create-merlin-brain 5.0.1 → 5.3.1

package/files/scripts/duo-pre-route.sh

@@ -30,13 +30,7 @@ if [[ "$DUO_STATE" == "enabled" ]]; then
     exit 0
 fi
 
-# Branch 2: Codex absent — stay solo silently (never mention duo)
-if ! "${SCRIPT_DIR}/duo-installed.sh" 2>/dev/null; then
-    echo "mode=solo"
-    exit 0
-fi
-
-# Branch 3: risk-detect suggestion
+# Branch 2: risk-detect suggestion (duo-installed.sh is always-pass; offer fires regardless of Codex)
 RISK_DETECT="${SCRIPT_DIR}/duo-risk-detect.sh"
 if [[ ! -x "$RISK_DETECT" ]]; then
     echo "mode=solo"
@@ -62,7 +56,7 @@ if [[ "$SUGGEST_DUO" != "true" ]]; then
     exit 0
 fi
 
-# Branch 3a: suppression check — use a temp python script to avoid heredoc-in-subshell issues
+# Branch 2a: suppression check — use a temp python script to avoid heredoc-in-subshell issues
 REASONS_JSON=$(python3 -c "
 import json, sys
 try:

package/files/scripts/install-design-skills.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -e
+
+# Merlin Design Skills Installer
+# Installs and prioritizes emilkowalski/skill and pbakaus/impeccable
+
+# Honor skip flag
+if [ "${MERLIN_SKIP_DESIGN_SKILLS:-0}" = "1" ]; then
+  exit 0
+fi
+
+echo "[merlin] Installing priority design skills…"
+
+SKILLS_DIR="${HOME}/.claude/skills"
+mkdir -p "$SKILLS_DIR"
+
+# ═══════════════════════════════════════════════════════════════
+# Install emilkowalski/skill (install-only, no license vendoring)
+# ═══════════════════════════════════════════════════════════════
+
+if [ ! -f "$SKILLS_DIR/emil-design-eng/SKILL.md" ]; then
+  if command -v npx >/dev/null 2>&1; then
+    # Attempt install via skills CLI
+    if npx --yes skills add emilkowalski/skill 2>/dev/null; then
+      : # Success
+    else
+      # Non-fatal — user can install manually
+      echo "[merlin] emil skill install hint: npx --yes skills add emilkowalski/skill"
+    fi
+  else
+    echo "[merlin] npx not found; skipping emil skill (user can install: npx --yes skills add emilkowalski/skill)"
+  fi
+fi
+
+# ═══════════════════════════════════════════════════════════════
+# Install pbakaus/impeccable (fetch + preserve Apache-2.0 attribution)
+# ═══════════════════════════════════════════════════════════════
+
+if [ ! -d "$SKILLS_DIR/impeccable" ]; then
+  if command -v git >/dev/null 2>&1; then
+    tmp=$(mktemp -d)
+    trap "rm -rf '$tmp'" EXIT
+
+    if git clone --depth 1 https://github.com/pbakaus/impeccable.git "$tmp" 2>/dev/null; then
+      # Copy the skill subtree (contains SKILL.md and commands/)
+      if [ -d "$tmp/dist/claude-code/.claude/skills/impeccable" ]; then
+        mkdir -p "$SKILLS_DIR"
+        cp -R "$tmp/dist/claude-code/.claude/skills/impeccable" "$SKILLS_DIR/"
+
+        # Preserve license attribution
+        if [ -f "$tmp/LICENSE" ]; then
+          cp "$tmp/LICENSE" "$SKILLS_DIR/impeccable/LICENSE"
+        fi
+        if [ -f "$tmp/NOTICE.md" ]; then
+          cp "$tmp/NOTICE.md" "$SKILLS_DIR/impeccable/NOTICE.md"
+        fi
+      else
+        echo "[merlin] impeccable skill structure not found in cloned repo"
+      fi
+    else
+      echo "[merlin] git clone failed for impeccable; user can install manually"
+    fi
+  else
+    echo "[merlin] git not found; skipping impeccable skill (user can install manually: git clone pbakaus/impeccable)"
+  fi
+fi
+
+# ═══════════════════════════════════════════════════════════════
+# Verification
+# ═══════════════════════════════════════════════════════════════
+
+has_impeccable=0
+has_emil=0
+
+[ -d "$SKILLS_DIR/impeccable" ] && has_impeccable=1
+[ -f "$SKILLS_DIR/emil-design-eng/SKILL.md" ] && has_emil=1
+
+if [ "$has_impeccable" = "1" ] || [ "$has_emil" = "1" ]; then
+  echo "[merlin] Design skills ready:"
+  [ "$has_impeccable" = "1" ] && echo "  ✓ impeccable"
+  [ "$has_emil" = "1" ] && echo "  ✓ emil-design-eng"
+else
+  echo "[merlin] Design skills install: no changes (already present or install failed)"
+fi
+
+exit 0

package/files/scripts/merlin-codex.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+#
+# merlin-codex.sh — Merlin-aware Codex CLI wrapper
+#
+# Prints the Merlin engagement banner to stderr and injects the Merlin
+# orchestrator system prompt into every Codex invocation. Pass-through
+# subcommands (login, logout, mcp, etc.) are forwarded unchanged.
+#
+# Usage:
+#   merlin-codex                        # interactive Codex shell with Merlin banner
+#   merlin-codex exec "list files"      # exec with Merlin prompt prepended
+#   merlin-codex "fix the auth bug"     # prompt with Merlin prompt prepended
+#   merlin-codex --help                 # forwarded directly to codex
+#   merlin-codex login                  # forwarded directly (no prompt injection)
+#
+set -euo pipefail
+
+export MERLIN_RUNTIME=codex
+
+SCRIPTS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SYSTEM_PROMPT_FILE="${HOME}/.claude/merlin-system-prompt.txt"
+FALLBACK_PROMPT="You are Merlin: orchestrator, not coder. Route implementation to specialists. Badge every action with ⟡🔮 MERLIN ›."
+
+# ── Pass-through subcommands (no Merlin prompt injection) ──────
+PASSTHROUGH_CMDS="login logout mcp mcp-server app app-server completion sandbox debug"
+
+# ── Determine duo mode and pair for banner ─────────────────────
+_mode_label="Solo"
+_pair_label=""
+if [ -x "${SCRIPTS_DIR}/duo-mode-read.sh" ]; then
+  _duo=$("${SCRIPTS_DIR}/duo-mode-read.sh" 2>/dev/null) || _duo="disabled"
+  if [ "${_duo}" = "enabled" ]; then
+    _mode_label="Duo"
+    _pair=$("${SCRIPTS_DIR}/duo-mode-read.sh" --pair 2>/dev/null) || _pair="none"
+    if [ "${_pair}" != "none" ]; then
+      _pair_label=" (${_pair})"
+    fi
+  fi
+fi
+
+# ── Print banner to stderr (always) ───────────────────────────
+printf '⟡🔮 MERLIN · entering Codex via merlin-codex\n' >&2
+printf '🎯 Mode: %s%s\n' "${_mode_label}" "${_pair_label}" >&2
+printf '▶ Codex will inherit Merlin'"'"'s orchestrator instructions\n' >&2
+
+# ── If no args, open interactive Codex shell ──────────────────
+if [ $# -eq 0 ]; then
+  exec codex
+fi
+
+# ── Check for pass-through subcommand or flags ────────────────
+FIRST_ARG="${1:-}"
+for cmd in ${PASSTHROUGH_CMDS}; do
+  if [ "${FIRST_ARG}" = "${cmd}" ]; then
+    exec codex "$@"
+  fi
+done
+# Also pass through if first arg is a flag like --help, --version
+if [[ "${FIRST_ARG}" == --* ]] || [[ "${FIRST_ARG}" == -* ]]; then
+  exec codex "$@"
+fi
+
+# ── Load Merlin system prompt ──────────────────────────────────
+MERLIN_PROMPT="${FALLBACK_PROMPT}"
+if [ -f "${SYSTEM_PROMPT_FILE}" ]; then
+  MERLIN_PROMPT=$(cat "${SYSTEM_PROMPT_FILE}" 2>/dev/null) || MERLIN_PROMPT="${FALLBACK_PROMPT}"
+fi
+
+# ── Inject Merlin prompt into Codex invocation ─────────────────
+# Try -c instructions= config override first (documented Codex flag).
+# If the subcommand is "exec", inject into the prompt argument.
+# Otherwise prepend to the full prompt string.
+if [ "${FIRST_ARG}" = "exec" ]; then
+  shift
+  # $@ is now the prompt(s) passed to codex exec
+  ORIGINAL_PROMPT="${*:-}"
+  FULL_PROMPT="${MERLIN_PROMPT}"$'\n\n'"---USER---"$'\n\n'"${ORIGINAL_PROMPT}"
+  exec codex exec "${FULL_PROMPT}"
+else
+  # Treat remaining args as a single prompt string
+  ORIGINAL_PROMPT="${*:-}"
+  FULL_PROMPT="${MERLIN_PROMPT}"$'\n\n'"---USER---"$'\n\n'"${ORIGINAL_PROMPT}"
+  exec codex "${FULL_PROMPT}"
+fi

package/files/scripts/task-optimize.sh

@@ -0,0 +1,335 @@
+#!/usr/bin/env bash
+# task-optimize.sh — Universal Task Optimizer for Merlin v5.3.0
+# Usage: task-optimize.sh --task "<text>" [--registry <path>] [--self-test]
+# Output: single JSON line {"score":<0-100>,"intent":"<id>","skills":["<id1>"],"agent":"<agent>","matched_phrases":["..."]}
+# Always exits 0 in normal usage. --self-test exits non-zero on failure.
+# Times out at 500ms.
+
+set -euo pipefail
+
+TASK=""
+REGISTRY=""
+SELF_TEST=false
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --task)      TASK="${2:-}"; shift 2 ;;
+        --registry)  REGISTRY="${2:-}"; shift 2 ;;
+        --self-test) SELF_TEST=true; shift ;;
+        *)           shift ;;
+    esac
+done
+
+# Default registry locations
+if [[ -z "$REGISTRY" ]]; then
+    if [[ -f "$HOME/.claude/merlin/skills/TASK-OPTIMIZER.json" ]]; then
+        REGISTRY="$HOME/.claude/merlin/skills/TASK-OPTIMIZER.json"
+    elif [[ -f "$HOME/.claude/skills/merlin/TASK-OPTIMIZER.json" ]]; then
+        REGISTRY="$HOME/.claude/skills/merlin/TASK-OPTIMIZER.json"
+    else
+        # Fallback to package location (for testing during development)
+        SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        REGISTRY="$SCRIPT_DIR/../merlin/skills/TASK-OPTIMIZER.json"
+    fi
+fi
+
+# ═══════════════════════════════════════════════════════════════
+# SELF-TEST MODE
+# ═══════════════════════════════════════════════════════════════
+if [[ "$SELF_TEST" == "true" ]]; then
+    TMPTEST=$(mktemp /tmp/task-opt-test.XXXXXX.py)
+    trap 'rm -f "$TMPTEST"' EXIT
+
+    cat > "$TMPTEST" << 'PYTESTEOF'
+import sys
+import os
+import json
+import subprocess
+
+# Test cases: (task, expected_intent, expected_agent, min_score)
+TEST_CASES = [
+    ("this looks ugly, redesign it", "design", "ui-builder", 25),
+    ("make it pretty", "design", "ui-builder", 25),
+    ("redesign the homepage", "design", "ui-builder", 25),
+    ("design review of the new component", "design", "ui-builder", 25),
+    ("WCAG compliance audit", "a11y", "hardening-guard", 25),
+    ("accessibility fixes for the form", "a11y", "hardening-guard", 25),
+    ("responsive design issue on mobile", "design", "ui-builder", 25),
+    ("mobile broken on iPhone", "design", "ui-builder", 25),
+    ("dark mode toggle implementation", "design", "ui-builder", 25),
+    ("theme switching support", "design", "ui-builder", 25),
+    ("match Stripe design quality", "design", "ui-builder", 25),
+    ("loading state for the form", "design", "ui-builder", 25),
+    ("UX writing for empty states", "design", "ui-builder", 25),
+    ("error messages copy review", "design", "ui-builder", 25),
+    ("animate this drawer", "animation-polish", "animation-expert", 25),
+    ("transitions feel stiff", "animation-polish", "animation-expert", 25),
+    ("add motion to the cards", "animation-polish", "animation-expert", 25),
+    ("polish the micro-interactions", "animation-polish", "animation-expert", 25),
+    ("add OAuth login flow", "security", "hardening-guard", 25),
+    ("CSRF protection check", "security", "hardening-guard", 25),
+    ("input validation hardening", "security", "hardening-guard", 25),
+    ("write unit tests for the parser", "testing", "tests-qa", 25),
+    ("TDD workflow for the API", "testing", "tests-qa", 25),
+    ("Jest test coverage", "testing", "tests-qa", 25),
+    ("REST API endpoint design", "api", "merlin-api-designer", 25),
+    ("OpenAPI spec for the v2 routes", "api", "merlin-api-designer", 25),
+    ("GraphQL schema design", "api", "merlin-api-designer", 25),
+    ("Core Web Vitals optimization", "performance", "merlin-performance", 25),
+    ("bundle size reduction", "performance", "merlin-performance", 25),
+    ("lighthouse score improvements", "performance", "merlin-performance", 25),
+    ("debug this null pointer crash", "debug", "merlin-debugger", 25),
+    ("investigate the broken deploy", "debug", "merlin-debugger", 25),
+    ("Docker containerization for the worker", "docker", "ops-railway", 25),
+    ("multi-stage build for the API", "docker", "ops-railway", 25),
+    ("Stripe payment integration", "payments", "implementation-dev", 25),
+    ("subscription billing setup", "payments", "implementation-dev", 25),
+    ("webhook signature verification", "webhooks", "implementation-dev", 25),
+    ("send email via Gmail API", "email", "implementation-dev", 25),
+    ("WhatsApp business API integration", "whatsapp", "implementation-dev", 25),
+    ("Telegram bot for notifications", "telegram", "implementation-dev", 25),
+    ("Google Sheets automation", "sheets", "implementation-dev", 25),
+    ("brainstorm options for onboarding", "brainstorm", "merlin-researcher", 25),
+    ("React component refactor", "react", "merlin-frontend", 25),
+    ("useState hook pattern", "react", "merlin-frontend", 25),
+    ("Next.js server component", "react", "merlin-frontend", 25),
+    ("fix the database query", "none", "", 0),
+    ("rename a variable", "none", "", 0),
+    ("update README", "none", "", 0),
+]
+
+def run_test(script_path, registry_path, task, expected_intent, expected_agent, min_score):
+    """Run the optimizer and check result."""
+    try:
+        result = subprocess.run(
+            ['bash', script_path, '--task', task, '--registry', registry_path],
+            capture_output=True,
+            text=True,
+            timeout=5
+        )
+        output = result.stdout.strip()
+        if not output:
+            return False, f"empty output (stderr: {result.stderr.strip()})"
+
+        data = json.loads(output)
+        actual_intent = data.get('intent', '')
+        actual_agent = data.get('agent', '')
+        actual_score = data.get('score', 0)
+
+        # Check conditions
+        if expected_intent == "none":
+            # For "none" cases, we expect score < min_score (which is 0, so score must be 0)
+            if actual_intent != "none" and actual_score >= 25:
+                return False, f"got intent={actual_intent}, agent={actual_agent}, score={actual_score} (expected none)"
+            return True, ""
+        else:
+            if actual_intent != expected_intent:
+                return False, f"intent={actual_intent} (expected {expected_intent})"
+            if actual_agent != expected_agent:
+                return False, f"agent={actual_agent} (expected {expected_agent})"
+            if actual_score < min_score:
+                return False, f"score={actual_score} (expected >= {min_score})"
+            return True, ""
+    except json.JSONDecodeError as e:
+        return False, f"invalid JSON: {e}"
+    except subprocess.TimeoutExpired:
+        return False, "timeout"
+    except Exception as e:
+        return False, str(e)
+
+def main():
+    script_path = os.environ.get('_SCRIPT_PATH', '')
+    registry_path = os.environ.get('_REGISTRY_PATH', '')
+
+    if not script_path or not registry_path:
+        print("Error: _SCRIPT_PATH and _REGISTRY_PATH must be set", file=sys.stderr)
+        sys.exit(1)
+
+    print("\n" + "=" * 60)
+    print("Universal Task Optimizer — Self-Test Suite")
+    print("=" * 60 + "\n")
+
+    passed = 0
+    failed = 0
+
+    for task, expected_intent, expected_agent, min_score in TEST_CASES:
+        ok, reason = run_test(script_path, registry_path, task, expected_intent, expected_agent, min_score)
+        if ok:
+            print(f"PASS: '{task[:50]}...' => {expected_intent}")
+            passed += 1
+        else:
+            print(f"FAIL: '{task[:50]}...' => {reason}")
+            failed += 1
+
+    print("\n" + "=" * 60)
+    print(f"RESULTS: {passed} passed, {failed} failed")
+    print("=" * 60)
+
+    sys.exit(0 if failed == 0 else 1)
+
+if __name__ == '__main__':
+    main()
+PYTESTEOF
+
+    export _SCRIPT_PATH="${BASH_SOURCE[0]}"
+    export _REGISTRY_PATH="$REGISTRY"
+    python3 "$TMPTEST"
+    exit $?
+fi
+
+# ═══════════════════════════════════════════════════════════════
+# MAIN SCORER
+# ═══════════════════════════════════════════════════════════════
+
+THRESHOLD="${MERLIN_TASK_OPT_THRESHOLD:-25}"
+
+# Write the scorer to a temp file so timeout can exec it cleanly
+TMPSCRIPT=$(mktemp /tmp/task-opt-score.XXXXXX.py)
+trap 'rm -f "$TMPSCRIPT"' EXIT
+
+cat > "$TMPSCRIPT" << 'PYEOF'
+import os
+import sys
+import json
+import re
+
+def main():
+    task = os.environ.get("_OPT_TASK", "")
+    registry_path = os.environ.get("_OPT_REGISTRY", "")
+    threshold = int(os.environ.get("_OPT_THRESHOLD", "25"))
+
+    # Default output
+    default_output = {"score": 0, "intent": "none", "skills": [], "agent": "", "matched_phrases": []}
+
+    # Load registry
+    if not registry_path or not os.path.exists(registry_path):
+        print(json.dumps(default_output))
+        return
+
+    try:
+        with open(registry_path, 'r') as f:
+            registry = json.load(f)
+    except (json.JSONDecodeError, IOError):
+        print(json.dumps(default_output))
+        return
+
+    task_lower = task.lower()
+    skills_list = registry.get("skills", [])
+
+    # Score each skill
+    skill_scores = []
+    for skill in skills_list:
+        triggers = skill.get("triggers", [])
+        weight = skill.get("weight", 1.0)
+        matched = []
+
+        for trigger in triggers:
+            trigger_lower = trigger.lower()
+            # Use word boundary matching for single words, substring for multi-word
+            if ' ' in trigger_lower:
+                # Multi-word: simple substring match
+                if trigger_lower in task_lower:
+                    matched.append(trigger_lower)
+            else:
+                # Single word: word boundary match
+                pattern = r'\b' + re.escape(trigger_lower) + r'\b'
+                if re.search(pattern, task_lower):
+                    matched.append(trigger_lower)
+
+        if matched:
+            # Score: 25 per unique match * weight, capped at 100
+            raw_score = len(matched) * 25 * weight
+            score = min(int(raw_score), 100)
+            skill_scores.append({
+                "skill": skill,
+                "score": score,
+                "matched": matched
+            })
+
+    if not skill_scores:
+        print(json.dumps(default_output))
+        return
+
+    # Sort by score descending
+    skill_scores.sort(key=lambda x: x["score"], reverse=True)
+    top = skill_scores[0]
+
+    if top["score"] < threshold:
+        print(json.dumps(default_output))
+        return
+
+    top_skill = top["skill"]
+    result_skills = [top_skill["id"]]
+    all_matched = list(top["matched"])
+
+    # Check bundles_with
+    bundles = top_skill.get("bundles_with", [])
+    for bundle_id in bundles:
+        # Find the bundle skill and check if it also matched
+        for ss in skill_scores[1:]:
+            if ss["skill"]["id"] == bundle_id and ss["matched"]:
+                if bundle_id not in result_skills:
+                    result_skills.append(bundle_id)
+                    all_matched.extend(ss["matched"])
+                break
+
+    # Check intent_overrides
+    overrides = registry.get("intent_overrides", {})
+    for override_key, override_val in overrides.items():
+        match_all = override_val.get("match_all", [])
+        if all(ma.lower() in task_lower for ma in match_all):
+            # Override applies
+            result_skills = override_val.get("skills", result_skills)
+            result_intent = override_key
+            result_agent = override_val.get("agent", top_skill.get("agent", ""))
+            output = {
+                "score": top["score"],
+                "intent": result_intent,
+                "skills": result_skills,
+                "agent": result_agent,
+                "matched_phrases": list(set(all_matched))
+            }
+            print(json.dumps(output))
+            return
+
+    # Build normal output
+    output = {
+        "score": top["score"],
+        "intent": top_skill.get("intent", "none"),
+        "skills": result_skills,
+        "agent": top_skill.get("agent", ""),
+        "matched_phrases": list(set(all_matched))
+    }
+    print(json.dumps(output))
+
+if __name__ == '__main__':
+    main()
+PYEOF
+
+# Export inputs via env — never interpolated into code
+export _OPT_TASK="$TASK"
+export _OPT_REGISTRY="$REGISTRY"
+export _OPT_THRESHOLD="$THRESHOLD"
+
+# Run with 500ms timeout — try gtimeout (macOS Homebrew coreutils), then timeout, then perl alarm
+_TIMEOUT_CMD=""
+if command -v gtimeout >/dev/null 2>&1; then
+    _TIMEOUT_CMD="gtimeout 0.5"
+elif timeout --version >/dev/null 2>&1; then
+    _TIMEOUT_CMD="timeout 0.5"
+fi
+
+if [[ -n "$_TIMEOUT_CMD" ]]; then
+    OUT=$($_TIMEOUT_CMD python3 "$TMPSCRIPT" 2>/dev/null) || OUT=""
+else
+    OUT=$(perl -e 'alarm 1; exec @ARGV' -- python3 "$TMPSCRIPT" 2>/dev/null) || OUT=""
+fi
+
+# Validate JSON; fall back to safe default
+if python3 -c "import json,sys; json.loads(sys.stdin.read())" <<< "$OUT" 2>/dev/null; then
+    echo "$OUT"
+else
+    echo '{"score":0,"intent":"none","skills":[],"agent":"","matched_phrases":[]}'
+fi
+
+exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-merlin-brain",
-  "version": "5.0.1",
+  "version": "5.3.1",
   "description": "Merlin - The Ultimate AI Brain for Claude Code, Codex, and other AI CLIs. One install: workflows, agents, loop, and Sights MCP server.",
   "type": "module",
   "main": "./dist/server/index.js",