bigpowers 2.83.4 → 2.84.0

package/scripts/adapters/opencode.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# story: e62s01
+# scenario: SC-e62s01-P1-01
+# OpenCode skill adapter — renders .opencode/skills from SkillIR.
+
+opencode_is_unsafe_skill_name() {
+  local name="$1"
+  [[ -z "$name" || "$name" == "null" || "$name" == *"/"* || "$name" == *".."* ]]
+}
+
+opencode_sanitize_name() {
+  local name="$1"
+  if opencode_is_unsafe_skill_name "$name"; then
+    echo "opencode: invalid skill name: ${name:-<empty>}" >&2
+    return 1
+  fi
+  printf '%s' "$name"
+}
+
+render_skill() {
+  local safe_name
+  safe_name=$(opencode_sanitize_name "${IR_NAME:-}") || return 1
+  local out="${OPENCODE_SKILLS:-.opencode/skills}"
+  mkdir -p "$out/$safe_name"
+
+  if [[ -n "${SKILL_MD_PATH:-}" && -f "$SKILL_MD_PATH" ]]; then
+    cp "$SKILL_MD_PATH" "$out/$safe_name/SKILL.md"
+    return 0
+  fi
+
+  {
+    echo "---"
+    echo "name: $safe_name"
+    [[ -n "${IR_MODEL:-}" && "$IR_MODEL" != "null" ]] && echo "model: $IR_MODEL"
+    echo "description: \"${IR_DESC_ESCAPED:-}\""
+    echo "---"
+    echo ""
+    echo "${IR_BODY:-}"
+  } > "$out/$safe_name/SKILL.md"
+}
+
+
+wire_context() {
+  source "$(dirname "${BASH_SOURCE[0]}")/../lib/context-wire.sh"
+  wire_context_mode symlink "${1:-AGENTS.md}"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
+  JSON_INPUT=$(cat)
+  if [[ -n "$JSON_INPUT" ]]; then
+    IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')
+    IR_MODEL=$(echo "$JSON_INPUT" | jq -r '.model')
+    IR_DESCRIPTION=$(echo "$JSON_INPUT" | jq -r '.description')
+    IR_BODY=$(echo "$JSON_INPUT" | jq -r '.body')
+    IR_DESC_ESCAPED=$(echo "$IR_DESCRIPTION" | sed 's/\\/\\\\/g; s/\"/\\"/g')
+    render_skill
+  fi
+fi

package/scripts/adapters/qwen.sh

@@ -1,6 +1,58 @@
 #!/usr/bin/env bash
-# story: e37s11
+# story: e68s01
+# scenario: SC-e68s01-P1-01
+# Qwen Code skill adapter — renders .qwen/skills from SkillIR.
+
+qwen_is_unsafe_skill_name() {
+  local name="$1"
+  [[ -z "$name" || "$name" == "null" || "$name" == *"/"* || "$name" == *".."* ]]
+}
+
+qwen_sanitize_name() {
+  local name="$1"
+  if qwen_is_unsafe_skill_name "$name"; then
+    echo "qwen: invalid skill name: ${name:-<empty>}" >&2
+    return 1
+  fi
+  printf '%s' "$name"
+}
+
+render_skill() {
+  local safe_name
+  safe_name=$(qwen_sanitize_name "${IR_NAME:-}") || return 1
+  local out="${QWEN_SKILLS:-.qwen/skills}"
+  mkdir -p "$out/$safe_name"
+
+  if [[ -n "${SKILL_MD_PATH:-}" && -f "$SKILL_MD_PATH" ]]; then
+    cp "$SKILL_MD_PATH" "$out/$safe_name/SKILL.md"
+    return 0
+  fi
+
+  {
+    echo "---"
+    echo "name: $safe_name"
+    [[ -n "${IR_MODEL:-}" && "$IR_MODEL" != "null" ]] && echo "model: $IR_MODEL"
+    echo "description: \"${IR_DESC_ESCAPED:-}\""
+    echo "---"
+    echo ""
+    echo "${IR_BODY:-}"
+  } > "$out/$safe_name/SKILL.md"
+}
+
+
 wire_context() {
   source "$(dirname "${BASH_SOURCE[0]}")/../lib/context-wire.sh"
   wire_context_mode symlink "${1:-QWEN.md}"
 }
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
+  JSON_INPUT=$(cat)
+  if [[ -n "$JSON_INPUT" ]]; then
+    IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')
+    IR_MODEL=$(echo "$JSON_INPUT" | jq -r '.model')
+    IR_DESCRIPTION=$(echo "$JSON_INPUT" | jq -r '.description')
+    IR_BODY=$(echo "$JSON_INPUT" | jq -r '.body')
+    IR_DESC_ESCAPED=$(echo "$IR_DESCRIPTION" | sed 's/\\/\\\\/g; s/\"/\\"/g')
+    render_skill
+  fi
+fi

package/scripts/adapters/trae.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# story: e70s01
+# scenario: SC-e70s01-P1-01
+# Trae skill adapter — renders .trae/skills from SkillIR.
+
+trae_is_unsafe_skill_name() {
+  local name="$1"
+  [[ -z "$name" || "$name" == "null" || "$name" == *"/"* || "$name" == *".."* ]]
+}
+
+trae_sanitize_name() {
+  local name="$1"
+  if trae_is_unsafe_skill_name "$name"; then
+    echo "trae: invalid skill name: ${name:-<empty>}" >&2
+    return 1
+  fi
+  printf '%s' "$name"
+}
+
+render_skill() {
+  local safe_name
+  safe_name=$(trae_sanitize_name "${IR_NAME:-}") || return 1
+  local out="${TRAE_SKILLS:-.trae/skills}"
+  mkdir -p "$out/$safe_name"
+
+  if [[ -n "${SKILL_MD_PATH:-}" && -f "$SKILL_MD_PATH" ]]; then
+    cp "$SKILL_MD_PATH" "$out/$safe_name/SKILL.md"
+    return 0
+  fi
+
+  {
+    echo "---"
+    echo "name: $safe_name"
+    [[ -n "${IR_MODEL:-}" && "$IR_MODEL" != "null" ]] && echo "model: $IR_MODEL"
+    echo "description: \"${IR_DESC_ESCAPED:-}\""
+    echo "---"
+    echo ""
+    echo "${IR_BODY:-}"
+  } > "$out/$safe_name/SKILL.md"
+}
+
+
+wire_context() {
+  source "$(dirname "${BASH_SOURCE[0]}")/../lib/context-wire.sh"
+  wire_context_mode symlink "${1:-AGENTS.md}"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
+  JSON_INPUT=$(cat)
+  if [[ -n "$JSON_INPUT" ]]; then
+    IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')
+    IR_MODEL=$(echo "$JSON_INPUT" | jq -r '.model')
+    IR_DESCRIPTION=$(echo "$JSON_INPUT" | jq -r '.description')
+    IR_BODY=$(echo "$JSON_INPUT" | jq -r '.body')
+    IR_DESC_ESCAPED=$(echo "$IR_DESCRIPTION" | sed 's/\\/\\\\/g; s/\"/\\"/g')
+    render_skill
+  fi
+fi

package/scripts/adapters/windsurf.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# story: e73s01
+# scenario: SC-e73s01-P1-01
+# Windsurf skill adapter — renders .windsurf/rules from SkillIR.
+
+windsurf_is_unsafe_skill_name() {
+  local name="$1"
+  [[ -z "$name" || "$name" == "null" || "$name" == *"/"* || "$name" == *".."* ]]
+}
+
+windsurf_sanitize_name() {
+  local name="$1"
+  if windsurf_is_unsafe_skill_name "$name"; then
+    echo "windsurf: invalid skill name: ${name:-<empty>}" >&2
+    return 1
+  fi
+  printf '%s' "$name"
+}
+
+render_skill() {
+  local safe_name
+  safe_name=$(windsurf_sanitize_name "${IR_NAME:-}") || return 1
+  local out="${WINDSURF_RULES:-.windsurf/rules}"
+  mkdir -p "$out"
+  {
+    echo "---"
+    echo "name: $safe_name"
+    [[ -n "${IR_MODEL:-}" && "$IR_MODEL" != "null" ]] && echo "model: $IR_MODEL"
+    echo "description: \"${IR_DESC_ESCAPED:-}\""
+    echo "---"
+    echo ""
+    echo "${IR_BODY:-}"
+  } > "$out/$safe_name.md"
+}
+
+
+wire_context() {
+  source "$(dirname "${BASH_SOURCE[0]}")/../lib/context-wire.sh"
+  wire_context_mode copy "${1:-AGENTS.md}"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] && [[ ! -t 0 ]]; then
+  JSON_INPUT=$(cat)
+  if [[ -n "$JSON_INPUT" ]]; then
+    IR_NAME=$(echo "$JSON_INPUT" | jq -r '.name')
+    IR_MODEL=$(echo "$JSON_INPUT" | jq -r '.model')
+    IR_DESCRIPTION=$(echo "$JSON_INPUT" | jq -r '.description')
+    IR_BODY=$(echo "$JSON_INPUT" | jq -r '.body')
+    IR_DESC_ESCAPED=$(echo "$IR_DESCRIPTION" | sed 's/\\/\\\\/g; s/\"/\\"/g')
+    render_skill
+  fi
+fi

package/scripts/bp-yaml-set.sh

@@ -3,6 +3,8 @@
 # Usage: bp-yaml-set.sh <file> <dotted.key> <value>
 set -euo pipefail
 source "$(dirname "${BASH_SOURCE[0]}")/lib/python-env.sh"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 FILE="${1:?file}"
 KEY="${2:?dotted.key}"
 VAL="${3:?value}"

package/scripts/generate-wave-b-hub.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+# story: e45s22
+"""Apply Wave B install hub wiring for fleet integration epics."""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_LIB = Path(__file__).resolve().parent / "lib"
+if str(_LIB) not in sys.path:
+    sys.path.insert(0, str(_LIB))
+
+from wave_b_hub_patch import apply_epic  # noqa: E402
+from wave_b_hub_config import HUB_EPICS  # noqa: E402
+
+def main(argv: list[str]) -> int:
+    if len(argv) < 2:
+        print("Usage: generate-wave-b-hub.py <e65|e68|...|all>", file=sys.stderr)
+        return 1
+    target = argv[1]
+    ids = list(HUB_EPICS.keys()) if target == "all" else [target]
+    for eid in ids:
+        if eid not in HUB_EPICS:
+            print(f"Unknown epic: {eid}", file=sys.stderr)
+            return 1
+        apply_epic(eid)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))

package/scripts/hooks/cline/HOOKS.md

@@ -0,0 +1,16 @@
+# Cline Hook Templates (Wave A)
+
+Shipped under `scripts/hooks/cline/` — copy to user config in Wave B.
+
+## Events
+
+- `tool.execute.before`
+- `tool.execute.after`
+- `session`
+- `message`
+- `permission`
+
+## Security
+
+Templates use fixed guard logic only — no dynamic eval.
+

package/scripts/hooks/cline/hooks-manifest.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "target": "cline",
+  "events_total": 5,
+  "events": [
+    "tool.execute.before",
+    "tool.execute.after",
+    "session",
+    "message",
+    "permission"
+  ]
+}

package/scripts/hooks/cline/plugin/guard-git-plugin.ts

@@ -0,0 +1,16 @@
+// story: e66s01
+// scenario: SC-e66s01-P1-03
+// cline plugin hook template — register tool guards (no dynamic eval).
+
+export function register(ctx: { registerHook: (event: string, fn: Function) => void }) {
+  const events = ["tool.execute.before", "tool.execute.after", "session"] as const;
+  for (const event of events) {
+    ctx.registerHook(event, async (payload: { command?: string }) => {
+      const cmd = payload?.command ?? "";
+      if (/git push --force|reset --hard|rm -rf \//.test(cmd)) {
+        return { decision: "block", reason: "BLOCKED: dangerous command pattern" };
+      }
+      return { decision: "allow" };
+    });
+  }
+}

package/scripts/hooks/codebuddy/HOOKS.md

@@ -0,0 +1,24 @@
+# CodeBuddy Hook Templates (Wave A)
+
+Shipped under `scripts/hooks/codebuddy/` — copy to user config in Wave B.
+
+## Events
+
+- `PreToolUse`
+- `PostToolUse`
+- `PostToolUseFailure`
+- `SessionStart`
+- `SessionEnd`
+- `Stop`
+- `SubagentStart`
+- `SubagentStop`
+- `UserPromptSubmit`
+- `Notification`
+- `PermissionRequest`
+- `PreCompact`
+- `PostCompact`
+
+## Security
+
+Templates use fixed guard logic only — no dynamic eval.
+

package/scripts/hooks/codebuddy/hooks-manifest.json

@@ -0,0 +1,20 @@
+{
+  "schema_version": 1,
+  "target": "codebuddy",
+  "events_total": 13,
+  "events": [
+    "PreToolUse",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "SessionStart",
+    "SessionEnd",
+    "Stop",
+    "SubagentStart",
+    "SubagentStop",
+    "UserPromptSubmit",
+    "Notification",
+    "PermissionRequest",
+    "PreCompact",
+    "PostCompact"
+  ]
+}

package/scripts/hooks/codebuddy/pre-tool-git-guard.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# story: e72s01
+# scenario: SC-e72s01-P2-02
+# codebuddy hook template — blocks dangerous terminal/git commands (fixed guard logic).
+set -euo pipefail
+
+INPUT=$(cat)
+CMD=$(echo "$INPUT" | jq -r '.tool_input.command // .tool_input.cmd // .command // empty')
+
+if [[ -z "$CMD" ]]; then
+  exit 0
+fi
+
+case "$CMD" in
+  *'git push --force'*|*'git push -f '*|*'reset --hard'*|*'git clean -f'*|*'rm -rf /'*)
+    jq -nc --arg reason "BLOCKED: dangerous command pattern" \
+      '{decision: "block", reason: $reason, hookVersion: "1.0.0"}'
+    exit 0
+    ;;
+esac
+
+exit 0

package/scripts/hooks/codebuddy/settings.example.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "type": "command",
+        "command": "bash scripts/hooks/codebuddy/pre-tool-git-guard.sh"
+      }
+    ],
+    "PostToolUse": [
+      {
+        "type": "command",
+        "command": "bash scripts/hooks/codebuddy/pre-tool-git-guard.sh"
+      }
+    ]
+  }
+}

package/scripts/hooks/codex/HOOKS.md

@@ -0,0 +1,21 @@
+# Codex CLI Hook Templates (Wave A)
+
+Shipped under `scripts/hooks/codex/` — copy to user config in Wave B.
+
+## Events
+
+- `PreToolUse`
+- `PostToolUse`
+- `SessionStart`
+- `PermissionRequest`
+- `PreCompact`
+- `PostCompact`
+- `UserPromptSubmit`
+- `SubagentStart`
+- `SubagentStop`
+- `Stop`
+
+## Security
+
+Templates use fixed guard logic only — no dynamic eval.
+

package/scripts/hooks/codex/hooks-manifest.json

@@ -0,0 +1,17 @@
+{
+  "schema_version": 1,
+  "target": "codex",
+  "events_total": 10,
+  "events": [
+    "PreToolUse",
+    "PostToolUse",
+    "SessionStart",
+    "PermissionRequest",
+    "PreCompact",
+    "PostCompact",
+    "UserPromptSubmit",
+    "SubagentStart",
+    "SubagentStop",
+    "Stop"
+  ]
+}

package/scripts/hooks/codex/pre-tool-git-guard.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# story: e65s01
+# scenario: SC-e65s01-P2-02
+# codex hook template — blocks dangerous terminal/git commands (fixed guard logic).
+set -euo pipefail
+
+INPUT=$(cat)
+CMD=$(echo "$INPUT" | jq -r '.tool_input.command // .tool_input.cmd // .command // empty')
+
+if [[ -z "$CMD" ]]; then
+  exit 0
+fi
+
+case "$CMD" in
+  *'git push --force'*|*'git push -f '*|*'reset --hard'*|*'git clean -f'*|*'rm -rf /'*)
+    jq -nc --arg reason "BLOCKED: dangerous command pattern" \
+      '{decision: "block", reason: $reason, hookVersion: "1.0.0"}'
+    exit 0
+    ;;
+esac
+
+exit 0

package/scripts/hooks/codex/settings.example.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "type": "command",
+        "command": "bash scripts/hooks/codex/pre-tool-git-guard.sh"
+      }
+    ],
+    "PostToolUse": [
+      {
+        "type": "command",
+        "command": "bash scripts/hooks/codex/pre-tool-git-guard.sh"
+      }
+    ]
+  }
+}

package/scripts/hooks/kilocode/HOOKS.md

@@ -0,0 +1,16 @@
+# Kilo Hook Templates (Wave A)
+
+Shipped under `scripts/hooks/kilocode/` — copy to user config in Wave B.
+
+## Events
+
+- `tool.execute.before`
+- `tool.execute.after`
+- `chat.message`
+- `permission.ask`
+- `event`
+
+## Security
+
+Templates use fixed guard logic only — no dynamic eval.
+

package/scripts/hooks/kilocode/hooks-manifest.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "target": "kilocode",
+  "events_total": 5,
+  "events": [
+    "tool.execute.before",
+    "tool.execute.after",
+    "chat.message",
+    "permission.ask",
+    "event"
+  ]
+}

package/scripts/hooks/kilocode/plugin/guard-git-plugin.ts

@@ -0,0 +1,16 @@
+// story: e67s01
+// scenario: SC-e67s01-P1-03
+// kilocode plugin hook template — register tool guards (no dynamic eval).
+
+export function register(ctx: { registerHook: (event: string, fn: Function) => void }) {
+  const events = ["tool.execute.before", "tool.execute.after", "chat.message"] as const;
+  for (const event of events) {
+    ctx.registerHook(event, async (payload: { command?: string }) => {
+      const cmd = payload?.command ?? "";
+      if (/git push --force|reset --hard|rm -rf \//.test(cmd)) {
+        return { decision: "block", reason: "BLOCKED: dangerous command pattern" };
+      }
+      return { decision: "allow" };
+    });
+  }
+}

package/scripts/hooks/qwen/HOOKS.md

@@ -0,0 +1,27 @@
+# Qwen Code Hook Templates (Wave A)
+
+Shipped under `scripts/hooks/qwen/` — copy to user config in Wave B.
+
+## Events
+
+- `PreToolUse`
+- `PostToolUse`
+- `PostToolUseFailure`
+- `UserPromptSubmit`
+- `SessionStart`
+- `SessionEnd`
+- `Stop`
+- `SubagentStart`
+- `SubagentStop`
+- `PreCompact`
+- `PostCompact`
+- `Notification`
+- `PermissionRequest`
+- `TodoCreated`
+- `TodoCompleted`
+- `StopFailure`
+
+## Security
+
+Templates use fixed guard logic only — no dynamic eval.
+

package/scripts/hooks/qwen/hooks-manifest.json

@@ -0,0 +1,23 @@
+{
+  "schema_version": 1,
+  "target": "qwen",
+  "events_total": 16,
+  "events": [
+    "PreToolUse",
+    "PostToolUse",
+    "PostToolUseFailure",
+    "UserPromptSubmit",
+    "SessionStart",
+    "SessionEnd",
+    "Stop",
+    "SubagentStart",
+    "SubagentStop",
+    "PreCompact",
+    "PostCompact",
+    "Notification",
+    "PermissionRequest",
+    "TodoCreated",
+    "TodoCompleted",
+    "StopFailure"
+  ]
+}

package/scripts/hooks/qwen/pre-tool-git-guard.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# story: e68s01
+# scenario: SC-e68s01-P2-02
+# qwen hook template — blocks dangerous terminal/git commands (fixed guard logic).
+set -euo pipefail
+
+INPUT=$(cat)
+CMD=$(echo "$INPUT" | jq -r '.tool_input.command // .tool_input.cmd // .command // empty')
+
+if [[ -z "$CMD" ]]; then
+  exit 0
+fi
+
+case "$CMD" in
+  *'git push --force'*|*'git push -f '*|*'reset --hard'*|*'git clean -f'*|*'rm -rf /'*)
+    jq -nc --arg reason "BLOCKED: dangerous command pattern" \
+      '{decision: "block", reason: $reason, hookVersion: "1.0.0"}'
+    exit 0
+    ;;
+esac
+
+exit 0

package/scripts/hooks/qwen/settings.example.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "type": "command",
+        "command": "bash scripts/hooks/qwen/pre-tool-git-guard.sh"
+      }
+    ],
+    "PostToolUse": [
+      {
+        "type": "command",
+        "command": "bash scripts/hooks/qwen/pre-tool-git-guard.sh"
+      }
+    ]
+  }
+}

package/scripts/hooks/trae/HOOKS.md

@@ -0,0 +1,17 @@
+# Trae Hook Templates (Wave A)
+
+Shipped under `scripts/hooks/trae/` — copy to user config in Wave B.
+
+## Events
+
+- `SessionStart`
+- `UserPromptSubmit`
+- `PreToolUse`
+- `PostToolUse`
+- `Stop`
+- `Notification`
+
+## Security
+
+Templates use fixed guard logic only — no dynamic eval.
+

package/scripts/hooks/trae/hooks-manifest.json

@@ -0,0 +1,13 @@
+{
+  "schema_version": 1,
+  "target": "trae",
+  "events_total": 6,
+  "events": [
+    "SessionStart",
+    "UserPromptSubmit",
+    "PreToolUse",
+    "PostToolUse",
+    "Stop",
+    "Notification"
+  ]
+}