beth-copilot 1.0.18 → 2.0.0

package/templates/.github/hooks/scripts/inject-skills.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+
+/**
+ * Skill Enforcement Hook — SubagentStart
+ *
+ * Deterministic skill injection for subagents. When Beth (or any orchestrator)
+ * spawns a subagent, this hook maps agent_type → required skills and injects
+ * them as additionalContext. The LLM doesn't decide whether to load skills —
+ * this script does.
+ *
+ * Hook event: SubagentStart
+ * Input: JSON via stdin with agent_type field
+ * Output: JSON to stdout with hookSpecificOutput.additionalContext
+ */
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+// ─── Agent → Required Skills mapping ───────────────────────────────────────
+// This is the single source of truth for which skills each agent MUST use.
+// Update this map when adding new agents or skills.
+const AGENT_SKILLS = {
+  'ux-designer': {
+    inject: ['.github/skills/web-design-guidelines/SKILL.md'],
+    readFile: [
+      '.github/skills/framer-components/SKILL.md',
+      '.github/prompts/ui-ux-pro-max/PROMPT.md',
+    ],
+  },
+  'developer': {
+    inject: ['.github/skills/vercel-react-best-practices/SKILL.md'],
+    readFile: [
+      '.github/skills/shadcn-ui/SKILL.md',
+      '.github/skills/vercel-react-best-practices/AGENTS.md',
+    ],
+  },
+  'product-manager': {
+    inject: [],
+    readFile: ['.github/skills/prd/SKILL.md'],
+  },
+  'security-reviewer': {
+    inject: [],
+    readFile: ['.github/skills/security-analysis/SKILL.md'],
+  },
+  'tester': {
+    inject: ['.github/skills/web-design-guidelines/SKILL.md'],
+    readFile: [],
+  },
+  'researcher': {
+    inject: ['.github/skills/web-search/SKILL.md'],
+    readFile: [],
+  },
+};
+
+// ─── Read stdin ────────────────────────────────────────────────────────────
+let input = '';
+for await (const chunk of process.stdin) {
+  input += chunk;
+}
+
+let data;
+try {
+  data = JSON.parse(input);
+} catch {
+  // If we can't parse input, exit cleanly — don't block the subagent
+  process.stdout.write(JSON.stringify({ continue: true }));
+  process.exit(0);
+}
+
+const agentType = data.agent_type;
+const cwd = data.cwd || process.cwd();
+
+// ─── Look up skills for this agent ─────────────────────────────────────────
+const config = AGENT_SKILLS[agentType];
+
+if (!config) {
+  // Unknown agent type — no skill enforcement needed
+  process.stdout.write(JSON.stringify({ continue: true }));
+  process.exit(0);
+}
+
+// ─── Build the injection context ───────────────────────────────────────────
+const sections = [];
+
+sections.push('## ⚡ SKILL ENFORCEMENT — INJECTED BY HOOK (NON-NEGOTIABLE)');
+sections.push('');
+sections.push(`You are \`${agentType}\`. The following skills are MANDATORY for your work.`);
+sections.push('This context was injected by the skill-enforcement hook — not by your own instructions.');
+sections.push('You MUST apply these rules. Ignoring them is a compliance violation.');
+sections.push('');
+
+// Inject small skill files directly into context
+if (config.inject.length > 0) {
+  sections.push('### Skills loaded into context (apply immediately):');
+  sections.push('');
+
+  for (const skillPath of config.inject) {
+    try {
+      const fullPath = join(cwd, skillPath);
+      const content = readFileSync(fullPath, 'utf8');
+      sections.push(`#### ${skillPath}`);
+      sections.push('');
+      sections.push(content);
+      sections.push('');
+    } catch (err) {
+      sections.push(`> ⚠️ WARNING: Could not load ${skillPath}: ${err.message}`);
+      sections.push(`> You MUST use readFile to load this skill manually.`);
+      sections.push('');
+    }
+  }
+}
+
+// For larger skill files, mandate readFile as first action
+if (config.readFile.length > 0) {
+  sections.push('### Skills to load via readFile (MANDATORY FIRST STEP):');
+  sections.push('');
+  sections.push('Before doing ANY work, you MUST read these files using the readFile tool:');
+  sections.push('');
+  for (const skillPath of config.readFile) {
+    sections.push(`- \`${skillPath}\``);
+  }
+  sections.push('');
+  sections.push('Do NOT proceed with any task until you have read ALL of the above files.');
+  sections.push('After reading, briefly confirm which key patterns you will apply.');
+  sections.push('');
+}
+
+const additionalContext = sections.join('\n');
+
+// ─── Output ────────────────────────────────────────────────────────────────
+const output = {
+  continue: true,
+  hookSpecificOutput: {
+    hookEventName: 'SubagentStart',
+    additionalContext,
+  },
+};
+
+process.stdout.write(JSON.stringify(output));

package/templates/.github/hooks/scripts/verify-skills.mjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+/**
+ * Skill Verification Hook — SubagentStop / Agent Stop
+ *
+ * Fires when a subagent completes (or an agent stops). On the FIRST stop
+ * attempt, blocks and asks the agent to confirm it applied its required skills.
+ * On the second attempt (stop_hook_active=true), lets it through.
+ *
+ * This is a lightweight enforcement gate — not a deep analysis of output.
+ * The real skill content was already injected by inject-skills.mjs at
+ * SubagentStart. This hook just forces a final compliance check.
+ */
+
+let input = '';
+for await (const chunk of process.stdin) {
+  input += chunk;
+}
+
+let data;
+try {
+  data = JSON.parse(input);
+} catch {
+  process.stdout.write(JSON.stringify({ continue: true }));
+  process.exit(0);
+}
+
+// If this is a retry (stop_hook_active), let the agent complete
+if (data.stop_hook_active) {
+  process.stdout.write(JSON.stringify({ continue: true }));
+  process.exit(0);
+}
+
+// First stop attempt — block and request skill verification
+const output = {
+  hookSpecificOutput: {
+    hookEventName: 'Stop',
+    decision: 'block',
+    reason:
+      'Before finishing: Confirm you loaded and applied your MANDATORY skills. ' +
+      'If you were injected skill context by the enforcement hook, state which ' +
+      'key rules you applied. If you did NOT read your required skill files, ' +
+      'read them now and verify your work complies.',
+  },
+};
+
+process.stdout.write(JSON.stringify(output));

package/templates/.github/hooks/skill-enforcement.json

@@ -0,0 +1,18 @@
+{
+  "hooks": {
+    "SubagentStart": [
+      {
+        "type": "command",
+        "command": "node .github/hooks/scripts/inject-skills.mjs",
+        "timeout": 15
+      }
+    ],
+    "SubagentStop": [
+      {
+        "type": "command",
+        "command": "node .github/hooks/scripts/verify-skills.mjs",
+        "timeout": 10
+      }
+    ]
+  }
+}

package/templates/.github/pull_request_template.md

@@ -0,0 +1,48 @@
+## Summary
+
+<!-- Brief description of what this PR does -->
+
+## Changes
+
+<!-- List the specific changes made -->
+- 
+- 
+- 
+
+## Testing
+
+<!-- How you tested these changes -->
+
+- [ ] All existing tests pass (`npm test`)
+- [ ] Added new tests for new functionality
+- [ ] Manually verified changes work as expected
+
+## Security Considerations
+
+<!-- Any security implications or mitigations -->
+
+- [ ] No new security risks introduced
+- [ ] Security scans pass (`npm audit`, gitleaks)
+- [ ] Follows security guidelines in [SECURITY.md](../SECURITY.md)
+
+## Documentation
+
+- [ ] Updated relevant docs
+- [ ] Added/updated code comments
+- [ ] Updated [CHANGELOG.md](../CHANGELOG.md)
+
+## Checklist
+
+- [ ] Branch follows naming convention (see [CONTRIBUTING.md](../CONTRIBUTING.md))
+- [ ] Tests pass
+- [ ] Security scans pass
+- [ ] Documentation updated
+- [ ] Commit messages are descriptive
+- [ ] Changes are minimal and focused
+
+---
+
+<!-- 
+For more details, see CONTRIBUTING.md
+Questions? Open a discussion or ask in the PR comments.
+-->