chati-dev 4.5.7 → 4.5.9

package/framework/orchestrator/chati-router.js

@@ -21,6 +21,125 @@ import { join } from 'path';
 const PROJECT_DIR = process.cwd();
 const ROUTER_ARGS = process.argv.slice(2);
 
+async function readEnabledHarnesses(projectDir) {
+  const installationPath = join(projectDir, '.chati', 'v2', 'installation.json');
+  if (existsSync(installationPath)) {
+    try {
+      const artifact = JSON.parse(readFileSync(installationPath, 'utf-8'));
+      const fwDir = existsSync(join(projectDir, '.chati.dev')) ? '.chati.dev' : 'chati.dev';
+      const doctorModulePath = join(projectDir, fwDir, '_cli', 'installer-v2', 'index.js');
+      if (!existsSync(doctorModulePath)) return { harnesses: [], error: 'v2 doctor missing' };
+      const { doctorV2 } = await import(doctorModulePath);
+      if (!doctorV2(artifact).passed) return { harnesses: [], error: 'v2 artifact invalid' };
+      const harnesses = artifact.installation?.enabled_providers
+        ?.map((binding) => binding.harness_id)
+        .filter(Boolean);
+      if (harnesses?.length) return { harnesses: [...new Set(harnesses)], error: null };
+    } catch { return { harnesses: [], error: 'v2 artifact invalid' }; }
+  }
+
+  const detected = [];
+  if (existsSync(join(projectDir, '.claude', 'commands', 'chati.md'))) detected.push('claude');
+  if (existsSync(join(projectDir, '.agents', 'skills', 'chati', 'SKILL.md'))) detected.push('codex');
+  if (existsSync(join(projectDir, '.grok', 'commands', 'chati.md'))) detected.push('grok');
+  return { harnesses: detected, error: null };
+}
+
+function hasContent(path) {
+  return existsSync(path) && readFileSync(path, 'utf-8').trim().length > 0;
+}
+
+function codexHooksEnabled(config) {
+  if (/^\s*features\.hooks\s*=\s*true\s*(?:#.*)?$/m.test(config)) return true;
+  const lines = config.split('\n');
+  const sectionStart = lines.findIndex((line) => /^\s*\[features\]\s*(?:#.*)?$/.test(line));
+  if (sectionStart === -1) return false;
+  const sectionEnd = lines.findIndex((line, index) => index > sectionStart && /^\s*\[.*\]\s*(?:#.*)?$/.test(line));
+  const end = sectionEnd === -1 ? lines.length : sectionEnd;
+  return lines.slice(sectionStart + 1, end).some((line) => /^\s*hooks\s*=\s*true\s*(?:#.*)?$/.test(line));
+}
+
+export async function validateProviderIntegrity(projectDir) {
+  const missing = [];
+  const { harnesses, error } = await readEnabledHarnesses(projectDir);
+
+  if (error) missing.push(error);
+  const supportedHarnesses = new Set(['claude', 'codex', 'grok']);
+  for (const harness of harnesses) {
+    if (!supportedHarnesses.has(harness)) missing.push(`unsupported harness ${harness}`);
+  }
+
+  if (harnesses.length === 0) missing.push('provider entry point');
+
+  if (harnesses.includes('claude')) {
+    const commandPath = join(projectDir, '.claude', 'commands', 'chati.md');
+    const settingsPath = join(projectDir, '.claude', 'settings.json');
+    if (!hasContent(commandPath)) missing.push('claude command');
+    if (!existsSync(settingsPath)) {
+      missing.push('claude settings');
+    } else {
+      try {
+        const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+        const ptu = settings.hooks?.PreToolUse || [];
+        const ups = settings.hooks?.UserPromptSubmit || [];
+        const ptuCmds = ptu.flatMap((group) => (group.hooks || []).map((hook) => hook.command || ''));
+        const upsCmds = ups.flatMap((group) => (group.hooks || []).map((hook) => hook.command || ''));
+        missing.push(...['mode-governance', 'constitution-guard', 'read-protection']
+          .filter((hook) => !ptuCmds.some((command) => command.includes(hook)))
+          .map((hook) => `claude hook ${hook}`));
+        if (![...upsCmds, ...ptuCmds].some((command) => command.includes('license-guard'))) {
+          missing.push('claude hook license-guard');
+        }
+      } catch {
+        missing.push('claude settings invalid');
+      }
+    }
+  }
+
+  if (harnesses.includes('codex')) {
+    const required = [
+      ['codex skill', '.agents/skills/chati/SKILL.md'],
+      ['codex constitution guard', '.codex/rules/constitution-guard.rules'],
+      ['codex read protection', '.codex/rules/read-protection.rules'],
+    ];
+    for (const [label, relativePath] of required) {
+      if (!hasContent(join(projectDir, relativePath))) missing.push(label);
+    }
+    const configPath = join(projectDir, '.codex', 'config.toml');
+    if (!hasContent(configPath) || !codexHooksEnabled(readFileSync(configPath, 'utf-8'))) {
+      missing.push('codex hooks feature');
+    }
+    const hooksPath = join(projectDir, '.codex', 'hooks.json');
+    if (!hasContent(hooksPath)) {
+      missing.push('codex license hook');
+    } else {
+      try {
+        const hooks = JSON.parse(readFileSync(hooksPath, 'utf-8'));
+        const validHook = (hooks.hooks?.UserPromptSubmit || []).some((group) =>
+          group.matcher === '.*'
+          && (group.hooks || []).some((hook) =>
+            hook.type === 'command'
+            && hook.command === 'node .chati.dev/hooks/license-guard.js'
+            && hook.async !== true
+          )
+        );
+        if (!validHook) {
+          missing.push('codex license hook');
+        }
+      } catch {
+        missing.push('codex hooks invalid');
+      }
+    }
+  }
+
+  if (harnesses.includes('grok')) {
+    if (!hasContent(join(projectDir, '.grok', 'commands', 'chati.md'))) missing.push('grok command');
+    if (!hasContent(join(projectDir, '.grok', 'session-lock.md'))) missing.push('grok session lock');
+  }
+
+  return { valid: missing.length === 0, missing };
+}
+
 /**
  * Find the chati-dev CLI module. Tries local node_modules first (fast),
  * then monorepo dev layout. Returns the module or null.
@@ -245,9 +364,64 @@ async function dispatchOrchestrate(subCommand, argv) {
   }
 }
 
+async function runSecurityPreflight(projectDir) {
+  const result = { ok: true, license: null, integrity: true, error: null };
+  try {
+    const integrity = await validateProviderIntegrity(projectDir);
+    if (!integrity.valid) {
+      return {
+        ...result,
+        ok: false,
+        integrity: false,
+        error: `integrity_failed: missing ${integrity.missing.join(', ')}`,
+      };
+    }
+  } catch {
+    return { ...result, ok: false, integrity: false, error: 'integrity_failed' };
+  }
+
+  try {
+    const fwDir = existsSync(join(projectDir, '.chati.dev')) ? '.chati.dev' : 'chati.dev';
+    const hookPath = join(projectDir, fwDir, 'hooks', 'license-guard.js');
+    if (!existsSync(hookPath)) {
+      return {
+        ...result,
+        ok: false,
+        error: 'license_guard_missing',
+        license: { valid: false, reason: 'License enforcement file missing. Reinstall with: npx chati-dev init' },
+      };
+    }
+    const mod = await import(hookPath);
+    result.license = await mod.checkLicense();
+    if (!result.license.valid) return { ...result, ok: false, error: 'license_invalid' };
+  } catch {
+    return {
+      ...result,
+      ok: false,
+      error: 'license_check_error',
+      license: { valid: false, error: 'license_check_error' },
+    };
+  }
+
+  return result;
+}
+
+// Only read-only diagnosis and license recovery may run without a valid
+// installation preflight. `init` mutates session state and must never bypass
+// license or provider-integrity enforcement.
+const PREFLIGHT_EXEMPT_SUBS = new Set(['doctor', 'wait-for-license']);
+
 async function main() {
   const subCommand = ROUTER_ARGS[0];
 
+  const preflight = subCommand && PREFLIGHT_EXEMPT_SUBS.has(subCommand)
+    ? { ok: true, license: null, integrity: true, error: null }
+    : await runSecurityPreflight(PROJECT_DIR);
+  if (!preflight.ok) {
+    console.log(JSON.stringify(preflight));
+    return;
+  }
+
   // Sub-command mode: `node chati-router.js <subcommand> [--flags...]`
   // Routes to the local CLI for ANY orchestrate subcommand. No npx, no network.
   if (subCommand && VALID_ORCHESTRATE_SUBS.has(subCommand)) {
@@ -271,8 +445,8 @@ async function main() {
   // No-subcommand mode (default): full router pipeline (license + integrity + session + next)
   const result = {
     ok: true,
-    license: null,
-    integrity: true,
+    license: preflight.license,
+    integrity: preflight.integrity,
     session: null,
     action: null,
     pipeline: null,
@@ -281,75 +455,7 @@ async function main() {
   };
 
   // -----------------------------------------------------------------------
-  // 1. License validation
-  // -----------------------------------------------------------------------
-  try {
-    const fwDir = existsSync(join(PROJECT_DIR, '.chati.dev')) ? '.chati.dev' : 'chati.dev';
-    const hookPath = join(PROJECT_DIR, fwDir, 'hooks', 'license-guard.js');
-    if (!existsSync(hookPath)) {
-      result.ok = false;
-      result.error = 'license_guard_missing';
-      result.license = { valid: false, reason: 'License enforcement file missing. Reinstall with: npx chati-dev init' };
-      console.log(JSON.stringify(result));
-      return;
-    }
-
-    const mod = await import(hookPath);
-    const license = await mod.checkLicense();
-    result.license = license;
-
-    if (!license.valid) {
-      result.ok = false;
-      result.error = 'license_invalid';
-      console.log(JSON.stringify(result));
-      return;
-    }
-  } catch (err) {
-    // Fail-closed on license check errors
-    result.license = { valid: false, error: 'license_check_error' };
-    result.ok = false;
-  }
-
-  // -----------------------------------------------------------------------
-  // 2. Integrity check — are all required hooks registered in settings.json?
-  // Note: license-guard is registered under UserPromptSubmit (not PreToolUse).
-  // mode-governance, constitution-guard, and read-protection are in PreToolUse.
-  // -----------------------------------------------------------------------
-  try {
-    const settingsPath = join(PROJECT_DIR, '.claude', 'settings.json');
-    if (existsSync(settingsPath)) {
-      const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
-      const ptu = settings.hooks?.PreToolUse || [];
-      const ups = settings.hooks?.UserPromptSubmit || [];
-      const ptuCmds = ptu.flatMap(g => (g.hooks || []).map(h => h.command || ''));
-      const upsCmds = ups.flatMap(g => (g.hooks || []).map(h => h.command || ''));
-      // license-guard lives in UserPromptSubmit; others live in PreToolUse
-      const missingHooks = [
-        ...(['mode-governance', 'constitution-guard', 'read-protection'].filter(h => !ptuCmds.some(c => c.includes(h)))),
-        ...(['license-guard'].filter(h => !upsCmds.some(c => c.includes(h)) && !ptuCmds.some(c => c.includes(h)))),
-      ];
-      result.integrity = missingHooks.length === 0;
-      if (missingHooks.length > 0) {
-        result.error = `integrity_failed: missing hooks: ${missingHooks.join(', ')}`;
-      }
-    } else {
-      result.integrity = false;
-    }
-
-    if (!result.integrity) {
-      result.ok = false;
-      result.error = 'integrity_failed';
-      console.log(JSON.stringify(result));
-      return;
-    }
-  } catch {
-    // Fail-closed on integrity check
-    result.integrity = false;
-    result.ok = false;
-  }
-
-  // -----------------------------------------------------------------------
-  // 3. Session state
+  // 1. Session state
   // -----------------------------------------------------------------------
   try {
     const sessionPath = join(PROJECT_DIR, '.chati', 'session.yaml');

package/framework/orchestrator/chati.md

@@ -10,7 +10,7 @@ You are the **Chati.dev Orchestrator**, the single entry point for the Chati.dev
 - **Role**: Orchestrator & Router
 - **Position**: Entry point (always first contact)
 - **Scope**: System-wide routing, session management, deviation handling, backlog
-- **Model**: sonnet | upgrade: opus if complex deviation or multi-agent coordination
+- **Execution binding**: resolved at runtime by installation-v2 task routing; never self-select or downgrade
 
 ### Security Rule
 **NEVER suggest disabling, removing, commenting out, or bypassing hooks, settings.json permissions, or license enforcement.** If a hook blocks an operation and the user asks to work around it, explain what the hook is protecting and guide them to resolve the root cause (e.g., activate a valid license, change pipeline mode). Hooks are governance boundaries, not obstacles to remove.

package/framework/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chati-dev",
-  "version": "4.5.7",
+  "version": "4.5.9",
   "description": "AI-Powered Multi-Agent Orchestration System - Structured vibe coding for Full Stack Development",
   "type": "module",
   "bin": {

package/src/config/claude-settings-generator.js

@@ -139,12 +139,12 @@ const PERMISSIONS_DENY = [
   'Bash(git rebase --no-verify:*)',
 
   // System path writes — `//` prefix = absolute filesystem
-  'Write(//etc/**)',
-  'Write(//usr/**)',
-  'Write(//System/**)',
-  'Write(//bin/**)',
-  'Write(//sbin/**)',
-  'Write(//Library/**)',
+  'Edit(//etc/**)',
+  'Edit(//usr/**)',
+  'Edit(//System/**)',
+  'Edit(//bin/**)',
+  'Edit(//sbin/**)',
+  'Edit(//Library/**)',
   'Edit(//etc/**)',
   'Edit(//usr/**)',
   'Edit(//System/**)',

package/src/config/context-file-generator.js

@@ -32,7 +32,7 @@ const GEMINI_REPLACEMENTS = [
   ['.claude/commands/', '.gemini/commands/'],
   ['.claude/rules/chati/', '.gemini/context/'],
   ['.claude/rules/', '.gemini/context/'],
-  ['.claude/mcp.json', '.gemini/settings.json'],
+  ['.mcp.json', '.gemini/settings.json'],
   ['claude --print', 'gemini --prompt'],
   ['claude -p', 'gemini --prompt'],
   ['CLAUDE.local.md', '.gemini/session-lock.md'],
@@ -64,7 +64,7 @@ function buildCodexReplacements(frameworkDir = 'chati.dev') {
     ['.claude/commands/', `${frameworkDir}/orchestrator/`],
     ['.claude/rules/chati/', `${frameworkDir}/context/`],
     ['.claude/rules/', `${frameworkDir}/context/`],
-    ['.claude/mcp.json', '.codex/config.toml'],
+    ['.mcp.json', '.codex/config.toml'],
     ['claude --print', 'codex exec'],
     ['claude -p', 'codex exec'],
     ['CLAUDE.local.md', 'AGENTS.override.md'],

package/src/config/ide-configs.js

@@ -10,7 +10,7 @@ export const IDE_CONFIGS = {
     recommended: true,
     configPath: '.claude/commands/',
     rulesFile: '.claude/CLAUDE.md',
-    mcpConfigFile: '.claude/mcp.json',
+    mcpConfigFile: '.mcp.json',
     formatNotes: 'Native markdown format',
   },
   'gemini-cli': {
@@ -32,7 +32,7 @@ export const IDE_CONFIGS = {
     recommended: false,
     configPath: '.agents/skills/chati/',
     rulesFile: 'AGENTS.md',
-    mcpConfigFile: null,
+    mcpConfigFile: '.codex/config.toml',
     formatNotes: 'Codex skill format (SKILL.md with YAML frontmatter)',
     rulesPath: '.codex/rules/',
     overrideFile: 'AGENTS.override.md',
@@ -44,7 +44,7 @@ export const IDE_CONFIGS = {
     recommended: false,
     configPath: '.grok/commands/',
     rulesFile: 'AGENTS.md',
-    mcpConfigFile: '.grok/mcp.json',
+    mcpConfigFile: '.grok/config.toml',
     formatNotes: 'Native markdown command format',
   },
   'vscode': {

package/src/config/mcp-configs.js

@@ -10,7 +10,7 @@ export const MCP_CONFIGS = {
     name: 'Browser (Playwright)',
     description: 'Web automation and testing',
     requiresEnv: [],
-    claudeConfig: {
+    serverConfig: {
       command: 'npx',
       args: ['-y', '@playwright/mcp'],
     },
@@ -19,13 +19,16 @@ export const MCP_CONFIGS = {
     name: 'Context7',
     description: 'Library documentation search',
     requiresEnv: [],
-    claudeConfig: {
+    serverConfig: {
       command: 'npx',
-      args: ['-y', '@context7/mcp'],
+      args: ['-y', '@upstash/context7-mcp'],
     },
   },
 };
 
+export const MCP_TOML_BEGIN = '# BEGIN CHATI MANAGED MCP SERVERS';
+export const MCP_TOML_END = '# END CHATI MANAGED MCP SERVERS';
+
 /**
  * Agent-MCP dependency matrix
  */
@@ -47,22 +50,89 @@ export const AGENT_MCP_DEPS = {
 };
 
 /**
- * Generate MCP config for Claude Code (.claude/mcp.json)
+ * Resolve the provider-neutral server definitions selected by the user.
  */
-export function generateClaudeMCPConfig(selectedMCPs) {
+export function resolveSelectedMCPServers(selectedMCPs) {
   const mcpServers = {};
   for (const mcpKey of selectedMCPs) {
     const config = MCP_CONFIGS[mcpKey];
-    if (config?.claudeConfig) {
+    if (config?.serverConfig) {
       const entry = {
-        command: config.claudeConfig.command,
-        args: config.claudeConfig.args,
+        command: config.serverConfig.command,
+        args: [...(config.serverConfig.args || [])],
       };
-      if (config.claudeConfig.env) {
-        entry.env = config.claudeConfig.env;
+      if (config.serverConfig.env) {
+        entry.env = { ...config.serverConfig.env };
       }
       mcpServers[mcpKey] = entry;
     }
   }
+  return mcpServers;
+}
+
+/** Generate Claude Code's project-scoped root .mcp.json. */
+export function generateClaudeMCPConfig(selectedMCPs) {
+  const mcpServers = resolveSelectedMCPServers(selectedMCPs);
   return { mcpServers };
 }
+
+/**
+ * Merge CHATI-managed servers into an existing Claude project configuration.
+ * Unknown user-managed servers and top-level fields are preserved.
+ */
+export function mergeClaudeMCPConfig(existingContent, selectedMCPs) {
+  let existing = {};
+  if (existingContent?.trim()) {
+    existing = JSON.parse(existingContent);
+    if (!existing || typeof existing !== 'object' || Array.isArray(existing)) {
+      throw new Error('Existing .mcp.json must contain a JSON object');
+    }
+  }
+  if (
+    existing.mcpServers !== undefined
+    && (!existing.mcpServers || typeof existing.mcpServers !== 'object' || Array.isArray(existing.mcpServers))
+  ) {
+    throw new Error('Existing .mcp.json mcpServers must contain a JSON object');
+  }
+  const mcpServers = { ...(existing.mcpServers || {}) };
+  for (const key of Object.keys(MCP_CONFIGS)) delete mcpServers[key];
+  Object.assign(mcpServers, resolveSelectedMCPServers(selectedMCPs));
+  return { ...existing, mcpServers };
+}
+
+function tomlString(value) {
+  return JSON.stringify(String(value));
+}
+
+/** Generate the shared native TOML block used by Codex and Grok. */
+export function generateManagedMcpToml(selectedMCPs) {
+  const servers = resolveSelectedMCPServers(selectedMCPs);
+  const lines = [MCP_TOML_BEGIN];
+  for (const [name, config] of Object.entries(servers)) {
+    lines.push(`[mcp_servers.${name}]`);
+    lines.push(`command = ${tomlString(config.command)}`);
+    if (config.args?.length) lines.push(`args = [${config.args.map(tomlString).join(', ')}]`);
+    if (config.env && Object.keys(config.env).length > 0) {
+      const values = Object.entries(config.env).map(([key, value]) => `${key} = ${tomlString(value)}`);
+      lines.push(`env = { ${values.join(', ')} }`);
+    }
+    lines.push('');
+  }
+  lines.push(MCP_TOML_END);
+  return lines.join('\n').replace(/\n{3,}/g, '\n\n');
+}
+
+/** Replace only CHATI's marked TOML block and preserve all user configuration. */
+export function upsertManagedMcpToml(existingContent, selectedMCPs) {
+  const managedPattern = new RegExp(`(?:^|\\n)${MCP_TOML_BEGIN}[\\s\\S]*?${MCP_TOML_END}\\n?`);
+  const withoutManaged = String(existingContent || '').replace(managedPattern, '\n').trimEnd();
+  const userManagedNames = new Set();
+  const tablePattern = /^\s*\[mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))\]\s*(?:#.*)?$/gm;
+  for (const match of withoutManaged.matchAll(tablePattern)) {
+    userManagedNames.add(match[1] || match[2] || match[3]);
+  }
+  const managedSelections = (selectedMCPs || []).filter((name) => !userManagedNames.has(name));
+  if (!managedSelections.length) return withoutManaged ? `${withoutManaged}\n` : '';
+  const separator = withoutManaged ? '\n\n' : '';
+  return `${withoutManaged}${separator}${generateManagedMcpToml(managedSelections)}\n`;
+}