getActivityPath(projectPath);
-    ensureLogsDir(projectPath);
-
-    const now = new Date();
-    const ts = now.toTimeString().slice(0, 8); // HH:MM:SS
-
-    const data = readRaw(activityPath) || { sessionId: '', feature: '', phase: '', hooks: [], skills: [] };
-
-    data.hooks = data.hooks || [];
-    data.hooks.push({ name, event, result, ts });
-
-    writeFileSync(activityPath, JSON.stringify(data, null, 2), 'utf-8');
-  } catch {
-    // Fail-silent — never block hooks
-  }
-}
-
-
-/**
- * Read the current activity log.
- *
- * @param {string} [projectPath]
- * @returns {{ sessionId: string, feature: string, phase: string, hooks: Array, skills: Array }|null}
- */
-export function readActivity(projectPath) {
-  try {
-    return readRaw(getActivityPath(projectPath));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Reset the activity log for a new session.
- * Called from SessionStart hook to clear stale data.
- *
- * @param {string} sessionId  - ISO timestamp of new session
- * @param {string} feature    - Active feature name (empty string if none)
- * @param {string} phase      - Current phase (empty string if none)
- * @param {string} [projectPath]
- */
-export function resetActivity(sessionId, feature, phase, projectPath) {
-  try {
-    ensureLogsDir(projectPath);
-    const data = {
-      sessionId: sessionId || new Date().toISOString(),
-      feature: feature || '',
-      phase: phase || '',
-      hooks: [],
-      skills: []
-    };
-    writeFileSync(getActivityPath(projectPath), JSON.stringify(data, null, 2), 'utf-8');
-  } catch {
-    // Fail-silent
-  }
-}
-
-/**
- * Log a structured event to the session activity log.
- *
- * @param {string} type   - Event type (e.g., 'task_start', 'loop_detected')
- * @param {Object} data   - Event data payload
- * @param {string} [projectPath] - Project root (defaults to cwd)
- */
-export function logEvent(type, data, projectPath) {
-  try {
-    const activityPath = getActivityPath(projectPath);
-    ensureLogsDir(projectPath);
-
-    const now = new Date();
-    const ts = now.toTimeString().slice(0, 8); // HH:MM:SS
-
-    const activity = readRaw(activityPath) || { sessionId: '', feature: '', phase: '', hooks: [], events: [] };
-    activity.events = activity.events || [];
-    activity.events.push({ type, data, ts });
-
-    writeFileSync(activityPath, JSON.stringify(activity, null, 2), 'utf-8');
-  } catch {
-    // Fail-silent
-  }
-}
-
-/**
- * Archive current activity.json to sessions/ directory for historical logging.
- * Called at the start of a new session.
- *
- * @param {string} [projectPath] - Project root (defaults to cwd)
- */
-export function archiveSession(projectPath) {
-  try {
-    const activityPath = getActivityPath(projectPath);
-    if (!existsSync(activityPath)) return;
-
-    const data = readRaw(activityPath);
-    if (!data) return;
-
-    // Only archive if there are meaningful events
-    if ((!data.hooks || data.hooks.length === 0) && (!data.events || data.events.length === 0)) return;
-
-    const sessionsDir = join(projectPath || process.cwd(), LOGS_DIR, 'sessions');
-    mkdirSync(sessionsDir, { recursive: true });
-
-    const sessionId = (data.sessionId || new Date().toISOString()).replace(/[:.]/g, '-');
-    const archivePath = join(sessionsDir, `${sessionId}.json`);
-    writeFileSync(archivePath, JSON.stringify(data, null, 2), 'utf-8');
-
-    unlinkSync(activityPath);
-  } catch {
-    // Fail-silent
-  }
-}
+/**
+ * Activity Logger — Session-scoped hook event log
+ *
+ * Writes hook activity to .morph/logs/activity.json for live consumption
+ * by `morph-spec monitor`.
+ *
+ * Design constraints:
+ * - Synchronous only (hooks run in process, no async overhead)
+ * - Fail-silent (never throws — hooks must not be blocked by logger)
+ * - ≤5ms per call (no retries, no network)
+ * - Windows-safe paths via path.join
+ */
+
+import { readFileSync, writeFileSync, mkdirSync, existsSync, unlinkSync } from 'fs';
+import { join } from 'path';
+
+const LOGS_DIR = '.morph/logs';
+const ACTIVITY_FILE = join(LOGS_DIR, 'activity.json');
+
+function getActivityPath(projectPath) {
+  return join(projectPath || process.cwd(), ACTIVITY_FILE);
+}
+
+function ensureLogsDir(projectPath) {
+  const dir = join(projectPath || process.cwd(), LOGS_DIR);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+}
+
+function readRaw(activityPath) {
+  try {
+    if (!existsSync(activityPath)) return null;
+    return JSON.parse(readFileSync(activityPath, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Log a hook firing event to the session activity log.
+ *
+ * @param {string} name   - Hook name (e.g. 'dispatch.js', 'enrich-prompt')
+ * @param {string} event  - Claude Code event (e.g. 'PostToolUse', 'UserPromptSubmit')
+ * @param {string} result - Outcome summary (e.g. 'ok', 'blocked', 'checkpoint_saved')
+ * @param {string} [projectPath] - Project root (defaults to cwd)
+ */
+export function logHookActivity(name, event, result, projectPath) {
+  try {
+    const activityPath = getActivityPath(projectPath);
+    ensureLogsDir(projectPath);
+
+    const now = new Date();
+    const ts = now.toTimeString().slice(0, 8); // HH:MM:SS
+
+    const data = readRaw(activityPath) || { sessionId: '', feature: '', phase: '', hooks: [], skills: [] };
+
+    data.hooks = data.hooks || [];
+    data.hooks.push({ name, event, result, ts });
+
+    writeFileSync(activityPath, JSON.stringify(data, null, 2), 'utf-8');
+  } catch {
+    // Fail-silent — never block hooks
+  }
+}
+
+
+/**
+ * Read the current activity log.
+ *
+ * @param {string} [projectPath]
+ * @returns {{ sessionId: string, feature: string, phase: string, hooks: Array, skills: Array }|null}
+ */
+export function readActivity(projectPath) {
+  try {
+    return readRaw(getActivityPath(projectPath));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Reset the activity log for a new session.
+ * Called from SessionStart hook to clear stale data.
+ *
+ * @param {string} sessionId  - ISO timestamp of new session
+ * @param {string} feature    - Active feature name (empty string if none)
+ * @param {string} phase      - Current phase (empty string if none)
+ * @param {string} [projectPath]
+ */
+export function resetActivity(sessionId, feature, phase, projectPath) {
+  try {
+    ensureLogsDir(projectPath);
+    const data = {
+      sessionId: sessionId || new Date().toISOString(),
+      feature: feature || '',
+      phase: phase || '',
+      hooks: [],
+      skills: []
+    };
+    writeFileSync(getActivityPath(projectPath), JSON.stringify(data, null, 2), 'utf-8');
+  } catch {
+    // Fail-silent
+  }
+}
+
+/**
+ * Log a structured event to the session activity log.
+ *
+ * @param {string} type   - Event type (e.g., 'task_start', 'loop_detected')
+ * @param {Object} data   - Event data payload
+ * @param {string} [projectPath] - Project root (defaults to cwd)
+ */
+export function logEvent(type, data, projectPath) {
+  try {
+    const activityPath = getActivityPath(projectPath);
+    ensureLogsDir(projectPath);
+
+    const now = new Date();
+    const ts = now.toTimeString().slice(0, 8); // HH:MM:SS
+
+    const activity = readRaw(activityPath) || { sessionId: '', feature: '', phase: '', hooks: [], events: [] };
+    activity.events = activity.events || [];
+    activity.events.push({ type, data, ts });
+
+    writeFileSync(activityPath, JSON.stringify(activity, null, 2), 'utf-8');
+  } catch {
+    // Fail-silent
+  }
+}
+
+/**
+ * Archive current activity.json to sessions/ directory for historical logging.
+ * Called at the start of a new session.
+ *
+ * @param {string} [projectPath] - Project root (defaults to cwd)
+ */
+export function archiveSession(projectPath) {
+  try {
+    const activityPath = getActivityPath(projectPath);
+    if (!existsSync(activityPath)) return;
+
+    const data = readRaw(activityPath);
+    if (!data) return;
+
+    // Only archive if there are meaningful events
+    if ((!data.hooks || data.hooks.length === 0) && (!data.events || data.events.length === 0)) return;
+
+    const sessionsDir = join(projectPath || process.cwd(), LOGS_DIR, 'sessions');
+    mkdirSync(sessionsDir, { recursive: true });
+
+    const sessionId = (data.sessionId || new Date().toISOString()).replace(/[:.]/g, '-');
+    const archivePath = join(sessionsDir, `${sessionId}.json`);
+    writeFileSync(archivePath, JSON.stringify(data, null, 2), 'utf-8');
+
+    unlinkSync(activityPath);
+  } catch {
+    // Fail-silent
+  }
+}

package/framework/hooks/shared/build-check.js

@@ -1,8 +1,8 @@
 /**
  * Build/Typecheck verification utility.
  *
- * Stack-aware: determines the correct build command based on project stack.
- * Used by the Stop hook to verify code health before session ends.
+ * Stack-aware: determines the correct build command(s) based on project stack.
+ * Used by the Stop hook and `morph-spec verify` to verify code health.
  *
  * Pure functions — no I/O except the actual build execution.
  */
@@ -11,8 +11,31 @@ import { execSync } from 'child_process';
 import { existsSync } from 'fs';
 import { join } from 'path';
 
+const DOTNET_BUILD_CMD = 'dotnet build --no-restore --nologo -v q';
+const TSC_BUILD_CMD = 'npx tsc --noEmit';
+
+function isDotnetStack(s) {
+  return s.includes('dotnet') || s.includes('aspnet');
+}
+
+function isFrontendStack(s) {
+  return s.includes('nextjs') || s.includes('node') || s.includes('react') || s.includes('vue');
+}
+
 /**
- * Determine the build command for a given stack.
+ * Determine the build command for a SINGLE (non-monorepo) stack string.
+ *
+ * Kept for backward compatibility with single-stack projects and existing
+ * callers. A monorepo stack that mixes a frontend token with "dotnet" (e.g.
+ * the detector's own `${frontendStack}+dotnet` format, or a hyphenated
+ * `dotnet-nextjs`) should resolve through `getBuildSteps()` instead: this
+ * function alone can only ever return ONE command, and — because it checks
+ * `dotnet` before the frontend tokens — a compound stack always resolves to
+ * `dotnet build` even when the frontend is what actually needs checking (or
+ * when there's no root-level `.sln`/`.csproj`, e.g. in a monorepo where the
+ * backend lives in a subfolder). `getBuildSteps()` runs BOTH sides, each
+ * from its own working directory, instead of one command winning by
+ * substring match order.
  *
  * @param {string} stack - Project stack (e.g., 'dotnet-nextjs', 'nextjs')
  * @param {boolean} [hasTsConfig] - Whether tsconfig.json exists (for TS projects)
@@ -22,17 +45,53 @@ export function getBuildCommand(stack, hasTsConfig = false) {
   if (!stack) return null;
   const s = stack.toLowerCase();
 
-  if (s.includes('dotnet')) {
-    return 'dotnet build --no-restore --nologo -v q';
+  if (isDotnetStack(s)) {
+    return DOTNET_BUILD_CMD;
   }
 
-  if ((s.includes('nextjs') || s.includes('node') || s.includes('react')) && hasTsConfig) {
-    return 'npx tsc --noEmit';
+  if (isFrontendStack(s) && hasTsConfig) {
+    return TSC_BUILD_CMD;
   }
 
   return null;
 }
 
+/**
+ * Resolve the build step(s) to run for a project, monorepo-aware.
+ *
+ * A monorepo stack mixes a frontend token and "dotnet" (see
+ * `detectProject()`'s own `${frontendStack}+dotnet` format) — in that case
+ * BOTH sides are checked, each from its own working directory
+ * (`frontendPath` / `backendPath`, as stored in
+ * `.morph/config/config.json → project`), instead of one command silently
+ * winning — or running from the wrong cwd — by substring match order.
+ * Single-stack projects (no `frontendPath`/`backendPath`, or a stack that
+ * only matches one side) resolve to exactly one step, from `cwd`, matching
+ * `getBuildCommand()`'s existing single-stack behavior.
+ *
+ * @param {string} stack
+ * @param {{ cwd: string, frontendPath?: string, backendPath?: string }} opts
+ * @returns {Array<{ command: string, cwd: string }>}
+ */
+export function getBuildSteps(stack, { cwd, frontendPath, backendPath } = {}) {
+  if (!stack || !cwd) return [];
+  const s = stack.toLowerCase();
+  const steps = [];
+
+  if (isDotnetStack(s)) {
+    steps.push({ command: DOTNET_BUILD_CMD, cwd: backendPath ? join(cwd, backendPath) : cwd });
+  }
+
+  if (isFrontendStack(s)) {
+    const frontendDir = frontendPath ? join(cwd, frontendPath) : cwd;
+    if (existsSync(join(frontendDir, 'tsconfig.json'))) {
+      steps.push({ command: TSC_BUILD_CMD, cwd: frontendDir });
+    }
+  }
+
+  return steps;
+}
+
 /**
  * Parse build command result into a structured object.
  *
@@ -52,28 +111,42 @@ export function parseBuildResult(exitCode, output) {
 }
 
 /**
- * Run build check for a project.
+ * Run build check for a project — monorepo-aware (see `getBuildSteps()`).
+ *
+ * For a compound stack (e.g. "nextjs+dotnet"), runs each resolved step in
+ * its own working directory and fails if any step fails; output from all
+ * failing steps is concatenated (prefixed by the command that produced it)
+ * so a frontend typecheck failure and a backend build failure are never
+ * silently masked by one another.
  *
  * @param {string} cwd - Project root directory
  * @param {string} stack - Project stack string
  * @param {number} [timeout=30000] - Timeout in ms
+ * @param {{ frontendPath?: string, backendPath?: string }} [paths] - Monorepo sub-paths, from config.json → project
  * @returns {{ status: 'pass'|'fail'|'skip', output: string }}
  */
-export function runBuildCheck(cwd, stack, timeout = 30000) {
-  const hasTsConfig = existsSync(join(cwd, 'tsconfig.json'));
-  const cmd = getBuildCommand(stack, hasTsConfig);
-  if (!cmd) return { status: 'skip', output: '' };
-
-  try {
-    const output = execSync(cmd, {
-      cwd,
-      encoding: 'utf-8',
-      timeout,
-      stdio: ['pipe', 'pipe', 'pipe']
-    });
-    return parseBuildResult(0, output);
-  } catch (err) {
-    const output = (err.stdout || '') + (err.stderr || '');
-    return parseBuildResult(err.status || 1, output);
+export function runBuildCheck(cwd, stack, timeout = 30000, paths = {}) {
+  const steps = getBuildSteps(stack, { cwd, frontendPath: paths.frontendPath, backendPath: paths.backendPath });
+  if (steps.length === 0) return { status: 'skip', output: '' };
+
+  const failures = [];
+  for (const step of steps) {
+    try {
+      execSync(step.command, {
+        cwd: step.cwd,
+        encoding: 'utf-8',
+        timeout,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+    } catch (err) {
+      const output = (err.stdout || '') + (err.stderr || '');
+      const parsed = parseBuildResult(err.status || 1, output);
+      failures.push(`[${step.command}] ${parsed.output}`);
+    }
+  }
+
+  if (failures.length > 0) {
+    return { status: 'fail', output: failures.join('\n\n') };
   }
+  return { status: 'pass', output: '' };
 }

package/framework/hooks/shared/stdin-reader.js

@@ -1,26 +1,26 @@
-/**
- * Shared stdin reader for Claude Code hooks.
- *
- * Reads JSON payload from stdin (provided by Claude Code to hooks).
- * Returns parsed object or null on failure.
- */
-
-/**
- * Read and parse JSON from stdin
- * @returns {Promise<Object|null>} Parsed JSON or null
- */
-export function readStdin() {
-  return new Promise((resolve) => {
-    let input = '';
-    process.stdin.setEncoding('utf-8');
-    process.stdin.on('data', (chunk) => { input += chunk; });
-    process.stdin.on('end', () => {
-      try {
-        resolve(JSON.parse(input || '{}'));
-      } catch {
-        resolve(null);
-      }
-    });
-    process.stdin.on('error', () => resolve(null));
-  });
-}
+/**
+ * Shared stdin reader for Claude Code hooks.
+ *
+ * Reads JSON payload from stdin (provided by Claude Code to hooks).
+ * Returns parsed object or null on failure.
+ */
+
+/**
+ * Read and parse JSON from stdin
+ * @returns {Promise<Object|null>} Parsed JSON or null
+ */
+export function readStdin() {
+  return new Promise((resolve) => {
+    let input = '';
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => { input += chunk; });
+    process.stdin.on('end', () => {
+      try {
+        resolve(JSON.parse(input || '{}'));
+      } catch {
+        resolve(null);
+      }
+    });
+    process.stdin.on('error', () => resolve(null));
+  });
+}

package/framework/rubrics/backend.json

@@ -1,41 +1,41 @@
-{
-  "id": "backend",
-  "version": "1.1.0",
-  "description": "Backend-focused rubric. Higher weight on architecture, security, and package health. Deterministic-validator rubric — approve threshold aligned to the single bar 9 from MORPH.md §0.",
-  "categories": {
-    "functionality": {
-      "weight": 0.25,
-      "validators": ["contract-compliance"],
-      "description": "Core feature correctness and contract compliance"
-    },
-    "code_quality": {
-      "weight": 0.25,
-      "validators": ["architecture"],
-      "description": "Architecture patterns, dependency direction, and code structure"
-    },
-    "design_ui": {
-      "weight": 0.05,
-      "validators": ["design-system", "css", "contrast", "nextjs-component"],
-      "description": "Design system compliance (minimal weight for backend projects)"
-    },
-    "security": {
-      "weight": 0.15,
-      "validators": [],
-      "description": "Security posture (agent-evaluated, no automated validator)"
-    },
-    "packages": {
-      "weight": 0.20,
-      "validators": ["packages"],
-      "description": "Dependency health, version compatibility, and deprecated packages"
-    },
-    "maf_compliance": {
-      "weight": 0.10,
-      "validators": [],
-      "description": "MAF agent compliance (agent-evaluated, applies only when the feature touches AI agents): Microsoft.Agents.AI GA packages used; Model Registry alias referenced not hardcoded models; structured output for pipelined agents; prompts from DB not hardcoded; no Semantic Kernel; no hosted agent services."
-    }
-  },
-  "thresholds": {
-    "approve": 9.0,
-    "retry": 6.0
-  }
-}
+{
+  "id": "backend",
+  "version": "1.1.0",
+  "description": "Backend-focused rubric. Higher weight on architecture, security, and package health. Deterministic-validator rubric — approve threshold aligned to the single bar 9 from MORPH.md §0.",
+  "categories": {
+    "functionality": {
+      "weight": 0.25,
+      "validators": ["contract-compliance"],
+      "description": "Core feature correctness and contract compliance"
+    },
+    "code_quality": {
+      "weight": 0.25,
+      "validators": ["architecture"],
+      "description": "Architecture patterns, dependency direction, and code structure"
+    },
+    "design_ui": {
+      "weight": 0.05,
+      "validators": ["design-system", "css", "contrast", "nextjs-component"],
+      "description": "Design system compliance (minimal weight for backend projects)"
+    },
+    "security": {
+      "weight": 0.15,
+      "validators": [],
+      "description": "Security posture (agent-evaluated, no automated validator)"
+    },
+    "packages": {
+      "weight": 0.20,
+      "validators": ["packages"],
+      "description": "Dependency health, version compatibility, and deprecated packages"
+    },
+    "maf_compliance": {
+      "weight": 0.10,
+      "validators": [],
+      "description": "MAF agent compliance (agent-evaluated, applies only when the feature touches AI agents): Microsoft.Agents.AI GA packages used; Model Registry alias referenced not hardcoded models; structured output for pipelined agents; prompts from DB not hardcoded; no Semantic Kernel; no hosted agent services."
+    }
+  },
+  "thresholds": {
+    "approve": 9.0,
+    "retry": 6.0
+  }
+}