@sugar-crash-studios/vibe-forge 0.4.0

package/bin/lib/colors.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+#
+# Vibe Forge - Shared Color Definitions and Logging
+# Source this file in other scripts: source "$SCRIPT_DIR/lib/colors.sh"
+#
+
+# Colors (only if terminal supports them)
+if [[ -t 1 ]]; then
+    RED='\033[0;31m'
+    GREEN='\033[0;32m'
+    YELLOW='\033[1;33m'
+    BLUE='\033[0;34m'
+    CYAN='\033[0;36m'
+    NC='\033[0m'
+else
+    RED=''
+    GREEN=''
+    YELLOW=''
+    BLUE=''
+    CYAN=''
+    NC=''
+fi
+
+# Logging functions
+log_error() {
+    echo -e "${RED}Error: $1${NC}" >&2
+}
+
+log_success() {
+    echo -e "${GREEN}✓ $1${NC}"
+}
+
+log_info() {
+    echo -e "${BLUE}ℹ $1${NC}"
+}
+
+log_warn() {
+    echo -e "${YELLOW}⚠ $1${NC}"
+}
+
+log_header() {
+    echo -e "${YELLOW}$1${NC}"
+    echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+}

package/bin/lib/config.sh

@@ -0,0 +1,347 @@
+#!/usr/bin/env bash
+#
+# Vibe Forge - Configuration Management
+# Source this file in other scripts: source "$SCRIPT_DIR/lib/config.sh"
+#
+# SECURITY: This module provides safe JSON parsing without grep/cut vulnerabilities.
+#
+
+# Ensure colors are loaded for error messages
+if ! type log_error &>/dev/null; then
+    echo "Error: colors.sh must be sourced before config.sh" >&2
+    exit 1
+fi
+
+# =============================================================================
+# Agent Configuration Loading
+# =============================================================================
+
+# load_agents_from_json AGENTS_JSON_FILE
+# Loads agent configuration from JSON file into shell variables.
+# Sets: VALID_AGENTS array, AGENT_ALIASES associative array, AGENT_DISPLAY_NAMES
+#
+# SECURITY: Uses safe JSON parsing via Node.js
+load_agents_from_json() {
+    local agents_file="$1"
+
+    if [[ ! -f "$agents_file" ]]; then
+        return 1
+    fi
+
+    if ! command -v node &>/dev/null; then
+        log_error "Node.js required for agent configuration"
+        return 1
+    fi
+
+    # Derive forge root from agents file location (agents_file is $FORGE_ROOT/config/agents.json)
+    local forge_root
+    forge_root="$(cd "$(dirname "$agents_file")/.." 2>/dev/null && pwd)"
+    local env_file="$forge_root/.forge/agents.env"
+
+    # Regenerate the static env file only when agents.json is newer or cache missing
+    # SECURITY: Writing to a file and sourcing it is auditable; eval of dynamic strings is not
+    if [[ ! -f "$env_file" || "$agents_file" -nt "$env_file" ]]; then
+        mkdir -p "$(dirname "$env_file")"
+
+        # Write header + validated shell assignments to the static cache file
+        # SECURITY: File path passed as argument, not interpolated into the script
+        # SECURITY: Agent names and aliases are validated to prevent shell injection
+        # NOTE: We output direct assignments (not declare -A) since arrays are pre-declared globally
+        {
+            printf '# AUTO-GENERATED by load_agents_from_json() -- DO NOT EDIT\n'
+            printf '# Source: config/agents.json\n'
+            printf '# Regenerated automatically when agents.json is newer than this file\n'
+            node -e '
+                const fs = require("fs");
+                const file = process.argv[1];
+
+                // SECURITY: Validate identifier contains only safe characters
+                // Allows: lowercase letters, numbers, underscore, hyphen
+                function isValidIdentifier(name) {
+                    return /^[a-z0-9_-]+$/.test(name);
+                }
+
+                // SECURITY: Escape string for safe use in shell double-quoted string
+                // Escapes: $, `, ", \, newlines
+                function escapeForShell(str) {
+                    if (typeof str !== "string") return "";
+                    return str
+                        .replace(/\\/g, "\\\\")
+                        .replace(/"/g, "\\\"")
+                        .replace(/\$/g, "\\$")
+                        .replace(/`/g, "\\`")
+                        .replace(/\n/g, "\\n")
+                        .replace(/\r/g, "");
+                }
+
+                try {
+                    const data = JSON.parse(fs.readFileSync(file, "utf8"));
+                    const agents = data.agents || {};
+
+                    // SECURITY: Validate all agent names before processing
+                    for (const name of Object.keys(agents)) {
+                        if (!isValidIdentifier(name)) {
+                            console.error("SECURITY ERROR: Invalid agent name: " + name);
+                            console.error("Agent names must contain only: a-z, 0-9, underscore, hyphen");
+                            process.exit(1);
+                        }
+                        // Also validate aliases
+                        const info = agents[name];
+                        if (info.aliases) {
+                            for (const alias of info.aliases) {
+                                if (!isValidIdentifier(alias)) {
+                                    console.error("SECURITY ERROR: Invalid alias: " + alias);
+                                    console.error("Aliases must contain only: a-z, 0-9, underscore, hyphen");
+                                    process.exit(1);
+                                }
+                            }
+                        }
+                    }
+
+                    // Output VALID_AGENTS array (names validated above)
+                    const validAgents = Object.keys(agents);
+                    console.log("VALID_AGENTS=(" + validAgents.map(a => `"${a}"`).join(" ") + ")");
+
+                    // Output AGENT_ALIASES assignments (array already declared globally)
+                    for (const [canonical, info] of Object.entries(agents)) {
+                        // Add self-mapping
+                        console.log(`AGENT_ALIASES["${canonical}"]="${canonical}"`);
+                        // Add aliases (validated above)
+                        if (info.aliases) {
+                            for (const alias of info.aliases) {
+                                console.log(`AGENT_ALIASES["${alias}"]="${canonical}"`);
+                            }
+                        }
+                    }
+
+                    // Output AGENT_DISPLAY_NAMES assignments
+                    // SECURITY: Display names are escaped since they come from user input
+                    for (const [canonical, info] of Object.entries(agents)) {
+                        const displayName = escapeForShell(info.name || canonical);
+                        console.log(`AGENT_DISPLAY_NAMES["${canonical}"]="${displayName}"`);
+                    }
+
+                    // Output AGENT_ROLES assignments
+                    for (const [canonical, info] of Object.entries(agents)) {
+                        const role = escapeForShell(info.role || "");
+                        console.log(`AGENT_ROLES["${canonical}"]="${role}"`);
+                    }
+
+                    // Output AGENT_PERSONALITY_FILES assignments
+                    for (const [canonical, info] of Object.entries(agents)) {
+                        const pfile = escapeForShell(info.personality_file || "");
+                        console.log(`AGENT_PERSONALITY_FILES["${canonical}"]="${pfile}"`);
+                    }
+
+                    // Output AGENT_ICONS assignments
+                    for (const [canonical, info] of Object.entries(agents)) {
+                        const icon = escapeForShell(info.icon || "");
+                        console.log(`AGENT_ICONS["${canonical}"]="${icon}"`);
+                    }
+
+                    // Output AGENT_TAB_COLORS assignments
+                    for (const [canonical, info] of Object.entries(agents)) {
+                        const tabColor = escapeForShell(info.tab_color || "");
+                        console.log(`AGENT_TAB_COLORS["${canonical}"]="${tabColor}"`);
+                    }
+
+                } catch (e) {
+                    console.error("Error parsing agents.json:", e.message);
+                    process.exit(1);
+                }
+            ' -- "$agents_file" 2>/dev/null
+        } > "$env_file" || { rm -f "$env_file"; return 1; }
+    fi
+
+    # Source the static cache file instead of eval-ing dynamic Node.js output
+    # SECURITY: Auditable static file; Node.js only runs when agents.json changes
+    # shellcheck source=/dev/null
+    if ! source "$env_file"; then
+        # Corrupted or invalid cache file — remove it so it regenerates on next call
+        rm -f "$env_file"
+        return 1
+    fi
+
+    # Mark as loaded
+    AGENTS_LOADED="true"
+    return 0
+}
+
+# json_get_string FILE KEY
+# Safely extracts a string value from a JSON file.
+# Uses node.js for safe parsing (available since we require Node 16+)
+#
+# SECURITY: This avoids grep/cut vulnerabilities by using proper JSON parsing.
+# SECURITY: File and key are passed as command-line arguments, not interpolated.
+json_get_string() {
+    local file="$1"
+    local key="$2"
+
+    if [[ ! -f "$file" ]]; then
+        return 1
+    fi
+
+    # Use Node.js for safe JSON parsing
+    # SECURITY: Pass file and key as arguments to avoid injection
+    if command -v node &>/dev/null; then
+        node -e '
+            const fs = require("fs");
+            const file = process.argv[1];
+            const key = process.argv[2];
+            try {
+                const data = JSON.parse(fs.readFileSync(file, "utf8"));
+                const value = data[key];
+                if (value !== undefined && value !== null) {
+                    console.log(String(value));
+                }
+            } catch (e) {
+                process.exit(1);
+            }
+        ' -- "$file" "$key" 2>/dev/null
+        return $?
+    fi
+
+    # Fallback: Use Python if available
+    # SECURITY: Pass file and key as arguments to avoid injection
+    if command -v python3 &>/dev/null; then
+        python3 -c '
+import json, sys
+try:
+    file_path = sys.argv[1]
+    key = sys.argv[2]
+    with open(file_path) as f:
+        data = json.load(f)
+    value = data.get(key)
+    if value is not None:
+        print(str(value))
+except:
+    sys.exit(1)
+' "$file" "$key" 2>/dev/null
+        return $?
+    fi
+
+    # No safe parser available - exit with error
+    log_error "No JSON parser available. Install Node.js or Python 3."
+    return 1
+}
+
+# load_forge_config CONFIG_FILE
+# Loads configuration from the forge config file into environment variables.
+# Sets: PLATFORM, GIT_BASH_PATH, TERMINAL_TYPE, FORGE_VALIDATED
+#
+# Returns: 0 on success, 1 on failure
+load_forge_config() {
+    local config_file="$1"
+
+    if [[ ! -f "$config_file" ]]; then
+        log_error "Vibe Forge not initialized."
+        echo "Run 'forge init' first." >&2
+        return 1
+    fi
+
+    # Load config values safely
+    PLATFORM=$(json_get_string "$config_file" "platform") || PLATFORM=""
+    GIT_BASH_PATH=$(json_get_string "$config_file" "git_bash_path") || GIT_BASH_PATH=""
+    TERMINAL_TYPE=$(json_get_string "$config_file" "terminal_type") || TERMINAL_TYPE="manual"
+    FORGE_VALIDATED=$(json_get_string "$config_file" "validated") || FORGE_VALIDATED="false"
+
+    # Validate required fields
+    if [[ -z "$PLATFORM" ]]; then
+        log_error "Invalid config: missing platform"
+        return 1
+    fi
+
+    return 0
+}
+
+# setup_windows_env
+# Sets up Windows-specific environment variables and PATH.
+# Call this after load_forge_config on Windows.
+setup_windows_env() {
+    if [[ "$PLATFORM" != "windows" ]]; then
+        return 0
+    fi
+
+    # Export Git Bash path for Claude Code
+    if [[ -n "$GIT_BASH_PATH" ]]; then
+        # Convert forward slashes to backslashes for Windows
+        local git_bash_win="${GIT_BASH_PATH//\//\\}"
+        export CLAUDE_CODE_GIT_BASH_PATH="$git_bash_win"
+    fi
+
+    # Add npm global path if not already in PATH
+    local npm_path=""
+
+    # Try with USER variable
+    if [[ -n "$USER" ]]; then
+        npm_path="/c/Users/$USER/AppData/Roaming/npm"
+    fi
+
+    # Try with USERPROFILE
+    if [[ -z "$npm_path" || ! -d "$npm_path" ]] && [[ -n "$USERPROFILE" ]]; then
+        npm_path="${USERPROFILE//\\//}/AppData/Roaming/npm"
+    fi
+
+    # Add to PATH if exists and not already there
+    if [[ -n "$npm_path" && -d "$npm_path" && ":$PATH:" != *":$npm_path:"* ]]; then
+        export PATH="$npm_path:$PATH"
+    fi
+}
+
+# require_forge_config FORGE_ROOT
+# Loads config and exits with error if not initialized.
+# Also applies local overrides from .forge/config.local.json if present.
+# config.local.json is gitignored and safe for per-developer settings
+# (e.g. custom terminal path, personal daemon preferences).
+require_forge_config() {
+    local forge_root="$1"
+    local config_file="$forge_root/.forge/config.json"
+    local local_config_file="$forge_root/.forge/config.local.json"
+
+    load_forge_config "$config_file" || exit 1
+
+    # Apply local overrides if present (not committed, per-developer)
+    if [[ -f "$local_config_file" ]]; then
+        local local_terminal local_git_bash local_daemon local_loop
+        local_terminal=$(json_get_string "$local_config_file" "terminal_type") && TERMINAL_TYPE="$local_terminal"
+        local_git_bash=$(json_get_string "$local_config_file" "git_bash_path") && GIT_BASH_PATH="$local_git_bash"
+        local_daemon=$(json_get_string "$local_config_file" "daemon_enabled") && DAEMON_ENABLED="$local_daemon"
+        local_loop=$(json_get_string "$local_config_file" "worker_loop_enabled") && WORKER_LOOP_ENABLED="$local_loop"
+    fi
+
+    setup_windows_env
+}
+
+# write_json_config FILE KEY VALUE
+# Safely writes/updates a key in a JSON config file.
+# Creates file if it doesn't exist.
+#
+# SECURITY: File, key, and value are passed as command-line arguments, not interpolated.
+write_json_config() {
+    local file="$1"
+    local key="$2"
+    local value="$3"
+
+    # Use Node.js for safe JSON manipulation
+    # SECURITY: Pass all values as arguments to avoid injection
+    if command -v node &>/dev/null; then
+        node -e '
+            const fs = require("fs");
+            const file = process.argv[1];
+            const key = process.argv[2];
+            const value = process.argv[3];
+            let data = {};
+            try {
+                if (fs.existsSync(file)) {
+                    data = JSON.parse(fs.readFileSync(file, "utf8"));
+                }
+            } catch (e) {}
+            data[key] = value;
+            fs.writeFileSync(file, JSON.stringify(data, null, 2) + "\n");
+        ' -- "$file" "$key" "$value" 2>/dev/null
+        return $?
+    fi
+
+    log_error "Node.js required for config writing"
+    return 1
+}

package/bin/lib/constants.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+#
+# Vibe Forge - Shared Constants
+# Source this file in other scripts: source "$SCRIPT_DIR/lib/constants.sh"
+#
+# NOTE: Agent configuration should be loaded from config/agents.json via
+# load_agents_from_json() in config.sh. The hardcoded values below are
+# fallback defaults for when JSON loading is not possible (e.g., tests).
+#
+
+# =============================================================================
+# Exit Codes
+# =============================================================================
+# Standardized exit codes for consistent error handling across scripts
+# Based on BSD sysexits.h conventions with project-specific additions
+
+EXIT_SUCCESS=0               # Successful execution
+EXIT_GENERAL_ERROR=1         # Generic/unspecified error
+EXIT_CONFIG_ERROR=2          # Configuration file missing/invalid
+EXIT_DEPENDENCY_MISSING=3    # Required dependency not found (Claude Code, Git Bash, etc.)
+EXIT_INVALID_ARGUMENT=4      # Invalid argument (unknown agent, unknown command)
+EXIT_RUNTIME_ERROR=5         # Runtime error (daemon conflict, spawn failed, etc.)
+
+# Timing
+POLL_INTERVAL=2              # seconds between daemon task checks
+NOTIFICATION_DEBOUNCE=1      # seconds to avoid notification spam
+
+# Daemon Configuration
+MAX_LOG_SIZE=1048576         # 1MB - log rotation threshold
+MAX_NOTIFY_ENTRIES=1000      # Maximum notification log entries before trimming
+STALE_STATUS_THRESHOLD=300   # 5 minutes - when worker status is considered stale
+MAINTENANCE_INTERVAL=100     # Daemon iterations between maintenance runs
+STALE_CLEANUP_MINUTES=30     # Remove agent status older than this (minutes)
+HISTORY_PRUNE_DAYS=7         # Remove status history older than this (days)
+
+# Directory structure (relative to FORGE_ROOT)
+CONFIG_DIR=".forge"
+TASKS_DIR="tasks"
+TASKS_PENDING="$TASKS_DIR/pending"
+TASKS_IN_PROGRESS="$TASKS_DIR/in-progress"
+TASKS_COMPLETED="$TASKS_DIR/completed"
+TASKS_REVIEW="$TASKS_DIR/review"
+TASKS_APPROVED="$TASKS_DIR/approved"
+TASKS_NEEDS_CHANGES="$TASKS_DIR/needs-changes"
+TASKS_MERGED="$TASKS_DIR/merged"
+TASKS_ATTENTION="$TASKS_DIR/attention"
+CONTEXT_DIR="context"
+AGENT_STATUS_DIR="$CONTEXT_DIR/agent-status"
+AGENTS_DIR="agents"
+
+# Config files
+AGENTS_CONFIG="config/agents.json"
+
+# =============================================================================
+# Agent Configuration (Fallback Defaults)
+# =============================================================================
+# These values are overwritten when load_agents_from_json() is called.
+# They exist as fallback for contexts where JSON loading isn't available.
+
+# Flag to track if agents were loaded from JSON
+AGENTS_LOADED="${AGENTS_LOADED:-false}"
+
+# Valid agent names (whitelist for security)
+# These are the ONLY valid canonical agent names
+# NOTE: Must stay in sync with config/agents.json (which is the source of truth)
+# Last sync: 2026-04-03 (added loki, renamed sentinel→temper)
+VALID_AGENTS=(
+    "hub"
+    "temper"
+    "anvil"
+    "furnace"
+    "crucible"
+    "scribe"
+    "herald"
+    "ember"
+    "aegis"
+    "architect"
+    "pixel"
+    "oracle"
+    "loki"
+)
+
+# Agent aliases map (for resolve_agent)
+# Format: alias=canonical
+# NOTE: Must stay in sync with config/agents.json (which is the source of truth)
+declare -A AGENT_ALIASES=(
+    # Hub aliases (Chief Orchestrator)
+    ["hub"]="hub"
+    ["planning"]="hub"
+    ["master"]="hub"
+    ["forge-master"]="hub"
+    # Temper aliases (Code Reviewer)
+    ["temper"]="temper"
+    ["review"]="temper"
+    ["reviewer"]="temper"
+    ["cr"]="temper"
+    # Anvil aliases (Frontend)
+    ["anvil"]="anvil"
+    ["frontend"]="anvil"
+    ["ui"]="anvil"
+    ["fe"]="anvil"
+    # Furnace aliases (Backend)
+    ["furnace"]="furnace"
+    ["backend"]="furnace"
+    ["api"]="furnace"
+    ["be"]="furnace"
+    # Crucible aliases (Testing)
+    ["crucible"]="crucible"
+    ["test"]="crucible"
+    ["testing"]="crucible"
+    ["qa"]="crucible"
+    ["tester"]="crucible"
+    # Scribe aliases (Documentation)
+    ["scribe"]="scribe"
+    ["docs"]="scribe"
+    ["documentation"]="scribe"
+    ["doc"]="scribe"
+    # Herald aliases (Release)
+    ["herald"]="herald"
+    ["release"]="herald"
+    ["deploy"]="herald"
+    ["deployment"]="herald"
+    # Ember aliases (DevOps)
+    ["ember"]="ember"
+    ["devops"]="ember"
+    ["ops"]="ember"
+    ["infra"]="ember"
+    ["infrastructure"]="ember"
+    # Aegis aliases (Security)
+    ["aegis"]="aegis"
+    ["security"]="aegis"
+    ["sec"]="aegis"
+    ["appsec"]="aegis"
+    # Architect aliases (System Design)
+    ["architect"]="architect"
+    ["arch"]="architect"
+    ["sage"]="architect"
+    # Pixel aliases (UX Design)
+    # NOTE: "design" intentionally removed — ambiguous with architect's technical design domain
+    ["pixel"]="pixel"
+    ["ux"]="pixel"
+    ["ui-design"]="pixel"
+    ["user-experience"]="pixel"
+    # Oracle aliases (Product / Requirements)
+    ["oracle"]="oracle"
+    ["product"]="oracle"
+    ["po"]="oracle"
+    ["requirements"]="oracle"
+    ["req"]="oracle"
+    ["analyst"]="oracle"
+    # Loki aliases (Lateral Thinker)
+    ["loki"]="loki"
+    ["trickster"]="loki"
+    ["contrarian"]="loki"
+    ["brainstorm"]="loki"
+)
+
+# Agent display names
+declare -A AGENT_DISPLAY_NAMES=(
+    ["hub"]="Planning Hub"
+    ["temper"]="Temper"
+    ["anvil"]="Anvil"
+    ["furnace"]="Furnace"
+    ["crucible"]="Crucible"
+    ["scribe"]="Scribe"
+    ["herald"]="Herald"
+    ["ember"]="Ember"
+    ["aegis"]="Aegis"
+    ["architect"]="Architect"
+    ["pixel"]="Pixel"
+    ["oracle"]="Oracle"
+    ["loki"]="Loki"
+)
+
+# Agent roles
+declare -A AGENT_ROLES=(
+    ["hub"]="Chief Orchestrator"
+    ["temper"]="Code Reviewer"
+    ["anvil"]="Frontend Developer"
+    ["furnace"]="Backend Developer"
+    ["crucible"]="Tester / QA"
+    ["scribe"]="Documentation Specialist"
+    ["herald"]="Release Manager"
+    ["ember"]="DevOps Engineer"
+    ["aegis"]="Security Specialist"
+    ["architect"]="System Architect"
+    ["pixel"]="UX Designer"
+    ["oracle"]="Product Owner / Requirements Analyst"
+    ["loki"]="Lateral Thinker"
+)
+
+# Agent personality files (relative to FORGE_ROOT)
+declare -A AGENT_PERSONALITY_FILES=(
+    ["hub"]="agents/planning-hub/personality.md"
+    ["temper"]="agents/temper/personality.md"
+    ["anvil"]="agents/anvil/personality.md"
+    ["furnace"]="agents/furnace/personality.md"
+    ["crucible"]="agents/crucible/personality.md"
+    ["scribe"]="agents/scribe/personality.md"
+    ["herald"]="agents/herald/personality.md"
+    ["ember"]="agents/ember/personality.md"
+    ["aegis"]="agents/aegis/personality.md"
+    ["architect"]="agents/architect/personality.md"
+    ["pixel"]="agents/pixel/personality.md"
+    ["oracle"]="agents/oracle/personality.md"
+    ["loki"]="agents/loki/personality.md"
+)
+
+# Agent icons
+declare -A AGENT_ICONS=(
+    ["hub"]="⚒️"
+    ["temper"]="⚖️"
+    ["anvil"]="🔨"
+    ["furnace"]="🔥"
+    ["crucible"]="🧪"
+    ["scribe"]="📜"
+    ["herald"]="📯"
+    ["ember"]="⚙️"
+    ["aegis"]="🔒"
+    ["architect"]="🏛️"
+    ["pixel"]="🎨"
+    ["oracle"]="🔮"
+    ["loki"]="🎭"
+)
+
+# Agent tab colors for Windows Terminal (hex format)
+declare -A AGENT_TAB_COLORS=(
+    ["hub"]="#FF6B35"
+    ["temper"]="#8B5CF6"
+    ["anvil"]="#3B82F6"
+    ["furnace"]="#EF4444"
+    ["crucible"]="#10B981"
+    ["scribe"]="#F59E0B"
+    ["herald"]="#EC4899"
+    ["ember"]="#F97316"
+    ["aegis"]="#06B6D4"
+    ["architect"]="#6366F1"
+    ["pixel"]="#D946EF"
+    ["oracle"]="#FBBF24"
+    ["loki"]="#7C3AED"
+)