@polymorphism-tech/morph-spec 8.37.1 → 8.40.0

package/src/dashboard/vite-plugin-morph-data.js

@@ -1,17 +1,134 @@
-import { scanAll } from './scanner/index.js';
-
-const VIRTUAL_MODULE_ID = 'virtual:morph-data';
-const RESOLVED_VIRTUAL_ID = '\0' + VIRTUAL_MODULE_ID;
-
-export default function morphDataPlugin(frameworkDir, projectDir) {
-  return {
-    name: 'vite-plugin-morph-data',
-    resolveId(id) { if (id === VIRTUAL_MODULE_ID) return RESOLVED_VIRTUAL_ID; },
-    load(id) {
-      if (id === RESOLVED_VIRTUAL_ID) {
-        const data = scanAll(frameworkDir, projectDir);
-        return `export default ${JSON.stringify(data)}`;
-      }
-    },
-  };
-}
+import { scanAll } from './scanner/index.js';
+import { classifyChange, watchTargets, isMorphDataReload } from './scanner/project-api.js';
+import { createPortfolio } from './scanner/portfolio.js';
+
+const VIRTUAL_MODULE_ID = 'virtual:morph-data';
+const RESOLVED_VIRTUAL_ID = '\0' + VIRTUAL_MODULE_ID;
+const DEBOUNCE_MS = 300;
+const RESCAN_MS = 30_000;
+const WARM_GAP_MS = 400;
+const MAX_BODY = 64 * 1024;
+
+function readBody(req) {
+  return new Promise((resolveBody) => {
+    let size = 0;
+    const chunks = [];
+    req.on('data', (c) => { size += c.length; if (size <= MAX_BODY) chunks.push(c); });
+    req.on('end', () => {
+      try { resolveBody(chunks.length ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : null); } catch { resolveBody(null); }
+    });
+    req.on('error', () => resolveBody(null));
+  });
+}
+
+/**
+ * Two data paths:
+ *   - `virtual:morph-data` — the framework's knowledge (agents, phases, skills,
+ *     standards, rules, hooks, docs). Static for the life of the server.
+ *   - `/api/morph/*` — the portfolio (`/projects`) and each project's features
+ *     and activity (`/p/:id/…`), read on demand and pushed as `morph:changed`
+ *     over the HMR socket when a project's `.morph/` changes.
+ */
+export default function morphDataPlugin(frameworkDir, projectDir) {
+  return {
+    name: 'vite-plugin-morph-data',
+    resolveId(id) { if (id === VIRTUAL_MODULE_ID) return RESOLVED_VIRTUAL_ID; },
+    load(id) {
+      if (id === RESOLVED_VIRTUAL_ID) {
+        const data = scanAll(frameworkDir);
+        return `export default ${JSON.stringify(data)}`;
+      }
+    },
+    configureServer(server) {
+      const portfolio = createPortfolio({ launchDir: projectDir });
+      const push = (data) => server.ws.send({ type: 'custom', event: 'morph:changed', data });
+
+      // Vite reloads the whole page for any changed .html it watches, even when
+      // handleHotUpdate returns [] (vite 6: no module matched + .html = full
+      // reload). A project's .morph/ carries .html design sources, and an agent
+      // writing one reloaded the dashboard under the person reading it. The
+      // dashboard's own code never lives under .morph/.
+      const clientHot = server.environments?.client?.hot;
+      if (clientHot?.send) {
+        const send = clientHot.send.bind(clientHot);
+        clientHot.send = (payload, ...rest) => {
+          if (payload?.type === 'full-reload' && isMorphDataReload(payload.path)) return;
+          send(payload, ...rest);
+        };
+      }
+
+      const watched = new Set();
+      function watchNew() {
+        const fresh = portfolio.list().flatMap((p) => watchTargets(p.dir)).filter((p) => !watched.has(p));
+        for (const p of fresh) watched.add(p);
+        if (fresh.length) server.watcher.add(fresh);
+      }
+
+      // Read the projects in the background, one at a time, so neither the first
+      // page nor the portfolio waits for a large project. Reading one blocks the
+      // event loop for seconds, so each step waits WARM_GAP_MS first: the reads
+      // a push (or an add) just caused are served before the next block.
+      let warming = false;
+      function warmSoon() {
+        if (warming) return;
+        warming = true;
+        const step = () => {
+          const warmed = portfolio.warmNext();
+          if (!warmed) { warming = false; return; }
+          push({ scope: 'projects' });
+          setTimeout(step, WARM_GAP_MS);
+        };
+        setTimeout(step, WARM_GAP_MS);
+      }
+
+      server.middlewares.use('/api/morph', async (req, res) => {
+        const body = req.method === 'POST' ? await readBody(req) : null;
+        const { status, body: out } = portfolio.handle(req.method || 'GET', req.url || '/', body);
+        res.statusCode = status;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.setHeader('Cache-Control', 'no-store');
+        res.end(JSON.stringify(out));
+        // The portfolio's list changed: watch and read any project just added.
+        if (req.method !== 'GET' && status === 200) { watchNew(); push({ scope: 'projects' }); warmSoon(); }
+      });
+
+      watchNew();
+      warmSoon();
+      const rescan = setInterval(watchNew, RESCAN_MS);
+      rescan.unref?.();
+
+      const timers = new Map();
+      const changed = new Map(); // `${project}:${scope}` -> path -> watcher event, in the debounce window
+      const onFsEvent = (event, path) => {
+        const scope = classifyChange(path);
+        if (!scope) return;
+        const project = portfolio.ownerOf(path);
+        if (!project) return;
+        const key = `${project.id}:${scope}`;
+        if (!changed.has(key)) changed.set(key, new Map());
+        const seen = changed.get(key);
+        // A path added then changed in one window is still an add.
+        if (!seen.has(path) || seen.get(path) === 'change') seen.set(path, event);
+        clearTimeout(timers.get(key));
+        timers.set(key, setTimeout(() => {
+          timers.delete(key);
+          const paths = changed.get(key) || new Map();
+          changed.delete(key);
+          for (const [p, event] of paths) portfolio.invalidate(project, scope, p, event);
+          if (scope === 'features') watchNew();
+          push({ scope, project: project.id });
+          // A log append is tailed on read, so the portfolio can refresh now; a
+          // feature change is re-read in the background first, then pushed.
+          if (scope === 'activity') push({ scope: 'projects' });
+          else warmSoon();
+        }, DEBOUNCE_MS));
+      };
+      for (const evt of ['add', 'change', 'unlink', 'addDir', 'unlinkDir']) server.watcher.on(evt, (path) => onFsEvent(evt, path));
+      server.httpServer?.once('close', () => clearInterval(rescan));
+    },
+    // A changed `.morph/` file is data, not a module: never let it reach HMR.
+    handleHotUpdate(ctx) {
+      if (classifyChange(ctx.file)) return [];
+    },
+  };
+}

package/src/lib/ai/comment-stripper.js

@@ -2,14 +2,17 @@
  * comment-stripper.js — apagar comentários SEM apagar o que está dentro de uma
  * string, preservando comprimento e quebras de linha.
  *
- * Existe uma vez só, e serve a dois consumidores que fariam a MESMA coisa de
+ * Existe uma vez só, e serve a consumidores que fariam a MESMA coisa de
  * jeitos ligeiramente diferentes se cada um escrevesse o seu:
  *
  *   - `code-audit.js` — não pode acusar `AgentThread` que só aparece num
  *     comentário ou numa mensagem de log;
  *   - `registry-audit.js` — precisa ler **JSONC**, a forma que o exemplar
  *     canônico `model-registry.v2.json` usa e que o leitor C# do kit aceita de
- *     propósito (`JsonCommentHandling.Skip`, `AllowTrailingCommas`).
+ *     propósito (`JsonCommentHandling.Skip`, `AllowTrailingCommas`);
+ *   - `dotnet-test-introspection.js` — lê o `global.json` por `jsoncToJson`;
+ *   - `validators/code-budget/comment-scanner.js` — acha as linhas de
+ *     comentário de `.cs`/`.ts`/`.js`, e é o único que liga a opção `js`.
  *
  * **Por que não um regex.** O exemplar tem `"http://localhost:11434/v1"` e uma
  * `provenance` com URL. Um `replace(/\/\/.*$/gm, '')` decapitaria as duas —
@@ -36,13 +39,18 @@
  *   `○ não verificado`. O B1 reintroduzido pela correção do B1.
  * @param {{ unterminated?: string|null }} [options.report]
  *   Se um objeto for passado, recebe `unterminated` = `'block-comment'`,
- *   `'string'`, `'verbatim-string'`, `'raw-string'` ou `null`. É o canal de
+ *   `'string'`, `'verbatim-string'`, `'raw-string'`, `'template'` ou `null`. É o canal de
  *   diagnóstico que `jsoncToJson` usa para ficar tão estrito quanto o leitor
  *   de produção, sem que este lexer precise lançar (ele também varre `.cs`,
  *   onde um comentário aberto é problema do arquivo, não da varredura).
+ * @param {boolean} [options.js=false]
+ *   Lê também template literal e regex literal de TS/JS. Opt-in porque só
+ *   quem varre `.ts`/`.js` precisa: sem template, `https://${h}` vira
+ *   comentário; sem regex, uma crase dentro de `/[`']/` abre um template que
+ *   engole o resto do arquivo.
  * @returns {string} texto do MESMO comprimento
  */
-export function stripComments(text, { blankStrings = false, report = null } = {}) {
+export function stripComments(text, { blankStrings = false, report = null, js = false } = {}) {
   const out = text.split('');
   const blank = (from, to) => {
     for (let k = from; k < to && k < out.length; k++) {
@@ -73,6 +81,19 @@ export function stripComments(text, { blankStrings = false, report = null } = {}
       continue;
     }
 
+    if (js && c === '`') {
+      const end = templateEnd(text, i);
+      if (end === -1) flag('template');
+      const stop = end === -1 ? text.length : end;
+      if (blankStrings) blank(i + 1, end === -1 ? stop : stop - 1);
+      i = stop;
+      continue;
+    }
+    if (js && c === '/' && next !== '>' && regexMayStart(out, i)) {
+      const end = regexEnd(text, i);
+      if (end !== -1) { i = end; continue; }
+    }
+
     // Raw string literal do C#: """ ... """ — delimitadores de 3 aspas.
     if (c === '"' && next === '"' && text[i + 2] === '"') {
       const end = text.indexOf('"""', i + 3);
@@ -137,6 +158,82 @@ export function stripComments(text, { blankStrings = false, report = null } = {}
   return out.join('');
 }
 
+/** Índice logo após a crase que fecha o template aberto em `start`, ou -1. */
+function templateEnd(text, start) {
+  let j = start + 1;
+  while (j < text.length) {
+    if (text[j] === '\\') { j += 2; continue; }
+    if (text[j] === '`') return j + 1;
+    if (text[j] === '$' && text[j + 1] === '{') { j = holeEnd(text, j + 2); continue; }
+    j += 1;
+  }
+  return -1;
+}
+
+const REGEX_AFTER_WORD = new Set([
+  'return', 'typeof', 'case', 'do', 'else', 'in', 'of', 'new', 'delete', 'void',
+  'throw', 'instanceof', 'yield', 'await',
+]);
+
+/**
+ * Uma `/` abre regex, e não divisão, quando o que vem antes não é um valor: o
+ * mesmo critério de contexto dos tokenizers de JS. `out` já tem os comentários
+ * apagados, então o caractere anterior é código. Sem `<`: em TSX, `</b>` é tag.
+ */
+function regexMayStart(out, i) {
+  let k = i - 1;
+  while (k >= 0 && /\s/.test(out[k])) k--;
+  if (k < 0) return true;
+  if ('(,=:[!&|?{};+-*%>~^'.includes(out[k])) return true;
+  if (!/[A-Za-z_$]/.test(out[k])) return false;
+  let w = k;
+  while (w > 0 && /[\w$]/.test(out[w - 1])) w--;
+  return REGEX_AFTER_WORD.has(out.slice(w, k + 1).join(''));
+}
+
+/** Índice logo após a `/` (e as flags) que fecha a regex aberta em `start`, ou -1 se a linha acaba antes. */
+function regexEnd(text, start) {
+  let inClass = false;
+  for (let j = start + 1; j < text.length; j++) {
+    const c = text[j];
+    if (c === '\n') return -1;
+    if (c === '\\') { j++; continue; }
+    if (c === '[') inClass = true;
+    else if (c === ']') inClass = false;
+    else if (c === '/' && !inClass) {
+      let k = j + 1;
+      while (k < text.length && /[a-z]/i.test(text[k])) k++;
+      return k;
+    }
+  }
+  return -1;
+}
+
+/** Índice logo após o `}` que fecha um `${`: o código do buraco aninha chaves, strings e templates. */
+function holeEnd(text, start) {
+  let depth = 1;
+  let j = start;
+  while (j < text.length) {
+    const c = text[j];
+    if (c === '`') {
+      const end = templateEnd(text, j);
+      if (end === -1) return text.length;
+      j = end;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      j += 1;
+      while (j < text.length && text[j] !== c && text[j] !== '\n') j += text[j] === '\\' ? 2 : 1;
+      j += 1;
+      continue;
+    }
+    if (c === '{') depth += 1;
+    else if (c === '}' && --depth === 0) return j + 1;
+    j += 1;
+  }
+  return text.length;
+}
+
 /**
  * Converte JSONC em JSON: apaga comentários e vírgulas sobrando antes de `}`/`]`.
  *

package/src/lib/detectors/claude-config-detector.js

@@ -15,13 +15,12 @@ import { homedir } from 'os';
  * Detect Claude Code configuration for a project.
  *
  * @param {string} targetPath - Root path of the project
- * @returns {{ plugins: string[], mcpServers: Array<{name: string, config: Object}>, superpowers: boolean, customSkills: string[], customCommands: string[], hooks: string[] }}
+ * @returns {{ plugins: string[], mcpServers: Array<{name: string, config: Object}>, customSkills: string[], customCommands: string[], hooks: string[] }}
  */
 export function detectClaudeConfig(targetPath) {
   const result = {
     plugins: [],
     mcpServers: [],
-    superpowers: false,
     customSkills: [],
     customCommands: [],
     hooks: [],
@@ -86,7 +85,6 @@ export function detectClaudeConfig(targetPath) {
         const pluginsData = JSON.parse(readFileSync(pluginsPath, 'utf8'));
         const plugins = pluginsData.plugins || {};
         result.plugins = Object.keys(plugins);
-        result.superpowers = 'superpowers@claude-plugins-official' in plugins;
       } catch { /* invalid JSON */ }
     }
 
@@ -166,7 +164,7 @@ export function mcpAvailabilityByPhase(mcpServers, phaseMatrix = {}) {
 /**
  * Format a human-readable one-liner summary of detected config.
  *
- * @param {{ plugins: string[], mcpServers: Array<{name: string}>, superpowers: boolean }} config
+ * @param {{ plugins: string[], mcpServers: Array<{name: string}> }} config
  * @returns {string}
  */
 export function formatConfigSummary(config) {
@@ -177,8 +175,5 @@ export function formatConfigSummary(config) {
   if (config.plugins.length > 0) {
     parts.push(`Plugins: ${config.plugins.length}`);
   }
-  if (config.superpowers) {
-    parts.push('superpowers: yes');
-  }
   return parts.join(' | ') || 'No Claude config detected';
 }

package/src/lib/detectors/index.js

@@ -2,7 +2,7 @@
  * @fileoverview Project Detector
  *
  * Scans a project directory for stack, architecture, UI library, and integrations.
- * Used by mcp-setup, morph-init, and session-start hooks.
+ * Used by `morph-spec init`, `mcp setup` and the test-node fallback (test-nodes.js).
  *
  * @module detectors/index
  */
@@ -106,6 +106,10 @@ export function detectProject(targetPath, opts = {}) {
         if (content.includes('Hangfire')) {
           if (!structure.integrations.includes('hangfire')) structure.integrations.push('hangfire');
         }
+        // Same heuristic as the package.json side (`pg`/`postgres` → neon).
+        if (content.includes('Npgsql')) {
+          if (!structure.integrations.includes('neon')) structure.integrations.push('neon');
+        }
       } catch { /* ignore */ }
     }
 

package/src/lib/evaluator-report.js

@@ -93,6 +93,12 @@ const MUTATION_SECTION_RE = /^##\s+Muta[çc][õo]es\s*$/m;
  */
 const MEDIA_SECTION_RE = /^##\s+M[íi]dia\s+gerada\s*$/m;
 
+/**
+ * A seção em que o avaliador confere o checklist de tela do mockup contra a
+ * tela entregue (`morph-review` §4). Mesma disciplina: exige `##`.
+ */
+const SCREEN_CHECKLIST_SECTION_RE = /^##\s+Checklist\s+de\s+tela\s*$/gim;
+
 /**
  * As chaves reconhecidas de `**Proof-Scores:**`, uma por rubrica de prova.
  * Chave fora desta lista é IGNORADA (não vira score, não vira erro): o relatório
@@ -287,6 +293,25 @@ export function evaluatorProofState(cwd, featureName) {
   };
 }
 
+/**
+ * A seção `## Checklist de tela` do relatório, com o corpo da ÚLTIMA ocorrência
+ * — append-only outra vez: numa reavaliação a conferência nova vai para o fim.
+ * O corpo vai cru para `checklistCoverage` (`src/lib/specs/screen-checklist.js`),
+ * dono único do parser de linha do checklist.
+ *
+ * @returns {{ section: boolean, body: string }} arquivo ausente ou sem a seção:
+ *   `{ section: false, body: '' }`. Nunca lança.
+ */
+export function evaluatorScreenChecklist(cwd, featureName) {
+  const text = readReport(cwd, featureName);
+  const matches = text === null ? [] : [...text.matchAll(SCREEN_CHECKLIST_SECTION_RE)];
+  if (matches.length === 0) return { section: false, body: '' };
+  const last = matches[matches.length - 1];
+  const rest = text.slice(last.index + last[0].length);
+  const next = rest.search(/^#{1,2}\s/m);
+  return { section: true, body: next === -1 ? rest : rest.slice(0, next) };
+}
+
 /**
  * O menor Proof-Score das provas de EVIDÊNCIA — o que impõe o teto em
  * `test-coverage`.
@@ -324,3 +349,25 @@ export function mediaProofScore(proofScores) {
   const value = proofScores?.media;
   return typeof value === 'number' && Number.isFinite(value) ? value : null;
 }
+
+/**
+ * Os dois vereditos do relatório lidos de um TEXTO já em mãos — o score
+ * composto vigente e os Proof-Scores vigentes, pela mesma regra append-only
+ * (o último token vale) dos leitores por `cwd` acima.
+ *
+ * Existe para quem tem o relatório fora do caminho canônico — o dashboard lê
+ * features arquivadas em `.morph/archive/{f}/4-review/` —, sem que ele
+ * precise de uma segunda cópia dos regexes.
+ *
+ * @param {string} text
+ * @returns {{ score: number|undefined, proofScores: Record<string, number>|undefined }}
+ */
+export function evaluatorVerdictFromText(text) {
+  if (typeof text !== 'string') return { score: undefined, proofScores: undefined };
+  const scores = compositeScoresIn(text);
+  const lines = [...text.matchAll(PROOF_SCORES_RE)];
+  return {
+    score: scores.length === 0 ? undefined : scores[scores.length - 1],
+    proofScores: lines.length === 0 ? undefined : parseProofScores(lines[lines.length - 1][1]),
+  };
+}

package/src/lib/generators/handoff-generator.js

@@ -16,9 +16,9 @@
  * degrades that section, never the document.
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from 'fs';
-import { join, resolve } from 'path';
-import { execSync } from 'child_process';
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { ensureCommonExclude } from '../../../framework/hooks/shared/git-exclude.js';
 import { derivePhaseForFeature, getPendingGates } from '../../../framework/hooks/shared/state-reader.js';
 
 const PHASE_DIRS = {
@@ -236,21 +236,7 @@ const HANDOFF_EXCLUDE_PATTERN = '/.morph/**/handoff.md';
  * untracked is noise, never data loss.
  */
 function ensureHandoffExcluded(cwd) {
-  try {
-    const common = execSync('git rev-parse --git-common-dir', { cwd, stdio: 'pipe' }).toString().trim();
-    if (!common) return;
-    const infoDir = join(resolve(cwd, common), 'info');
-    const excludePath = join(infoDir, 'exclude');
-    const current = existsSync(excludePath) ? readFileSync(excludePath, 'utf8') : '';
-    const present = new Set(current.split(/\r?\n/).map((l) => l.trim()));
-    if (present.has(HANDOFF_EXCLUDE_PATTERN)) return;
-    mkdirSync(infoDir, { recursive: true });
-    appendFileSync(excludePath, [
-      current && !current.endsWith('\n') ? '\n' : '',
-      present.has(HANDOFF_EXCLUDE_MARKER) ? '' : `${HANDOFF_EXCLUDE_MARKER}\n`,
-      `${HANDOFF_EXCLUDE_PATTERN}\n`,
-    ].join(''));
-  } catch { /* fail-open */ }
+  ensureCommonExclude(cwd, [HANDOFF_EXCLUDE_PATTERN], HANDOFF_EXCLUDE_MARKER);
 }
 
 /**