@sienklogic/plan-build-run 2.32.0 → 2.33.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Plan-Build-Run will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.33.0](https://github.com/SienkLogic/plan-build-run/compare/plan-build-run-v2.32.1...plan-build-run-v2.33.0) (2026-02-25)
+
+
+### Features
+
+* **quick-008:** add block mode to checkNonPbrAgent for stronger enforcement ([57b2117](https://github.com/SienkLogic/plan-build-run/commit/57b2117bda206fd88f7bbf4b89895b6feec422eb))
+
+## [2.32.1](https://github.com/SienkLogic/plan-build-run/compare/plan-build-run-v2.32.0...plan-build-run-v2.32.1) (2026-02-24)
+
+
+### Bug Fixes
+
+* **43-02:** use tsx runtime with absolute static path for cross-cwd dashboard launch ([b19d7d5](https://github.com/SienkLogic/plan-build-run/commit/b19d7d5267632eed82760257df7f50592a71f139))
+
 ## [2.32.0](https://github.com/SienkLogic/plan-build-run/compare/plan-build-run-v2.31.0...plan-build-run-v2.32.0) (2026-02-24)
 
 

package/dashboard/src/index.tsx

@@ -1,6 +1,8 @@
 import { serve } from '@hono/node-server';
 import { serveStatic } from '@hono/node-server/serve-static';
 import { Hono } from 'hono';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
 import { compress } from 'hono/compress';
 import { logger } from 'hono/logger';
 import { secureHeaders } from 'hono/secure-headers';
@@ -33,6 +35,10 @@ type Env = {
   };
 };
 
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const publicDir = join(__dirname, '..', 'public');
+
 function createApp(config: ServerConfig) {
   const app = new Hono<Env>();
 
@@ -62,8 +68,8 @@ function createApp(config: ServerConfig) {
     c.header('Vary', 'Accept');
   });
 
-  // Static file serving from public/
-  app.use('*', serveStatic({ root: './public' }));
+  // Static file serving from public/ (absolute path for cross-cwd compatibility)
+  app.use('*', serveStatic({ root: publicDir }));
 
   // Current phase middleware — populates c.var.currentPhase for all routes
   app.use('*', currentPhaseMiddleware);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sienklogic/plan-build-run",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "Plan it, Build it, Run it — structured development workflow for Claude Code",
   "keywords": [
     "claude-code",
@@ -30,7 +30,7 @@
     "test": "jest",
     "lint": "eslint plugins/pbr/scripts/ tests/",
     "validate": "node plugins/pbr/scripts/validate-plugin-structure.js",
-    "dashboard": "node dashboard/bin/cli.js",
+    "dashboard": "npx --prefix dashboard tsx --tsconfig dashboard/tsconfig.json dashboard/bin/cli.js",
     "dashboard:install": "npm install --prefix dashboard"
   },
   "devDependencies": {

package/plugins/copilot-pbr/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pbr",
   "displayName": "Plan-Build-Run",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "Plan-Build-Run — Structured development workflow for GitHub Copilot CLI. Solves context rot through disciplined agent delegation, structured planning, atomic execution, and goal-backward verification.",
   "author": {
     "name": "SienkLogic",

package/plugins/cursor-pbr/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pbr",
   "displayName": "Plan-Build-Run",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "Plan-Build-Run — Structured development workflow for Cursor. Solves context rot through disciplined subagent delegation, structured planning, atomic execution, and goal-backward verification.",
   "author": {
     "name": "SienkLogic",

package/plugins/pbr/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pbr",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "Plan-Build-Run — Structured development workflow for Claude Code. Solves context rot through disciplined subagent delegation, structured planning, atomic execution, and goal-backward verification.",
   "author": {
     "name": "SienkLogic",

package/plugins/pbr/scripts/enforce-pbr-workflow.js

@@ -131,11 +131,11 @@ const AGENT_MAPPING = {
  *   - subagent_type is missing/empty (can't determine type)
  *   - Enforcement level is "off"
  *
- * NOTE: This function NEVER blocks Task() — blocking is too disruptive.
- *       It always returns an advisory (exitCode 0) or null.
+ * In "advisory" mode (default): returns exitCode 0 with additionalContext.
+ * In "block" mode: returns exitCode 2 with decision/reason to hard-block the agent spawn.
  *
  * @param {Object} data - parsed hook input from Claude Code
- * @returns {null|{ exitCode: 0, output: Object }}
+ * @returns {null|{ exitCode: number, output: Object }}
  */
 function checkNonPbrAgent(data) {
   const subagentType = data.tool_input && data.tool_input.subagent_type;
@@ -154,6 +154,22 @@ function checkNonPbrAgent(data) {
   if (config.level === 'off') return null;
 
   const suggestion = AGENT_MAPPING[subagentType] || 'a pbr:* agent (e.g., pbr:researcher, pbr:general, pbr:executor)';
+
+  if (config.level === 'block') {
+    const blockMessage =
+      `PBR workflow violation: spawning generic agent "${subagentType}" is blocked. ` +
+      `Use ${suggestion} instead. ` +
+      'PBR agents are auto-loaded via subagent_type — just change the type, no extra setup needed. ' +
+      'Set workflow.enforce_pbr_skills: "advisory" in config to allow with warnings.';
+
+    logHook('enforce-pbr-workflow', 'PreToolUse', 'block', { agentType: subagentType, suggestion });
+    return {
+      exitCode: 2,
+      output: { decision: 'block', reason: '[pbr] ' + blockMessage }
+    };
+  }
+
+  // advisory (default)
   const message =
     `PBR workflow advisory: spawning generic agent "${subagentType}" without PBR routing. ` +
     `Use ${suggestion} instead to maintain audit logging and workflow context. ` +

package/dashboard/src/app.js

@@ -1,91 +0,0 @@
-import express from 'express';
-import helmet from 'helmet';
-import { join } from 'path';
-import { fileURLToPath } from 'url';
-import { dirname } from 'path';
-import indexRouter from './routes/index.routes.js';
-import pagesRouter from './routes/pages.routes.js';
-import eventsRouter from './routes/events.routes.js';
-import notFoundHandler from './middleware/notFoundHandler.js';
-import errorHandler from './middleware/errorHandler.js';
-import currentPhaseMiddleware from './middleware/current-phase.js';
-import { readFileSync } from 'node:fs';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-export function createApp(config) {
-  const app = express();
-
-  // Security headers via Helmet
-  // CSP allows CDN scripts (HTMX, Pico.css, htmx-ext-sse) and inline styles
-  app.use(helmet({
-    contentSecurityPolicy: {
-      directives: {
-        defaultSrc: ["'self'"],
-        scriptSrc: ["'self'", "https://cdn.jsdelivr.net"],
-        styleSrc: ["'self'", "'unsafe-inline'", "https://cdn.jsdelivr.net"],
-        imgSrc: ["'self'", "data:"],
-        connectSrc: ["'self'"],
-        fontSrc: ["'self'", "https://cdn.jsdelivr.net"]
-      }
-    }
-  }));
-  app.disable('x-powered-by');
-
-  // Store config for access in routes/services
-  app.locals.projectDir = config.projectDir;
-
-  // Read dashboard version from package.json for footer display
-  try {
-    const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf-8'));
-    app.locals.dashboardVersion = pkg.version || '0.0.0';
-  } catch (_e) {
-    app.locals.dashboardVersion = '0.0.0';
-  }
-
-  // View engine setup -- all paths use path.join (cross-platform)
-  app.set('views', join(__dirname, 'views'));
-  app.set('view engine', 'ejs');
-
-  // Built-in middleware
-  app.use(express.json());
-  app.use(express.urlencoded({ extended: false }));
-
-  // Handle common browser auto-requests cleanly (no stack traces in logs)
-  app.get('/favicon.ico', (req, res) => res.status(204).end());
-  app.get('/sw.js', (req, res) => res.status(404).end());
-
-  // Static files
-  app.use(express.static(join(__dirname, '..', 'public')));
-
-  // Auto-set HX-Title on HTMX partial responses so document.title stays current
-  app.use((req, res, next) => {
-    if (req.get('HX-Request') === 'true') {
-      const originalRender = res.render.bind(res);
-      res.render = function(view, options, callback) {
-        if (options && options.title && !res.getHeader('HX-Title')) {
-          res.setHeader('HX-Title', `${options.title} - Plan-Build-Run`);
-        }
-        return originalRender(view, options, callback);
-      };
-    }
-    next();
-  });
-
-  // Current phase middleware (populates res.locals.currentPhase for templates)
-  app.use(currentPhaseMiddleware);
-
-  // Routes
-  app.use('/', indexRouter);
-  app.use('/', pagesRouter);
-  app.use('/api/events', eventsRouter);
-
-  // 404 catch-all (after routes, before error handler)
-  app.use(notFoundHandler);
-
-  // Error handler MUST be registered last
-  app.use(errorHandler);
-
-  return app;
-}

package/dashboard/src/middleware/current-phase.js

@@ -1,25 +0,0 @@
-import { parseStateFile } from '../services/dashboard.service.js';
-
-/**
- * Middleware that reads STATE.md and sets res.locals.currentPhase
- * for use in sidebar and other templates.
- */
-export default async function currentPhaseMiddleware(req, res, next) {
-  try {
-    const state = await parseStateFile(req.app.locals.projectDir);
-    const cp = state.currentPhase;
-    if (cp && cp.id > 0) {
-      res.locals.currentPhase = {
-        number: cp.id,
-        name: cp.name,
-        status: cp.status,
-        nextAction: state.nextAction || null,
-      };
-    } else {
-      res.locals.currentPhase = null;
-    }
-  } catch (_err) {
-    res.locals.currentPhase = null;
-  }
-  next();
-}

package/dashboard/src/middleware/errorHandler.js

@@ -1,62 +0,0 @@
-/**
- * Express error-handling middleware.
- * MUST have exactly 4 parameters for Express to recognize it as an error handler.
- */
-
-function escapeHtml(str) {
-  if (!str) return '';
-  return str
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
-// eslint-disable-next-line no-unused-vars
-export default function errorHandler(err, req, res, next) {
-  // If headers already sent, delegate to Express default handler
-  if (res.headersSent) {
-    return next(err);
-  }
-
-  const isDev = process.env.NODE_ENV !== 'production';
-  const status = err.status || err.statusCode || 500;
-
-  // Logging -- skip stack traces for 404s (they're expected, not bugs)
-  if (status === 404) {
-    console.warn(`404: ${req.originalUrl}`);
-  } else {
-    console.error('Unhandled error:', err.message);
-    if (isDev) {
-      console.error(err.stack);
-    }
-  }
-
-  // Detect HTMX requests
-  const isHtmx = req.get('HX-Request') === 'true';
-
-  // Set Vary header for proper caching
-  res.setHeader('Vary', 'HX-Request');
-
-  // Build template data
-  const templateData = {
-    title: `Error ${status}`,
-    status,
-    message: err.message || 'Internal Server Error',
-    stack: isDev ? err.stack : null,
-    activePage: ''
-  };
-
-  // Render response
-  if (isHtmx) {
-    let html = `<h1>Error ${status}</h1><p>${escapeHtml(templateData.message)}</p>`;
-    if (templateData.stack) {
-      html += `<pre><code>${escapeHtml(templateData.stack)}</code></pre>`;
-    }
-    html += '<p><a href="/">Return to Dashboard</a></p>';
-    return res.status(status).send(html);
-  }
-
-  res.status(status).render('error', templateData);
-}

package/dashboard/src/middleware/notFoundHandler.js

@@ -1,9 +0,0 @@
-/**
- * 404 catch-all handler for routes that don't match any defined route.
- * Must be registered AFTER all route handlers but BEFORE the error handler.
- */
-export default function notFoundHandler(req, res, next) {
-  const err = new Error(`Page not found: ${req.originalUrl}`);
-  err.status = 404;
-  next(err);
-}

package/dashboard/src/routes/events.routes.js

@@ -1,94 +0,0 @@
-import { Router } from 'express';
-import { addClient, removeClient } from '../services/sse.service.js';
-import { tailLogFile } from '../services/log.service.js';
-import { join } from 'node:path';
-
-const router = Router();
-
-/**
- * GET /stream - Server-Sent Events endpoint.
- * Establishes a long-lived SSE connection. Events are pushed by the SSE service
- * when the file watcher detects changes. Heartbeat comments every 30s keep the
- * connection alive.
- */
-router.get('/stream', (req, res) => {
-  // Set SSE headers
-  res.writeHead(200, {
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    'Connection': 'keep-alive',
-    'X-Accel-Buffering': 'no'
-  });
-  res.flushHeaders();
-
-  // Send initial connection confirmation
-  res.write(': connected\n\n');
-
-  // If client reconnected with a lastEventId, send state-recovery event
-  if (req.query.lastEventId) {
-    res.write(`event: state-recovery\ndata: {"action":"refresh"}\nid: ${Date.now()}\n\n`);
-  }
-
-  // Register this client for broadcasts
-  addClient(res);
-
-  // Heartbeat every 30 seconds to keep connection alive
-  const heartbeat = setInterval(() => {
-    res.write(': heartbeat\n\n');
-  }, 30000);
-
-  // Clean up on client disconnect
-  req.on('close', () => {
-    clearInterval(heartbeat);
-    removeClient(res);
-  });
-});
-
-/**
- * GET /logs/stream?file=<filename>
- * SSE endpoint that tails a .planning/logs/<filename> for new JSONL entries.
- * Sends log-entry events to the connected client.
- */
-router.get('/logs/stream', async (req, res) => {
-  const { file } = req.query;
-
-  // Validate filename to prevent path traversal
-  if (!file || !/^[\w.-]+\.jsonl$/.test(file)) {
-    res.status(400).end('Invalid log file parameter');
-    return;
-  }
-
-  const projectDir = req.app.locals.projectDir;
-  const filePath = join(projectDir, '.planning', 'logs', file);
-
-  res.writeHead(200, {
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    'Connection': 'keep-alive',
-    'X-Accel-Buffering': 'no'
-  });
-  res.flushHeaders();
-  res.write(': connected\n\n');
-
-  const sendEntry = (entry) => {
-    try {
-      const id = Date.now();
-      res.write(`event: log-entry\ndata: ${JSON.stringify(entry)}\nid: ${id}\n\n`);
-    } catch {
-      // client disconnected
-    }
-  };
-
-  const cleanup = await tailLogFile(filePath, sendEntry);
-
-  const heartbeat = setInterval(() => {
-    res.write(': heartbeat\n\n');
-  }, 30000);
-
-  req.on('close', () => {
-    clearInterval(heartbeat);
-    cleanup();
-  });
-});
-
-export default router;

package/dashboard/src/routes/index.routes.js

@@ -1,35 +0,0 @@
-import { Router } from 'express';
-import { getHomepage } from '../services/project.service.js';
-import { getDashboardData } from '../services/dashboard.service.js';
-import { listPendingTodos } from '../services/todo.service.js';
-
-const router = Router();
-
-router.get('/', async (req, res) => {
-  const projectDir = req.app.locals.projectDir;
-
-  const [homepageData, dashboardData, pendingTodos] = await Promise.all([
-    getHomepage(projectDir),
-    getDashboardData(projectDir),
-    listPendingTodos(projectDir).catch(() => [])
-  ]);
-
-  const templateData = {
-    ...homepageData,
-    ...dashboardData,
-    pendingTodoCount: pendingTodos.length,
-    activePage: 'dashboard',
-    currentPath: '/',
-    breadcrumbs: []
-  };
-
-  res.setHeader('Vary', 'HX-Request');
-
-  if (req.get('HX-Request') === 'true') {
-    res.render('partials/dashboard-content', templateData);
-  } else {
-    res.render('index', templateData);
-  }
-});
-
-export default router;