all-for-claudecode 2.0.0 → 2.2.0

package/scripts/afc-parallel-validate.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 # Parallel Task Validator: Parse tasks.md and check for file path conflicts
 # among [P]-marked (parallel) tasks within the same phase.
+# Calls Node.js ESM version if available, falls back to bash implementation.
 #
 # Usage: afc-parallel-validate.sh <tasks_file_path>
 # Exit 0: valid (no overlaps, or no [P] tasks found)
@@ -14,7 +15,6 @@ cleanup() {
 }
 trap cleanup EXIT
 
-# PROJECT_DIR kept for convention consistency with other afc scripts
 # shellcheck disable=SC2034
 PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 
@@ -29,92 +29,85 @@ if [ ! -f "$TASKS_FILE" ]; then
   exit 1
 fi
 
-# ------------------------------------------------------------------
-# Parse phases and [P] tasks
-# Phase headers match:   ## Phase N: ...
-# Task lines match:      - [ ] T{NNN} [P] {desc} `{path}` ...
-# ------------------------------------------------------------------
+# --- Node.js fast path ---
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if command -v node >/dev/null 2>&1; then
+  node "$SCRIPT_DIR/afc-parallel-validate.mjs" "$TASKS_FILE"
+  exit $?
+fi
+
+# --- Bash fallback ---
 
 current_phase=""
 total_p_tasks=0
 conflict_found=0
 conflict_messages=""
 
-# We process line by line using a while loop.
-# Two associative arrays are used per phase to track:
-#   phase_files[file_path]="task_id" — first task that claimed the file
-#   phase_tasks[file_path]="task_id" — same map for conflict lookup
-# Because bash 3 (macOS default) lacks associative arrays we use temp files.
-
 TMPDIR_WORK="$(mktemp -d)"
 # shellcheck disable=SC2064
 trap "rm -rf '$TMPDIR_WORK'; :" EXIT
 
-# File that accumulates seen paths for the current phase:
-#   format: <file_path><TAB><task_id>
 phase_index="$TMPDIR_WORK/phase_index.tsv"
 
 flush_phase() {
-  # Reset the per-phase index for a new phase
   : > "$phase_index"
 }
 
 flush_phase
 
 while IFS= read -r line || [ -n "$line" ]; do
-  # Detect phase header: ## Phase N: ...
   if printf '%s\n' "$line" | grep -qE '^## Phase [0-9]+'; then
-    # Extract phase number
     current_phase="$(printf '%s\n' "$line" | sed 's/^## Phase \([0-9]*\).*/\1/')"
     flush_phase
     continue
   fi
 
-  # Only process [P]-marked task lines when inside a phase
   [ -z "$current_phase" ] && continue
 
-  # Match task lines containing [P] marker
   if ! printf '%s\n' "$line" | grep -qE '^\s*-\s*\[[ xX]\]\s+T[0-9]+\s+\[P\]'; then
     continue
   fi
 
-  # Extract task ID: first T{NNN} token
   task_id="$(printf '%s\n' "$line" | grep -oE 'T[0-9]+' | head -1)"
   [ -z "$task_id" ] && continue
 
-  # Extract backtick-wrapped file path (first occurrence)
-  file_path="$(printf '%s\n' "$line" | sed "s/.*\`\([^\`]*\)\`.*/\1/" | head -1)"
+  # shellcheck disable=SC2016
+  file_paths_raw="$(printf '%s\n' "$line" | grep -oE '`[^`]+`' | sed 's/`//g' || true)"
+  file_paths=""
+  if [ -n "$file_paths_raw" ]; then
+    file_paths="$(printf '%s\n' "$file_paths_raw" | grep -E '[/.]' || true)"
+  fi
 
-  # Skip if no file path found or extraction failed (line unchanged means no backtick)
-  if [ -z "$file_path" ] || [ "$file_path" = "$line" ]; then
+  if [ -z "$file_paths" ]; then
     total_p_tasks=$((total_p_tasks + 1))
     continue
   fi
 
   total_p_tasks=$((total_p_tasks + 1))
 
-  # Look for this file_path in current phase index
-  existing_task="$(grep -F "${file_path}	" "$phase_index" | cut -f2 | head -1 || true)"
+  while IFS= read -r file_path; do
+    [ -z "$file_path" ] && continue
 
-  if [ -n "$existing_task" ]; then
-    # Conflict detected
-    conflict_found=1
-    msg="CONFLICT: Phase ${current_phase} — ${existing_task} and ${task_id} both target ${file_path}"
-    if [ -z "$conflict_messages" ]; then
-      conflict_messages="$msg"
-    else
-      conflict_messages="${conflict_messages}
+    existing_task="$(grep -F "${file_path}	" "$phase_index" | cut -f2 | head -1 || true)"
+
+    if [ -n "$existing_task" ]; then
+      conflict_found=1
+      msg="CONFLICT: Phase ${current_phase} — ${existing_task} and ${task_id} both target ${file_path}"
+      if [ -z "$conflict_messages" ]; then
+        conflict_messages="$msg"
+      else
+        conflict_messages="${conflict_messages}
 ${msg}"
+      fi
+    else
+      printf '%s\t%s\n' "$file_path" "$task_id" >> "$phase_index"
     fi
-  else
-    # Record this file path for the current phase
-    printf '%s\t%s\n' "$file_path" "$task_id" >> "$phase_index"
-  fi
+  done <<EOF_PATHS
+$file_paths
+EOF_PATHS
 
 done < "$TASKS_FILE"
 
-# Count distinct phases that had [P] tasks by checking how many phase headers
-# had at least one [P] task line (reparse for count only)
 phases_with_p=0
 current_phase_count=""
 phase_had_p=0
@@ -134,15 +127,10 @@ while IFS= read -r line || [ -n "$line" ]; do
   fi
 done < "$TASKS_FILE"
 
-# Flush last phase
 if [ "$phase_had_p" -eq 1 ]; then
   phases_with_p=$((phases_with_p + 1))
 fi
 
-# ------------------------------------------------------------------
-# Output
-# ------------------------------------------------------------------
-
 if [ "$total_p_tasks" -eq 0 ]; then
   printf 'Valid: no [P] tasks found, nothing to validate\n'
   exit 0

package/scripts/afc-permission-request.sh

@@ -4,6 +4,9 @@ set -euo pipefail
 # PermissionRequest Hook: Auto-allow CI-related Bash commands during implement/review Phase
 # Only exact whitelist matches allowed; commands with chaining (&&/;/|/$()) fall through to default behavior (user confirmation)
 
+# shellcheck source=afc-state.sh
+. "$(dirname "$0")/afc-state.sh"
+
 # shellcheck disable=SC2329
 cleanup() {
   :
@@ -11,22 +14,17 @@ cleanup() {
 trap cleanup EXIT
 
 PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
-PIPELINE_FLAG="$PROJECT_DIR/.claude/.afc-active"
-PHASE_FLAG="$PROJECT_DIR/.claude/.afc-phase"
 
 # Read hook data from stdin
 INPUT=$(cat)
 
 # Exit silently if pipeline is inactive
-if [ ! -f "$PIPELINE_FLAG" ]; then
+if ! afc_state_is_active; then
   exit 0
 fi
 
 # Only active during implement/review Phase
-PHASE=""
-if [ -f "$PHASE_FLAG" ]; then
-  PHASE="$(head -1 "$PHASE_FLAG" | tr -d '\n\r')"
-fi
+PHASE="$(afc_state_read phase || echo '')"
 case "${PHASE:-}" in
   implement|review) ;;
   *) exit 0 ;;
@@ -54,13 +52,60 @@ case "$COMMAND" in
   *$'\n'*) exit 0 ;;
 esac
 
+# Build dynamic whitelist from afc.config.md (CI/gate/test commands)
+DYNAMIC_WHITELIST=""
+CONFIG_FILE="$PROJECT_DIR/.claude/afc.config.md"
+if [ -f "$CONFIG_FILE" ]; then
+  # Extract ci, gate, test values from YAML code block
+  # Handles both quoted and unquoted: ci: "npm run lint" or ci: npm run lint
+  for key in ci gate test; do
+    val=$(grep -E "^\s*${key}:\s*\"[^\"]*\"" "$CONFIG_FILE" 2>/dev/null | head -1 | sed 's/.*'"${key}"': *"\([^"]*\)".*/\1/' || true)
+    if [ -n "$val" ] && [ "$val" != '""' ]; then
+      DYNAMIC_WHITELIST="${DYNAMIC_WHITELIST:+${DYNAMIC_WHITELIST}|}${val}"
+      # Generate PM-agnostic variants (npm → pnpm, yarn, bun)
+      case "$val" in
+        "npm run "*)
+          suffix="${val#npm run }"
+          DYNAMIC_WHITELIST="${DYNAMIC_WHITELIST}|pnpm run ${suffix}|yarn run ${suffix}|bun run ${suffix}"
+          ;;
+        "npm test"*)
+          suffix="${val#npm test}"
+          DYNAMIC_WHITELIST="${DYNAMIC_WHITELIST}|pnpm test${suffix}|yarn test${suffix}|bun test${suffix}"
+          ;;
+      esac
+    fi
+  done
+fi
+
 # Whitelist exact match (uses space + $ to prevent prefix matching)
 ALLOWED=false
-case "$COMMAND" in
-  "npm run lint"|"npm test"|"npm run test:all")
+
+# Check dynamic whitelist first (from afc.config.md)
+if [ -n "$DYNAMIC_WHITELIST" ]; then
+  # Use printf + grep for safe matching (no eval)
+  if printf '%s\n' "$DYNAMIC_WHITELIST" | tr '|' '\n' | grep -qxF "$COMMAND"; then
     ALLOWED=true
-    ;;
-esac
+  fi
+fi
+
+# Hardcoded fallback whitelist (always active for backward compatibility)
+if [ "$ALLOWED" = "false" ]; then
+  case "$COMMAND" in
+    "npm run lint"|"npm test"|"npm run test:all")
+      ALLOWED=true
+      ;;
+  esac
+fi
+
+# Plugin's own scripts (auto-allow during pipeline execution)
+PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-}"
+if [ "$ALLOWED" = "false" ] && [ -n "$PLUGIN_ROOT" ]; then
+  case "$COMMAND" in
+    "\"${PLUGIN_ROOT}/scripts/"*|"${PLUGIN_ROOT}/scripts/"*)
+      ALLOWED=true
+      ;;
+  esac
+fi
 
 # Prefix matching (allow paths after shellcheck, prettier, chmod +x)
 if [ "$ALLOWED" = "false" ]; then

package/scripts/afc-pipeline-manage.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 set -euo pipefail
 
-# Pipeline Management: Manage afc pipeline state flags
-# Manages flag files referenced by other hook scripts
+# Pipeline Management: Manage afc pipeline state
+# Uses .afc-state.json for all state (replaces legacy flag files)
 #
 # Usage:
 #   afc-pipeline-manage.sh start <feature-name>
@@ -16,16 +16,17 @@ set -euo pipefail
 
 PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
 FLAG_DIR="$PROJECT_DIR/.claude"
-PIPELINE_FLAG="$FLAG_DIR/.afc-active"
-PHASE_FLAG="$FLAG_DIR/.afc-phase"
-CI_FLAG="$FLAG_DIR/.afc-ci-passed"
-CHANGES_LOG="$FLAG_DIR/.afc-changes.log"
+
+# Source state library
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=afc-state.sh
+. "$SCRIPT_DIR/afc-state.sh"
 
 # shellcheck disable=SC2329
 cleanup() {
   local exit_code=$?
   if [ "$exit_code" -ne 0 ]; then
-    echo "afc-pipeline-manage: exited with code $exit_code" >&2
+    echo "[afc:pipeline] Abnormal exit (code: $exit_code)" >&2
   fi
   exit "$exit_code"
 }
@@ -35,34 +36,32 @@ mkdir -p "$FLAG_DIR"
 
 COMMAND="${1:-}"
 if [ -z "$COMMAND" ]; then
-  echo "Usage: $0 {start|phase|ci-pass|end|status} [args]" >&2
+  echo "[afc] Usage: $0 {start|phase|ci-pass|end|status} [args]" >&2
   exit 1
 fi
 
 case "$COMMAND" in
   start)
     if [ -z "${2:-}" ]; then
-      echo "Feature name required" >&2
+      echo "[afc:pipeline] Feature name required" >&2
       exit 1
     fi
     # Sanitize feature name (strip newlines, path traversal, limit length)
-    FEATURE=$(printf '%s' "$2" | tr -d '\n\r/' | cut -c1-100)
+    FEATURE=$(printf '%s' "$2" | tr -d '\n\r/"\\&' | cut -c1-100)
     if [ -z "$FEATURE" ]; then
-      echo "Feature name invalid after sanitization" >&2
+      echo "[afc:pipeline] Feature name invalid after sanitization" >&2
       exit 1
     fi
 
     # Prevent duplicate execution
-    if [ -f "$PIPELINE_FLAG" ]; then
-      EXISTING=$(cat "$PIPELINE_FLAG")
-      echo "WARNING: Pipeline already active: $EXISTING" >&2
-      echo "Use '$0 end --force' to clear, or '$0 status' to check." >&2
+    if afc_state_is_active; then
+      EXISTING=$(afc_state_read feature || echo "unknown")
+      echo "[afc] WARNING: Pipeline already active: $EXISTING" >&2
+      echo "  → Use '$0 end --force' to clear, or '$0 status' to check" >&2
       exit 1
     fi
 
-    printf '%s\n' "$FEATURE" > "$PIPELINE_FLAG"
-    printf '%s\n' "spec" > "$PHASE_FLAG"
-    rm -f "$CI_FLAG" "$CHANGES_LOG"
+    afc_state_init "$FEATURE"
 
     # Safety snapshot
     if cd "$PROJECT_DIR" 2>/dev/null; then
@@ -74,35 +73,34 @@ case "$COMMAND" in
 
   phase)
     PHASE="${2:?Phase name required}"
-    case "$PHASE" in
-      spec|plan|tasks|implement|review|clean)
-        printf '%s\n' "$PHASE" > "$PHASE_FLAG"
-        rm -f "$CI_FLAG"  # Reset CI for new Phase
-        echo "Phase: $PHASE"
-        ;;
-      *)
-        echo "Invalid phase: $PHASE (valid: spec|plan|tasks|implement|review|clean)" >&2
-        exit 1
-        ;;
-    esac
+    if afc_is_valid_phase "$PHASE"; then
+      afc_state_write "phase" "$PHASE"
+      afc_state_invalidate_ci
+      echo "Phase: $PHASE"
+    else
+      printf "[afc:pipeline] Invalid phase: %s\n  → Valid phases: %s\n" "$PHASE" "$AFC_VALID_PHASES" >&2
+      exit 1
+    fi
     ;;
 
   ci-pass)
-    date +%s > "$CI_FLAG"
+    afc_state_ci_pass
     echo "CI passed at $(date '+%H:%M:%S')"
     ;;
 
   end)
     FORCE="${2:-}"
     FEATURE=""
-    if [ -f "$PIPELINE_FLAG" ]; then
-      FEATURE=$(cat "$PIPELINE_FLAG")
+    if afc_state_is_active; then
+      FEATURE=$(afc_state_read feature || echo "")
     elif [ "$FORCE" != "--force" ]; then
-      echo "No active pipeline to end." >&2
+      echo "[afc:pipeline] No active pipeline to end" >&2
       exit 0
     fi
 
-    rm -f "$PIPELINE_FLAG" "$PHASE_FLAG" "$CI_FLAG" "$CHANGES_LOG"
+    afc_state_delete
+    # Clean sidecar changes file if it exists (jq-less fallback)
+    rm -f "$FLAG_DIR/.afc-state.changes.log"
     rm -f "$FLAG_DIR/.afc-failures.log" "$FLAG_DIR/.afc-task-results.log" "$FLAG_DIR/.afc-config-audit.log"
 
     # Clean up safety tag and phase tags (on successful completion)
@@ -117,12 +115,15 @@ case "$COMMAND" in
     ;;
 
   status)
-    if [ -f "$PIPELINE_FLAG" ]; then
-      echo "Active: $(cat "$PIPELINE_FLAG")"
-      [ -f "$PHASE_FLAG" ] && echo "Phase: $(cat "$PHASE_FLAG")"
-      [ -f "$CI_FLAG" ] && echo "CI: passed ($(cat "$CI_FLAG"))"
-      if [ -f "$CHANGES_LOG" ]; then
-        CHANGE_COUNT=$(wc -l < "$CHANGES_LOG" | tr -d ' ')
+    if afc_state_is_active; then
+      echo "Active: $(afc_state_read feature || echo 'unknown')"
+      PHASE=$(afc_state_read phase 2>/dev/null || true)
+      [ -n "$PHASE" ] && echo "Phase: $PHASE"
+      CI_TS=$(afc_state_read ciPassedAt 2>/dev/null || true)
+      [ -n "$CI_TS" ] && echo "CI: passed ($CI_TS)"
+      CHANGES=$(afc_state_read_changes 2>/dev/null || true)
+      if [ -n "$CHANGES" ]; then
+        CHANGE_COUNT=$(printf '%s\n' "$CHANGES" | wc -l | tr -d ' ')
         echo "Changes: $CHANGE_COUNT files"
       fi
     else
@@ -134,10 +135,9 @@ case "$COMMAND" in
     EVENT="${2:-}"
     MSG="${3:-}"
     if [ -z "$EVENT" ]; then
-      echo "Usage: $0 log <event_type> <message>" >&2
+      echo "[afc] Usage: $0 log <event_type> <message>" >&2
       exit 1
     fi
-    SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
     "$SCRIPT_DIR/afc-timeline-log.sh" "$EVENT" "$MSG"
     ;;
 
@@ -146,14 +146,14 @@ case "$COMMAND" in
     # Sanitize to digits only
     PHASE_NUM=$(printf '%s' "$PHASE_NUM" | tr -dc '0-9' | cut -c1-2)
     if [ -z "$PHASE_NUM" ]; then
-      echo "Invalid phase number" >&2
+      echo "[afc:pipeline] Invalid phase number" >&2
       exit 1
     fi
     if cd "$PROJECT_DIR" 2>/dev/null; then
       git tag -f "afc/phase-${PHASE_NUM}" 2>/dev/null || true
       echo "Phase tag created: afc/phase-${PHASE_NUM}"
     else
-      echo "Cannot create tag: not a git repo" >&2
+      echo "[afc:pipeline] Cannot create tag: not a git repo" >&2
       exit 1
     fi
     ;;
@@ -172,13 +172,13 @@ case "$COMMAND" in
         echo "No phase tags to remove"
       fi
     else
-      echo "Cannot clean tags: not a git repo" >&2
+      echo "[afc:pipeline] Cannot clean tags: not a git repo" >&2
       exit 0
     fi
     ;;
 
   *)
-    echo "Usage: $0 {start|phase|ci-pass|end|status|log|phase-tag|phase-tag-clean} [args]" >&2
+    echo "[afc] Usage: $0 {start|phase|ci-pass|end|status|log|phase-tag|phase-tag-clean} [args]" >&2
     exit 1
     ;;
 esac

package/scripts/afc-preflight-check.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 set -euo pipefail
 
+# shellcheck source=afc-state.sh
+. "$(dirname "$0")/afc-state.sh"
+
 # shellcheck disable=SC2329
 cleanup() {
   :
@@ -165,9 +168,9 @@ fi
 
 # ── Check 5: No active pipeline ──────────────────────────
 
-ACTIVE_FILE="$PROJECT_DIR/.claude/.afc-active"
-if [[ -f "$ACTIVE_FILE" ]]; then
-  ACTIVE_NAME=$(head -1 "$ACTIVE_FILE" 2>/dev/null | tr -d '\n\r' | cut -c1-100 || printf 'unknown')
+if afc_state_is_active; then
+  ACTIVE_NAME=$(afc_state_read feature 2>/dev/null || printf 'unknown')
+  ACTIVE_NAME=$(printf '%s' "$ACTIVE_NAME" | cut -c1-100)
   printf '  \xe2\x9c\x97 No active pipeline: pipeline already running (%s)\n' "$ACTIVE_NAME"
   FAIL_COUNT=$((FAIL_COUNT + 1))
 else