all-hands-cli 0.1.0

package/.allhands/harness/src/lib/flows.ts

@@ -0,0 +1,155 @@
+/**
+ * Flow File Management
+ *
+ * Loads flow files from .allhands/flows/ directory and converts them
+ * to modal items for the TUI custom flow selection.
+ */
+
+import { existsSync, readdirSync, statSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import type { ModalItem } from '../tui/modal.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+export interface FlowFile {
+  /** Display name (filename without .md) */
+  name: string;
+  /** Relative path from flows directory (e.g., "shared/jury/BEST_PRACTICES_REVIEW.md") */
+  relativePath: string;
+  /** Absolute path to the flow file */
+  absolutePath: string;
+  /** Directory group (e.g., "", "shared", "shared/jury") */
+  directory: string;
+}
+
+export interface FlowGroup {
+  /** Directory path (empty string for root) */
+  directory: string;
+  /** Display label for the group */
+  label: string;
+  /** Flow files in this group */
+  flows: FlowFile[];
+}
+
+/**
+ * Get the flows directory path
+ */
+function getFlowsDir(): string {
+  // Path: harness/src/lib/ -> harness/src/ -> harness/ -> .allhands/ -> flows/
+  return join(__dirname, '..', '..', '..', 'flows');
+}
+
+/**
+ * Recursively collect all .md files from a directory
+ */
+function collectFlowFiles(baseDir: string, currentDir: string, relativePath: string = ''): FlowFile[] {
+  const flows: FlowFile[] = [];
+
+  if (!existsSync(currentDir)) {
+    return flows;
+  }
+
+  const entries = readdirSync(currentDir);
+
+  for (const entry of entries) {
+    const fullPath = join(currentDir, entry);
+    const relPath = relativePath ? join(relativePath, entry) : entry;
+    const stat = statSync(fullPath);
+
+    if (stat.isDirectory()) {
+      // Recurse into subdirectories
+      flows.push(...collectFlowFiles(baseDir, fullPath, relPath));
+    } else if (entry.endsWith('.md')) {
+      flows.push({
+        name: entry.replace('.md', ''),
+        relativePath: relPath,
+        absolutePath: fullPath,
+        directory: relativePath,
+      });
+    }
+  }
+
+  return flows;
+}
+
+/**
+ * Load all flow files from the flows directory
+ *
+ * Returns flows grouped by their directory structure.
+ */
+export function loadAllFlows(): FlowGroup[] {
+  const flowsDir = getFlowsDir();
+  const allFlows = collectFlowFiles(flowsDir, flowsDir);
+
+  // Group flows by directory
+  const groupMap = new Map<string, FlowFile[]>();
+
+  for (const flow of allFlows) {
+    const dir = flow.directory;
+    const existing = groupMap.get(dir) ?? [];
+    existing.push(flow);
+    groupMap.set(dir, existing);
+  }
+
+  // Convert to FlowGroup array, sorted by directory depth then name
+  const groups: FlowGroup[] = [];
+  const sortedDirs = Array.from(groupMap.keys()).sort((a, b) => {
+    // Root first, then by depth, then alphabetically
+    if (a === '' && b !== '') return -1;
+    if (b === '' && a !== '') return 1;
+    const depthA = a.split('/').length;
+    const depthB = b.split('/').length;
+    if (depthA !== depthB) return depthA - depthB;
+    return a.localeCompare(b);
+  });
+
+  for (const dir of sortedDirs) {
+    const flows = groupMap.get(dir) ?? [];
+    // Sort flows by name within each group
+    flows.sort((a, b) => a.name.localeCompare(b.name));
+
+    groups.push({
+      directory: dir,
+      label: dir === '' ? 'Root Flows' : dir.replace(/\//g, ' / '),
+      flows,
+    });
+  }
+
+  return groups;
+}
+
+/**
+ * Convert flow groups to modal items for display
+ */
+export function flowsToModalItems(groups: FlowGroup[]): ModalItem[] {
+  const items: ModalItem[] = [];
+
+  for (const group of groups) {
+    // Add header for this group
+    items.push({
+      id: `header-${group.directory || 'root'}`,
+      label: group.label,
+      type: 'header',
+    });
+
+    // Add flow items
+    for (const flow of group.flows) {
+      items.push({
+        id: flow.absolutePath, // Use absolute path as ID for easy lookup
+        label: flow.name,
+        type: 'item',
+      });
+    }
+  }
+
+  return items;
+}
+
+/**
+ * Get the absolute path to the flows directory
+ */
+export function getFlowsDirectory(): string {
+  return getFlowsDir();
+}

package/.allhands/harness/src/lib/git.ts

@@ -0,0 +1,276 @@
+/**
+ * Git utilities for All Hands CLI.
+ *
+ * Provides git context for notifications and other features.
+ */
+
+import { spawnSync } from "child_process";
+import { basename } from "path";
+import { getBaseBranch, getLocalBaseBranch } from '../hooks/shared.js';
+
+// Re-export getBaseBranch and getLocalBaseBranch for consumers
+export { getBaseBranch, getLocalBaseBranch };
+
+// ── Safe git execution wrapper ──────────────────────────────────────────────
+
+export interface GitExecResult {
+  success: boolean;
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+}
+
+/**
+ * Safe git command execution using spawnSync with argument arrays.
+ * No shell involved — immune to command injection via branch names, paths, etc.
+ */
+export function gitExec(args: string[], cwd?: string): GitExecResult {
+  const workingDir = cwd || process.cwd();
+  const result = spawnSync('git', args, {
+    encoding: 'utf-8',
+    cwd: workingDir,
+    maxBuffer: 10 * 1024 * 1024,
+  });
+
+  return {
+    success: result.status === 0,
+    stdout: result.stdout?.trim() || '',
+    stderr: result.stderr?.trim() || '',
+    exitCode: result.status ?? 1,
+  };
+}
+
+// ── Input validation ────────────────────────────────────────────────────────
+
+const GIT_REF_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9/_.-]*$/;
+
+/**
+ * Validate a git ref (branch name, tag, etc.) against a safe allowlist pattern.
+ * Throws a descriptive error if the ref contains unsafe characters.
+ *
+ * Apply at the boundary where user-derived values (spec frontmatter `branch`,
+ * settings `baseBranch`) enter git operations — not deep inside helpers.
+ */
+export function validateGitRef(ref: string, label: string): void {
+  if (!ref || !GIT_REF_PATTERN.test(ref)) {
+    throw new Error(
+      `Invalid ${label}: "${ref}". Git refs must start with an alphanumeric character and contain only alphanumerics, slashes, underscores, dots, and hyphens.`
+    );
+  }
+}
+
+// Protected branches - no planning required
+const PROTECTED_BRANCHES = new Set([
+  "main",
+  "master",
+  "develop",
+  "development",
+  "dev",
+  "staging",
+  "stage",
+  "production",
+  "prod",
+]);
+
+// Prefixes that indicate direct mode (no planning)
+const DIRECT_MODE_PREFIXES = ["quick/", "curator/"];
+
+/**
+ * Get current git branch name.
+ * Uses CLAUDE_PROJECT_DIR if available (for hooks), else current directory.
+ */
+export function getBranch(): string {
+  try {
+    const cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+    const result = spawnSync("git", ["branch", "--show-current"], {
+      encoding: "utf-8",
+      cwd,
+    });
+    return result.status === 0 ? result.stdout.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Convert branch name to safe directory name (feat/auth -> feat-auth).
+ */
+export function sanitizeBranch(branch: string): string {
+  return branch.replace(/[^a-zA-Z0-9_-]/g, "-");
+}
+
+/**
+ * Check if branch should skip planning.
+ */
+export function isDirectModeBranch(branch: string): boolean {
+  if (PROTECTED_BRANCHES.has(branch)) {
+    return true;
+  }
+  return DIRECT_MODE_PREFIXES.some((prefix) => branch.startsWith(prefix));
+}
+
+/**
+ * Get git diff against a reference.
+ */
+export function getDiff(ref: string): string {
+  try {
+    const result = spawnSync("git", ["diff", ref], {
+      encoding: "utf-8",
+      maxBuffer: 10 * 1024 * 1024, // 10MB
+    });
+
+    if (result.status !== 0) {
+      // Fallback to empty tree if ref doesn't exist (fresh repo)
+      const emptyTree = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+      const fallback = spawnSync("git", ["diff", emptyTree], {
+        encoding: "utf-8",
+        maxBuffer: 10 * 1024 * 1024,
+      });
+      return fallback.stdout || "(No changes)";
+    }
+
+    return result.stdout || "(No changes)";
+  } catch {
+    return "(Unable to get diff)";
+  }
+}
+
+/**
+ * Get the project root directory (where .git is located).
+ * Uses CLAUDE_PROJECT_DIR if available (for hooks), else current directory.
+ */
+export function getProjectRoot(): string {
+  const cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const result = gitExec(['rev-parse', '--show-toplevel'], cwd);
+  return result.success ? result.stdout : cwd;
+}
+
+/**
+ * Get the repo's root directory name (e.g., "claude-agents").
+ */
+export function getRepoName(): string {
+  return basename(getProjectRoot()) || "";
+}
+
+/**
+ * Get the plan directory path for current branch.
+ */
+export function getPlanDir(cwd?: string): string {
+  const root = cwd ?? getProjectRoot();
+  const branch = getBranch();
+  const planId = sanitizeBranch(branch);
+  return `${root}/.allhands/plans/${planId}`;
+}
+
+/**
+ * Get the current HEAD commit hash.
+ */
+export function getHeadCommit(cwd?: string): string {
+  const workingDir = cwd || process.cwd();
+
+  try {
+    const result = spawnSync("git", ["rev-parse", "HEAD"], {
+      encoding: "utf-8",
+      cwd: workingDir,
+    });
+
+    return result.status === 0 ? result.stdout.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Get short commit hash (7 chars).
+ */
+export function getShortCommit(commitHash: string): string {
+  return commitHash.substring(0, 7);
+}
+
+/**
+ * Check if there are uncommitted changes in the working directory.
+ * Returns true if there are staged or unstaged changes.
+ *
+ * Fail-safe: returns true when git itself fails (non-zero exit or exception).
+ * When we can't determine repo state, assume dirty to prevent destructive
+ * operations (checkout, clean, branch delete) from proceeding on false data.
+ */
+export function hasUncommittedChanges(cwd?: string): boolean {
+  const workingDir = cwd || process.cwd();
+  try {
+    const result = spawnSync("git", ["status", "--porcelain"], {
+      encoding: "utf-8",
+      cwd: workingDir,
+    });
+    // Fail-safe: if git status itself fails, assume changes exist
+    if (result.status !== 0) {
+      return true;
+    }
+    return result.stdout.trim().length > 0;
+  } catch {
+    // Fail-safe: exception means we can't determine state — assume dirty
+    return true;
+  }
+}
+
+/**
+ * Checkout a git branch.
+ * Returns true on success, false on failure.
+ */
+export function checkoutBranch(branch: string, cwd?: string): boolean {
+  const workingDir = cwd || process.cwd();
+  try {
+    const result = spawnSync("git", ["checkout", branch], {
+      encoding: "utf-8",
+      cwd: workingDir,
+    });
+    return result.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+// ── Remote sync ─────────────────────────────────────────────────────────────
+
+export interface SyncResult {
+  success: boolean;
+  conflicts: string[];
+}
+
+/**
+ * Sync the current branch with origin/main.
+ * Used at three lifecycle points: activation, PR creation, completion.
+ *
+ * Flow: fetch origin main → merge origin/main --no-edit →
+ *   on conflict: parse conflicted files, abort merge, return conflicts list
+ *   on success: return { success: true, conflicts: [] }
+ */
+export function syncWithOriginMain(cwd?: string): SyncResult {
+  const workingDir = cwd || process.cwd();
+
+  // 1. Fetch latest main from origin
+  const fetch = gitExec(['fetch', 'origin', 'main'], workingDir);
+  if (!fetch.success) {
+    return { success: false, conflicts: [] };
+  }
+
+  // 2. Attempt merge
+  const merge = gitExec(['merge', 'origin/main', '--no-edit'], workingDir);
+  if (merge.success) {
+    return { success: true, conflicts: [] };
+  }
+
+  // 3. Merge failed — detect conflicts
+  const diffResult = gitExec(
+    ['diff', '--name-only', '--diff-filter=U'],
+    workingDir,
+  );
+  const conflicts = diffResult.stdout
+    ? diffResult.stdout.split('\n').filter(Boolean)
+    : [];
+
+  // 4. Abort the failed merge to restore clean state
+  gitExec(['merge', '--abort'], workingDir);
+
+  return { success: false, conflicts };
+}

package/.allhands/harness/src/lib/knowledge-worker.ts

@@ -0,0 +1,72 @@
+#!/usr/bin/env tsx
+/**
+ * Knowledge Worker - standalone child process for embedding operations.
+ *
+ * Isolates the ONNX Runtime + gtr-t5-quant model (~300-600MB) from the
+ * main TUI process. The model loads, runs, and dies entirely within this
+ * child process, preventing heap pressure in the TUI.
+ *
+ * Usage:
+ *   npx tsx knowledge-worker.ts reindexAll <indexName> <projectRoot>
+ *   npx tsx knowledge-worker.ts reindexFromChanges <indexName> <projectRoot>
+ *     (reads changes JSON from stdin for reindexFromChanges)
+ *
+ * Output:
+ *   stderr: Progress messages (line-buffered)
+ *   stdout: Final JSON result { success, files_indexed, total_tokens } or
+ *           { success, message, files }
+ */
+
+import { KnowledgeService, type IndexName } from "./knowledge.js";
+
+async function main(): Promise<void> {
+  const [command, indexName, projectRoot] = process.argv.slice(2);
+
+  if (!command || !indexName || !projectRoot) {
+    process.stderr.write("Usage: knowledge-worker.ts <reindexAll|reindexFromChanges> <indexName> <projectRoot>\n");
+    process.exit(1);
+  }
+
+  // Create service with quiet=false so log() writes to stderr
+  const service = new KnowledgeService(projectRoot, { quiet: false });
+
+  try {
+    if (command === "reindexAll") {
+      const result = await service.reindexAll(indexName as IndexName);
+      // Write final result to stdout
+      process.stdout.write(JSON.stringify({
+        success: true,
+        files_indexed: result.files_indexed,
+        total_tokens: result.total_tokens,
+      }) + "\n");
+    } else if (command === "reindexFromChanges") {
+      // Read changes from stdin
+      const chunks: Buffer[] = [];
+      for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+      }
+      const changesJson = Buffer.concat(chunks).toString("utf-8");
+      const changes = JSON.parse(changesJson);
+
+      const result = await service.reindexFromChanges(indexName as IndexName, changes);
+      process.stdout.write(JSON.stringify({
+        success: result.success,
+        message: result.message,
+        files: result.files,
+      }) + "\n");
+    } else {
+      process.stderr.write(`Unknown command: ${command}\n`);
+      process.exit(1);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`[knowledge-worker] Error: ${message}\n`);
+    process.stdout.write(JSON.stringify({ success: false, error: message }) + "\n");
+    process.exit(1);
+  }
+
+  // Clean exit to release ONNX thread pools
+  process.exit(0);
+}
+
+main();