@polymorphism-tech/morph-spec 8.47.0 → 9.0.0

package/src/lib/generators/settings-generator.js

@@ -23,25 +23,12 @@ export async function generateSettings(targetPath, detectedConfig, morphConfig =
   const claudeDir = join(targetPath, '.claude');
   const settingsPath = join(claudeDir, 'settings.local.json');
 
-  // Read existing settings
-  const existing = await readSettingsSafe(settingsPath);
-
-  // Build stack-based permissions
-  const stack = morphConfig?.project?.architecture || 'unknown';
-  const permissions = buildPermissions(stack, detectedConfig);
-
-  // Build generated settings
+  const existing = withoutLegacyPermissions(await readSettingsSafe(settingsPath));
   const generated = {};
 
-  if (permissions.length > 0) {
-    generated.permissions = permissions;
-  }
-
-  // Track what we manage
   const managed = {
-    permissions_added: permissions,
     mcps_detected: detectedConfig.mcpServers.map(s => s.name),
-    plugins_detected: detectedConfig.plugins.map(p => p.name),
+    plugins_detected: detectedConfig.plugins.map(p => (typeof p === 'string' ? p : p?.name)),
     generated_at: new Date().toISOString()
   };
 
@@ -58,44 +45,10 @@ export async function generateSettings(targetPath, detectedConfig, morphConfig =
 
   return {
     settingsPath,
-    permissionsAdded: permissions.length,
     managed
   };
 }
 
-/**
- * Build permission rules based on detected stack
- * @param {string} stack - Detected project stack
- * @param {Object} detectedConfig - Detected Claude config
- * @returns {Array<string>} Permission patterns
- */
-export function buildPermissions(stack, detectedConfig = {}) {
-  const permissions = [];
-
-  // Stack-based permissions
-  const stackPermissions = {
-    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
-    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
-    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
-    go: ['Bash(go:*)']
-  };
-
-  if (stackPermissions[stack]) {
-    permissions.push(...stackPermissions[stack]);
-  }
-
-  // morph-spec CLI always needs node/npx
-  if (!permissions.includes('Bash(npx:*)')) {
-    permissions.push('Bash(npx:*)');
-  }
-
-  return permissions;
-}
-
 /**
  * Deep merge settings without overwriting user entries
  * @param {Object} existing - Current settings.local.json
@@ -127,46 +80,6 @@ export function mergeSettings(existing, generated) {
   return result;
 }
 
-/**
- * Remove only morph-spec managed entries from settings
- * @param {string} settingsPath - Path to settings.local.json
- * @returns {Promise<Object>} Summary of what was removed
- */
-export async function resetMorphSettings(settingsPath) {
-  if (!existsSync(settingsPath)) {
-    return { removed: false, reason: 'file not found' };
-  }
-
-  const settings = await readSettingsSafe(settingsPath);
-  const managed = settings[MORPH_MANAGED_KEY];
-
-  if (!managed) {
-    return { removed: false, reason: 'no _morph_managed section found' };
-  }
-
-  // Remove managed permissions
-  if (managed.permissions_added && Array.isArray(settings.permissions)) {
-    settings.permissions = settings.permissions.filter(
-      p => !managed.permissions_added.includes(p)
-    );
-    if (settings.permissions.length === 0) {
-      delete settings.permissions;
-    }
-  }
-
-  // Remove the managed marker itself
-  delete settings[MORPH_MANAGED_KEY];
-
-  // Write back
-  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
-
-  return {
-    removed: true,
-    permissionsRemoved: managed.permissions_added || [],
-    previouslyGenerated: managed.generated_at
-  };
-}
-
 /**
  * Save integrations.json with detected config
  * @param {string} targetPath - Project root directory
@@ -198,6 +111,15 @@ export async function saveIntegrations(targetPath, detectedConfig) {
 // Helpers
 // ============================================================================
 
+// Claude Code reads only `permissions: { allow, deny }`; a bare array (older generator) is ignored.
+// Versões antigas gravavam regras curinga (node:*, npm:*, npx:*…) como array, forma que o
+// Claude Code ignora: nunca valeram. Converter para { allow } as ligaria em silêncio.
+function withoutLegacyPermissions(settings) {
+  if (!Array.isArray(settings.permissions)) return settings;
+  const { permissions, ...rest } = settings;
+  return rest;
+}
+
 async function readSettingsSafe(settingsPath) {
   try {
     if (!existsSync(settingsPath)) return {};

package/src/lib/git/evidence-staleness.js

@@ -7,7 +7,7 @@ const CONFIG_PATH = '.morph/config/config.json';
 
 const gitOut = (cwd, args) => execFileSync('git', args, { cwd, stdio: 'pipe', maxBuffer: 64 * 1024 * 1024 }).toString();
 
-function withoutBaseline(text) {
+export function withoutBaseline(text) {
   const config = JSON.parse(text);
   if (Array.isArray(config?.project?.tests)) {
     for (const node of config.project.tests) delete node?.expectedCount;

package/src/lib/git/tree-fingerprint.js

@@ -1,15 +1,15 @@
 /**
- * A hash of what a verify run reads: the commit, the uncommitted changes and
- * the untracked files, plus the project's `config.json` (it names the test
- * commands). Everything else under `.morph/` stays out — verify itself writes
- * feature.json and the logs on every run, and counting that would make two
- * runs over the same code look different.
+ * A hash of what a verify run reads: the committed tree, the uncommitted changes and the
+ * untracked files, plus `config.json` without `expectedCount` (it names the test commands).
+ * The rest of `.morph/` stays out, as in `treeMovedSince`: committing verify's own
+ * bookkeeping must not make the same code look different.
  */
 
 import { execFileSync } from 'child_process';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync, statSync } from 'fs';
 import { join } from 'path';
+import { withoutBaseline } from './evidence-staleness.js';
 
 /** Pathspec for "the project minus its `.morph/` bookkeeping". */
 export const OUTSIDE_MORPH = ['--', '.', ':(exclude).morph'];
@@ -31,7 +31,11 @@ export function treeFingerprint(projectPath) {
     const hash = createHash('sha256');
     let head = null;
     try { head = git(projectPath, ['rev-parse', 'HEAD']).toString().trim(); } catch { /* no commit yet */ }
-    hash.update(`head\0${head ?? 'no-commit'}\0`);
+    // Tree ids are content-addressed: the top-level entries minus .morph change only with code.
+    const tree = head
+      ? git(projectPath, ['ls-tree', '-z', 'HEAD']).toString().split('\0').filter((e) => e && e.split('\t')[1] !== '.morph')
+      : ['no-commit'];
+    hash.update(`tree\0${tree.join('\0')}\0`);
     // Before the first commit there is no HEAD to diff against: every file is
     // untracked, and the listing below covers them.
     if (head) hash.update(git(projectPath, ['diff', 'HEAD', '--binary', ...OUTSIDE_MORPH]));
@@ -50,9 +54,17 @@ export function treeFingerprint(projectPath) {
     }
     const config = join(projectPath, '.morph', 'config', 'config.json');
     hash.update('\0config\0');
-    if (existsSync(config)) hash.update(readFileSync(config));
+    if (existsSync(config)) hash.update(normalizedConfig(readFileSync(config, 'utf8')));
     return hash.digest('hex');
   } catch {
     return null;
   }
 }
+
+function normalizedConfig(text) {
+  try {
+    return JSON.stringify(withoutBaseline(text));
+  } catch {
+    return text;
+  }
+}

package/src/lib/git/tree-state.js

@@ -11,7 +11,7 @@ import { OUTSIDE_MORPH, treeFingerprint, git as gitBuffer } from './tree-fingerp
 import { detectDefaultBranch } from './default-branch.js';
 import { resolveBaseRef } from './branch-classifier.js';
 
-/** What an evaluator writes next to a mutation it has not reverted yet. */
+/** What the verifier writes next to a mutation it has not reverted yet. */
 export const MUTATION_MARKER = 'MUTACAO';
 const MAX_LISTED = 50;
 const MAX_COMMITS = 10;
@@ -50,7 +50,7 @@ function commitBlobs(cwd, commit, paths) {
 
 /**
  * What the tree is before a dispatch whose work must leave it unchanged (the
- * evaluator mutates and reverts): HEAD plus the blob of every file that
+ * verifier mutates and reverts): HEAD plus the blob of every file that
  * differs from it. Kept on disk, so a session that resumes after the agent
  * died compares against the tree before the dispatch, not its own start.
  * @returns {{ at: string, head: string|null, files: Object<string, string|null> }|null}

package/src/lib/heavy/cleanup.js

@@ -6,7 +6,6 @@ import { heavyDir, runExclusive } from '../../../framework/hooks/shared/heavy-sl
 
 const DOTNET_ACTIVE = /\bdotnet(?:\.exe)?["']?\s+(?:build|test|publish|pack|msbuild|restore|run|watch|vstest)\b/i;
 const IDLE_WORKER = /\/nodemode:\d|vbcscompiler|razorserver/i;
-const SHUTDOWN_SCOPES = new Set(['feature', 'e2e-down', 'prune']);
 const SHUTDOWN_TIMEOUT_MS = 30_000;
 const TAIL_CHARS = 400;
 
@@ -33,16 +32,13 @@ export function dotnetBusy(procs) {
   });
 }
 
-export function afterHeavyRun({ projectPath, config, scope, env = process.env, deps = {} }) {
+export function afterHeavyRun({ projectPath, config, env = process.env, deps = {} }) {
   const {
     exec = defaultProcExec, list = listProcesses, dotnet = hasDotnet, exclusive = runExclusive,
   } = deps;
 
   if (!config.enabled) return { status: 'skipped', reason: 'semáforo desligado: sem ele nada prova que outra sessão não está compilando' };
   if (!config.shutdownBuildServer) return { status: 'skipped', reason: 'desligado em heavy.shutdownBuildServer' };
-  if (!SHUTDOWN_SCOPES.has(scope)) {
-    return { status: 'skipped', reason: 'escopo de task: o servidor de compilação segue quente para a próxima task' };
-  }
   if (!dotnet(projectPath)) return { status: 'skipped', reason: 'projeto sem .NET' };
 
   const guarded = exclusive({

package/src/lib/installers/memory-installer.js

@@ -41,8 +41,7 @@ metadata:
 - \`.morph/framework/MORPH.md\` — NLH charter (read once per session)
 - \`.morph/framework/agents.json\` — 8 agents: 7 domain personas + 1 stage persona (\`scout\`, read-only)
 - \`.morph/framework/standards/STANDARDS.json\` — standards index (load on demand)
-- \`.morph/framework/schemas/tasks.schema.json\` — JSON Schema for tasks.json
-- \`.morph/features/{feature}/\` — feature artifacts: 0-proposal / 1-design / 2-plan / 3-implement / 4-review
+- \`.morph/features/{feature}/\` — feature artifacts: 2-plan / 1-design / 3-implement / 4-review
 - \`.morph/context/\` — long-lived architectural context (design-system, decisions)
 - \`.morph/state.json\` — feature state (managed by state-sync hook; Edit fallback allowed)
 
@@ -50,8 +49,8 @@ metadata:
 
 | Command | Skill invoked |
 |---------|---------------|
-| \`/morph-proposal {feature}\` | \`Skill(morph-proposal)\` — brainstorming → Gate 1 → plan → Gate 2 |
-| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — DAG-adaptive implement loop → review → Gate 3 |
+| \`/morph-proposal {feature}\` | \`Skill(morph-plan)\` — entrevista → plan.md → plan-check → gate do plano |
+| \`/morph-apply {feature}\` | \`Skill(morph-apply)\` — fatias do plano → verify → review → Gate 3 |
 | \`/morph-status [feature]\` | inspect state.json |
 | \`/morph-archive {feature}\` | move completed feature to .morph/archive/ |
 | \`/morph-preflight\` | pre-deploy validation |
@@ -59,13 +58,13 @@ metadata:
 
 ## Core skills
 
-\`morph-proposal\`, \`morph-apply\`, \`morph-brainstorming\`, \`morph-plan\`, \`morph-implement\`, \`morph-review\`, \`morph-stack-scan\`, \`morph-standards\`
+\`morph-plan\`, \`morph-apply\`, \`morph-uiux\`, \`morph-review\`, \`morph-hotfix\`, \`morph-standards\`
 
 **Why:** This project is managed by morph-spec — spec-driven autonomous development with trust-aware gates.
 
 **How to apply:**
 - When user mentions a feature, check \`.morph/features/\` first.
-- When user types \`/morph-proposal\`, invoke \`Skill(morph-proposal)\` directly.
+- When user types \`/morph-proposal\`, invoke \`Skill(morph-plan)\` directly.
 - In \`trust: "auto"\`, gates auto-pass; only AskUserQuestion on risk signals.
 `;
 }
@@ -83,10 +82,9 @@ metadata:
 - \`.morph/context/design-system.md\` — design tokens and components (source of truth)
 - \`.morph/framework/MORPH.md\` — NLH charter, Trust Mode rules, gates, skills table
 - \`.morph/framework/standards/STANDARDS.json\` — index; load specific standard via \`path\` field
-- \`.morph/framework/schemas/tasks.schema.json\` — tasks.json schema reference
 - \`.morph/framework/phases.json\` — phase folder mapping and skill associations
 - \`.morph/framework/agents.json\` — domain persona definitions (dotnet-senior, ef-modeler, etc.)
-- \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 evaluator checks (verdict SHIP/FIX + evidence-typed blockers)
+- \`.morph/framework/evals/review-checklist.md\` — what the Gate 3 verifier, reviewer and security check (verdict SHIP/FIX + evidence-typed blockers)
 `;
 
 /**

package/src/lib/mutation/commands.js

@@ -1,4 +1,5 @@
-import { dotnetBuildCommandFor, resolveTestBuildTargets } from '../tasks/test-runner.js';
+import { resolve } from 'node:path';
+import { discoverDotnetBuildTargets, dotnetBuildCommandFor } from '../tasks/test-runner.js';
 
 const FILTER = /--filter(?:[ =:])(?:"([^"]*)"|'([^']*)'|(\S+))/;
 const quote = (s) => `"${String(s).replace(/"/g, '\\"')}"`;
@@ -32,7 +33,7 @@ const VERBOSITY = /\s(?:-v|--verbosity)[ =:]?\S+/g;
 export function dotnetBuildCommands(node, projectPath) {
   const configuration = CONFIGURATION.exec(node.command ?? '');
   const flag = configuration ? ` -c ${configuration[1] ?? configuration[2]}` : '';
-  return resolveTestBuildTargets(node)
+  return discoverDotnetBuildTargets(node, resolve(projectPath || '.', node.cwd || '.'))
     .map((target) => dotnetBuildCommandFor(target, projectPath))
     .filter(Boolean)
     .map((command) => `${command.replace(VERBOSITY, '')} -v m${flag}`);