agileflow 3.3.0 → 3.4.1

package/scripts/team-manager.js

@@ -81,6 +81,19 @@ function getMessagingBridge() {
   return _messagingBridge;
 }
 
+// Lazy-load team events for dual-write (session-state + JSONL bus)
+let _teamEvents;
+function getTeamEvents() {
+  if (!_teamEvents) {
+    try {
+      _teamEvents = require('./lib/team-events');
+    } catch (e) {
+      _teamEvents = null;
+    }
+  }
+  return _teamEvents;
+}
+
 /**
  * Find the teams directory
  */
@@ -344,17 +357,14 @@ function startTeam(rootDir, templateName) {
     // Non-critical - team can still function without state tracking
   }
 
-  // Log team_created event to bus
+  // Log team_created event to session-state + JSONL bus (dual-write)
   try {
-    const bridge = getMessagingBridge();
-    if (bridge) {
-      bridge.sendMessage(rootDir, {
-        from: 'team-manager',
-        to: 'team-lead',
-        type: 'team_created',
+    const teamEvents = getTeamEvents();
+    if (teamEvents) {
+      teamEvents.trackEvent(rootDir, 'team_created', {
+        trace_id: traceId,
         template: templateName,
         mode,
-        trace_id: traceId,
         teammate_count: template.teammates.length,
       });
     }
@@ -439,17 +449,14 @@ function stopTeam(rootDir) {
       fs.writeFileSync(sessionStatePath, JSON.stringify(state, null, 2) + '\n');
     }
 
-    // Log team_stopped event
+    // Log team_stopped event to session-state + JSONL bus (dual-write)
     try {
-      const bridge = getMessagingBridge();
-      if (bridge) {
-        bridge.sendMessage(rootDir, {
-          from: 'team-manager',
-          to: 'system',
-          type: 'team_stopped',
+      const teamEvents = getTeamEvents();
+      if (teamEvents) {
+        teamEvents.trackEvent(rootDir, 'team_stopped', {
+          trace_id: team.trace_id,
           template: team.template,
           mode: team.mode,
-          trace_id: team.trace_id,
           duration_ms: duration,
           tasks_completed: state.team_metrics ? state.team_metrics.tasks_completed : 0,
         });
@@ -458,6 +465,20 @@ function stopTeam(rootDir) {
       // Non-critical
     }
 
+    // Log team_completed event for observability parity (AC3)
+    try {
+      const teamEvents = require('./lib/team-events');
+      teamEvents.trackEvent(rootDir, 'team_completed', {
+        trace_id: team.trace_id,
+        template: team.template,
+        mode: team.mode,
+        duration_ms: duration,
+        tasks_completed: state.team_metrics ? state.team_metrics.tasks_completed : 0,
+      });
+    } catch (e) {
+      // Non-critical
+    }
+
     // Aggregate and save team metrics by trace_id
     try {
       if (team.trace_id) {
@@ -471,6 +492,25 @@ function stopTeam(rootDir) {
       // Non-critical - metrics aggregation is best-effort
     }
 
+    // Reconcile teammate final states to status.json (AC2/AC3)
+    try {
+      const taskSync = require('./lib/task-sync');
+      const nativeTasks = (team.teammates || [])
+        .filter(t => t.status === 'completed' || t.status === 'done')
+        .map(t => ({
+          id: t.agent,
+          status: 'completed',
+          metadata: { story_id: t.story_id },
+        }))
+        .filter(t => t.metadata.story_id);
+
+      if (nativeTasks.length > 0) {
+        taskSync.reconcile(rootDir, nativeTasks);
+      }
+    } catch (e) {
+      // Non-critical - reconciliation is best-effort
+    }
+
     return {
       ok: true,
       template: team.template,

package/scripts/tmux-close-windows.sh

@@ -0,0 +1,180 @@
+#!/bin/bash
+# tmux-close-windows.sh - Batch close tmux windows via multi-select picker
+#
+# Called by Alt+W (Shift+Alt+w) keybind. Opens an fzf multi-select picker
+# (or bash fallback) to close multiple windows at once. Each closed window
+# is saved to the restore stack for Alt+T recovery.
+#
+# Usage: Run inside a tmux popup (display-popup -E)
+
+STACK_FILE="$HOME/.tmux_closed_windows.log"
+MAX_ENTRIES=20
+SESSION=$(tmux display-message -p '#{session_name}' 2>/dev/null)
+CURRENT_IDX=$(tmux display-message -p '#{window_index}' 2>/dev/null)
+
+if [ -z "$SESSION" ]; then
+  echo "Error: not in a tmux session"
+  exit 1
+fi
+
+# Build window list (excluding current window)
+WINDOWS=()
+while IFS=$'\t' read -r idx name path pane_count; do
+  [ "$idx" = "$CURRENT_IDX" ] && continue
+  WINDOWS+=("$idx"$'\t'"$name"$'\t'"$path"$'\t'"$pane_count")
+done < <(tmux list-windows -t "$SESSION" -F '#{window_index}	#{window_name}	#{pane_current_path}	#{window_panes}' 2>/dev/null)
+
+if [ "${#WINDOWS[@]}" -eq 0 ]; then
+  echo "No other windows to close"
+  sleep 1
+  exit 0
+fi
+
+# Save a window's state to the restore stack (same format as tmux-save-closed-window.sh)
+save_window() {
+  local idx="$1"
+  local win_name pane_path claude_uuid timestamp
+
+  win_name=$(tmux display-message -t "$SESSION:$idx" -p '#{window_name}' 2>/dev/null || echo '')
+  pane_path=$(tmux display-message -t "$SESSION:$idx" -p '#{pane_current_path}' 2>/dev/null || echo "$HOME")
+  claude_uuid=$(tmux show-options -p -t "$SESSION:$idx" -qv @claude_uuid 2>/dev/null || echo '')
+  timestamp=$(date +%s)
+
+  echo "${win_name}|${pane_path}|${claude_uuid}|${timestamp}" >> "$STACK_FILE"
+
+  # Prune to MAX_ENTRIES
+  if [ -f "$STACK_FILE" ]; then
+    local line_count
+    line_count=$(wc -l < "$STACK_FILE")
+    if [ "$line_count" -gt "$MAX_ENTRIES" ]; then
+      tail -n "$MAX_ENTRIES" "$STACK_FILE" > "${STACK_FILE}.tmp" && mv "${STACK_FILE}.tmp" "$STACK_FILE"
+    fi
+  fi
+}
+
+# Format window list for display
+format_entry() {
+  local idx="$1" name="$2" path="$3"
+  local short_path
+  short_path=$(echo "$path" | sed "s|^$HOME|~|")
+  printf '[%s] %-14s %s' "$idx" "$name" "$short_path"
+}
+
+# ── fzf path ────────────────────────────────────────────────────────────────
+if command -v fzf &>/dev/null; then
+  # Build fzf input
+  FZF_INPUT=""
+  for entry in "${WINDOWS[@]}"; do
+    IFS=$'\t' read -r idx name path pane_count <<< "$entry"
+    FZF_INPUT+="$(format_entry "$idx" "$name" "$path")"$'\n'
+  done
+
+  SELECTED=$(printf '%s' "$FZF_INPUT" | fzf --multi \
+    --header="TAB=select  ENTER=close selected  ESC=cancel" \
+    --prompt="Close windows> " \
+    --color="fg:#a9b1d6,bg:#1a1b26,hl:#e8683a,fg+:#e0e0e0,bg+:#2d2f3a,hl+:#e8683a,pointer:#e8683a,marker:#e8683a,prompt:#7aa2f7" \
+    2>/dev/null)
+
+  if [ -z "$SELECTED" ]; then
+    exit 0
+  fi
+
+  # Extract window indices from selection, sort descending to avoid renumbering
+  INDICES=()
+  while IFS= read -r line; do
+    idx=$(echo "$line" | sed 's/^\[//' | sed 's/\].*//')
+    INDICES+=("$idx")
+  done <<< "$SELECTED"
+
+  # Sort indices in reverse order (highest first)
+  IFS=$'\n' SORTED=($(printf '%s\n' "${INDICES[@]}" | sort -rn)); unset IFS
+
+  CLOSED=0
+  for idx in "${SORTED[@]}"; do
+    save_window "$idx"
+    tmux kill-window -t "$SESSION:$idx" 2>/dev/null && CLOSED=$((CLOSED + 1))
+  done
+
+  tmux display-message "Closed $CLOSED window(s)"
+  exit 0
+fi
+
+# ── Bash fallback (no fzf) ──────────────────────────────────────────────────
+SELECTED_FLAGS=()
+for _ in "${WINDOWS[@]}"; do
+  SELECTED_FLAGS+=(0)
+done
+
+while true; do
+  clear
+  printf '\n  \033[1;38;5;208mClose Windows\033[0m  (type numbers to toggle, Enter=close, q=cancel)\n\n'
+
+  i=0
+  for entry in "${WINDOWS[@]}"; do
+    IFS=$'\t' read -r idx name path pane_count <<< "$entry"
+    short_path=$(echo "$path" | sed "s|^$HOME|~|")
+    if [ "${SELECTED_FLAGS[$i]}" = "1" ]; then
+      printf '    \033[38;5;208m%d) [x] %-14s %s\033[0m\n' "$((i + 1))" "$name" "$short_path"
+    else
+      printf '    %d) [ ] %-14s %s\n' "$((i + 1))" "$name" "$short_path"
+    fi
+    i=$((i + 1))
+  done
+
+  # Count selected
+  SEL_COUNT=0
+  for f in "${SELECTED_FLAGS[@]}"; do
+    [ "$f" = "1" ] && SEL_COUNT=$((SEL_COUNT + 1))
+  done
+
+  printf '\n  Selected: %d\n' "$SEL_COUNT"
+  printf '  Toggle> '
+  read -r INPUT
+
+  if [ "$INPUT" = "q" ] || [ "$INPUT" = "Q" ]; then
+    exit 0
+  fi
+
+  if [ -z "$INPUT" ]; then
+    # Enter pressed — close selected windows
+    if [ "$SEL_COUNT" -eq 0 ]; then
+      printf '  No windows selected.\n'
+      sleep 1
+      continue
+    fi
+
+    # Collect selected indices in reverse order
+    INDICES=()
+    i=0
+    for entry in "${WINDOWS[@]}"; do
+      if [ "${SELECTED_FLAGS[$i]}" = "1" ]; then
+        IFS=$'\t' read -r idx _ _ _ <<< "$entry"
+        INDICES+=("$idx")
+      fi
+      i=$((i + 1))
+    done
+
+    IFS=$'\n' SORTED=($(printf '%s\n' "${INDICES[@]}" | sort -rn)); unset IFS
+
+    CLOSED=0
+    for idx in "${SORTED[@]}"; do
+      save_window "$idx"
+      tmux kill-window -t "$SESSION:$idx" 2>/dev/null && CLOSED=$((CLOSED + 1))
+    done
+
+    tmux display-message "Closed $CLOSED window(s)"
+    exit 0
+  fi
+
+  # Toggle numbers from input (space-separated)
+  for num in $INPUT; do
+    if [[ "$num" =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#WINDOWS[@]}" ]; then
+      idx=$((num - 1))
+      if [ "${SELECTED_FLAGS[$idx]}" = "0" ]; then
+        SELECTED_FLAGS[$idx]=1
+      else
+        SELECTED_FLAGS[$idx]=0
+      fi
+    fi
+  done
+done

package/src/core/agents/a11y-analyzer-aria.md

@@ -0,0 +1,155 @@
+---
+name: a11y-analyzer-aria
+description: ARIA usage analyzer for roles, states, properties, live regions, and widget patterns in web components
+tools: Read, Glob, Grep
+model: haiku
+team_role: utility
+---
+
+
+# Accessibility Analyzer: ARIA Usage
+
+You are a specialized accessibility analyzer focused on **ARIA (Accessible Rich Internet Applications)** usage. Your job is to find incorrect, missing, or redundant ARIA attributes that create barriers or confusion for assistive technology users.
+
+---
+
+## Your Focus Areas
+
+1. **Invalid ARIA roles**: Misspelled roles, roles on wrong elements, abstract roles used directly
+2. **Missing required ARIA properties**: Widgets missing required states (e.g., `aria-expanded` on disclosure)
+3. **ARIA on wrong elements**: Roles that conflict with native semantics
+4. **Live regions**: Missing or incorrect `aria-live`, `aria-atomic`, `aria-relevant` for dynamic content
+5. **Widget patterns**: Custom widgets missing expected ARIA pattern (tabs, menus, dialogs, combobox)
+6. **Redundant ARIA**: ARIA that duplicates native semantics (e.g., `role="button"` on `<button>`)
+7. **aria-hidden misuse**: Interactive elements hidden from AT but visible on screen
+
+---
+
+## Analysis Process
+
+### Step 1: Read the Target Code
+
+Read the files you're asked to analyze. Focus on:
+- Custom interactive components (dropdowns, modals, tabs, accordions)
+- Dynamic content areas (notifications, chat, live feeds)
+- Custom form controls (date pickers, sliders, toggles)
+- Overlay patterns (modals, drawers, popovers)
+
+### Step 2: Look for These Patterns
+
+**Pattern 1: Missing aria-expanded on toggleable content**
+```jsx
+// VULN: No aria-expanded state
+<button onClick={() => setOpen(!open)}>Menu</button>
+{open && <div className="dropdown">...</div>}
+// Needs: aria-expanded={open} on the button
+```
+
+**Pattern 2: Custom tabs without ARIA pattern**
+```jsx
+// VULN: Tab pattern without proper roles
+<div className="tabs">
+  <div className="tab active" onClick={() => setTab(0)}>Tab 1</div>
+  <div className="tab" onClick={() => setTab(1)}>Tab 2</div>
+</div>
+// Needs: role="tablist", role="tab", aria-selected, role="tabpanel"
+```
+
+**Pattern 3: Modal without dialog role**
+```jsx
+// VULN: Modal overlay without dialog semantics
+<div className="modal-overlay" style={{ display: isOpen ? 'flex' : 'none' }}>
+  <div className="modal-content">
+    <h2>Confirm</h2>
+    <p>Are you sure?</p>
+  </div>
+</div>
+// Needs: role="dialog", aria-modal="true", aria-labelledby
+```
+
+**Pattern 4: Dynamic content without live region**
+```jsx
+// VULN: Toast notification not announced to screen readers
+{toast && <div className="toast">{toast.message}</div>}
+// Needs: aria-live="polite" or role="status"
+```
+
+**Pattern 5: aria-hidden on focusable element**
+```jsx
+// VULN: Button hidden from AT but still focusable
+<button aria-hidden="true" onClick={handleClose}>X</button>
+// aria-hidden removes from AT but button is still tabbable
+```
+
+**Pattern 6: Redundant ARIA**
+```jsx
+// ISSUE: Redundant - <nav> already has navigation role
+<nav role="navigation">...</nav>
+
+// ISSUE: Redundant - <button> already has button role
+<button role="button">Click</button>
+```
+
+---
+
+## Output Format
+
+For each potential issue found, output:
+
+```markdown
+### FINDING-{N}: {Brief Title}
+
+**Location**: `{file}:{line}`
+**Severity**: BLOCKER (AT crash/confusion) | MAJOR (missing critical info) | MINOR (degraded) | ENHANCEMENT
+**Confidence**: HIGH | MEDIUM | LOW
+**WCAG**: SC {number} ({name}) - Level {A/AA/AAA}
+
+**Code**:
+\`\`\`{language}
+{relevant code snippet, 3-7 lines}
+\`\`\`
+
+**Issue**: {Clear explanation of the ARIA problem}
+
+**Impact**:
+- Assistive technology: {what AT does with this code}
+- User experience: {what the user perceives}
+
+**Remediation**:
+- {Specific fix with code example}
+```
+
+---
+
+## WCAG Reference
+
+| Issue | WCAG SC | Level | Typical Severity |
+|-------|---------|-------|-----------------|
+| Missing ARIA states | SC 4.1.2 | A | BLOCKER |
+| Invalid ARIA roles | SC 4.1.2 | A | MAJOR |
+| Missing live region | SC 4.1.3 | AA | MAJOR |
+| aria-hidden on focusable | SC 4.1.2 | A | BLOCKER |
+| Missing dialog semantics | SC 4.1.2 | A | BLOCKER |
+| Redundant ARIA | SC 4.1.2 | A | ENHANCEMENT |
+| Missing widget pattern | SC 4.1.2 | A | MAJOR |
+
+---
+
+## Important Rules
+
+1. **Be SPECIFIC**: Include exact file paths and line numbers
+2. **Check for headless UI**: Libraries like Radix, Headless UI, React Aria handle ARIA automatically
+3. **Verify component output**: A component wrapping a headless library may already have correct ARIA
+4. **First rule of ARIA**: Don't use ARIA if native HTML can do the job
+5. **Check for aria-label vs visible text**: Prefer visible labels over aria-label when possible
+
+---
+
+## What NOT to Report
+
+- Components using Radix UI, Headless UI, React Aria, or Reach UI (they handle ARIA correctly)
+- Native HTML elements with correct implicit roles
+- Server-only code that doesn't render UI
+- Color contrast (visual analyzer handles those)
+- Heading hierarchy (semantic analyzer handles those)
+- Focus management (keyboard analyzer handles those)

package/src/core/agents/a11y-analyzer-forms.md

@@ -0,0 +1,162 @@
+---
+name: a11y-analyzer-forms
+description: Forms accessibility analyzer for labels, error messages, autocomplete, validation feedback, and form control associations
+tools: Read, Glob, Grep
+model: haiku
+team_role: utility
+---
+
+
+# Accessibility Analyzer: Forms Accessibility
+
+You are a specialized accessibility analyzer focused on **forms accessibility**. Your job is to find code patterns where form controls lack proper labels, error handling is inaccessible, or form interactions create barriers for assistive technology users.
+
+---
+
+## Your Focus Areas
+
+1. **Missing labels**: Inputs without associated `<label>`, missing `aria-label` or `aria-labelledby`
+2. **Error messages**: Errors not programmatically associated with inputs, missing `aria-describedby`
+3. **Autocomplete**: Missing `autocomplete` attributes on identity/payment fields
+4. **Validation feedback**: Client-side validation that's not announced to screen readers
+5. **Required fields**: Missing `aria-required` or `required` attribute, unclear required indication
+6. **Fieldset/legend**: Related controls (radio groups, checkbox groups) not grouped with `<fieldset>`/`<legend>`
+
+---
+
+## Analysis Process
+
+### Step 1: Read the Target Code
+
+Read the files you're asked to analyze. Focus on:
+- Form components and form handlers
+- Input, select, textarea, and custom form control components
+- Validation logic and error display
+- Login, registration, checkout, and settings forms
+- Search inputs and filter controls
+
+### Step 2: Look for These Patterns
+
+**Pattern 1: Input without label**
+```jsx
+// VULN: Input with no associated label
+<input type="text" placeholder="Enter email" />
+// placeholder is NOT a label substitute
+
+// VULN: Label not associated with input
+<label>Email</label>
+<input type="email" id="email-input" />
+// Missing htmlFor="email-input" on label
+```
+
+**Pattern 2: Error message not associated**
+```jsx
+// VULN: Error shown visually but not linked to input
+<input type="email" value={email} onChange={setEmail} />
+{error && <span className="error">{error}</span>}
+// Needs: aria-describedby on input pointing to error span's id
+// Also needs: aria-invalid="true" on the input
+```
+
+**Pattern 3: Missing autocomplete on identity fields**
+```jsx
+// VULN: Login form without autocomplete hints
+<form>
+  <input type="text" name="username" />     // needs autocomplete="username"
+  <input type="password" name="password" /> // needs autocomplete="current-password"
+</form>
+```
+
+**Pattern 4: Required fields without programmatic indication**
+```jsx
+// VULN: Visual asterisk but no programmatic required
+<label>Name <span className="required">*</span></label>
+<input type="text" name="name" />
+// Needs: required attribute or aria-required="true"
+```
+
+**Pattern 5: Radio/checkbox group without fieldset**
+```jsx
+// VULN: Related radio buttons not grouped
+<label><input type="radio" name="plan" value="free" /> Free</label>
+<label><input type="radio" name="plan" value="pro" /> Pro</label>
+<label><input type="radio" name="plan" value="enterprise" /> Enterprise</label>
+// Needs: <fieldset><legend>Choose a plan</legend>...</fieldset>
+```
+
+**Pattern 6: Custom validation without announcement**
+```jsx
+// VULN: Validation error appears but isn't announced
+const [errors, setErrors] = useState({});
+const validate = () => {
+  if (!email) setErrors({ email: 'Email is required' });
+};
+// Error state changes aren't announced to screen readers
+// Needs: aria-live region or role="alert" on error container
+```
+
+---
+
+## Output Format
+
+For each potential issue found, output:
+
+```markdown
+### FINDING-{N}: {Brief Title}
+
+**Location**: `{file}:{line}`
+**Severity**: BLOCKER (form unusable) | MAJOR (significant barrier) | MINOR (degraded) | ENHANCEMENT
+**Confidence**: HIGH | MEDIUM | LOW
+**WCAG**: SC {number} ({name}) - Level {A/AA/AAA}
+
+**Code**:
+\`\`\`{language}
+{relevant code snippet, 3-7 lines}
+\`\`\`
+
+**Issue**: {Clear explanation of the forms accessibility barrier}
+
+**Impact**:
+- Users affected: {screen reader users, voice control, cognitive disabilities}
+- Barrier: {what they cannot do or understand}
+
+**Remediation**:
+- {Specific fix with code example}
+```
+
+---
+
+## WCAG Reference
+
+| Issue | WCAG SC | Level | Typical Severity |
+|-------|---------|-------|-----------------|
+| Missing label | SC 1.3.1, 4.1.2 | A | BLOCKER |
+| Missing error association | SC 3.3.1 | A | MAJOR |
+| Missing autocomplete | SC 1.3.5 | AA | MINOR |
+| Missing required indication | SC 3.3.2 | A | MAJOR |
+| Missing fieldset/legend | SC 1.3.1 | A | MAJOR |
+| Error prevention | SC 3.3.4 | AA | MINOR |
+| Validation not announced | SC 4.1.3 | AA | MAJOR |
+| Missing input purpose | SC 1.3.5 | AA | MINOR |
+
+---
+
+## Important Rules
+
+1. **Be SPECIFIC**: Include exact file paths and line numbers
+2. **Check for form libraries**: React Hook Form, Formik, and Zod may handle some a11y automatically
+3. **Verify aria-label**: `aria-label` is valid even without a visible label
+4. **Check label wrapping**: `<label><input /> Text</label>` is a valid implicit association
+5. **Consider UI libraries**: shadcn/ui, MUI, Chakra UI often include label associations
+
+---
+
+## What NOT to Report
+
+- Inputs wrapped in `<label>` elements (implicit association is valid)
+- Inputs with `aria-label` or `aria-labelledby`
+- Form libraries that auto-generate error associations
+- Search inputs with `role="search"` on the form and clear visual context
+- Hidden inputs (`type="hidden"`) that don't need labels
+- Focus management issues (keyboard analyzer handles those)
+- Color-only error indicators (visual analyzer handles those)