agentic-loop 3.19.0 → 3.21.0

package/.claude/commands/tour.md

@@ -271,26 +271,30 @@ Edit `.ralph/config.json` if anything needs adjusting."
 ### 2g. Test Credentials (Optional)
 
 ```bash
-cat .ralph/config.json | jq -r '.auth.testUser // empty'
+grep -q "^RALPH_TEST_USER=" .env 2>/dev/null && echo "configured" || echo "not set"
 ```
 
-**If empty**, use AskUserQuestion:
+**If not set**, use AskUserQuestion:
 - **Question:** "Add test credentials? Ralph needs these for authenticated endpoints."
 - **Header:** "Test auth"
 - **Options:**
   - **Yes** - "I'll ask for email and password"
-  - **Skip** - "Edit .ralph/config.json later"
+  - **Skip** - "Add to .env later"
 
 If "Yes":
 - Ask for email, then password
-- Update config:
+- Save to `.env` (gitignored — never committed):
   ```bash
-  jq --arg u "$EMAIL" --arg p "$PASSWORD" '.auth.testUser = $u | .auth.testPassword = $p' .ralph/config.json > .ralph/config.tmp && mv .ralph/config.tmp .ralph/config.json
+  touch .env
+  echo "" >> .env
+  echo "# Test credentials for browser automation" >> .env
+  printf 'RALPH_TEST_USER=%s\n' "$EMAIL" >> .env
+  printf 'RALPH_TEST_PASSWORD=%s\n' "$PASSWORD" >> .env
   ```
-- Say: "✓ Test credentials saved"
+- Say: "Credentials saved to .env (gitignored — never committed to git)"
 
 If "Skip":
-- Say: "No problem! Add credentials to `.ralph/config.json` when needed."
+- Say: "No problem! Add `RALPH_TEST_USER` and `RALPH_TEST_PASSWORD` to `.env` when needed."
 
 **If already set:**
 - Say: "✓ Test credentials configured"

package/.claude/commands/vibe-help.md

@@ -12,7 +12,8 @@ Print this cheatsheet for the user. Do not add any commentary or explanation.
 
 ```
 /idea [feature]          brainstorm & generate PRD
-npx ralph run            autonomous coding loop
+npx ralph run            autonomous coding loop (live activity feed)
+npx ralph run --quiet    same, but suppress activity feed
 npx ralph status         check progress
 npx ralph stop           stop after current story
 ```
@@ -23,12 +24,14 @@ Run `/vibe-list` to see all commands.
 
 ---
 
-## Quality
+## Quality & Testing
 
 ```
 /vibe-check              audit code quality
 /review                  security-focused review
 npx ralph check          run verification only
+npx ralph uat            team acceptance testing
+npx ralph chaos-agent          adversarial red team testing
 ```
 
 ---

package/.claude/commands/vibe-list.md

@@ -13,6 +13,7 @@ Print this complete reference for the user. Do not add any commentary.
 | Command | Description |
 |---------|-------------|
 | `/idea [feature]` | Brainstorm in plan mode, generate PRD for Ralph |
+| `/setup-review` | Review config against project, fix mismatches |
 | `/sign` | Add a learned pattern for Ralph to remember |
 | `/my-dna` | Set up your personal style preferences |
 | `/vibe-check` | Audit code quality before shipping |
@@ -46,9 +47,10 @@ Print this complete reference for the user. Do not add any commentary.
 ### Autonomous Loop
 | Command | Description |
 |---------|-------------|
-| `npx ralph run` | Run loop until all stories pass |
+| `npx ralph run` | Run loop until all stories pass (shows live activity feed) |
 | `npx ralph run --max 10` | Limit to N iterations (default: 20) |
 | `npx ralph run --story TASK-001` | Run for specific task only |
+| `npx ralph run --quiet` | Suppress the live activity feed |
 | `npx ralph stop` | Stop after current story completes |
 
 ### Verification
@@ -57,6 +59,17 @@ Print this complete reference for the user. Do not add any commentary.
 | `npx ralph check` | Run all configured checks |
 | `npx ralph verify TASK-001` | Verify a specific task |
 
+### UAT & Chaos Agent
+| Command | Description |
+|---------|-------------|
+| `npx ralph uat` | Team acceptance testing (explore, test, fix) |
+| `npx ralph uat --plan-only` | Generate test plan without executing |
+| `npx ralph uat --focus <id\|cat>` | Run specific test case or category |
+| `npx ralph uat --no-fix` | Write tests but don't fix app bugs |
+| `npx ralph chaos-agent` | Chaos Agent adversarial red team testing |
+| `npx ralph chaos-agent --plan-only` | Generate chaos plan without executing |
+| `npx ralph chaos-agent --no-fix` | Find vulnerabilities without fixing |
+
 ### Signs (Learned Patterns)
 | Command | Description |
 |---------|-------------|
@@ -170,7 +183,9 @@ npx ralph unsign "camelCase"
     "test": "npm test",
     "build": "npm run build"
   },
-  "testUrlBase": "http://localhost:3000",
+  "urls": {
+    "frontend": "http://localhost:3000"
+  },
   "maxSessionSeconds": 600
 }
 ```

package/.claude/skills/prd/SKILL.md

@@ -189,6 +189,23 @@ If validation found dependency issues, reorder stories:
 
 **After reordering, re-run Step 6 validation to confirm the new order works.**
 
+### Step 7b: Assign Batch Numbers
+
+After reordering, assign a `batch` number to every story. Batches group independent stories that could theoretically run in parallel.
+
+1. Stories with no `dependsOn` → **batch 1**
+2. Stories whose deps are ALL in batch N → **batch N+1** (use the highest dep batch)
+3. Within each batch level, check `files.create` and `files.modify` overlap — if two stories share any create/modify files, bump one to the next batch
+4. Add `"batch": N` to every story
+
+**Example:**
+```
+TASK-001: batch 1  (no deps)
+TASK-002: batch 2  (depends on TASK-001, creates RegisterForm)
+TASK-003: batch 2  (depends on TASK-001, modifies src/api/users.ts)
+```
+TASK-002 and TASK-003 are in the same batch because they don't depend on each other and don't share create/modify files.
+
 ### Step 8: Present Final PRD
 
 Open the PRD for review:
@@ -312,10 +329,6 @@ Ralph will work through each story, running tests and committing as it goes."
         "response": {"field": "type"}
       },
 
-      "testUsers": {
-        "admin": {"email": "admin@test.com", "password": "test123"}
-      },
-
       "prerequisites": [
         "Backend server running",
         "Database seeded"
@@ -330,7 +343,8 @@ Ralph will work through each story, running tests and committing as it goes."
         "constraints": ["No Redux"]
       },
 
-      "dependsOn": []
+      "dependsOn": [],
+      "batch": 1
     }
   ]
 }
@@ -372,12 +386,13 @@ Each story is **self-contained** with all the context it needs. No global defaul
 | `contextFiles` | No | Files Claude should read (idea files, styleguides) |
 | `skills` | No | Relevant skills with usage hints |
 | `apiContract` | Backend | Expected request/response format |
-| `testUsers` | No | Test accounts (only for auth stories that need them) |
+| `testUsers` | **Deprecated** | Use `RALPH_TEST_USER` / `RALPH_TEST_PASSWORD` env vars in `.env` instead |
 | `prerequisites` | No | What must be running/ready |
 | `notes` | No | Human guidance for Claude |
 | `scale` | No | small, medium, large |
 | `architecture` | No | Story-specific patterns/constraints |
 | `dependsOn` | No | Story IDs that must complete first |
+| `batch` | Yes | Batch number for parallel grouping (1 = no deps, higher = later) |
 
 ---
 

package/.claude/skills/setup-review/SKILL.md

@@ -0,0 +1,56 @@
+---
+description: Review .ralph/config.json against the actual project and fix mismatches.
+---
+
+# Setup Review
+
+Review `.ralph/config.json` and validate every setting against what actually exists in this project. Fix anything that's wrong.
+
+## What to check
+
+Read `.ralph/config.json`, then check each section against the real project files:
+
+**1. commands.dev** — Does the dev command make sense?
+- Check `package.json` scripts, `pyproject.toml`, `Makefile`, etc.
+- Is the port in `urls.*` / `api.baseUrl` consistent with the dev command?
+
+**2. commands.install** — Matches the actual package manager?
+- `uv.lock` → `uv sync`, `poetry.lock` → `poetry install`, `pnpm-lock.yaml` → `pnpm install`, `yarn.lock` → `yarn install`, `package-lock.json` → `npm install`, `requirements.txt` → `pip install -r requirements.txt`
+
+**3. checks.test / tests.\*** — Does the test runner exist?
+- Check if `tests.directory` exists on disk
+- Check if the test command actually works for this project (pytest, vitest, jest, go test, etc.)
+
+**4. checks.lint** — Is the linter installed?
+- Look for eslint, ruff, golangci-lint, clippy config files
+
+**5. urls.\* / api.baseUrl** — Correct ports?
+- Match ports to the dev command and any framework defaults
+
+**6. paths.\* / tests.directory** — Do these directories exist?
+- Check every path value against the filesystem
+
+**7. playwright.\*** — Is Playwright actually set up?
+- Check if `@playwright/test` is in package.json or playwright is pip-installed
+- Does `playwright.testDir` exist?
+- If Playwright isn't installed, set `playwright.enabled` to `false`
+
+**8. migrations.\*** — Matches the actual migration tool?
+- `prisma/` → prisma, `alembic/` or `alembic.ini` → alembic, `migrations/` + `manage.py` → Django, `priv/repo/migrations` → Ecto
+
+**9. Python projects** — Correct package manager?
+- `uv.lock` exists → commands should use `uv run`
+- `poetry.lock` exists → commands should use `poetry run`
+- Neither → plain `pip` / `python`
+
+## How to fix
+
+Edit `.ralph/config.json` directly to correct any mismatches.
+
+## Output
+
+Print a short summary. For each section, one line:
+- What you checked
+- Whether it was correct or what you changed
+
+Keep it conversational — explain what each setting does in plain language so the user understands their config.

package/.claude/skills/tour/SKILL.md

@@ -271,26 +271,30 @@ Edit `.ralph/config.json` if anything needs adjusting."
 ### 2g. Test Credentials (Optional)
 
 ```bash
-cat .ralph/config.json | jq -r '.auth.testUser // empty'
+grep -q "^RALPH_TEST_USER=" .env 2>/dev/null && echo "configured" || echo "not set"
 ```
 
-**If empty**, use AskUserQuestion:
+**If not set**, use AskUserQuestion:
 - **Question:** "Add test credentials? Ralph needs these for authenticated endpoints."
 - **Header:** "Test auth"
 - **Options:**
   - **Yes** - "I'll ask for email and password"
-  - **Skip** - "Edit .ralph/config.json later"
+  - **Skip** - "Add to .env later"
 
 If "Yes":
 - Ask for email, then password
-- Update config:
+- Save to `.env` (gitignored — never committed):
   ```bash
-  jq --arg u "$EMAIL" --arg p "$PASSWORD" '.auth.testUser = $u | .auth.testPassword = $p' .ralph/config.json > .ralph/config.tmp && mv .ralph/config.tmp .ralph/config.json
+  touch .env
+  echo "" >> .env
+  echo "# Test credentials for browser automation" >> .env
+  printf 'RALPH_TEST_USER=%s\n' "$EMAIL" >> .env
+  printf 'RALPH_TEST_PASSWORD=%s\n' "$PASSWORD" >> .env
   ```
-- Say: "✓ Test credentials saved"
+- Say: "Credentials saved to .env (gitignored — never committed to git)"
 
 If "Skip":
-- Say: "No problem! Add credentials to `.ralph/config.json` when needed."
+- Say: "No problem! Add `RALPH_TEST_USER` and `RALPH_TEST_PASSWORD` to `.env` when needed."
 
 **If already set:**
 - Say: "✓ Test credentials configured"

package/.claude/skills/vibe-help/SKILL.md

@@ -12,7 +12,8 @@ Print this cheatsheet for the user. Do not add any commentary or explanation.
 
 ```
 /idea [feature]          brainstorm & generate PRD
-npx ralph run            autonomous coding loop
+npx ralph run            autonomous coding loop (live activity feed)
+npx ralph run --quiet    same, but suppress activity feed
 npx ralph status         check progress
 npx ralph stop           stop after current story
 ```

package/.claude/skills/vibe-list/SKILL.md

@@ -46,9 +46,10 @@ Print this complete reference for the user. Do not add any commentary.
 ### Autonomous Loop
 | Command | Description |
 |---------|-------------|
-| `npx ralph run` | Run loop until all stories pass |
+| `npx ralph run` | Run loop until all stories pass (shows live activity feed) |
 | `npx ralph run --max 10` | Limit to N iterations (default: 20) |
 | `npx ralph run --story TASK-001` | Run for specific task only |
+| `npx ralph run --quiet` | Suppress the live activity feed |
 | `npx ralph stop` | Stop after current story completes |
 
 ### Verification
@@ -170,7 +171,9 @@ npx ralph unsign "camelCase"
     "test": "npm test",
     "build": "npm run build"
   },
-  "testUrlBase": "http://localhost:3000",
+  "urls": {
+    "frontend": "http://localhost:3000"
+  },
   "maxSessionSeconds": 600
 }
 ```

package/.pre-commit-hooks.yaml

@@ -93,6 +93,14 @@
   types_or: [python, javascript, ts, json, yaml]
   pass_filenames: true
 
+# Signs credential check (blocking - prevents committing credentials in learned patterns)
+- id: check-signs-secrets
+  name: Check signs.json for credentials
+  entry: bash -c 'for f in "$@"; do if grep -qiE "([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}|password[[:space:]]*[:=]|[[:space:]][A-Za-z0-9_]*_?(pass|pwd|token|secret|key|api.?key)[[:space:]]*[:=]|sk-[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{36})" "$f"; then echo "ERROR: $f contains credentials (email, password, token, etc.)"; echo "  Signs are committed to git — use environment variables instead."; exit 1; fi; done' --
+  language: system
+  files: 'signs\.json$'
+  pass_filenames: true
+
 # Quality-only check (non-blocking)
 - id: vibe-check-quality
   name: Vibe Check (quality only)

package/README.md

@@ -71,8 +71,11 @@ claude --dangerously-skip-permissions
 **Terminal 2 - Ralph Loop:**
 ```bash
 npx agentic-loop run         # Execute PRDs autonomously
+npx agentic-loop run --quiet # Same, but suppress activity feed
 ```
 
+Ralph shows a live activity feed as it works — what files it's reading, what code it's writing, and why. Use `--quiet` to suppress it.
+
 > **Tip:** Use two terminals. Plan with Claude in one, run Ralph in the other.
 
 ---
@@ -90,6 +93,7 @@ npx agentic-loop run         # Execute PRDs autonomously
 - [Code Check](docs/CODE-CHECK.md) - Verification pipeline after each story
 - [Customization](docs/CUSTOMIZATION.md) - Personalization and guardrails
 - [How Ralph Works](docs/RALPH.md) - Architecture, config, full reference
+- [UAT & Chaos Agent](docs/UAT.md) - Autonomous acceptance testing and adversarial red teaming
 - [Cheatsheet](docs/CHEATSHEET.md) - All commands at a glance
 - [Hooks Reference](docs/HOOKS.md) - Pre-commit and Claude Code hooks
 - [Loopgram](docs/LOOPGRAM.md) - Telegram bot for mobile idea capture and loop monitoring

package/bin/agentic-loop.sh

@@ -3,6 +3,13 @@
 # agentic-loop - Tools to thrive with agentic coding
 #
 # Main CLI - wraps ralph.sh for the autonomous dev loop.
+#
+# Run options:
+#   run                     Run autonomous loop until all stories pass
+#   run --max <n>           Run with max iterations (default: 20)
+#   run --fast              Skip code review for faster iterations
+#   run --quiet             Suppress the live activity feed
+#   run --story <id>        Run a specific story only
 
 set -euo pipefail
 

package/bin/ralph.sh

@@ -103,6 +103,9 @@ source "$RALPH_LIB/signs.sh"
 source "$RALPH_LIB/test.sh"
 source "$RALPH_LIB/ci.sh"
 
+# Migrate deprecated config fields (e.g., testUrlBase -> urls.frontend)
+_migrate_config
+
 # Run auto-config if config.json was just created
 if [[ "${_ralph_needs_autoconfig:-}" == "true" ]]; then
   echo "Auto-detecting project configuration..." >&2
@@ -131,6 +134,24 @@ main() {
       ralph_prd "$@"
       ;;
     run)
+      # Check if setup has been run (progress.txt is created by setup/init)
+      if [[ ! -f "$RALPH_DIR/progress.txt" ]]; then
+        print_error "Setup hasn't been run yet."
+        echo ""
+        echo "  You need to run setup once before your first loop:"
+        echo ""
+        echo "    npx agentic-loop setup"
+        echo ""
+        echo "  Then review your config with Claude — every project is"
+        echo "  different, so Claude can fine-tune the setup to your needs:"
+        echo ""
+        echo "    claude --dangerously-skip-permissions"
+        echo "    > /setup-review"
+        echo ""
+        echo "  Full walkthrough: docs/GETTING-STARTED.md"
+        echo ""
+        exit 1
+      fi
       # Clear any previous stop signal
       rm -f "$RALPH_DIR/.stop"
       run_loop "$@"
@@ -173,6 +194,14 @@ main() {
     ci)
       ralph_ci "$@"
       ;;
+    uat)
+      source "$RALPH_LIB/uat.sh"
+      run_uat "$@"
+      ;;
+    chaos-agent)
+      source "$RALPH_LIB/uat.sh"
+      run_chaos "$@"
+      ;;
     sign)
       ralph_sign "$@"
       ;;

package/dist/checks/check-signs-secrets.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Check signs.json for credentials (emails, passwords, tokens, API keys)
+ *
+ * Signs are learned patterns saved to .ralph/signs.json and committed to git.
+ * They should never contain credentials — use environment variables instead.
+ */
+import type { Hook } from '../utils/types.js';
+export declare const checkSignsSecrets: Hook;
+//# sourceMappingURL=check-signs-secrets.d.ts.map

package/dist/checks/check-signs-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-signs-secrets.d.ts","sourceRoot":"","sources":["../../src/checks/check-signs-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,IAAI,EAA2B,MAAM,mBAAmB,CAAC;AAoBvE,eAAO,MAAM,iBAAiB,EAAE,IAuC/B,CAAC"}

package/dist/checks/check-signs-secrets.js

@@ -0,0 +1,57 @@
+/**
+ * Check signs.json for credentials (emails, passwords, tokens, API keys)
+ *
+ * Signs are learned patterns saved to .ralph/signs.json and committed to git.
+ * They should never contain credentials — use environment variables instead.
+ */
+const EMAIL_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
+const PASSWORD_PATTERN = /password\s*[:=]/i;
+const TOKEN_PATTERN = /\b[A-Za-z0-9_]*_?(pass|pwd|token|secret|key|api[_.]?key)\s*[:=]/i;
+const AWS_KEY_PATTERN = /AKIA[0-9A-Z]{16}/;
+const OPENAI_KEY_PATTERN = /sk-[a-zA-Z0-9]{20,}/;
+const GITHUB_TOKEN_PATTERN = /ghp_[a-zA-Z0-9]{36}/;
+const STRIPE_KEY_PATTERN = /sk_(live|test)_[0-9a-zA-Z]{24,}/;
+const CREDENTIAL_CHECKS = [
+    { pattern: EMAIL_PATTERN, message: 'Email address in sign — use environment variables', ruleId: 'signs-secrets/email' },
+    { pattern: PASSWORD_PATTERN, message: 'Password reference in sign — use environment variables', ruleId: 'signs-secrets/password' },
+    { pattern: TOKEN_PATTERN, message: 'Token/secret/key reference in sign — use environment variables', ruleId: 'signs-secrets/token' },
+    { pattern: AWS_KEY_PATTERN, message: 'AWS access key in sign — use environment variables', ruleId: 'signs-secrets/aws-key' },
+    { pattern: OPENAI_KEY_PATTERN, message: 'OpenAI API key in sign — use environment variables', ruleId: 'signs-secrets/openai-key' },
+    { pattern: GITHUB_TOKEN_PATTERN, message: 'GitHub token in sign — use environment variables', ruleId: 'signs-secrets/github-token' },
+    { pattern: STRIPE_KEY_PATTERN, message: 'Stripe key in sign — use environment variables', ruleId: 'signs-secrets/stripe-key' },
+];
+export const checkSignsSecrets = {
+    id: 'signs-secrets',
+    name: 'Check Signs for Credentials',
+    description: 'Detect credentials (emails, passwords, tokens) in signs.json',
+    severity: 'error',
+    fileTypes: ['json'],
+    check(context) {
+        // Only check signs.json files
+        if (!context.filePath.endsWith('signs.json')) {
+            return [];
+        }
+        const results = [];
+        const lines = context.content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const lineNum = i + 1;
+            // Only check lines that contain pattern values (the actual sign text)
+            if (!/"pattern"/.test(line)) {
+                continue;
+            }
+            for (const { pattern, message, ruleId } of CREDENTIAL_CHECKS) {
+                if (pattern.test(line)) {
+                    results.push({
+                        line: lineNum,
+                        message,
+                        severity: 'error',
+                        ruleId,
+                    });
+                }
+            }
+        }
+        return results;
+    },
+};
+//# sourceMappingURL=check-signs-secrets.js.map

package/dist/checks/check-signs-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-signs-secrets.js","sourceRoot":"","sources":["../../src/checks/check-signs-secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,aAAa,GAAG,gDAAgD,CAAC;AACvE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAC5C,MAAM,aAAa,GAAG,kEAAkE,CAAC;AACzF,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACnD,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAE7D,MAAM,iBAAiB,GAA2D;IAChF,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mDAAmD,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACvH,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,wDAAwD,EAAE,MAAM,EAAE,wBAAwB,EAAE;IAClI,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,gEAAgE,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACpI,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,oDAAoD,EAAE,MAAM,EAAE,uBAAuB,EAAE;IAC5H,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,oDAAoD,EAAE,MAAM,EAAE,0BAA0B,EAAE;IAClI,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,kDAAkD,EAAE,MAAM,EAAE,4BAA4B,EAAE;IACpI,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,gDAAgD,EAAE,MAAM,EAAE,0BAA0B,EAAE;CAC/H,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAS;IACrC,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,EAAE,OAAO;IACjB,SAAS,EAAE,CAAC,MAAM,CAAC;IAEnB,KAAK,CAAC,OAAoB;QACxB,8BAA8B;QAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtB,sEAAsE;YACtE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,KAAK,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;gBAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,OAAO,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,OAAO;wBACb,OAAO;wBACP,QAAQ,EAAE,OAAO;wBACjB,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC"}

package/dist/checks/index.d.ts

@@ -18,13 +18,10 @@ import { checkSnakeCaseTs } from './check-snake-case-ts.js';
 import { checkUnsafeHtml } from './check-unsafe-html.js';
 import { checkDockerPlatform } from './check-docker-platform.js';
 import { checkHardcodedAiModels } from './check-hardcoded-ai-models.js';
+import { checkSignsSecrets } from './check-signs-secrets.js';
 /** All available hooks */
 export declare const hooks: Hook[];
-/** Get a hook by its ID */
-export declare function getHook(id: string): Hook | undefined;
 /** Get hooks filtered by file extension */
 export declare function getHooksForFile(extension: string): Hook[];
-/** Get all hook IDs */
-export declare function getHookIds(): string[];
-export { checkSecrets, checkHardcodedUrls, checkDebugStatements, checkTodoFixme, checkEmptyCatch, checkDryViolations, checkMagicNumbers, checkFunctionLength, checkCommentedCode, checkDeepNesting, checkConsoleError, checkAnyTypes, checkSnakeCaseTs, checkUnsafeHtml, checkDockerPlatform, checkHardcodedAiModels, };
+export { checkSecrets, checkHardcodedUrls, checkDebugStatements, checkTodoFixme, checkEmptyCatch, checkDryViolations, checkMagicNumbers, checkFunctionLength, checkCommentedCode, checkDeepNesting, checkConsoleError, checkAnyTypes, checkSnakeCaseTs, checkUnsafeHtml, checkDockerPlatform, checkHardcodedAiModels, checkSignsSecrets, };
 //# sourceMappingURL=index.d.ts.map

package/dist/checks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,0BAA0B;AAC1B,eAAO,MAAM,KAAK,EAAE,IAAI,EAwBvB,CAAC;AAEF,2BAA2B;AAC3B,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAEpD;AAED,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,CAEzD;AAED,uBAAuB;AACvB,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAErC;AAED,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,0BAA0B;AAC1B,eAAO,MAAM,KAAK,EAAE,IAAI,EA2BvB,CAAC;AAEF,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,CAEzD;AAED,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,GAClB,CAAC"}

package/dist/checks/index.js

@@ -18,6 +18,7 @@ import { checkSnakeCaseTs } from './check-snake-case-ts.js';
 import { checkUnsafeHtml } from './check-unsafe-html.js';
 import { checkDockerPlatform } from './check-docker-platform.js';
 import { checkHardcodedAiModels } from './check-hardcoded-ai-models.js';
+import { checkSignsSecrets } from './check-signs-secrets.js';
 /** All available hooks */
 export const hooks = [
     // Security (blocking)
@@ -40,18 +41,12 @@ export const hooks = [
     checkDockerPlatform,
     // AI/LLM
     checkHardcodedAiModels,
+    // Signs
+    checkSignsSecrets,
 ];
-/** Get a hook by its ID */
-export function getHook(id) {
-    return hooks.find((hook) => hook.id === id);
-}
 /** Get hooks filtered by file extension */
 export function getHooksForFile(extension) {
     return hooks.filter((hook) => hook.fileTypes.includes(extension));
 }
-/** Get all hook IDs */
-export function getHookIds() {
-    return hooks.map((hook) => hook.id);
-}
-export { checkSecrets, checkHardcodedUrls, checkDebugStatements, checkTodoFixme, checkEmptyCatch, checkDryViolations, checkMagicNumbers, checkFunctionLength, checkCommentedCode, checkDeepNesting, checkConsoleError, checkAnyTypes, checkSnakeCaseTs, checkUnsafeHtml, checkDockerPlatform, checkHardcodedAiModels, };
+export { checkSecrets, checkHardcodedUrls, checkDebugStatements, checkTodoFixme, checkEmptyCatch, checkDryViolations, checkMagicNumbers, checkFunctionLength, checkCommentedCode, checkDeepNesting, checkConsoleError, checkAnyTypes, checkSnakeCaseTs, checkUnsafeHtml, checkDockerPlatform, checkHardcodedAiModels, checkSignsSecrets, };
 //# sourceMappingURL=index.js.map

package/dist/checks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,0BAA0B;AAC1B,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;IAClB,eAAe;IAEf,0BAA0B;IAC1B,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,gBAAgB;IAEhB,iBAAiB;IACjB,mBAAmB;IAEnB,SAAS;IACT,sBAAsB;CACvB,CAAC;AAEF,2BAA2B;AAC3B,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,uBAAuB;AACvB,MAAM,UAAU,UAAU;IACxB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/checks/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,0BAA0B;AAC1B,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;IAClB,eAAe;IAEf,0BAA0B;IAC1B,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,gBAAgB;IAEhB,iBAAiB;IACjB,mBAAmB;IAEnB,SAAS;IACT,sBAAsB;IAEtB,QAAQ;IACR,iBAAiB;CAClB,CAAC;AAEF,2CAA2C;AAC3C,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,GAClB,CAAC"}

package/dist/index.d.ts

@@ -4,6 +4,6 @@
  * Catch common AI-generated code issues before they hit your codebase.
  */
 export type { Hook, HookResult, FileContext, CheckOptions, CheckResult, SummaryResult, Severity, } from './utils/types.js';
-export { hooks, getHook, getHooksForFile, getHookIds, } from './checks/index.js';
+export { hooks, getHooksForFile, } from './checks/index.js';
 export { vibeCheck } from './cli.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,IAAI,EACJ,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,KAAK,EACL,OAAO,EACP,eAAe,EACf,UAAU,GACX,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,IAAI,EACJ,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,KAAK,EACL,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -4,7 +4,7 @@
  * Catch common AI-generated code issues before they hit your codebase.
  */
 // Export hooks
-export { hooks, getHook, getHooksForFile, getHookIds, } from './checks/index.js';
+export { hooks, getHooksForFile, } from './checks/index.js';
 // Export main check function
 export { vibeCheck } from './cli.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,eAAe;AACf,OAAO,EACL,KAAK,EACL,OAAO,EACP,eAAe,EACf,UAAU,GACX,MAAM,mBAAmB,CAAC;AAE3B,6BAA6B;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,eAAe;AACf,OAAO,EACL,KAAK,EACL,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,6BAA6B;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-loop",
-  "version": "3.19.0",
+  "version": "3.21.0",
   "description": "Autonomous AI coding loop - PRD-driven development with Claude Code",
   "author": "Allie Jones <allie@allthrive.ai>",
   "license": "MIT",
@@ -75,6 +75,7 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.32.0",
+    "agentic-loop": "^3.19.0",
     "telegraf": "^4.16.0",
     "tsx": "^4.0.0"
   },