crewforth 3.2.0-rc.1 → 3.2.0-rc.3

package/kit/eval/lib/review-prepass/prepass.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# prepass.sh — the shell entry to prepass.mjs, the review's deterministic first pass. It finds a Node that RUNS
+# and hands over; the arguments and exit codes are prepass.mjs's (0, 1, 2).
+#
+#   bash prepass.sh [--root DIR] [--base REF] [--stdout]
+#       rc 3 = no usable Node here, so nothing was checked. Not a pass: the review then reads the diff without it.
+#
+# The Node is found the way findings.sh finds it (one rule): asked for its version, never trusted by name.
+set -u
+d="${BASH_SOURCE%[/\\]*}"; [ "$d" = "${BASH_SOURCE}" ] && d=.
+FLOOR=18
+usable(){ local v; v="$("$1" -p 'process.versions.node.split(".")[0]' 2>/dev/null)" || return 1
+  case "$v" in ''|*[!0-9]*) return 1 ;; esac; [ "$v" -ge "$FLOOR" ]; }
+NODE=""
+if usable node; then NODE=node
+elif [ -f "$d/../../../studio/ensure-node.sh" ]; then
+  n="$(bash "$d/../../../studio/ensure-node.sh" 2>/dev/null)" && [ -n "$n" ] && usable "$n" && NODE="$n"
+fi
+if [ -z "$NODE" ]; then
+  echo "review-prepass: no Node $FLOOR+ that runs was found, so nothing was checked (this is not a pass)" >&2
+  exit 3
+fi
+exec "$NODE" "$d/prepass.mjs" "$@"

package/kit/eval/lib/settings-default.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# settings-default.sh — put one of Crewforth's defaults into the project's .claude/settings.json, only where nothing
+# sets it yet. The project's settings win over the user's, so writing a default over a user's own choice would
+# silently replace it: a value set in the project's settings, its local settings or the user's own is kept.
+#
+#   bash settings-default.sh --install <path> <defaults.json> [ENV_VAR]     from the project root
+#     <path>           the setting, as a dot path: statusLine, env.CLAUDE_CODE_SUBAGENT_MODEL
+#     <defaults.json>  a JSON object holding just that setting (data beside the caller: one definition)
+#     ENV_VAR          also kept when this variable is set in the environment (a value exported in the shell)
+#
+# Prints one word: installed · kept (it is set) · none (no settings.json) · failed (the file is left as it was).
+# A managed settings layer is not read. The merge is Crewforth's own JSON reader.
+set -u
+_here="${BASH_SOURCE%[/\\]*}"; [ "$_here" = "${BASH_SOURCE}" ] && _here=.
+
+[ "${1:-}" = --install ] && [ -n "${2:-}" ] && [ -n "${3:-}" ] || { echo "usage: settings-default.sh --install <path> <defaults.json> [ENV_VAR]" >&2; exit 2; }
+KEY="$2"; K="$3"; VAR="${4:-}"
+P=".claude/settings.json"; SJ="$_here/settings-json.awk"
+[ -f "$P" ] && [ -f "$SJ" ] || { echo none; exit 0; }
+case "$VAR" in '') ;; [A-Za-z_]*) case "$VAR" in *[!A-Za-z0-9_]*) echo failed; exit 0 ;; esac; [ -n "${!VAR:-}" ] && { echo kept; exit 0; } ;; *) echo failed; exit 0 ;; esac
+for f in "$P" ".claude/settings.local.json" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"; do
+  [ -f "$f" ] && awk -v op=get -v path="$KEY" -f "$SJ" "$f" >/dev/null 2>&1 && { echo kept; exit 0; }
+done
+[ -f "$K" ] || { echo failed; exit 0; }
+t="$P.default.$$"
+r=failed
+# The project's file goes FIRST: the merge refreshes the first file's .claude/hooks/ entries from the first file,
+# so put second it would lose every Crewforth hook (measured: the installed project's own smoke failed 30 checks).
+# The second file holds only the default, which the first lacks: that is the one change (an object such as env is
+# merged member by member, the project's own members kept). Written through the file, so a symlink and its mode
+# survive.
+if awk -v op=merge -v retired= -f "$SJ" "$P" "$K" > "$t" 2>/dev/null && [ -s "$t" ] \
+   && awk -v op=validate -f "$SJ" "$t" 2>/dev/null && awk -v op=get -v path="$KEY" -f "$SJ" "$t" >/dev/null 2>&1; then
+  cat "$t" > "$P" && r=installed
+fi
+rm -f "$t"; echo "$r"

package/kit/eval/lib/settings-json.awk

@@ -7,8 +7,13 @@
 #   awk -v op=gets -v path='a.b|c.d' -f settings-json.awk FILE   several values in one read, tab-separated, "" if absent
 #   awk -v op=strings -v path=permissions.deny -f settings-json.awk FILE   each string element of that array, one per
 #       line, quotes off, escapes as written (rc 1 = not an array)
+#   awk -v op=keys [-v path=P] -f settings-json.awk FILE   the member names of the object there, one per line, quotes
+#       off, in file order (rc 1 = not an object)
 #       path = dot-separated keys, a number indexes an array (0-based), empty = the root. rc 1 = no such path
 #       (or, for len, a scalar there), 10 = FILE is not a JSON object.
+#   awk -v op=get -v path=P -v setk=M -v setv=RAWJSON -f settings-json.awk FILE   the object at P with member M set
+#       to RAWJSON (added when absent): a payload rewritten in one field, every other field and escape kept
+#       (rc 1 = nothing at P, or not an object)
 #   awk -v op=overlay -v key=K [-v setk=M -v setv=RAWJSON] -f settings-json.awk FILE1 FILE2
 #       FILE1 with FILE1.K shallow-merged from FILE2.K (FILE2 wins, FILE1's other members and order kept), then
 #       member M set to RAWJSON. rc 10 = FILE1 (or its K) is not an object, 11 = FILE2 has no object at K.
@@ -70,6 +75,10 @@ function at(id,path,  n,sg,i){ n=split(path,sg,".")
   return id }
 function mk(t){ NN++; T[NN]=t; N[NN]=0; return NN }
 function add(o,k,c){ N[o]++; K[o,N[o]]=k; C[o,N[o]]=c }
+# Member k of object o set to the raw JSON v, added at the end when o has none (overlay and get share it).
+function setm(o,k,v,  sn,i,x){ sn=mk("s"); V[sn]=v; x=0
+  for(i=1;i<=N[o];i++) if(K[o,i]=="\"" k "\""){ C[o,i]=sn; x=1 }
+  if(!x) add(o,"\"" k "\"",sn) }
 function canon(id,  i,j,n,s,t,ord){
   if(T[id]=="s") return V[id]
   if(T[id]=="a"){ s="["; for(i=1;i<=N[id];i++) s=s (i>1 ? "," : "") canon(C[id,i]); return s "]" }
@@ -130,17 +139,18 @@ END{
   if(op=="gets"){ if(!(r=doc(1))) exit 10; n=split(path,pp,"|"); o=""
     for(i=1;i<=n;i++){ x=at(r,pp[i]); o=o (i>1?"\t":"") (x ? put(x,"") : "") } print o; exit 0 }
   if(op=="get" || op=="len"){ if(!(r=doc(1))) exit 10; if(!(r=at(r,path))) exit 1
-    if(op=="get"){ print put(r,""); exit 0 } if(T[r]=="s") exit 1; print N[r]; exit 0 }
+    if(op=="get"){ if(setk!=""){ if(T[r]!="o") exit 1; setm(r,setk,setv) } print put(r,""); exit 0 }
+    if(T[r]=="s") exit 1; print N[r]; exit 0 }
   if(op=="strings"){ if(!(r=doc(1))) exit 10; if(!(r=at(r,path))) exit 1; if(T[r]!="a") exit 1
     for(i=1;i<=N[r];i++){ c=C[r,i]; if(T[c]=="s" && substr(V[c],1,1)=="\"") print substr(V[c],2,length(V[c])-2) }
     exit 0 }
+  if(op=="keys"){ if(!(r=doc(1))) exit 10; if(!(r=at(r,path))) exit 1; if(T[r]!="o") exit 1
+    for(i=1;i<=N[r];i++){ k=K[r,i]; print substr(k,2,length(k)-2) } exit 0 }
   if(op=="overlay"){ if(!(t=doc(1))) exit 10; if(!(q=doc(2))) exit 11; kk="\"" key "\""
     qv=get(q,kk); if(T[qv]!="o") exit 11; tv=get(t,kk); if(tv && T[tv]!="o") exit 10
     nv=mk("o"); for(i=1;i<=N[tv];i++){ x=get(qv,K[tv,i]); add(nv,K[tv,i], x ? x : C[tv,i]) }
     for(i=1;i<=N[qv];i++) if(!get(nv,K[qv,i])) add(nv,K[qv,i],C[qv,i])
-    if(setk!=""){ sn=mk("s"); V[sn]=setv; x=0
-      for(i=1;i<=N[nv];i++) if(K[nv,i]=="\"" setk "\""){ C[nv,i]=sn; x=1 }
-      if(!x) add(nv,"\"" setk "\"",sn) }
+    if(setk!="") setm(nv,setk,setv)
     x=0; for(i=1;i<=N[t];i++) if(K[t,i]==kk){ C[t,i]=nv; x=1 }
     if(!x) add(t,kk,nv)
     print put(t,""); exit 0 }

package/kit/eval/lib/statusline.sh

@@ -25,24 +25,9 @@ _here="${BASH_SOURCE%[/\\]*}"; [ "$_here" = "${BASH_SOURCE}" ] && _here=.
 # the project's setting would win over it. Prints one word: installed · kept (one is set) · none (no settings.json)
 # · failed (the file is left as it was). A managed settings layer is not read. The merge is Crewforth's own JSON reader.
 if [ "${1:-}" = --install ]; then
-  P=".claude/settings.json"; SJ="$_here/settings-json.awk"
-  [ -f "$P" ] && [ -f "$SJ" ] || { echo none; exit 0; }
-  for f in "$P" ".claude/settings.local.json" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"; do
-    [ -f "$f" ] && awk -v op=get -v path=statusLine -f "$SJ" "$f" >/dev/null 2>&1 && { echo kept; exit 0; }
-  done
-  # The setting itself is data beside this file (statusline.settings.json): one definition, read here and nowhere else.
-  K="$_here/statusline.settings.json"; [ -f "$K" ] || { echo failed; exit 0; }
-  t="$P.statusline.$$"
-  r=failed
-  # The project's file goes FIRST: the merge refreshes the first file's .claude/hooks/ entries from the first file,
-  # so put second it would lose every Crewforth hook (measured: the installed project's own smoke failed 30
-  # checks). The second file has one member, statusLine, which the first lacks: that is the one change. Written
-  # through the file, so a symlink and its mode survive.
-  if awk -v op=merge -v retired= -f "$SJ" "$P" "$K" > "$t" 2>/dev/null && [ -s "$t" ] \
-     && awk -v op=validate -f "$SJ" "$t" 2>/dev/null && awk -v op=get -v path=statusLine -f "$SJ" "$t" >/dev/null 2>&1; then
-    cat "$t" > "$P" && r=installed
-  fi
-  rm -f "$t"; echo "$r"; exit 0
+  # The setting itself is data beside this file (statusline.settings.json); the rule for putting a default in is
+  # one helper, shared with the subagent model's default.
+  exec bash "$_here/settings-default.sh" --install statusLine "$_here/statusline.settings.json"
 fi
 
 IFS= read -r -d '' IN || true
@@ -67,7 +52,7 @@ if [ -n "$SID" ] && [ -d .claude ]; then
 fi
 
 # 🛡 The gate's last word in this session.
-GL="${CREW_GATE_LOG:-.claude/gate-log.tsv}"
+GL=""; [ -f "$_here/gate-log.sh" ] && { . "$_here/gate-log.sh"; crew_gate_log_read; GL="$_CREW_GL"; }   # one rule (gate-log.sh)
 if [ -n "$BASE" ] && [ -f "$GL" ] && [ "$GL" -nt "$BASE" ]; then
   last="$(tail -n 1 "$GL" 2>/dev/null)"
   IFS=$'\t' read -r verdict section _ <<< "$last"

package/kit/eval/lib/verify-cmd.sh

@@ -0,0 +1,17 @@
+# Sourced, not run. How a card's verify command is read: one definition, for the gate that runs it
+# (hooks/guard-agent-model.sh) and for doctor, which offers the line that would allow it.
+#
+# A verify command in a sub-folder: `cd apps/mobile && flutter test`, the usual shape in a repository of several
+# projects (measured on one: 41 of 71 refused verify commands had it). Split into the folder and the one command,
+# so the command is judged alone and run in that folder with no chain; a `verify <command>` rule names the command
+# alone. Only a relative folder inside the project, with no .. step, that exists; anything else is left whole, and
+# is refused as a chain.
+crew_verify_split(){  # $1 = the command, $2 = the project root -> _AMVD the folder ("" = the root), _AMVC the command
+  local c="$1" d r root="${2:-.}"
+  _AMVD=""; _AMVC="$c"
+  case "$c" in 'cd '*' && '*) ;; *) return 0 ;; esac
+  d="${c#cd }"; d="${d%% && *}"; r="${c#cd "$d" && }"
+  case "$d" in ''|/*|~*|*[!A-Za-z0-9._/-]*|..|../*|*/..|*/../*) return 0 ;; esac
+  [ -n "$r" ] && [ -d "$root/$d" ] || return 0
+  _AMVD="$d"; _AMVC="$r"
+}

package/kit/eval/lib/version.sh

@@ -0,0 +1,41 @@
+# Sourced, not run. The ONE definition of how Crewforth reads and orders its own version numbers.
+#
+# An install's VERSION holds X.Y.Z, or X.Y.Z-rc.N when it came from a release candidate. An rc comes before its
+# final (3.2.0-rc.1 < 3.2.0), so someone who tried the rc is offered the final when it ships. Read by the update
+# check (hooks/session-update-check.sh), doctor and adopt.sh; each used to split on "." and read 3.2.0-rc.1 as 3.2.0.
+#
+# Builtins only: sourcing this costs no process, which matters in hooks on Git Bash.
+
+# The version an install may hold in its own VERSION file: X.Y.Z or X.Y.Z-rc.N, nothing else; printed, or rc 1.
+# A value off the network is not read with this: the update check holds that to X.Y.Z alone.
+crew_local_version(){
+  local v="${1:-}" base n
+  v="${v//[!0-9A-Za-z.-]/}"
+  base="${v%%-rc.*}"
+  case "$base" in
+    *[!0-9.]*|'')           return 1 ;;
+    [0-9]*.[0-9]*.[0-9]*.*) return 1 ;;
+    [0-9]*.[0-9]*.[0-9]*)   ;;
+    *)                      return 1 ;;
+  esac
+  if [ "$base" != "$v" ]; then
+    n="${v#"$base"-rc.}"
+    case "$n" in ''|*[!0-9]*) return 1 ;; esac
+  fi
+  printf '%s' "$v"
+}
+
+# vcmp(a, b): 1 when a is newer, -1 when older, 0 when the same. Prepended to an awk program:
+#   awk -v a="$X" -v b="$Y" "$CREW_VCMP_AWK"' BEGIN { exit !(vcmp(a, b) > 0) }'
+CREW_VCMP_AWK='
+function vrc(v) { return match(v, /-rc\.[0-9]+$/) ? substr(v, RSTART + 4) + 0 : -1 }
+function vcmp(a, b,   x, y, i, ra, rb) {
+  ra = vrc(a); rb = vrc(b); sub(/-.*/, "", a); sub(/-.*/, "", b)
+  split(a, x, "."); split(b, y, ".")
+  for (i = 1; i <= 3; i++) { if (x[i] + 0 > y[i] + 0) return 1; if (x[i] + 0 < y[i] + 0) return -1 }
+  if (ra == rb) return 0
+  if (ra < 0) return 1
+  if (rb < 0) return -1
+  return ra > rb ? 1 : -1
+}
+'

package/kit/eval/review-bench.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# review-bench.sh — how right the review is, on labelled cases: precision, recall and every false alarm by name.
+# The shell entry to eval/lib/review-bench/bench.mjs; it finds a Node that RUNS and hands over.
+#
+#   bash review-bench.sh --cases DIR [--arm prepass|agent] [--split all|train|holdout] [--only id,id]
+#                        [--model sonnet] [--advisor opus] [--case-budget 0.75] [--max-cost 12] [--floors FILE]
+#                        [--out FILE] [--no-tools]
+#
+# --arm prepass (the default) runs no model and costs nothing. --arm agent runs Claude Code headless as
+# crew-review-agent on every case and SPENDS TOKENS: each case is capped by --case-budget (US dollars) and the run
+# by --max-cost; ask the person paying before running it. rc 3 = no usable Node here (not a pass).
+set -u
+d="${BASH_SOURCE%[/\\]*}"; [ "$d" = "${BASH_SOURCE}" ] && d=.
+FLOOR=18
+usable(){ local v; v="$("$1" -p 'process.versions.node.split(".")[0]' 2>/dev/null)" || return 1
+  case "$v" in ''|*[!0-9]*) return 1 ;; esac; [ "$v" -ge "$FLOOR" ]; }
+NODE=""
+if usable node; then NODE=node
+elif [ -f "$d/../studio/ensure-node.sh" ]; then
+  n="$(bash "$d/../studio/ensure-node.sh" 2>/dev/null)" && [ -n "$n" ] && usable "$n" && NODE="$n"
+fi
+if [ -z "$NODE" ]; then
+  echo "review-bench: no Node $FLOOR+ that runs was found, so nothing was measured (this is not a pass)" >&2
+  exit 3
+fi
+exec "$NODE" "$d/lib/review-bench/bench.mjs" "$@"