@rpamis/comet 0.3.5 → 0.3.7

package/assets/skills/comet/scripts/comet-guard.sh

@@ -7,6 +7,8 @@
 
 set -euo pipefail
 
+COMET_BASH="${COMET_BASH:-${BASH:-bash}}"
+
 red() { echo -e "\033[31m$1\033[0m" >&2; }
 green() { echo -e "\033[32m$1\033[0m" >&2; }
 warn() { echo -e "\033[33m$1\033[0m" >&2; }
@@ -32,18 +34,26 @@ validate_change_name() {
   fi
 }
 
-validate_change_name "$1"
+if [ "${COMET_GUARD_SOURCE_ONLY:-0}" = "1" ]; then
+  CHANGE="${CHANGE:-}"
+  PHASE="${PHASE:-}"
+  APPLY="${APPLY:-0}"
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd -P)"
+  CHANGE_DIR="${CHANGE_DIR:-}"
+else
+  validate_change_name "$1"
 
-CHANGE="$1"
-PHASE="$2"
-APPLY=0
-SCRIPT_DIR="$(dirname "$(readlink -f "$0" 2>/dev/null || echo "$0")" 2>/dev/null || dirname "$0")"
-if [[ "${3:-}" == "--apply" ]]; then
-  APPLY=1
-fi
-CHANGE_DIR="openspec/changes/$CHANGE"
-if [ "$PHASE" = "archive" ] && [ ! -d "$CHANGE_DIR" ] && [ -d "openspec/changes/archive/$CHANGE" ]; then
-  CHANGE_DIR="openspec/changes/archive/$CHANGE"
+  CHANGE="$1"
+  PHASE="$2"
+  APPLY=0
+  SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+  if [[ "${3:-}" == "--apply" ]]; then
+    APPLY=1
+  fi
+  CHANGE_DIR="openspec/changes/$CHANGE"
+  if [ "$PHASE" = "archive" ] && [ ! -d "$CHANGE_DIR" ] && [ -d "openspec/changes/archive/$CHANGE" ]; then
+    CHANGE_DIR="openspec/changes/archive/$CHANGE"
+  fi
 fi
 
 BLOCK=0
@@ -92,6 +102,27 @@ tasks_has_any() {
   [ -f "$tasks" ] && grep -q '\- \[' "$tasks"
 }
 
+plan_tasks_all_done() {
+  local plan
+  plan=$(yaml_field_value "plan" 2>/dev/null || true)
+
+  if [ -z "$plan" ] || [ "$plan" = "null" ]; then
+    return 0
+  fi
+  if [ ! -f "$plan" ]; then
+    echo "plan file is missing at $plan" >&2
+    echo "Next: restore the Superpowers plan file or update .comet.yaml plan before leaving build." >&2
+    return 1
+  fi
+  if grep -q '^[[:space:]]*- \[ \]' "$plan"; then
+    echo "Unfinished Superpowers plan tasks:" >&2
+    grep -n '^[[:space:]]*- \[ \]' "$plan" >&2 || true
+    echo "Next: check off corresponding completed plan tasks, then commit the plan update." >&2
+    return 1
+  fi
+  return 0
+}
+
 yaml_field_value() {
   local field="$1"
   local yaml="$CHANGE_DIR/.comet.yaml"
@@ -180,8 +211,19 @@ is_windows_bash() {
 
 run_command_string() {
   local command="$1"
+  if [ -z "$command" ]; then
+    red "ERROR: build/verify command is empty" >&2
+    return 1
+  fi
+  # Basic command injection guard: reject dangerous shell metacharacters
+  # Quotes are allowed to support paths with spaces (e.g. Windows)
+  if [[ "$command" =~ [\;\|\&\$\`] ]]; then
+    red "ERROR: build/verify command contains shell metacharacters: $command" >&2
+    red "Allowed: alphanumeric, spaces, hyphens, underscores, dots, colons, forward slashes, quotes" >&2
+    return 1
+  fi
   echo "+ $command" >&2
-  bash -lc "$command"
+  "$COMET_BASH" -lc "$command"
 }
 
 hash_stream() {
@@ -217,12 +259,14 @@ handoff_source_files() {
 }
 
 compute_handoff_hash() {
-  handoff_source_files | while IFS= read -r file; do
+  local hash_input
+  hash_input=$(handoff_source_files | while IFS= read -r file; do
     if [ -f "$file" ]; then
       printf 'path:%s\n' "$file"
       printf 'sha256:%s\n' "$(hash_file "$file")"
     fi
-  done | hash_stream
+  done)
+  printf '%s' "$hash_input" | hash_stream
 }
 
 preflight() {
@@ -240,8 +284,8 @@ preflight() {
   local validate_script
   validate_script="$SCRIPT_DIR/comet-yaml-validate.sh"
   if [ -f "$validate_script" ]; then
-    if ! bash "$validate_script" "$CHANGE" 2>/dev/null; then
-      bash "$validate_script" "$CHANGE"
+    if ! "$COMET_BASH" "$validate_script" "$CHANGE" 2>/dev/null; then
+      "$COMET_BASH" "$validate_script" "$CHANGE" || true
       red "FATAL: .comet.yaml schema validation failed"
       exit 1
     fi
@@ -300,7 +344,7 @@ isolation_selected() {
     *)
       echo "isolation must be branch or worktree, got '${isolation:-null}'" >&2
       echo "Next: ask the user to choose branch or worktree, create the chosen isolation, then run:" >&2
-      echo "  bash \"\$COMET_STATE\" set $CHANGE isolation <branch|worktree>" >&2
+      echo "  \"\$COMET_BASH\" \"\$COMET_STATE\" set $CHANGE isolation <branch|worktree>" >&2
       return 1
       ;;
   esac
@@ -313,8 +357,8 @@ build_mode_selected() {
     subagent-driven-development|executing-plans|direct) return 0 ;;
     *)
       echo "build_mode must be selected before leaving build, got '${build_mode:-null}'" >&2
-      echo "Next: ask the user to choose an implementation mode, then run:" >&2
-      echo "  bash \"\$COMET_STATE\" set $CHANGE build_mode <subagent-driven-development|executing-plans>" >&2
+      echo "Next: ask the user to choose an execution mode, then run:" >&2
+      echo "  \"\$COMET_BASH\" \"\$COMET_STATE\" set $CHANGE build_mode <subagent-driven-development|executing-plans>" >&2
       return 1
       ;;
   esac
@@ -336,7 +380,48 @@ build_mode_allowed_for_workflow() {
         return 0
       fi
       echo "build_mode=direct is only allowed for hotfix/tweak unless direct_override: true is recorded" >&2
-      echo "Next: switch build_mode to executing-plans or subagent-driven-development, or stop and ask the user for an explicit direct override." >&2
+      echo "Next: choose executing-plans or subagent-driven-development, or stop and ask the user for an explicit direct override." >&2
+      return 1
+      ;;
+  esac
+}
+
+subagent_dispatch_confirmed() {
+  local build_mode subagent_dispatch
+  build_mode=$(yaml_field_value "build_mode" 2>/dev/null || true)
+  subagent_dispatch=$(yaml_field_value "subagent_dispatch" 2>/dev/null || true)
+
+  if [ "$build_mode" != "subagent-driven-development" ]; then
+    return 0
+  fi
+
+  if [ "$subagent_dispatch" = "confirmed" ]; then
+    return 0
+  fi
+
+  echo "subagent_dispatch must be confirmed before using build_mode=subagent-driven-development" >&2
+  echo "Next: confirm the current platform has a real background subagent/Task/multi-agent dispatcher, then run:" >&2
+  echo "  \"\$COMET_BASH\" \"\$COMET_STATE\" set $CHANGE subagent_dispatch confirmed" >&2
+  echo "Or ask the user to switch to executing-plans and run:" >&2
+  echo "  \"\$COMET_BASH\" \"\$COMET_STATE\" set $CHANGE build_mode executing-plans" >&2
+  return 1
+}
+
+tdd_mode_selected() {
+  local workflow tdd_mode
+  workflow=$(yaml_field_value "workflow" 2>/dev/null || true)
+  tdd_mode=$(yaml_field_value "tdd_mode" 2>/dev/null || true)
+
+  case "$workflow" in
+    hotfix|tweak) return 0 ;;
+  esac
+
+  case "$tdd_mode" in
+    tdd|direct) return 0 ;;
+    *)
+      echo "tdd_mode must be tdd or direct for full workflow, got '${tdd_mode:-null}'" >&2
+      echo "Next: ask the user to choose TDD enforcement level, then run:" >&2
+      echo "  \"\$COMET_BASH\" \"\$COMET_STATE\" set $CHANGE tdd_mode <tdd|direct>" >&2
       return 1
       ;;
   esac
@@ -367,7 +452,7 @@ design_handoff_context_valid() {
 
   if [ -z "$context" ] || [ "$context" = "null" ]; then
     echo "handoff_context is missing from .comet.yaml" >&2
-    echo "Next: run bash \"\$COMET_HANDOFF\" $CHANGE design --write before invoking Superpowers." >&2
+    echo "Next: run \"\$COMET_BASH\" \"\$COMET_HANDOFF\" $CHANGE design --write before invoking Superpowers." >&2
     return 1
   fi
   if [ ! -s "$context" ]; then
@@ -414,7 +499,7 @@ design_handoff_markdown_traceable() {
     echo "handoff markdown is missing Generated-by marker" >&2
     missing=1
   }
-  grep -Eq '^- Mode: (compact|full)$' "$markdown" || {
+  grep -Eq '^- Mode: (compact|full|beta)$' "$markdown" || {
     echo "handoff markdown is missing Mode marker" >&2
     missing=1
   }
@@ -433,6 +518,47 @@ design_handoff_markdown_traceable() {
   [ "$missing" -eq 0 ]
 }
 
+context_compression_mode() {
+  local mode
+  mode=$(yaml_field_value "context_compression" 2>/dev/null || true)
+  printf '%s\n' "${mode:-off}"
+}
+
+beta_spec_json_structurally_valid() {
+  local context missing=0
+  if [ "$(context_compression_mode)" != "beta" ]; then
+    return 0
+  fi
+
+  context=$(yaml_field_value "handoff_context" 2>/dev/null || true)
+  if [ -z "$context" ] || [ "$context" = "null" ]; then
+    echo "handoff_context is missing from .comet.yaml" >&2
+    return 1
+  fi
+  if [ ! -s "$context" ]; then
+    echo "spec-context.json is missing or empty: $context" >&2
+    return 1
+  fi
+
+  # Validate required JSON fields
+  grep -q '"change"' "$context" || { echo "spec-context.json missing 'change' field" >&2; return 1; }
+  grep -q '"phase"' "$context" || { echo "spec-context.json missing 'phase' field" >&2; return 1; }
+  grep -q '"mode": "beta"' "$context" || { echo "spec-context.json mode is not beta" >&2; return 1; }
+  grep -q '"files"' "$context" || { echo "spec-context.json missing 'files' field" >&2; return 1; }
+  grep -q '"context_hash"' "$context" || { echo "spec-context.json missing 'context_hash' field" >&2; return 1; }
+
+  # Verify all source files are referenced in the JSON
+  handoff_source_files | while IFS= read -r file; do
+    [ -f "$file" ] || continue
+    if ! grep -qF "$file" "$context"; then
+      echo "spec-context.json missing source file reference: $file" >&2
+      exit 2
+    fi
+  done || missing=1
+
+  [ "$missing" -eq 0 ]
+}
+
 design_doc_frontmatter_has() {
   local design_doc="$1"
   local field="$2"
@@ -492,32 +618,55 @@ guard_open() {
 guard_design() {
   echo "=== Guard: design → build ===" >&2
 
-  local design_doc
+  local design_doc workflow
   design_doc=$(yaml_field_value "design_doc" 2>/dev/null || true)
+  workflow=$(yaml_field_value "workflow" 2>/dev/null || true)
 
   check "proposal.md exists" file_nonempty "$CHANGE_DIR/proposal.md"
   check "design.md exists" file_nonempty "$CHANGE_DIR/design.md"
   check "tasks.md exists" file_nonempty "$CHANGE_DIR/tasks.md"
   check "design handoff context exists" design_handoff_context_valid
   check "design handoff markdown is traceable" design_handoff_markdown_traceable
+  if [ "$(context_compression_mode)" = "beta" ]; then
+    check "beta spec-context.json is structurally valid" beta_spec_json_structurally_valid
+  fi
+
+  if [ "$workflow" = "full" ]; then
+    # Full workflow: design_doc is REQUIRED
+    check "design_doc is recorded for full workflow" design_doc_recorded
+  fi
 
   if [ -n "$design_doc" ] && [ "$design_doc" != "null" ]; then
     check "Design Doc ($design_doc) exists" file_nonempty "$design_doc"
     check "Design Doc frontmatter links current change" design_doc_links_current_change
     check "Design Doc declares technical design role" design_doc_declares_technical_role
     check "Design Doc declares OpenSpec as canonical spec" design_doc_declares_canonical_spec
-  else
-    warn "  [WARN] No design_doc recorded in .comet.yaml"
+  elif [ "$workflow" != "full" ]; then
+    warn "  [WARN] No design_doc recorded in .comet.yaml (optional for hotfix/tweak)"
   fi
 }
 
+design_doc_recorded() {
+  local design_doc
+  design_doc=$(yaml_field_value "design_doc" 2>/dev/null || true)
+  if [ -n "$design_doc" ] && [ "$design_doc" != "null" ] && [ -f "$design_doc" ]; then
+    return 0
+  fi
+  echo "design_doc must point to an existing Superpowers Design Doc for full workflow before leaving design." >&2
+  echo "Next: create the Design Doc and run: \"\$COMET_BASH\" \"\$COMET_STATE\" set $CHANGE design_doc <path>" >&2
+  return 1
+}
+
 guard_build() {
   echo "=== Guard: build → verify ===" >&2
 
   check "isolation selected" isolation_selected
   check "build_mode selected" build_mode_selected
   check "build_mode allowed for workflow" build_mode_allowed_for_workflow
+  check "subagent dispatch confirmed" subagent_dispatch_confirmed
+  check "tdd_mode selected" tdd_mode_selected
   check "tasks.md all tasks checked" tasks_all_done
+  check "Superpowers plan all tasks checked" plan_tasks_all_done
   check "proposal.md exists" file_nonempty "$CHANGE_DIR/proposal.md"
   check "Build passes" build_passes
 }
@@ -536,6 +685,7 @@ guard_archive() {
 
   check "archived is true" archived_is_true
   check "proposal.md exists" file_nonempty "$CHANGE_DIR/proposal.md"
+  check "design.md exists" file_nonempty "$CHANGE_DIR/design.md"
   check "tasks.md all tasks checked" tasks_all_done
 }
 
@@ -545,10 +695,10 @@ apply_state_update() {
 
   if [ -f "$state_sh" ]; then
     case "$p" in
-      open)   bash "$state_sh" transition "$CHANGE" open-complete ;;
-      design) bash "$state_sh" transition "$CHANGE" design-complete ;;
-      build)  bash "$state_sh" transition "$CHANGE" build-complete ;;
-      verify) bash "$state_sh" transition "$CHANGE" verify-pass ;;
+      open)   "$COMET_BASH" "$state_sh" transition "$CHANGE" open-complete ;;
+      design) "$COMET_BASH" "$state_sh" transition "$CHANGE" design-complete ;;
+      build)  "$COMET_BASH" "$state_sh" transition "$CHANGE" build-complete ;;
+      verify) "$COMET_BASH" "$state_sh" transition "$CHANGE" verify-pass ;;
     esac
   else
     red "FATAL: comet-state.sh not found; cannot apply state transition"
@@ -558,6 +708,14 @@ apply_state_update() {
 
 # --- Main ---
 
+if [ "${COMET_GUARD_SOURCE_ONLY:-0}" = "1" ]; then
+  return 0 2>/dev/null
+  # shellcheck disable=SC2317  # unreachable if sourced; fallback for direct execution
+  red "ERROR: COMET_GUARD_SOURCE_ONLY=1 is only for sourcing, not direct execution" >&2
+  # shellcheck disable=SC2317
+  exit 1
+fi
+
 case "$PHASE" in
   open)     preflight ; guard_open ;;
   design)   preflight ; guard_design ;;

package/assets/skills/comet/scripts/comet-handoff.sh

@@ -1,11 +1,15 @@
 #!/bin/bash
 # Comet Handoff — creates machine-owned context packages between phases
 # Usage: comet-handoff.sh <change-name> design --write [--full]
+#        comet-handoff.sh <change-name> --hash-only
 
 set -euo pipefail
 
+COMET_BASH="${COMET_BASH:-${BASH:-bash}}"
+
 red() { echo -e "\033[31m$1\033[0m" >&2; }
 green() { echo -e "\033[32m$1\033[0m" >&2; }
+warn() { echo -e "\033[33m$1\033[0m" >&2; }
 
 validate_change_name() {
   local name="$1"
@@ -101,12 +105,14 @@ source_files() {
 }
 
 compute_context_hash() {
-  source_files | while IFS= read -r file; do
+  local hash_input
+  hash_input=$(source_files | while IFS= read -r file; do
     if [ -f "$file" ]; then
       printf 'path:%s\n' "$file"
       printf 'sha256:%s\n' "$(hash_file "$file")"
     fi
-  done | hash_stream
+  done)
+  printf '%s' "$hash_input" | hash_stream
 }
 
 json_escape() {
@@ -194,6 +200,86 @@ write_json_context() {
   } > "$output"
 }
 
+write_spec_projection_for_file() {
+  local file="$1"
+  echo "## $file"
+  echo ""
+  echo "- Source: $file"
+  echo "- Lines: 1-$(file_line_count "$file")"
+  echo "- SHA256: $(hash_file "$file")"
+  echo ""
+  echo '```md'
+  cat "$file"
+  echo '```'
+  echo ""
+}
+
+write_spec_markdown_context() {
+  local output="$1"
+  {
+    echo "# Comet Spec Context"
+    echo ""
+    echo "- Change: $CHANGE"
+    echo "- Phase: design"
+    echo "- Mode: beta"
+    echo "- Context hash: $CONTEXT_HASH"
+    echo ""
+    echo "Generated-by: comet-handoff.sh"
+    echo ""
+    echo "OpenSpec remains the canonical capability spec. This beta context pack verbatim-projects spec files and references supporting artifacts by hash, not an agent-authored summary."
+    echo ""
+    echo "## Source References"
+    echo ""
+    source_files | while IFS= read -r file; do
+      [ -f "$file" ] || continue
+      echo "- Source: $file"
+      echo "- SHA256: $(hash_file "$file")"
+    done
+    echo ""
+    echo "## Acceptance Projection"
+    echo ""
+    if [ -d "$CHANGE_DIR/specs" ]; then
+      find "$CHANGE_DIR/specs" -path '*/spec.md' -type f 2>/dev/null | sort | while IFS= read -r file; do
+        write_spec_projection_for_file "$file"
+      done
+    else
+      echo "No delta spec files found."
+      echo ""
+    fi
+    echo "Full source files remain canonical. If a required heading or scenario is missing here, regenerate the handoff or read the source spec directly. Supporting files (proposal, design, tasks) are referenced by hash only."
+  } > "$output"
+}
+
+write_spec_json_context() {
+  local output="$1"
+  {
+    echo "{"
+    echo "  \"change\": \"$(json_escape "$CHANGE")\","
+    echo "  \"phase\": \"design\","
+    echo "  \"mode\": \"beta\","
+    echo "  \"canonical_spec\": \"openspec\","
+    echo "  \"generated_by\": \"comet-handoff.sh\","
+    echo "  \"context_hash\": \"$CONTEXT_HASH\","
+    echo "  \"files\": ["
+    local first_file=1
+    while IFS= read -r file; do
+      [ -f "$file" ] || continue
+      local role="supporting"
+      case "$file" in
+        */specs/*/spec.md) role="spec" ;;
+      esac
+      if [ "$first_file" -eq 0 ]; then
+        echo ","
+      fi
+      first_file=0
+      printf '    { "path": "%s", "sha256": "%s", "role": "%s" }' "$(json_escape "$file")" "$(hash_file "$file")" "$role"
+    done < <(source_files)
+    echo ""
+    echo "  ]"
+    echo "}"
+  } > "$output"
+}
+
 CHANGE="${1:-}"
 PHASE="${2:-}"
 MODE="${3:-}"
@@ -201,6 +287,25 @@ FULL_FLAG="${4:-}"
 
 validate_change_name "$CHANGE"
 
+# --hash-only: compute and output context hash without generating handoff files
+if [ "${PHASE:-}" = "--hash-only" ]; then
+  CHANGE_DIR="openspec/changes/$CHANGE"
+  if [ ! -d "$CHANGE_DIR" ]; then
+    red "ERROR: change directory not found: $CHANGE_DIR"
+    exit 1
+  fi
+  for required in proposal.md design.md tasks.md; do
+    if [ ! -s "$CHANGE_DIR/$required" ]; then
+      red "ERROR: required file missing or empty: $CHANGE_DIR/$required"
+      exit 1
+    fi
+  done
+  CONTEXT_HASH="$(compute_context_hash)"
+  printf '%s
+' "$CONTEXT_HASH"
+  exit 0
+fi
+
 if [ "$PHASE" != "design" ] || [ "$MODE" != "--write" ]; then
   red "Usage: comet-handoff.sh <change-name> design --write [--full]"
   exit 1
@@ -240,17 +345,41 @@ for required in proposal.md design.md tasks.md; do
 done
 
 HANDOFF_DIR="$CHANGE_DIR/.comet/handoff"
-CONTEXT_JSON="$HANDOFF_DIR/design-context.json"
-CONTEXT_MD="$HANDOFF_DIR/design-context.md"
+CONTEXT_COMPRESSION="$(yaml_field_value context_compression 2>/dev/null || true)"
+CONTEXT_COMPRESSION="${CONTEXT_COMPRESSION:-off}"
+case "$CONTEXT_COMPRESSION" in
+  off)
+    CONTEXT_JSON="$HANDOFF_DIR/design-context.json"
+    CONTEXT_MD="$HANDOFF_DIR/design-context.md"
+    ;;
+  beta)
+    if [ "$HANDOFF_MODE" = "full" ]; then
+      warn "[HANDOFF] --full is ignored in beta mode; spec files are projected verbatim"
+    fi
+    HANDOFF_MODE="beta"
+    CONTEXT_JSON="$HANDOFF_DIR/spec-context.json"
+    CONTEXT_MD="$HANDOFF_DIR/spec-context.md"
+    ;;
+  *)
+    red "ERROR: invalid context_compression: $CONTEXT_COMPRESSION"
+    red "Valid values: off, beta"
+    exit 1
+    ;;
+esac
 mkdir -p "$HANDOFF_DIR"
 
 CONTEXT_HASH="$(compute_context_hash)"
-write_markdown_context "$CONTEXT_MD"
-write_json_context "$CONTEXT_JSON"
+if [ "$CONTEXT_COMPRESSION" = "beta" ]; then
+  write_spec_markdown_context "$CONTEXT_MD"
+  write_spec_json_context "$CONTEXT_JSON"
+else
+  write_markdown_context "$CONTEXT_MD"
+  write_json_context "$CONTEXT_JSON"
+fi
 
 if [ -x "$STATE_SH" ] || [ -f "$STATE_SH" ]; then
-  bash "$STATE_SH" set "$CHANGE" handoff_context "$CONTEXT_JSON" >/dev/null
-  bash "$STATE_SH" set "$CHANGE" handoff_hash "$CONTEXT_HASH" >/dev/null
+  "$COMET_BASH" "$STATE_SH" set "$CHANGE" handoff_context "$CONTEXT_JSON" >/dev/null
+  "$COMET_BASH" "$STATE_SH" set "$CHANGE" handoff_hash "$CONTEXT_HASH" >/dev/null
 else
   red "ERROR: comet-state.sh not found; cannot record handoff fields"
   exit 1