agent-bober 0.12.0 → 0.15.0

package/dist/utils/git.js

@@ -62,6 +62,56 @@ export async function hasUncommittedChanges(cwd) {
     });
     return stdout.trim().length > 0;
 }
+/**
+ * Add a new git worktree at the given path on a new branch.
+ *
+ * Shells out to: git worktree add <path> -b <branch> [<baseBranch>]
+ * Throws on non-zero exit (a failed worktree-add must surface as an error).
+ */
+export async function addWorktree(projectRoot, worktreePath, branch, baseBranch) {
+    const args = ["worktree", "add", worktreePath, "-b", branch];
+    if (baseBranch)
+        args.push(baseBranch);
+    await execa("git", args, { cwd: projectRoot });
+}
+/**
+ * Remove a git worktree by path.
+ *
+ * Shells out to: git worktree remove [-f] <path>
+ * Uses reject: false so that removing a worktree that no longer exists
+ * does not crash cleanup paths.
+ */
+export async function removeWorktree(projectRoot, worktreePath, force) {
+    const args = ["worktree", "remove"];
+    if (force)
+        args.push("-f");
+    args.push(worktreePath);
+    await execa("git", args, { cwd: projectRoot, reject: false });
+}
+/**
+ * Check whether the working tree is clean (no staged or unstaged changes).
+ *
+ * Returns { clean: true, dirtyFiles: [] } when the tree is clean.
+ * Returns { clean: false, dirtyFiles: [...] } listing each dirty path
+ * (parsed from `git status --porcelain` — columns 0-1 are the XY status
+ * codes, column 2 is a space, then the path starts at column 3).
+ */
+export async function isClean(cwd) {
+    const { stdout } = await execa("git", ["status", "--porcelain"], {
+        cwd,
+        reject: false,
+    });
+    const lines = stdout
+        .split("\n")
+        .map((l) => l.trim())
+        .filter(Boolean);
+    if (lines.length === 0) {
+        return { clean: true, dirtyFiles: [] };
+    }
+    // Porcelain format: "XY path" — strip the leading "XY " (3 chars)
+    const dirtyFiles = lines.map((l) => l.slice(3).trim());
+    return { clean: false, dirtyFiles };
+}
 /**
  * Stash any current changes, run the provided function, then restore.
  *

package/dist/utils/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE;QAC3E,GAAG;KACJ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IAC1D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,OAAe;IAEf,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;QACtE,GAAG;KACJ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAc;IAEd,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,EAC5B,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CACvB,CAAC;IACF,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,KAAc;IAEd,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACnD,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;QAC/D,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,EAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE/C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAE9B,sEAAsE;AAEtE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE;QAC3E,GAAG;KACJ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IAC1D,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,OAAe;IAEf,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;QACtE,GAAG;KACJ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,KAAc;IAEd,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAC5B,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,EAC5B,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CACvB,CAAC;IACF,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,KAAc;IAEd,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;QACnD,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;QAC/D,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,WAAmB,EACnB,YAAoB,EACpB,MAAc,EACd,UAAmB;IAEnB,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,YAAoB,EACpB,KAAe;IAEf,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACxB,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW;IAEX,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE;QAC/D,GAAG;QACH,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,kEAAkE;IAClE,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EACX,EAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE/C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}

package/hooks/hooks.json

@@ -1,9 +1,25 @@
 {
   "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|clear|compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "${CLAUDE_PLUGIN_ROOT:-.}/hooks/session-start",
+            "async": false
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Edit|Write",
-        "command": "echo 'Files modified \u2014 run /bober:eval to verify'"
+        "command": "echo 'Files modified — run /bober:eval to verify'"
+      },
+      {
+        "matcher": "Edit|Write",
+        "command": "node scripts/graph-hook.mjs"
       }
     ]
   }

package/hooks/session-start

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# session-start — SessionStart hook for agent-bober
+# Injects the bober.using-bober bootstrap skill into the model's first-turn context.
+#
+# Structural pattern from obra/superpowers (MIT). https://github.com/obra/superpowers
+
+set -euo pipefail
+
+# Determine project root directory
+PROJECT_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+# Read bober.using-bober skill content
+using_bober_content=$(cat "${PROJECT_ROOT}/skills/bober.using-bober/SKILL.md" 2>&1 || echo "Error reading bober.using-bober skill")
+
+# Escape string for JSON embedding using bash parameter substitution.
+# Each ${s//old/new} is a single C-level pass - orders of magnitude
+# faster than the character-by-character loop this replaces.
+escape_for_json() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    s="${s//\"/\\\"}"
+    s="${s//$'\n'/\\n}"
+    s="${s//$'\r'/\\r}"
+    s="${s//$'\t'/\\t}"
+    printf '%s' "$s"
+}
+
+using_bober_escaped=$(escape_for_json "$using_bober_content")
+session_context="<EXTREMELY_IMPORTANT>\nYou are agent-bober.\n\n**Below is the full content of your 'bober-using-bober' skill - your introduction to using bober skills. For all other skills, use the 'Skill' tool:**\n\n${using_bober_escaped}\n\n</EXTREMELY_IMPORTANT>"
+
+# Output context injection as JSON.
+# Uses printf instead of heredoc to work around bash 5.3+ heredoc hang.
+# See: https://github.com/obra/superpowers/issues/571
+if [ -n "${CURSOR_PLUGIN_ROOT:-}" ]; then
+  printf '{\n  "additional_context": "%s"\n}\n' "$session_context"
+elif [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -z "${COPILOT_CLI:-}" ]; then
+  printf '{\n  "hookSpecificOutput": {\n    "hookEventName": "SessionStart",\n    "additionalContext": "%s"\n  }\n}\n' "$session_context"
+else
+  printf '{\n  "additionalContext": "%s"\n}\n' "$session_context"
+fi
+
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-bober",
-  "version": "0.12.0",
+  "version": "0.15.0",
   "description": "Multi-agent harness for building applications autonomously with any LLM. Researcher, Planner, Curator, Generator, Evaluator pipeline. Supports Claude, GPT, Gemini, Ollama. MCP server for Cursor/Windsurf.",
   "type": "module",
   "main": "dist/index.js",
@@ -57,7 +57,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.39.0",
+    "@anthropic-ai/sdk": "^0.100.1",
     "@modelcontextprotocol/sdk": "^1.28.0",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",
@@ -65,6 +65,7 @@
     "glob": "^11.0.1",
     "ora": "^8.1.1",
     "prompts": "^2.4.2",
+    "semver": "^7.8.1",
     "zod": "^3.24.2"
   },
   "peerDependencies": {
@@ -83,9 +84,11 @@
     "@eslint/js": "^10.0.1",
     "@types/node": "^22.13.0",
     "@types/prompts": "^2.4.9",
+    "@types/semver": "^7.7.1",
     "@typescript-eslint/eslint-plugin": "^8.22.0",
     "@typescript-eslint/parser": "^8.22.0",
     "eslint": "^9.19.0",
+    "markdownlint-cli": "^0.48.0",
     "typescript": "^5.7.3",
     "vitest": "^3.0.5"
   }

package/scripts/check-prereqs.sh

@@ -54,6 +54,18 @@ else
   add_check "{\"name\":\"bober_dir\",\"status\":\"missing\",\"path\":\".bober/\",\"message\":\"No .bober/ directory. Run /bober-plan first.\"}"
 fi
 
+# ── Optional check: tokensave (only if installed) ─────────────────
+if command -v agent-bober &>/dev/null; then
+  ts_json=$(agent-bober graph check-prereq 2>/dev/null || echo '{"ok":false,"reason":"MISSING","hint":"agent-bober graph check-prereq failed"}')
+  # Normalize to the {name,status} shape used by other checks
+  if echo "$ts_json" | grep -q '"ok":true'; then
+    add_check "{\"name\":\"tokensave\",\"status\":\"ok\",\"detail\":$ts_json}"
+  else
+    # Tokensave missing is NOT a hard blocker for any current command — emit info-only
+    CHECKS+=("{\"name\":\"tokensave\",\"status\":\"optional\",\"detail\":$ts_json}")
+  fi
+fi
+
 # ── Command-specific checks ───────────────────────────────────────
 
 case "$COMMAND" in

package/scripts/e2e-graph-smoke.sh

@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+# e2e-graph-smoke.sh — end-to-end smoke test for the tokensave graph integration.
+#
+# Prerequisites:
+#   - tokensave >= 6.0.0-beta.1 installed and on PATH
+#   - npm + node >= 18
+#
+# This script is gated in CI by checking for the tokensave binary.
+# If tokensave is not available, the script exits 0 (skip, not fail).
+#
+# Usage:
+#   bash scripts/e2e-graph-smoke.sh
+#
+# The script:
+#   1. Verifies tokensave is available
+#   2. Builds the project
+#   3. Creates a temp directory with a minimal project
+#   4. Runs agent-bober init (brownfield) to get bober.config.json with graph.enabled=true
+#   5. Runs agent-bober graph init
+#   6. Runs agent-bober graph status — asserts ready=true in JSON output
+#   7. Runs agent-bober onboard — asserts 5 files written
+#   8. Runs agent-bober impact sandboxPath — asserts .bober/graph/impact/sandboxpath.md exists
+#   9. Cleans up
+
+set -euo pipefail
+
+# ── Colors ────────────────────────────────────────────────────────────────────
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+CYAN='\033[0;36m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+info()  { echo -e "${CYAN}[smoke]${NC} $*"; }
+ok()    { echo -e "${GREEN}[OK]${NC} $*"; }
+warn()  { echo -e "${YELLOW}[SKIP]${NC} $*"; }
+fail()  { echo -e "${RED}[FAIL]${NC} $*" >&2; exit 1; }
+
+# ── Gate: tokensave must be available ─────────────────────────────────────────
+if ! command -v tokensave &>/dev/null; then
+  warn "tokensave binary not found — skipping e2e smoke test (install with: brew install aovestdipaperino/tap/tokensave)"
+  exit 0
+fi
+
+TOKENSAVE_VERSION=$(tokensave --version 2>&1 | head -1 || echo "unknown")
+info "tokensave found: ${TOKENSAVE_VERSION}"
+
+# ── Step 1: Build the project ─────────────────────────────────────────────────
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+info "Building agent-bober from ${REPO_ROOT}..."
+cd "${REPO_ROOT}"
+npm run build 2>&1 | tail -5
+ok "Build complete"
+
+# ── Step 2: Create a temp test project ────────────────────────────────────────
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "${TMP_DIR}"' EXIT
+info "Temp project: ${TMP_DIR}"
+
+# Initialise a minimal git repo so agent-bober can detect project root
+cd "${TMP_DIR}"
+git init -q
+git commit --allow-empty -m "init" -q
+
+# Write a minimal bober.config.json with graph.enabled=true
+cat > bober.config.json <<'EOF'
+{
+  "project": { "name": "smoke-test", "mode": "brownfield" },
+  "planner": { "model": "sonnet" },
+  "generator": { "model": "sonnet" },
+  "evaluator": { "strategies": [] },
+  "graph": { "enabled": true, "languageTier": "core" }
+}
+EOF
+
+# Add a minimal TypeScript source file
+mkdir -p src
+cat > src/index.ts <<'EOF'
+export function sandboxPath(root: string, p: string): string {
+  return `${root}/${p}`;
+}
+EOF
+
+# Write a package.json so tokensave knows it is a Node project
+cat > package.json <<'EOF'
+{ "name": "smoke-test", "version": "1.0.0" }
+EOF
+
+ok "Temp project created"
+
+# ── Step 3: Link or use agent-bober ───────────────────────────────────────────
+BOBER_BIN="${REPO_ROOT}/node_modules/.bin/agent-bober"
+if [[ ! -f "${BOBER_BIN}" ]]; then
+  # If running from a global install
+  BOBER_BIN="agent-bober"
+fi
+
+# Use the built binary directly for hermetic execution
+NODE_BIN="node ${REPO_ROOT}/dist/cli/index.js"
+
+run_bober() {
+  ${NODE_BIN} "$@"
+}
+
+# ── Step 4: graph init ────────────────────────────────────────────────────────
+info "Running: agent-bober graph init"
+run_bober graph init
+ok "graph init succeeded"
+
+# ── Step 5: graph status ──────────────────────────────────────────────────────
+info "Running: agent-bober graph status --json"
+STATUS_JSON="$(run_bober graph status --json)"
+info "Status output: ${STATUS_JSON}"
+
+# The graph may not be 'ready' if tokensave hasn't fully indexed in CI,
+# but the command should succeed (exit 0) and produce valid JSON.
+echo "${STATUS_JSON}" | node -e "
+  const d = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
+  if (typeof d.indexedFileCount !== 'number') { console.error('Missing indexedFileCount'); process.exit(1); }
+  if (typeof d.stale !== 'boolean') { console.error('Missing stale'); process.exit(1); }
+  console.log('JSON shape OK');
+" || fail "graph status --json produced invalid JSON"
+
+ok "graph status succeeded"
+
+# ── Step 6: onboard ───────────────────────────────────────────────────────────
+info "Running: agent-bober onboard"
+# onboard requires a live graph engine; run it and check artifacts
+run_bober onboard || warn "onboard exited non-zero (graph may not be fully ready)"
+
+ONBOARD_DIR="${TMP_DIR}/.bober/onboarding"
+if [[ -d "${ONBOARD_DIR}" ]]; then
+  ARTIFACT_COUNT="$(ls "${ONBOARD_DIR}"/*.md 2>/dev/null | wc -l | tr -d ' ')"
+  if [[ "${ARTIFACT_COUNT}" -eq 5 ]]; then
+    ok "onboard wrote 5 artifacts"
+  else
+    warn "onboard wrote ${ARTIFACT_COUNT}/5 artifacts (graph may be warming up)"
+  fi
+else
+  warn "onboard directory not created (graph engine may not be ready)"
+fi
+
+# ── Step 7: impact ────────────────────────────────────────────────────────────
+info "Running: agent-bober impact sandboxPath"
+run_bober impact sandboxPath || warn "impact exited non-zero (graph may not be fully ready)"
+
+IMPACT_FILE="${TMP_DIR}/.bober/graph/impact/sandboxpath.md"
+if [[ -f "${IMPACT_FILE}" ]]; then
+  ok "impact report written: .bober/graph/impact/sandboxpath.md"
+  # Verify required sections
+  if grep -q "^# Impact: sandboxPath" "${IMPACT_FILE}" && \
+     grep -q "^## Affected symbols" "${IMPACT_FILE}" && \
+     grep -q "^## Tests covering this symbol" "${IMPACT_FILE}"; then
+    ok "impact report has all required sections"
+  else
+    fail "impact report is missing required sections"
+  fi
+else
+  warn "impact file not created (graph engine may not be ready)"
+fi
+
+# ── Done ──────────────────────────────────────────────────────────────────────
+echo ""
+ok "e2e-graph-smoke.sh completed"
+echo ""
+echo "  Temp project:    ${TMP_DIR} (cleaned up)"
+echo "  Tokensave:       ${TOKENSAVE_VERSION}"

package/scripts/graph-hook.mjs

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+/**
+ * PostToolUse hook for Edit|Write tools.
+ *
+ * Claude Code invokes this script after every Edit/Write tool call,
+ * passing tool metadata via stdin (JSON) per the hook contract.
+ *
+ * Contract:
+ *   - Read bober.config.json sync; exit 0 if graph.enabled=false or graph.autoSync=false.
+ *   - Read JSON payload from stdin (Claude Code hook protocol).
+ *   - Extract file paths (tool_input.file_path for Edit/Write).
+ *   - Validate each path is inside the project root (sandboxPath logic mirrored
+ *     from src/orchestrator/tools/handlers.ts:31-45).
+ *   - Append one JSON line to .bober/graph/.hook-queue.jsonl: {ts, tool, paths}.
+ *   - Exit 0 in <50ms. No tokensave invocation here.
+ *
+ * Cross-platform notes:
+ *   - Shebang is present but Windows uses the hooks.json command directly:
+ *     "command": "node scripts/graph-hook.mjs" (NOT a bare path).
+ *   - All path operations use node:path, no shell quoting.
+ *   - Uses fs SYNC calls only (readFileSync, appendFileSync) so the script
+ *     can return as soon as the event loop drains. No promises.
+ */
+
+import { readFileSync, appendFileSync, mkdirSync, existsSync } from "node:fs";
+import { resolve, relative, isAbsolute, dirname } from "node:path";
+
+const PROJECT_ROOT = process.cwd();
+
+// ── Helpers ────────────────────────────────────────────────────────
+
+/**
+ * Mirror of src/orchestrator/tools/handlers.ts:31-45 sandboxPath.
+ * Returns null instead of throwing when the path is outside the sandbox,
+ * so the hook script can silently drop + log an incident rather than crash.
+ */
+function sandboxPath(projectRoot, inputPath) {
+  if (typeof inputPath !== "string" || !inputPath) return null;
+  const abs = isAbsolute(inputPath) ? resolve(inputPath) : resolve(projectRoot, inputPath);
+  const rel = relative(projectRoot, abs);
+  if (rel.startsWith("..") || isAbsolute(rel)) return null;
+  return abs;
+}
+
+function readConfigSync() {
+  for (const candidate of ["bober.config.json", ".bober/config.json"]) {
+    const p = resolve(PROJECT_ROOT, candidate);
+    if (existsSync(p)) {
+      try {
+        return JSON.parse(readFileSync(p, "utf-8"));
+      } catch {
+        return null;
+      }
+    }
+  }
+  return null;
+}
+
+function readStdinSync() {
+  // Read up to 64KB from stdin synchronously via file descriptor 0.
+  try {
+    return readFileSync(0, "utf-8");
+  } catch {
+    return "";
+  }
+}
+
+function appendSandboxDropIncident(file) {
+  // Best-effort; mirrors IncidentLog.append for the "sandbox-drop" variant.
+  try {
+    const incidentsPath = resolve(PROJECT_ROOT, ".bober/graph/incidents.jsonl");
+    mkdirSync(dirname(incidentsPath), { recursive: true });
+    appendFileSync(
+      incidentsPath,
+      JSON.stringify({
+        ts: new Date().toISOString(),
+        event: "sandbox-drop",
+        file,
+        source: "graph-hook",
+      }) + "\n",
+      "utf-8",
+    );
+  } catch {
+    // ignore — never block the tool call
+  }
+}
+
+// ── Main ───────────────────────────────────────────────────────────
+
+function main() {
+  const config = readConfigSync();
+  const graph = config?.graph;
+
+  // Early exit when graph is disabled or autoSync is off.
+  // The hook entry stays registered in hooks.json (per s8-c9) but does nothing.
+  if (!graph || graph.enabled === false) return 0;
+  if (graph.autoSync === false) return 0;
+
+  const raw = readStdinSync();
+  let payload = {};
+  try {
+    payload = raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    // Malformed payload — exit cleanly with a warning; never crash.
+    process.stderr.write("[graph-hook] Warning: malformed stdin payload\n");
+    return 0;
+  }
+
+  // Claude Code hook payload shape:
+  //   { tool_name, tool_input: { file_path?, edits?[{file_path?}] }, ... }
+  const tool = payload.tool_name ?? "unknown";
+  const candidatePaths = [];
+  const ti = payload.tool_input ?? {};
+  if (typeof ti.file_path === "string") candidatePaths.push(ti.file_path);
+  if (Array.isArray(ti.edits)) {
+    for (const e of ti.edits) {
+      if (typeof e?.file_path === "string") candidatePaths.push(e.file_path);
+    }
+  }
+
+  // Sandbox-validate every path. Drop any path outside the project root
+  // with a silent incident log.
+  const validated = [];
+  for (const p of candidatePaths) {
+    const sb = sandboxPath(PROJECT_ROOT, p);
+    if (sb === null) appendSandboxDropIncident(p);
+    else validated.push(sb);
+  }
+  if (validated.length === 0) return 0;
+
+  // Append to IPC queue file. mkdir is defensive.
+  const queueFile = resolve(PROJECT_ROOT, ".bober/graph/.hook-queue.jsonl");
+  try {
+    mkdirSync(dirname(queueFile), { recursive: true });
+    appendFileSync(
+      queueFile,
+      JSON.stringify({
+        ts: new Date().toISOString(),
+        tool,
+        paths: validated,
+      }) + "\n",
+      "utf-8",
+    );
+  } catch {
+    // Best-effort; never block the tool call
+  }
+
+  return 0;
+}
+
+process.exit(main());