agileflow 3.4.2 → 4.0.0-alpha.1

package/scripts/lib/counter.js

@@ -1,103 +0,0 @@
-/**
- * Shared Counter Module
- *
- * Single source of truth for counting AgileFlow components.
- * Used by: sync-counts.js, content-injector.js, installer.js
- */
-
-const fs = require('fs');
-const path = require('path');
-
-/**
- * Count command files in a directory (including subdirectories like session/)
- * @param {string} commandsDir - Path to commands directory
- * @returns {number} Total command count
- */
-function countCommands(commandsDir) {
-  if (!fs.existsSync(commandsDir)) return 0;
-
-  let count = 0;
-  const entries = fs.readdirSync(commandsDir, { withFileTypes: true });
-
-  for (const entry of entries) {
-    if (entry.isFile() && entry.name.endsWith('.md')) {
-      count++;
-    } else if (entry.isDirectory()) {
-      // Count commands in subdirectories (e.g., session/)
-      const subDir = path.join(commandsDir, entry.name);
-      const subFiles = fs.readdirSync(subDir).filter(f => f.endsWith('.md'));
-      count += subFiles.length;
-    }
-  }
-
-  return count;
-}
-
-/**
- * Count agent files in a directory
- * @param {string} agentsDir - Path to agents directory
- * @returns {number} Total agent count
- */
-function countAgents(agentsDir) {
-  if (!fs.existsSync(agentsDir)) return 0;
-  return fs.readdirSync(agentsDir).filter(f => f.endsWith('.md')).length;
-}
-
-/**
- * Count skill directories (each skill has a SKILL.md file)
- * @param {string} skillsDir - Path to skills directory
- * @returns {number} Total skill count
- */
-function countSkills(skillsDir) {
-  if (!fs.existsSync(skillsDir)) return 0;
-
-  let count = 0;
-
-  function scanDir(dir) {
-    const entries = fs.readdirSync(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        const skillFile = path.join(dir, entry.name, 'SKILL.md');
-        if (fs.existsSync(skillFile)) {
-          count++;
-        }
-        // Recurse into subdirectories
-        scanDir(path.join(dir, entry.name));
-      }
-    }
-  }
-
-  scanDir(skillsDir);
-  return count;
-}
-
-/**
- * Get all counts at once from a core directory
- * @param {string} coreDir - Path to core directory containing commands/, agents/, skills/
- * @returns {Object} Counts object { commands, agents, skills }
- */
-function getCounts(coreDir) {
-  return {
-    commands: countCommands(path.join(coreDir, 'commands')),
-    agents: countAgents(path.join(coreDir, 'agents')),
-    skills: countSkills(path.join(coreDir, 'skills')),
-  };
-}
-
-/**
- * Get counts from CLI package source
- * @param {string} cliRoot - Path to packages/cli directory
- * @returns {Object} Counts object { commands, agents, skills }
- */
-function getSourceCounts(cliRoot) {
-  const coreDir = path.join(cliRoot, 'src', 'core');
-  return getCounts(coreDir);
-}
-
-module.exports = {
-  countCommands,
-  countAgents,
-  countSkills,
-  getCounts,
-  getSourceCounts,
-};

package/scripts/lib/damage-control-utils.js

@@ -1,619 +0,0 @@
-/**
- * damage-control-utils.js - Shared utilities for damage-control hooks
- *
- * EXIT CODE SEMANTICS (Claude Code Hook Protocol):
- * ================================================
- *   0 - Allow operation (or ask via JSON output)
- *   1 - Error (operation proceeds - fail-open)
- *   2 - Block operation (stderr message shown to user)
- *
- * For blocking (exit 2), output reason to stderr:
- *   console.error('[BLOCKED] Reason');
- *   process.exit(2);
- *
- * For "ask" confirmation (exit 0 with JSON):
- *   console.log(JSON.stringify({ result: 'ask', message: 'Confirm?' }));
- *   process.exit(0);
- *
- * IMPORTANT: These scripts must FAIL OPEN (exit 0 on error)
- * to avoid blocking users when config is broken.
- *
- * This module is copied to .agileflow/scripts/lib/ at install time
- * and used by damage-control-bash.js, damage-control-edit.js, damage-control-write.js
- */
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-
-// Inline colors (no external dependency - keeps scripts standalone)
-const c = {
-  coral: '\x1b[38;5;203m',
-  dim: '\x1b[2m',
-  reset: '\x1b[0m',
-};
-
-// Pattern cache: avoids re-reading and re-parsing YAML on every hook invocation.
-// Invalidated when the config file's mtime changes.
-const _patternCache = {
-  /** @type {string|null} */ filePath: null,
-  /** @type {number} */ mtime: 0,
-  /** @type {object|null} */ config: null,
-};
-
-// Shared constants
-const CONFIG_PATHS = [
-  '.agileflow/config/damage-control-patterns.yaml',
-  '.agileflow/config/damage-control-patterns.yml',
-  '.agileflow/templates/damage-control-patterns.yaml',
-];
-
-const STDIN_TIMEOUT_MS = 4000;
-
-/**
- * Find project root by looking for .agileflow directory
- * @returns {string} Project root path or current working directory
- */
-function findProjectRoot() {
-  let dir = process.cwd();
-  while (dir !== '/') {
-    if (fs.existsSync(path.join(dir, '.agileflow'))) {
-      return dir;
-    }
-    dir = path.dirname(dir);
-  }
-  return process.cwd();
-}
-
-/**
- * Expand ~ to home directory
- * @param {string} p - Path that may start with ~/
- * @returns {string} Expanded path
- */
-function expandPath(p) {
-  if (p.startsWith('~/')) {
-    return path.join(os.homedir(), p.slice(2));
-  }
-  return p;
-}
-
-/**
- * Load patterns configuration from YAML file with caching.
- * Returns cached config when the file hasn't changed (mtime check).
- * Returns empty config if not found (fail-open).
- *
- * @param {string} projectRoot - Project root directory
- * @param {function} parseYAML - Function to parse YAML content
- * @param {object} defaultConfig - Default config if no file found
- * @returns {object} Parsed configuration
- */
-function loadPatterns(projectRoot, parseYAML, defaultConfig = {}) {
-  for (const configPath of CONFIG_PATHS) {
-    const fullPath = path.join(projectRoot, configPath);
-    if (fs.existsSync(fullPath)) {
-      try {
-        // Check mtime for cache invalidation
-        const stat = fs.statSync(fullPath);
-        const mtime = stat.mtimeMs;
-
-        if (
-          _patternCache.filePath === fullPath &&
-          _patternCache.mtime === mtime &&
-          _patternCache.config
-        ) {
-          return _patternCache.config;
-        }
-
-        const content = fs.readFileSync(fullPath, 'utf8');
-        const config = parseYAML(content);
-
-        // Store in cache
-        _patternCache.filePath = fullPath;
-        _patternCache.mtime = mtime;
-        _patternCache.config = config;
-
-        return config;
-      } catch (e) {
-        // Continue to next path
-      }
-    }
-  }
-
-  // Return empty config if no file found (fail-open)
-  return defaultConfig;
-}
-
-/**
- * Clear the pattern cache (for testing or forced reload).
- */
-function clearPatternCache() {
-  _patternCache.filePath = null;
-  _patternCache.mtime = 0;
-  _patternCache.config = null;
-}
-
-/**
- * Check if a file path matches any of the protected patterns
- *
- * @param {string} filePath - File path to check
- * @param {string[]} patterns - Array of patterns to match against
- * @returns {string|null} Matched pattern or null
- */
-function pathMatches(filePath, patterns) {
-  if (!filePath) return null;
-
-  const normalizedPath = path.resolve(filePath);
-  const relativePath = path.relative(process.cwd(), normalizedPath);
-
-  for (const pattern of patterns) {
-    const expandedPattern = expandPath(pattern);
-
-    // Check if pattern is a directory prefix
-    if (pattern.endsWith('/')) {
-      const patternDir = expandedPattern.slice(0, -1);
-      if (normalizedPath.startsWith(patternDir)) {
-        return pattern;
-      }
-    }
-
-    // Check exact match
-    if (normalizedPath === expandedPattern) {
-      return pattern;
-    }
-
-    // Check if normalized path ends with pattern (for filenames like "id_rsa")
-    if (normalizedPath.endsWith(pattern) || relativePath.endsWith(pattern)) {
-      return pattern;
-    }
-
-    // Check if pattern appears in path (for patterns like "*.pem")
-    if (pattern.startsWith('*')) {
-      const ext = pattern.slice(1);
-      if (normalizedPath.endsWith(ext) || relativePath.endsWith(ext)) {
-        return pattern;
-      }
-    }
-
-    // Check if path contains pattern (for things like ".env.production")
-    const patternBase = path.basename(pattern);
-    if (path.basename(normalizedPath) === patternBase) {
-      return pattern;
-    }
-  }
-
-  return null;
-}
-
-/**
- * Output blocked message to stderr
- *
- * @param {string} reason - Main reason for blocking
- * @param {string} [detail] - Additional detail
- * @param {string} [context] - Context info (file path or command)
- */
-function outputBlocked(reason, detail, context) {
-  console.error(`${c.coral}[BLOCKED]${c.reset} ${reason}`);
-  if (detail) {
-    console.error(`${c.dim}${detail}${c.reset}`);
-  }
-  if (context) {
-    console.error(`${c.dim}${context}${c.reset}`);
-  }
-  // Help message for AI and user
-  console.error('');
-  console.error(
-    `${c.dim}This is intentional - AgileFlow Damage Control blocked a potentially dangerous operation.${c.reset}`
-  );
-  console.error(
-    `${c.dim}DO NOT retry this command. Ask the user if they want to proceed manually.${c.reset}`
-  );
-  console.error(`${c.dim}To disable: run /configure → Infrastructure → Damage Control${c.reset}`);
-}
-
-/**
- * Run damage control hook with stdin parsing
- * Handles common error cases and timeout
- *
- * @param {object} options - Hook options
- * @param {function} options.getInputValue - Extract value from parsed input (input) => value
- * @param {function} options.loadConfig - Load configuration () => config
- * @param {function} options.validate - Validate input (value, config) => { action, reason, detail? }
- * @param {function} options.onBlock - Handle blocked result (result, value) => void
- * @param {function} [options.onAsk] - Handle ask result (result, value) => void (optional)
- */
-function runDamageControlHook(options) {
-  const { getInputValue, loadConfig, validate, onBlock, onAsk } = options;
-
-  let inputData = '';
-
-  process.stdin.setEncoding('utf8');
-
-  process.stdin.on('data', chunk => {
-    inputData += chunk;
-  });
-
-  process.stdin.on('end', () => {
-    try {
-      // Parse tool input from Claude Code
-      const input = JSON.parse(inputData);
-      const value = getInputValue(input);
-
-      if (!value) {
-        // No value to validate - allow
-        process.exit(0);
-      }
-
-      // Load patterns and validate
-      const config = loadConfig();
-      const result = validate(value, config);
-
-      switch (result.action) {
-        case 'block':
-          onBlock(result, value);
-          process.exit(2);
-          break;
-
-        case 'ask':
-          if (onAsk) {
-            onAsk(result, value);
-          } else {
-            // Default ask behavior - output JSON
-            console.log(
-              JSON.stringify({
-                result: 'ask',
-                message: result.reason,
-              })
-            );
-          }
-          process.exit(0);
-          break;
-
-        case 'allow':
-        default:
-          process.exit(0);
-      }
-    } catch (e) {
-      // Parse error or other issue - fail open
-      process.exit(0);
-    }
-  });
-
-  // Handle no stdin (direct invocation)
-  process.stdin.on('error', () => {
-    process.exit(0);
-  });
-
-  // Set timeout to prevent hanging
-  setTimeout(() => {
-    process.exit(0);
-  }, STDIN_TIMEOUT_MS);
-}
-
-/**
- * Parse simplified YAML for damage control patterns
- * Handles both pattern-based sections (with pattern/reason/flags objects)
- * and list-based sections (with simple string arrays)
- *
- * @param {string} content - YAML file content
- * @param {object} sectionConfig - Map of section names to their type ('patterns' or 'list')
- * @returns {object} Parsed configuration
- *
- * @example
- * // For bash patterns (pattern objects):
- * parseSimpleYAML(content, {
- *   bashToolPatterns: 'patterns',
- *   askPatterns: 'patterns',
- *   agileflowProtections: 'patterns',
- * })
- *
- * @example
- * // For path lists (string arrays):
- * parseSimpleYAML(content, {
- *   zeroAccessPaths: 'list',
- *   readOnlyPaths: 'list',
- *   noDeletePaths: 'list',
- * })
- */
-function parseSimpleYAML(content, sectionConfig) {
-  // Initialize result with empty arrays for each section
-  const config = {};
-  for (const section of Object.keys(sectionConfig)) {
-    config[section] = [];
-  }
-
-  let currentSection = null;
-  let currentPattern = null;
-
-  for (const line of content.split('\n')) {
-    const trimmed = line.trim();
-
-    // Skip empty lines and comments
-    if (!trimmed || trimmed.startsWith('#')) continue;
-
-    // Check if this line is a section header we care about
-    const sectionMatch = trimmed.match(/^(\w+):$/);
-    if (sectionMatch) {
-      const sectionName = sectionMatch[1];
-      if (sectionConfig[sectionName]) {
-        currentSection = sectionName;
-        currentPattern = null;
-      } else {
-        // Section we don't care about
-        currentSection = null;
-        currentPattern = null;
-      }
-      continue;
-    }
-
-    // Skip if we're not in a tracked section
-    if (!currentSection) continue;
-
-    const sectionType = sectionConfig[currentSection];
-
-    if (sectionType === 'patterns') {
-      // Pattern-based section (objects with pattern/reason/flags)
-      if (trimmed.startsWith('- pattern:')) {
-        const patternValue = trimmed
-          .replace('- pattern:', '')
-          .trim()
-          .replace(/^["']|["']$/g, '');
-        currentPattern = { pattern: patternValue };
-        config[currentSection].push(currentPattern);
-      } else if (trimmed.startsWith('reason:') && currentPattern) {
-        currentPattern.reason = trimmed
-          .replace('reason:', '')
-          .trim()
-          .replace(/^["']|["']$/g, '');
-      } else if (trimmed.startsWith('flags:') && currentPattern) {
-        currentPattern.flags = trimmed
-          .replace('flags:', '')
-          .trim()
-          .replace(/^["']|["']$/g, '');
-      } else if (trimmed.startsWith('ask:') && currentPattern) {
-        const askValue = trimmed.replace('ask:', '').trim().toLowerCase();
-        currentPattern.ask = askValue === 'true';
-      }
-    } else if (sectionType === 'list') {
-      // List-based section (simple string arrays)
-      if (trimmed.startsWith('- ')) {
-        const value = trimmed.slice(2).replace(/^["']|["']$/g, '');
-        config[currentSection].push(value);
-      }
-    }
-  }
-
-  return config;
-}
-
-/**
- * Pre-configured parser for bash tool patterns
- */
-function parseBashPatterns(content) {
-  return parseSimpleYAML(content, {
-    bashToolPatterns: 'patterns',
-    askPatterns: 'patterns',
-    agileflowProtections: 'patterns',
-    releaseProtections: 'patterns',
-  });
-}
-
-/**
- * Pre-configured parser for path patterns (edit/write)
- */
-function parsePathPatterns(content) {
-  return parseSimpleYAML(content, {
-    zeroAccessPaths: 'list',
-    readOnlyPaths: 'list',
-    noDeletePaths: 'list',
-  });
-}
-
-/**
- * Validate file path against path patterns
- * Used by both edit and write hooks
- *
- * @param {string} filePath - File path to validate
- * @param {object} config - Parsed path patterns config
- * @param {string} operation - Operation type ('edit' or 'write') for error messages
- * @returns {object} Validation result { action, reason?, detail? }
- */
-function validatePathAgainstPatterns(filePath, config, operation = 'access') {
-  // Check zero access paths - completely blocked
-  const zeroMatch = pathMatches(filePath, config.zeroAccessPaths || []);
-  if (zeroMatch) {
-    return {
-      action: 'block',
-      reason: `Zero-access path: ${zeroMatch}`,
-      detail: 'This file is protected and cannot be accessed',
-    };
-  }
-
-  // Check read-only paths - cannot edit/write
-  const readOnlyMatch = pathMatches(filePath, config.readOnlyPaths || []);
-  if (readOnlyMatch) {
-    return {
-      action: 'block',
-      reason: `Read-only path: ${readOnlyMatch}`,
-      detail: `This file is read-only and cannot be ${operation === 'edit' ? 'edited' : 'written to'}`,
-    };
-  }
-
-  // Allow by default
-  return { action: 'allow' };
-}
-
-/**
- * Factory: Create a path-based damage control hook
- *
- * Reduces boilerplate for Edit/Write/Delete hooks that all use path validation.
- *
- * @param {string} operation - Operation type ('edit', 'write', 'delete')
- * @returns {function} Hook runner function
- *
- * @example
- * // In damage-control-edit.js:
- * const { createPathHook } = require('./lib/damage-control-utils');
- * createPathHook('edit')();
- */
-function createPathHook(operation) {
-  return function runHook() {
-    const projectRoot = findProjectRoot();
-    const defaultConfig = { zeroAccessPaths: [], readOnlyPaths: [], noDeletePaths: [] };
-
-    runDamageControlHook({
-      getInputValue: input => input.file_path || input.tool_input?.file_path,
-      loadConfig: () => loadPatterns(projectRoot, parsePathPatterns, defaultConfig),
-      validate: (filePath, config) => validatePathAgainstPatterns(filePath, config, operation),
-      onBlock: (result, filePath) => {
-        outputBlocked(result.reason, result.detail, `File: ${filePath}`);
-      },
-    });
-  };
-}
-
-/**
- * Factory: Create the bash damage control hook
- *
- * @returns {function} Hook runner function
- *
- * @example
- * // In damage-control-bash.js:
- * const { createBashHook } = require('./lib/damage-control-utils');
- * createBashHook()();
- */
-function createBashHook() {
-  return function runHook() {
-    const projectRoot = findProjectRoot();
-    const defaultConfig = {
-      bashToolPatterns: [],
-      askPatterns: [],
-      agileflowProtections: [],
-      releaseProtections: [],
-    };
-
-    /**
-     * Test command against a single pattern rule
-     * Skips patterns that fail ReDoS validation
-     */
-    function matchesPattern(command, rule) {
-      try {
-        // Validate pattern for ReDoS safety before use
-        const validation = validatePattern(rule.pattern);
-        if (!validation.safe) {
-          return false;
-        }
-        const flags = rule.flags || '';
-        const regex = new RegExp(rule.pattern, flags);
-        return regex.test(command);
-      } catch (e) {
-        // Invalid regex - skip this pattern
-        return false;
-      }
-    }
-
-    /**
-     * Validate command against all patterns
-     */
-    function validateCommand(command, config) {
-      // Check bashToolPatterns + agileflowProtections
-      // Rules with ask: true trigger confirmation, others block
-      const allPatterns = [
-        ...(config.bashToolPatterns || []),
-        ...(config.agileflowProtections || []),
-        ...(config.releaseProtections || []),
-      ];
-
-      for (const rule of allPatterns) {
-        if (matchesPattern(command, rule)) {
-          // Check if this rule wants to ask instead of block
-          if (rule.ask === true || rule.ask === 'true') {
-            return {
-              action: 'ask',
-              reason: rule.reason || 'Please confirm this command',
-            };
-          }
-          return {
-            action: 'block',
-            reason: rule.reason || 'Command blocked by damage control',
-          };
-        }
-      }
-
-      // Check askPatterns section (always ask)
-      for (const rule of config.askPatterns || []) {
-        if (matchesPattern(command, rule)) {
-          return {
-            action: 'ask',
-            reason: rule.reason || 'Please confirm this command',
-          };
-        }
-      }
-
-      // Allow by default
-      return { action: 'allow' };
-    }
-
-    runDamageControlHook({
-      getInputValue: input => input.command || input.tool_input?.command,
-      loadConfig: () => loadPatterns(projectRoot, parseBashPatterns, defaultConfig),
-      validate: validateCommand,
-      onBlock: (result, command) => {
-        outputBlocked(
-          result.reason,
-          `Command: ${command.substring(0, 100)}${command.length > 100 ? '...' : ''}`
-        );
-      },
-    });
-  };
-}
-
-/**
- * Detect ReDoS-vulnerable patterns (nested quantifiers)
- *
- * Checks for patterns like (a+)+ or (a*b?)* that cause
- * catastrophic backtracking on pathological inputs.
- *
- * @param {string} pattern - Regex pattern string to validate
- * @returns {{ safe: boolean, reason?: string }}
- */
-function validatePattern(pattern) {
-  if (!pattern || typeof pattern !== 'string') {
-    return { safe: false, reason: 'Empty or invalid pattern' };
-  }
-
-  // Detect nested quantifiers: a group with a quantifier containing inner quantifiers
-  // Matches patterns like (x+)*, (x+)+, (x*)+, (x+){2,}, etc.
-  const nestedQuantifierRe = /\([^)]*[+*][^)]*\)[+*{]/;
-  if (nestedQuantifierRe.test(pattern)) {
-    return { safe: false, reason: `Nested quantifier detected in: ${pattern}` };
-  }
-
-  // Try to compile the regex to catch syntax errors
-  try {
-    new RegExp(pattern);
-  } catch (e) {
-    return { safe: false, reason: `Invalid regex: ${e.message}` };
-  }
-
-  return { safe: true };
-}
-
-module.exports = {
-  c,
-  findProjectRoot,
-  expandPath,
-  loadPatterns,
-  clearPatternCache,
-  pathMatches,
-  outputBlocked,
-  runDamageControlHook,
-  parseSimpleYAML,
-  parseBashPatterns,
-  parsePathPatterns,
-  validatePathAgainstPatterns,
-  validatePattern,
-  createPathHook,
-  createBashHook,
-  CONFIG_PATHS,
-  STDIN_TIMEOUT_MS,
-};