azcodr 2.2.0 → 2.3.0

package/.agents/scripts/agent_guard.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+/**
+ * Cross-platform PreToolUse safety & architectural enforcement hook.
+ *
+ * Enforces:
+ *  1. Command safety (blocks destructive rm, force-push, drop db, etc.)
+ *  2. Refactor-Before-Add (blocks adding lines to files over line budget)
+ *  3. Test-First / RED-before-GREEN (when enabled)
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const selfDir = path.dirname(fileURLToPath(import.meta.url));
+const guardModulePath = path.resolve(selfDir, '../../lib/agent-guard.js');
+
+async function getGuardModule() {
+  return import(pathToFileURL(guardModulePath).href);
+}
+
+async function readStdin(timeoutMs = 1500) {
+  if (process.stdin.isTTY) return '';
+  return new Promise((resolve) => {
+    let acc = '';
+    const timer = setTimeout(() => resolve(acc), timeoutMs);
+    process.stdin.setEncoding('utf-8');
+    process.stdin.on('data', (chunk) => { acc += chunk; });
+    process.stdin.on('end', () => {
+      clearTimeout(timer);
+      resolve(acc);
+    });
+    process.stdin.on('error', () => {
+      clearTimeout(timer);
+      resolve(acc);
+    });
+  });
+}
+
+async function main() {
+  const argvInput = process.argv.slice(2).join(' ').trim();
+  const stdinInput = (await readStdin()).trim();
+  const rawInput = argvInput || stdinInput;
+
+  if (!rawInput) {
+    process.exit(0);
+  }
+
+  const { inspectPreTool } = await getGuardModule();
+  const decision = inspectPreTool(rawInput, {
+    workspaceRoot: process.cwd()
+  });
+
+  if (!decision.allowed) {
+    console.error(`🚨 Architectural Guard: ${decision.reason}`);
+    process.exit(1);
+  }
+
+  process.exit(0);
+}
+
+main().catch(() => process.exit(0));

package/.agents/skills/lets-build/SKILL.md

@@ -100,7 +100,7 @@ Upon user confirmation:
    - *Extension:* `manifest.json`, `src/background/index.ts`, `src/content/index.ts`, `src/popup/index.html`.
    - *Game / Engine:* `src/core/`, `src/ecs/`, asset manifest, frame loop entrypoint.
    - *CLI:* `src/cmd/`, `src/core/`, CLI entrypoint with exit code handling.
-3. Generate build manifests (`Cargo.toml`, `package.json`, `go.mod`, `pyproject.toml`), linter configurations, and boundary smoke test (`scripts/smoke_test.sh`).
+3. Generate build manifests (`Cargo.toml`, `package.json`, `go.mod`, `pyproject.toml`), deterministic linter configurations strictly enforcing the [Polyglot Fitness Function Standards](../../../docs/rules/clean_code.md#polyglot-fitness-function-standards), and boundary smoke test (`scripts/smoke_test.sh`).
 4. **Replace Starter README with Project-Specific README**:
    Generate a clean, project-specific `README.md` using [references/project_readme_template.md](./references/project_readme_template.md), completely replacing meta-template content with the project's actual name, mission, stack highlights, quickstart commands, and directory tree.
 

package/.github/workflows/ci.yml

@@ -84,6 +84,14 @@ jobs:
       - name: Verify Coverage Gates
         run: npm run test:coverage
 
+      - name: Upload Coverage Report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14
+
   shell-syntax:
     name: Shell Script Syntax (shipped hooks)
     runs-on: ubuntu-24.04

package/CONTRIBUTING.md

@@ -0,0 +1,79 @@
+# Contributing to azcodr
+
+Thank you for contributing to `azcodr`!
+
+This repository is governed by strict systemic atomicity, Clean Code fitness functions, and test-driven development.
+
+---
+
+## 🛠️ Development Setup
+
+### Prerequisites
+- Node.js `>=22.8.0` (required for native ESM VM modules)
+- npm `>=10.0.0`
+- Git
+
+### Installation
+Clone the repository and install exact-pinned development tooling:
+```bash
+git clone https://github.com/prosubodh/azcodr.git
+cd azcodr
+npm ci
+```
+
+---
+
+## 🧪 Verification & Quality Gates
+
+Before submitting any code changes, all 5 quality gates must pass with zero errors:
+
+1. **Type Checking:**
+   ```bash
+   npm run typecheck
+   ```
+2. **Production Build:**
+   ```bash
+   npm run build
+   ```
+3. **Clean Code Fitness Functions (ESLint):**
+   ```bash
+   npm run lint
+   ```
+   *Enforces:*
+   - Maximum 300 lines per file (including comments)
+   - Maximum 30 lines per function
+   - Cyclomatic complexity $\le 10$
+   - Maximum 3 parameters per function
+4. **Test Suite & Coverage Gate (Jest):**
+   ```bash
+   npm test
+   npm run test:coverage
+   ```
+   *Coverage gates enforced:*
+   - **100% lines coverage**
+   - **97% functions coverage**
+   - **98% branches coverage**
+5. **Agentic Architecture Validation:**
+   ```bash
+   npm run validate
+   ```
+   Validates root harness parity, progressive disclosure rules, skill formats, markdown links, and ADR ledger consistency.
+
+---
+
+## 🏛️ Architectural Invariants
+
+Every contribution must preserve these core invariants:
+- **Zero Runtime Dependencies:** `dependencies` in `package.json` must remain undefined. Runtime features rely strictly on Node.js standard builtins (`node:*`).
+- **Exact-Pinned DevDependencies:** Any tool in `devDependencies` must have an exact version (no `^`, `~`, or floating ranges) and committed `package-lock.json`.
+- **Refactor Before Adding:** When introducing changes, refactor structure first under existing green tests before adding new logic.
+- **Lightweight ADRs:** Significant architectural decisions or boundary changes must be recorded in `memory.md`.
+
+---
+
+## 🔄 Pull Request Guidelines
+
+1. Create a feature branch: `git checkout -b feat/your-feature-name`.
+2. Follow Conventional Commits: `feat(...)`, `fix(...)`, `docs(...)`, `test(...)`.
+3. Ensure all tests and validation pass locally (`npm run prepublishOnly`).
+4. Submit your pull request with a concise summary and verification evidence.

package/README.md

@@ -1,6 +1,7 @@
 # azcodr: Enterprise Architecture & Agentic Engineering Starter Template
 
-> **Production-ready, battle-tested software architecture governed by problem-first topology alignment, strict systemic atomicity, evolutionary architecture tipping points, 100% open-source standards, true incremental TDD nano-cycles, and zero speculative bloat.**
+> **Production-oriented architecture governance and topology-scoped scaffolding for AI-assisted development (early release).**  
+> *AI agents move fast. Architecture drifts. Azcodr turns architectural intent into executable constraints your agent cannot skip.*
 
 ---
 
@@ -8,7 +9,7 @@
 
 1. **Problem-First & Topology Alignment**: Architecture emerges strictly from problem constraints and execution targets (Problem-First; zero preemptive tool bias). Architectural styles match the problem topology: Hexagonal for enterprise backends, Platform Scripting for extensions, Data-Oriented Design for game engines, Command Pipeline for CLIs, and Game Loop for canvas games.
 2. **Systemic Atomicity**: Every rule, skill, database transaction, and code unit adheres to the Single Responsibility Principle (SRP)—indivisible, self-contained, orthogonal, and composable with zero conjunction naming.
-3. **Evolutionary Architecture & Refactor-Before-Add**: To eliminate AI-accelerated architectural drift, code graduates across 5 deterministic tipping points. Refactor structure first under existing green tests before implementing new features. Never append code into rotting files.
+3. **Evolutionary Architecture & Refactor-Before-Add**: To catch AI-accelerated architectural drift, code graduates across [5 deterministic tipping points](./docs/tipping-points.md). Refactor structure first under existing green tests before implementing new features. Never append code into rotting files.
 4. **True Incremental TDD & Nano-Cycles**: Prohibit batch-test dumps ("Test-First Waterfall"). Follow Uncle Bob's Three Laws: write one micro-assertion at a time, verify RED failure output, write minimal code to turn GREEN, and refactor under green with Ping-Pong pair programming.
 5. **100% Open-Source & Open Standards**: Standardized exclusively on open-source solutions and vendor-neutral specifications (OpenTelemetry, OPA, OpenFGA, Protocol Buffers, OpenAPI 3.1, JSON Schema Draft 2020-12, CloudEvents, Semgrep, Trivy, Gitleaks, Cosign).
 6. **Zero-Assumption Framework**: Ground truth is established solely through workspace configurations, code evidence, or direct user confirmation.
@@ -165,4 +166,4 @@ The scaffolder declares two expected capabilities:
 
 Failures carry stable machine-readable codes (`E_TARGET_NOT_EMPTY`, `E_GIT_BLOCKED`, `E_PATH_ESCAPE`, ...). Branch on `err.code`, never on message text — see the exported `ERROR_CODES` map and `ScaffoldError` type.
 
-Initial-commit fallback identity is `Subodh Khanal <prosubodh@gmail.com>` via `GIT_AUTHOR_*` / `GIT_COMMITTER_*` env (no `git -c` shell flags).
+Initial-commit fallback identity is `azcodr[bot] <bot@azcodr.internal>` via `GIT_AUTHOR_*` / `GIT_COMMITTER_*` env (no `git -c` shell flags).

package/SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.x     | :white_check_mark: |
+| 1.x     | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of `azcodr` and the architectures scaffolded with it seriously. If you discover a security vulnerability, please report it responsibly:
+
+1. **GitHub Private Vulnerability Reporting (Preferred):**  
+   Submit a private advisory directly through [GitHub Security Advisories](https://github.com/prosubodh/azcodr/security/advisories/new).
+2. **Email Disclosure:**  
+   Email `prosubodh+security@gmail.com` with:
+   - Detailed description of the vulnerability and potential impact.
+   - Minimal, reproducible steps or proof-of-concept payload.
+   - Affected subsystem (`src/guards.ts`, `src/scaffold.ts`, `.agents/scripts/`, etc.).
+
+### Response Commitments
+- **Initial Acknowledgment:** Within 48 hours.
+- **Triage & Reproduction:** Within 5 business days.
+- **Coordinated Disclosure:** Security patch release with accompanying advisory disclosure once remediated.
+
+### Scope & Hardening Invariants
+The core supply-chain invariants defended by `azcodr` include:
+- **Zero Runtime Dependencies:** Supply chain attack surface bounded to standard library Node.js builtins.
+- **Strict Process Isolation:** No shell-string execution (`execSync`/`exec` forbidden; `execFileSync` requires `shell: false`).
+- **Filesystem Containment:** Path boundary enforcement (`assertInside`) preventing directory traversal or escape.
+- **Target Protection:** Refusal to write into system root, user home directory, or ancestors (`isProtectedTarget`), even with `--force`.

package/data/memory.template

@@ -0,0 +1,36 @@
+# Workspace Memory, Architecture Decisions & Knowledge Hub
+
+> **Core Purpose:** Authoritative persistent memory ledger for the workspace repository (`./`), maintaining Lightweight Architectural Decision Records (ADRs), system topologies, and living domain contracts.
+
+---
+
+## 1. Quick Navigation & Knowledge Repositories
+
+- 📖 **[Living Ubiquitous Language Glossary](./docs/knowledge/ubiquitous_language.md)**: Authoritative, single-name domain vocabulary contract.
+- 📜 **[Lightweight ADR Master Index](#adr-master-index)**: Summary of all architectural decisions and direct links to governing rules.
+
+---
+
+## 2. Consolidated Architectural Decision Records (ADRs)
+
+### ADR Master Index
+
+| ID | Title | Date | Status | Governing Rule / Skill |
+|---|---|---|---|---|
+| *(No decisions recorded yet)* | *Record initial architecture decisions during Phase 3 of /lets-build.* | *YYYY-MM-DD* | *ACCEPTED* | *e.g. [`clean_code.md`](./docs/rules/clean_code.md)* |
+
+---
+
+### Lightweight Decision Summaries
+
+<!--
+Record project Architectural Decision Records (ADRs) below as decisions are finalized.
+Format:
+
+#### ADR-001: [Imperative Title]
+- **Date:** YYYY-MM-DD | **Status:** ACCEPTED
+- **Context:** Problem space, constraints, and operational context requiring a decision.
+- **Decision:** Chosen architecture, invariants, and implementation patterns.
+- **Consequences:** Positive benefits and deliberate trade-offs accepted.
+- **Enforced In:** Relevant rule files in docs/rules/ or code paths.
+-->

package/docs/rules/clean_code.md

@@ -60,3 +60,16 @@ Prevent AI-generated code rot using automated fitness functions integrated into
 - **Dependency Direction Gates**: Enforce unidirectional import rules (e.g. `import/no-restricted-paths`, `dependency-cruiser`, `ArchUnit`) ensuring domain core never imports infrastructure or transport adapters.
 - **Complexity Budgets**: Enforce cyclomatic complexity limits (maximum 10 per function).
 If an AI attempt to add code violates any fitness function, the build fails immediately, blocking completion until the architecture is refactored.
+
+### Polyglot Fitness Function Standards
+
+When bootstrapping non-TypeScript projects via `/lets-build`, the agent must instantiate deterministic, automated fitness function gates matching these exact rules:
+
+| Language | Linter / Static Tool | Max File Lines (300) | Max Function Lines (30) | Max Complexity (10) | Max Arguments (3) |
+|---|---|---|---|---|---|
+| **TypeScript / Node** | `eslint` | `max-lines: [error, 300]` | `max-lines-per-function: [error, 30]` | `complexity: [error, 10]` | `max-params: [error, 3]` |
+| **Python** | `ruff` + `flake8` | `flake8-lines: max-line-count = 300` | `flake8-functions: max-function-length = 30` | `mccabe: max-complexity = 10` | `flake8-functions: max-parameters = 3` |
+| **Rust** | `cargo clippy` | `#![deny(clippy::too_many_lines)]` | `clippy::too_many_lines = 30` | `clippy::cognitive_complexity = 10` | `clippy::too_many_arguments = 3` |
+| **Go** | `golangci-lint` | `maintidx: 300` | `funlen: lines = 30` | `gocyclo: min-complexity = 10` | `funlen: statements = 25` |
+| **Java** | `Checkstyle` + `ArchUnit` | `FileLength: max 300` | `MethodLength: max 30` | `CyclomaticComplexity: max 10` | `ParameterNumber: max 3` |
+| **C# / .NET** | `.editorconfig` + Roslyn | `file_length = 300:error` | `method_length = 30:error` | `CA1502: Avoid excessive complexity <= 10` | `CA1501: max 3 params` |

package/docs/tipping-points.md

@@ -0,0 +1,37 @@
+# Deterministic Architectural Tipping Points
+
+> **Core Mandate:** Architecture evolves incrementally as complexity grows. AI coding agents naturally take the path of least resistance (local token minimization), repeatedly appending code to simple files until they rot into a Big Ball of Mud. Whenever code crosses one of the 5 Deterministic Tipping Points, the agent must pause and execute an architectural refactor under green tests before adding new features.
+
+---
+
+## The 5 Deterministic Tipping Points
+
+| # | Simple Baseline (Day 1) | Tipping Point / Mutation Trigger | Required Architectural Upgrade |
+|---|---|---|---|
+| **1** | **Flat Script / Single File** | File exceeds **250 lines**, coordinates **>2 distinct I/O resources**, or is imported by **>3 distinct callers**. | **Extract Modular Subsystems:** Decouple domain logic from platform I/O; split into dedicated, cohesive submodules. |
+| **2** | **Inline Branching (`if/else` / `switch`)** | **Rule of Three:** The 3rd branching variant, payment provider, or protocol format is introduced. | **Strategy Pattern / Registry:** Replace conditional cascades with a polymorphic Strategy interface or handler registry; update `memory.md`. |
+| **3** | **In-Memory Store / Global State** | State requires **concurrent mutations**, **persistence across restarts**, or **transactional rollback**. | **Repository Pattern & Persistence Port:** Introduce an explicit storage port contract; swap in-memory mock for a persistent database adapter. |
+| **4** | **Direct Platform / Third-Party SDK Calls** | External SDK or platform API is called from **>2 places**, or throws untyped exceptions across boundaries. | **Adapter Pattern (Anti-Corruption Layer):** Wrap external SDK inside an application-owned port interface; mock only the owned interface in tests. |
+| **5** | **Monolithic Domain Model** | The same business noun represents divergent lifecycles or definitions across workflows (e.g. `User` in Auth vs `User` in Billing). | **Bounded Context Split:** Separate into isolated domain contexts with explicit DTO / Anti-Corruption translation between them. |
+
+---
+
+## Refactor-Before-Add Protocol (Kent Beck's Rule)
+
+> *"Make the change easy (warning: this may be hard), then make the easy change."* — Kent Beck
+
+Before writing production code for any new feature or user story:
+
+1. **Assess Tipping Points**: Will adding this requirement cause any module, function, or data structure to cross an architectural tipping point?
+2. **Phase A — Structural Refactoring (Under Green)**: If yes, refactor the existing architecture *first* while existing test suites remain 100% green. Zero behavioral changes; purely structural evolution.
+3. **Phase B — ADR Mutation**: When an architectural tipping point is crossed, log a Lightweight Architectural Decision Record in `memory.md` summarizing the new structural boundary and trade-off.
+4. **Phase C — Feature Implementation (Inner TDD)**: Only once the architecture cleanly accommodates the new capability, write the failing micro-test and implement the feature.
+
+---
+
+## References
+
+- [Clean Code & Pragmatic Directives](./rules/clean_code.md)
+- [Design Patterns & Result Types](./rules/design_patterns.md)
+- [Domain-Driven Design](./rules/domain_driven_design.md)
+- [Test-Driven Development](./rules/test_driven_development.md)

package/lib/agent-guard-command.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Command safety guard inspecting shell commands against a destructive denylist.
+ */
+export interface CommandViolation {
+    blocked: boolean;
+    reason?: string;
+    command?: string;
+}
+export interface DenylistRule {
+    pattern: RegExp;
+    reason: string;
+}
+export declare const DESTRUCTIVE_RULES: readonly DenylistRule[];
+export declare function normalizeCommand(raw: string): string;
+/**
+ * Checks a command string against the safety denylist.
+ *
+ * @param command - Raw shell command string.
+ * @returns Violation details if blocked, or clean outcome.
+ */
+export declare function inspectCommand(command: string): CommandViolation;
+declare const _default: {
+    DESTRUCTIVE_RULES: readonly DenylistRule[];
+    normalizeCommand: typeof normalizeCommand;
+    inspectCommand: typeof inspectCommand;
+};
+export default _default;
+//# sourceMappingURL=agent-guard-command.d.ts.map

package/lib/agent-guard-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guard-command.d.ts","sourceRoot":"","sources":["../src/agent-guard-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,iBAAiB,EAAE,SAAS,YAAY,EAyEpD,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAehE;;;;;;AAED,wBAAuE"}

package/lib/agent-guard-command.js

@@ -0,0 +1,103 @@
+/**
+ * Command safety guard inspecting shell commands against a destructive denylist.
+ */
+export const DESTRUCTIVE_RULES = [
+    {
+        pattern: /\brm\s+(-[a-z-]*[rf][a-z-]*\s+)+(\/|\/\*|~|~\/\*|\$home|\$\{home\}|\.|\.\.|\.\/|[a-z]:\\|[a-z]:\/)/i,
+        reason: 'destructive rm targeting root, home, drive, or the current directory'
+    },
+    {
+        pattern: /(^|\s)rm\s+(-[a-z-]*\s+)*(\/|~|[a-z]:\\|[a-z]:\/)($|\s)/i,
+        reason: 'destructive rm targeting root or home'
+    },
+    {
+        pattern: /\brm\s+--recursive.*--force\s+(\/|~|\$home|\.)/i,
+        reason: 'destructive rm using long-form flags'
+    },
+    {
+        pattern: /\brm\s+.*--no-preserve-root/i,
+        reason: 'rm --no-preserve-root is forbidden under agent execution'
+    },
+    {
+        pattern: /\b(wipefs\s+-a|shred\s+-u|find\s+.*-delete)\b/i,
+        reason: 'irreversible disk or mass-delete operation'
+    },
+    {
+        pattern: /\bgit\s+push\s+.*(-f|--force|--mirror)\b/i,
+        reason: 'force-push or mirror-push can destroy remote history'
+    },
+    {
+        pattern: /\bgit\s+push\b.*--force-with-lease\b/i,
+        reason: 'force-push variant detected'
+    },
+    {
+        pattern: /\bgit\s+(reset\s+--hard|clean\s+-[a-z]*[fd])/i,
+        reason: 'destructive git worktree operation (reset --hard / clean)'
+    },
+    {
+        pattern: /\bgit\s+checkout\s+--\s+\./i,
+        reason: 'git checkout -- . discards all uncommitted work'
+    },
+    {
+        pattern: /\bgit\s+branch\s+-D\b/i,
+        reason: 'force branch delete'
+    },
+    {
+        pattern: /\b(drop\s+(database|schema|table)|truncate\s+(table\s+)?[a-z_])/i,
+        reason: 'destructive SQL DDL'
+    },
+    {
+        pattern: /\b(delete\s+from|update\s+[a-z_]+\s+set|alter\s+table)\b/i,
+        reason: 'destructive SQL DML'
+    },
+    {
+        pattern: /\b(grant\s+all|revoke\s+all)\b/i,
+        reason: 'privilege escalation in SQL'
+    },
+    {
+        pattern: /\b(mkfs|dd\s+if=|fdisk|parted\s+\/dev)\b/i,
+        reason: 'raw disk operation'
+    },
+    {
+        pattern: /(:[\s]*\([\s]*\)[\s]*\{|:[\s]*\|[\s]*:)/,
+        reason: 'fork bomb'
+    },
+    {
+        pattern: /\b(curl|wget)\s+.*\|\s*(sudo\s+)?(ba)?sh\b/i,
+        reason: 'piping download directly into shell execution'
+    },
+    {
+        pattern: /\b(base64\s+-d|base64\s+--decode)\s+.*\|/i,
+        reason: 'decoding encoded payload into a pipe'
+    },
+    {
+        pattern: /\b(npm|yarn|pnpm)\s+publish\b/i,
+        reason: 'package publish must run via release workflow, not ad-hoc tool call'
+    }
+];
+export function normalizeCommand(raw) {
+    return raw.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+/**
+ * Checks a command string against the safety denylist.
+ *
+ * @param command - Raw shell command string.
+ * @returns Violation details if blocked, or clean outcome.
+ */
+export function inspectCommand(command) {
+    const normalized = normalizeCommand(command);
+    if (!normalized)
+        return { blocked: false };
+    for (const rule of DESTRUCTIVE_RULES) {
+        if (rule.pattern.test(normalized)) {
+            return {
+                blocked: true,
+                reason: rule.reason,
+                command: normalized.slice(0, 300)
+            };
+        }
+    }
+    return { blocked: false, command: normalized };
+}
+export default { DESTRUCTIVE_RULES, normalizeCommand, inspectCommand };
+//# sourceMappingURL=agent-guard-command.js.map

package/lib/agent-guard-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guard-command.js","sourceRoot":"","sources":["../src/agent-guard-command.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,MAAM,CAAC,MAAM,iBAAiB,GAA4B;IACxD;QACE,OAAO,EAAE,qGAAqG;QAC9G,MAAM,EAAE,sEAAsE;KAC/E;IACD;QACE,OAAO,EAAE,0DAA0D;QACnE,MAAM,EAAE,uCAAuC;KAChD;IACD;QACE,OAAO,EAAE,iDAAiD;QAC1D,MAAM,EAAE,sCAAsC;KAC/C;IACD;QACE,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,0DAA0D;KACnE;IACD;QACE,OAAO,EAAE,gDAAgD;QACzD,MAAM,EAAE,4CAA4C;KACrD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,sDAAsD;KAC/D;IACD;QACE,OAAO,EAAE,uCAAuC;QAChD,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,+CAA+C;QACxD,MAAM,EAAE,2DAA2D;KACpE;IACD;QACE,OAAO,EAAE,6BAA6B;QACtC,MAAM,EAAE,iDAAiD;KAC1D;IACD;QACE,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,kEAAkE;QAC3E,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,2DAA2D;QACpE,MAAM,EAAE,qBAAqB;KAC9B;IACD;QACE,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE,6BAA6B;KACtC;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,oBAAoB;KAC7B;IACD;QACE,OAAO,EAAE,yCAAyC;QAClD,MAAM,EAAE,WAAW;KACpB;IACD;QACE,OAAO,EAAE,6CAA6C;QACtD,MAAM,EAAE,+CAA+C;KACxD;IACD;QACE,OAAO,EAAE,2CAA2C;QACpD,MAAM,EAAE,sCAAsC;KAC/C;IACD;QACE,OAAO,EAAE,gCAAgC;QACzC,MAAM,EAAE,qEAAqE;KAC9E;CACF,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aAClC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC"}

package/lib/agent-guard-file.d.ts

@@ -0,0 +1,32 @@
+export declare const DEFAULT_MAX_FILE_LINES = 300;
+export interface FileCheckInput {
+    filePath: string;
+    incomingContent?: string;
+    replacementContent?: string;
+    targetContent?: string;
+    maxLines?: number;
+}
+export interface FileCheckResult {
+    blocked: boolean;
+    reason?: string;
+    currentLines: number;
+    projectedLines: number;
+    maxLines: number;
+}
+export declare function countLines(text: string): number;
+export declare function readExistingLines(filePath: string): number;
+/**
+ * Checks a proposed file write or edit against Refactor-Before-Add rules.
+ *
+ * @param input - File path and proposed content.
+ * @returns Decision result indicating whether the write is blocked.
+ */
+export declare function inspectFileWrite(input: FileCheckInput): FileCheckResult;
+declare const _default: {
+    DEFAULT_MAX_FILE_LINES: number;
+    countLines: typeof countLines;
+    readExistingLines: typeof readExistingLines;
+    inspectFileWrite: typeof inspectFileWrite;
+};
+export default _default;
+//# sourceMappingURL=agent-guard-file.d.ts.map

package/lib/agent-guard-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guard-file.d.ts","sourceRoot":"","sources":["../src/agent-guard-file.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG/C;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ1D;AAgDD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAWvE;;;;;;;AAED,wBAKE"}

package/lib/agent-guard-file.js

@@ -0,0 +1,77 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export const DEFAULT_MAX_FILE_LINES = 300;
+export function countLines(text) {
+    if (!text)
+        return 0;
+    return text.split('\n').length;
+}
+export function readExistingLines(filePath) {
+    if (!fs.existsSync(filePath))
+        return 0;
+    try {
+        const content = fs.readFileSync(filePath, 'utf-8');
+        return countLines(content);
+    }
+    catch {
+        return 0;
+    }
+}
+function calculateProjectedLines(currentLines, input) {
+    if (input.incomingContent !== undefined) {
+        return countLines(input.incomingContent);
+    }
+    if (input.replacementContent !== undefined) {
+        const addedLines = countLines(input.replacementContent);
+        const removedLines = input.targetContent !== undefined ? countLines(input.targetContent) : 1;
+        return Math.max(0, currentLines + addedLines - removedLines);
+    }
+    return currentLines;
+}
+function evaluateLineThresholds(params) {
+    const { filePath, currentLines, projectedLines, maxLines } = params;
+    const base = { currentLines, projectedLines, maxLines };
+    const relPath = path.basename(filePath);
+    if (currentLines > maxLines) {
+        if (projectedLines >= currentLines) {
+            return {
+                ...base,
+                blocked: true,
+                reason: `Refactor-Before-Add violation: '${relPath}' currently has ${currentLines} lines (limit: ${maxLines}). Adding or maintaining lines in an overflowing file is blocked. Refactor into modular units under green tests first.`
+            };
+        }
+        return { ...base, blocked: false };
+    }
+    if (projectedLines > maxLines) {
+        return {
+            ...base,
+            blocked: true,
+            reason: `File line budget exceeded: '${relPath}' would grow to ${projectedLines} lines (limit: ${maxLines}). Decompose into modular components before appending more code.`
+        };
+    }
+    return { ...base, blocked: false };
+}
+/**
+ * Checks a proposed file write or edit against Refactor-Before-Add rules.
+ *
+ * @param input - File path and proposed content.
+ * @returns Decision result indicating whether the write is blocked.
+ */
+export function inspectFileWrite(input) {
+    const maxLines = input.maxLines ?? DEFAULT_MAX_FILE_LINES;
+    const currentLines = readExistingLines(input.filePath);
+    const projectedLines = calculateProjectedLines(currentLines, input);
+    return evaluateLineThresholds({
+        filePath: input.filePath,
+        currentLines,
+        projectedLines,
+        maxLines
+    });
+}
+export default {
+    DEFAULT_MAX_FILE_LINES,
+    countLines,
+    readExistingLines,
+    inspectFileWrite
+};
+//# sourceMappingURL=agent-guard-file.js.map

package/lib/agent-guard-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guard-file.js","sourceRoot":"","sources":["../src/agent-guard-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAkB1C,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB,EAAE,KAAqB;IAC1E,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AASD,SAAS,sBAAsB,CAAC,MAAuB;IACrD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpE,MAAM,IAAI,GAAG,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;QAC5B,IAAI,cAAc,IAAI,YAAY,EAAE,CAAC;YACnC,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,mCAAmC,OAAO,mBAAmB,YAAY,kBAAkB,QAAQ,wHAAwH;aACpO,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,cAAc,GAAG,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,+BAA+B,OAAO,mBAAmB,cAAc,kBAAkB,QAAQ,kEAAkE;SAC5K,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,sBAAsB,CAAC;IAC1D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAEpE,OAAO,sBAAsB,CAAC;QAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY;QACZ,cAAc;QACd,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,eAAe;IACb,sBAAsB;IACtB,UAAU;IACV,iBAAiB;IACjB,gBAAgB;CACjB,CAAC"}

package/lib/agent-guard-tdd.d.ts

@@ -0,0 +1,34 @@
+export interface SessionTddState {
+    lastFailingTestRecorded: boolean;
+    lastTestRunTime?: number;
+    lastTestPath?: string;
+}
+export interface TddCheckResult {
+    blocked: boolean;
+    reason?: string;
+    isProductionFile: boolean;
+}
+export declare function isTestFile(filePath: string): boolean;
+export declare function isNonCodeFile(filePath: string): boolean;
+export declare function isProductionFile(filePath: string): boolean;
+export declare function readTddState(stateFile: string): SessionTddState;
+export declare function writeTddState(stateFile: string, state: SessionTddState): void;
+/**
+ * Checks whether an edit to a file is allowed under RED-before-GREEN TDD rules.
+ *
+ * @param filePath - Path to file being edited.
+ * @param state - Current session TDD state.
+ * @param enforceTestFirst - Whether test-first enforcement is strictly enabled.
+ * @returns Decision result indicating whether edit is blocked.
+ */
+export declare function inspectTddRequirement(filePath: string, state: SessionTddState, enforceTestFirst?: boolean): TddCheckResult;
+declare const _default: {
+    isTestFile: typeof isTestFile;
+    isNonCodeFile: typeof isNonCodeFile;
+    isProductionFile: typeof isProductionFile;
+    readTddState: typeof readTddState;
+    writeTddState: typeof writeTddState;
+    inspectTddRequirement: typeof inspectTddRequirement;
+};
+export default _default;
+//# sourceMappingURL=agent-guard-tdd.d.ts.map

package/lib/agent-guard-tdd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-guard-tdd.d.ts","sourceRoot":"","sources":["../src/agent-guard-tdd.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,uBAAuB,EAAE,OAAO,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMpD;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAU/D;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI,CAQ7E;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,EACtB,gBAAgB,GAAE,OAAe,GAChC,cAAc,CAgBhB;;;;;;;;;AAED,wBAOE"}