crewforth 3.2.0-rc.2 → 3.2.0-rc.3

package/kit/eval/lib/crew-map/stacks.mjs

@@ -1,5 +1,5 @@
 // stacks.mjs — modules, their declared dependencies, their imports and their references to each other, for the
-// five stacks. Every fact carries the line it was read from; what cannot be read is returned as notMeasured.
+// six stacks. Every fact carries the line it was read from; what cannot be read is returned as notMeasured.
 //
 // A module is { id, name, stack, dir, manifest, tech[], evidence[], deps[], refs[], imports[], entry, entryEv,
 //              aliases[], selfNames[], files[] }.
@@ -10,7 +10,7 @@
 // (a namespace prefix, a Gradle line read by pattern).
 
 import path from 'node:path';
-import { parseJsonc, parseToml, parseXml, xKids, xKid, xText, xLine, xFind, Unsupported } from './parse.mjs';
+import { parseJsonc, parseToml, parseXml, parseYaml, yGet, xKids, xKid, xText, xLine, xFind, Unsupported } from './parse.mjs';
 import { ev, evFirst, lineOf, isTestPath } from './project.mjs';
 
 const P = path.posix;
@@ -20,7 +20,7 @@ const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 const isComment = (l) => /^\s*(\/\/|#|\*|\/\*|<!--)/.test(l);
 
 export const SOURCE_EXT = {
-  node: /\.(m?[jt]sx?|cjs|cts|mts)$/, python: /\.py$/, go: /\.go$/, dotnet: /\.cs$/, java: /\.(java|kt)$/,
+  node: /\.(m?[jt]sx?|cjs|cts|mts)$/, python: /\.py$/, go: /\.go$/, dotnet: /\.cs$/, java: /\.(java|kt)$/, dart: /\.dart$/,
 };
 
 function mod(stack, name, manifest, dir) {
@@ -28,6 +28,22 @@ function mod(stack, name, manifest, dir) {
     imports: [], entry: false, entryEv: null, aliases: [], selfNames: [name], files: [] };
 }
 
+/**
+ * What each module is built with, from rules/tech.json: a package its manifest declares, or a file at its root.
+ * Labels are words a newcomer reads (Hono, Cloudflare Workers, Flutter), not versions; frameworks before tools, in
+ * the order of the rules. Before, only nine npm frameworks were named and a Node module read as "node".
+ */
+export function applyTech(st, pj, rules) {
+  const has = new Set(pj.files);
+  for (const m of st.modules) {
+    const deps = new Set(m.deps.map((d) => `${d.eco}\t${d.name}`));
+    for (const [eco, list] of Object.entries(rules?.packages ?? {})) for (const [name, label] of list) if (deps.has(`${eco}\t${name}`)) m.tech.add(label);
+    const base = m.dir === '.' ? '' : `${m.dir}/`;
+    for (const [file, label] of rules?.files ?? []) if (has.has(`${base}${file}`)) m.tech.add(label);
+    if (m.stack === 'node' && !m.tech.has('TypeScript') && m.files.some((f) => /\.(ts|tsx|mts|cts)$/.test(f))) m.tech.add('TypeScript');
+  }
+}
+
 // A version the map may show. A dependency can be declared by URL (git+https://token@host/repo.git#v1), and a URL
 // is never copied out: it reads as 'url', which no detector compares.
 export function cleanVersion(v) {
@@ -48,7 +64,7 @@ function runnable(m) {
 
 // Hand each source file to the deepest module of its stack whose directory holds it.
 // A file under a sample project's own manifest (left out of discovery) belongs to that sample, so to nobody here.
-const MANIFEST = /(^|\/)(package\.json|pyproject\.toml|setup\.cfg|requirements[^/]*\.txt|go\.mod|[^/]+\.(cs|fs|vb)proj|pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?)$/;
+const MANIFEST = /(^|\/)(package\.json|pyproject\.toml|setup\.cfg|requirements[^/]*\.txt|go\.mod|[^/]+\.(cs|fs|vb)proj|pom\.xml|build\.gradle(\.kts)?|settings\.gradle(\.kts)?|pubspec\.yaml)$/;
 function own(modules, files, stack) {
   const mine = modules.filter((m) => m.stack === stack).sort((a, b) => b.dir.length - a.dir.length);
   const samples = files.filter((f) => MANIFEST.test(f) && isTestPath(f)).map(dirOf);
@@ -76,9 +92,6 @@ function nodeStack(pj, out) {
       if (!v[sect] || typeof v[sect] !== 'object') continue;
       for (const [dn, ver] of Object.entries(v[sect])) m.deps.push({ eco: 'npm', name: dn, version: cleanVersion(ver), dev, peer: sect === 'peerDependencies', ev: ev(f, L([sect, dn]), dn) });
     }
-    for (const fw of ['next', 'react', 'vue', 'svelte', '@angular/core', 'express', 'fastify', '@nestjs/core', 'vite']) {
-      const d = m.deps.find((x) => x.name === fw && x.version !== 'url'); if (d) m.tech.add(`${fw}@${d.version.replace(/^[\^~>=<\s]+/, '')}`);
-    }
     if (v.bin) { m.entry = true; m.entryEv = ev(f, L(['bin']), 'bin'); }
     else if (v.scripts && (v.scripts.start || v.scripts.dev)) { const k = v.scripts.start ? 'start' : 'dev'; m.entry = true; m.entryEv = ev(f, L(['scripts', k]), k); }
     else if (v.workspaces) { m.entry = true; m.entryEv = ev(f, L(['workspaces']), 'workspaces'); }
@@ -265,6 +278,98 @@ function goStack(pj, out) {
   }
 }
 
+// ---- Dart / Flutter -------------------------------------------------------------------------------------------
+// One module per pubspec.yaml. A `path:` dependency names another module of this repository (a reference); a
+// `sdk: flutter` dependency makes it a Flutter module. Its .dart files import `package:<name>/…`: another module's
+// name is a reference, anything else a package it uses; `dart:` is the SDK. lib/main.dart or bin/ is an entry, and
+// so is a tool/ script with a main() (`dart run tool/x.dart` is how a package's own command is run).
+// Before this reader, a Flutter repository's app and its packages were not on the map at all (measured on a real
+// project: 5 Dart modules, 949 .dart files, none drawn).
+function dartStack(pj, out) {
+  const made = [];
+  for (const f of pj.manifests.filter((x) => P.basename(x) === 'pubspec.yaml')) {
+    const src = pj.read(f); if (!src) continue;
+    let y; try { y = parseYaml(src.text); } catch (e) { out.notMeasured.push({ what: f, reason: `pubspec.yaml outside the subset this scanner reads: ${e.message}` }); continue; }
+    const nm = yGet(y, 'name');
+    if (!nm || nm.v.t !== 'str' || !nm.v.v) { out.notMeasured.push({ what: f, reason: 'pubspec.yaml has no name' }); continue; }
+    const m = mod('dart', nm.v.v, f, dirOf(f));
+    m.evidence.push(ev(f, nm.line, nm.v.v));
+    const paths = [];
+    for (const [key, dev] of [['dependencies', false], ['dev_dependencies', true]]) {
+      const block = yGet(y, key); if (!block || block.v.t !== 'map') continue;
+      for (const d of block.v.e) {
+        const e = ev(f, d.line, d.k);
+        if (d.v.t === 'map') {
+          const sdk = yGet(d.v, 'sdk'); const pth = yGet(d.v, 'path');
+          if (sdk && sdk.v.t === 'str') { if (sdk.v.v === 'flutter' && d.k === 'flutter') m.tech.add('Flutter'); continue; }
+          if (pth && pth.v.t === 'str') { paths.push({ to: P.normalize(P.join(m.dir === '.' ? '' : m.dir, pth.v.v)), name: d.k, ev: e }); continue; }
+          const v = yGet(d.v, 'version'); m.deps.push({ eco: 'pub', name: d.k, version: v && v.v.t === 'str' ? cleanVersion(v.v.v) : '', dev, ev: e });
+        } else {
+          m.deps.push({ eco: 'pub', name: d.k, version: d.v.t === 'str' ? cleanVersion(d.v.v) : '', dev, ev: e });
+        }
+      }
+    }
+    if (yGet(y, 'flutter')) m.tech.add('Flutter');
+    m._paths = paths;
+    out.modules.push(m); made.push(m);
+  }
+  if (!made.length) return;
+  own(out.modules, pj.files, 'dart');
+  const byName = new Map(made.map((m) => [m.name, m]));
+  for (const m of made) {
+    for (const p of m._paths) {
+      const t = made.find((o) => o.dir === p.to) ?? byName.get(p.name);
+      if (t && t !== m) m.refs.push({ to: t.id, toMod: t, ev: p.ev, confidence: 'evidence' });
+    }
+    delete m._paths;
+    for (const f of m.files) {
+      if (/(^|\/)(lib\/main\.dart|bin\/[^/]+\.dart)$/.test(f.slice(m.dir === '.' ? 0 : m.dir.length + 1)) && !m.entry) {
+        m.entry = true; m.entryEv = evFirst(f, pj.read(f)?.lines ?? []);
+      }
+      if (!m.entry && /^tool\/[^/]+\.dart$/.test(f.slice(m.dir === '.' ? 0 : m.dir.length + 1))) {
+        const i = (pj.read(f)?.lines ?? []).findIndex((l) => /^\s*(?:Future<void>|void)\s+main\s*\(/.test(l));
+        if (i >= 0) { m.entry = true; m.entryEv = ev(f, i + 1, 'main'); }
+      }
+      const src = pj.read(f); if (!src) continue;
+      src.lines.forEach((l, i) => {
+        const x = /^\s*(?:import|export)\s+['"]package:([A-Za-z0-9_]+)\/[^'"]*['"]/.exec(l);
+        if (!x) return;
+        const t = byName.get(x[1]);
+        if (t) { if (t !== m && !m.refs.some((r) => r.toMod === t)) m.refs.push({ to: t.id, toMod: t, ev: ev(f, i + 1, x[1]), confidence: 'evidence' }); return; }
+        if (x[1] === m.name) return;
+        m.imports.push({ spec: x[1], root: x[1], ev: ev(f, i + 1, x[1]), file: f });
+      });
+    }
+  }
+  // Flutter declares packages nothing imports (cupertino_icons is a font, flutter_lints a lint set, build_runner a
+  // command), so an unused-package rule would mostly be wrong here: it is not run, and that is said.
+  if (out.modules.some((m) => m.stack === 'dart')) out.notMeasured.push({ what: 'Dart package usage (dep-unused, dep-undeclared)', reason: 'Flutter declares packages that no file imports (fonts, lint sets, code generators), so a declared package is not proven unused' });
+}
+
+// A Flutter app holds its platforms as folders of their own: android/ is a Gradle project, ios/ an Xcode one. They
+// are how the app is built for each platform, not modules of the repository, so they are folded into the app: its
+// tech says Android / iOS, and the Gradle modules under it are not drawn on their own (measured on a real project:
+// two "unplaced" Gradle modules beside a Flutter app the map did not show).
+function foldPlatforms(pj, out) {
+  const apps = out.modules.filter((m) => m.stack === 'dart' && m.tech.has('Flutter'));
+  if (!apps.length) return;
+  const drop = new Set();
+  for (const a of apps) {
+    const base = a.dir === '.' ? '' : `${a.dir}/`;
+    for (const m of out.modules) {
+      if (m === a || m.stack !== 'java') continue;
+      if (m.dir === `${base}android` || m.dir.startsWith(`${base}android/`)) { drop.add(m); a.tech.add('Android'); }
+    }
+    if (pj.files.some((f) => f.startsWith(`${base}ios/`))) a.tech.add('iOS');
+  }
+  if (!drop.size) return;
+  out.modules = out.modules.filter((m) => !drop.has(m));
+  for (const m of out.modules) m.refs = m.refs.filter((r) => !drop.has(r.toMod));
+  // The Gradle notes were about those folders; with no Java module left on the map they speak of nothing.
+  if (!out.modules.some((m) => m.stack === 'java')) out.notMeasured = out.notMeasured.filter((x) => !JAVA_NOTES.has(x.what));
+}
+const JAVA_NOTES = new Set(['Gradle build logic', 'Java/Kotlin package usage (dep-unused, dep-undeclared)']);
+
 // ---- .NET ---------------------------------------------------------------------------------------------------
 function dotnetStack(pj, out) {
   const central = new Map();
@@ -425,12 +530,13 @@ export function scanStacks(pj0) {
   // Its source files still belong to the module that holds them (a test imports that module's dependencies).
   const pj = { ...pj0, manifests: pj0.files.filter((f) => !isTestPath(f)) };
   const out = { modules: [], notMeasured: [], globalAliases: [] };
-  for (const fn of [nodeStack, pythonStack, goStack, dotnetStack, javaStack]) {
+  for (const fn of [nodeStack, pythonStack, goStack, dartStack, dotnetStack, javaStack]) {
     try { fn(pj, out); } catch (e) {
       if (!(e instanceof Unsupported)) throw e;
       out.notMeasured.push({ what: fn.name, reason: e.message });
     }
   }
+  foldPlatforms(pj, out);
   // Two manifests with one name (a copy, a fork in a subdirectory) would share an id: the directory tells them apart.
   const count = new Map();
   for (const m of out.modules) count.set(m.id, (count.get(m.id) || 0) + 1);

package/kit/eval/lib/crew-map/surface.mjs

@@ -117,7 +117,7 @@ export function configuration(pj, st, rules, hostOf, ex, out) {
       src.lines.forEach((l, i) => {
         const m = /^\s*(ENV|ARG)\s+([A-Za-z_][A-Za-z0-9_]*)/i.exec(l); if (m) def(m[2], f, i + 1, 'dockerfile');
         const from = /^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)/i.exec(l);
-        if (from) { const o = ownerOf(st.modules, f); if (o) o.tech.add(`image:${from[1]}`); }
+        if (from) { const o = ownerOf(st.modules, f); if (o) o.tech.add('Docker'); }   // the image itself is the line's evidence
       });
     }
   }
@@ -186,6 +186,52 @@ export function codeUrls(pj, st, hostOf, ex, out) {
   }
 }
 
+// ---- one module calling another at the address it is served on -----------------------------------------------
+// A module says where it is served in its own deployment file: wrangler routes and custom domains (Cloudflare
+// Workers), the app of fly.toml (<app>.fly.dev). Another module that writes that host, quoted on its own or as the
+// host of a URL, calls it: an app that builds Uri(host: 'api.x.app') never spells a URL, and before this a call
+// to the project's own server was drawn as an external API, or not at all.
+const SERVED_FILES = /(^|\/)(wrangler\.toml|wrangler\.jsonc?|fly\.toml)$/;
+export function servedCalls(pj, st, ex, out) {
+  const served = new Map();   // host -> module
+  for (const m of st.modules) {
+    for (const f of pj.files.filter((x) => SERVED_FILES.test(x) && dirOf(x) === m.dir)) {
+      const src = pj.read(f); if (!src) continue;
+      src.lines.forEach((l, i) => {
+        if (isComment(l)) return;
+        const hosts = [];
+        for (const x of l.matchAll(/["']?(?:pattern|route)["']?\s*[=:]\s*["']([^"']+)["']/g)) hosts.push(x[1]);
+        if (/fly\.toml$/.test(f)) { const a = /^\s*app\s*=\s*["']([a-z0-9-]+)["']/.exec(l); if (a) hosts.push(`${a[1]}.fly.dev`); }
+        for (const raw of hosts) {
+          const h = raw.replace(/^https?:\/\//, '').replace(/^\*\.?/, '').split('/')[0].toLowerCase();
+          if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(h) || isLocalHost(h) || served.has(h)) continue;
+          served.set(h, m); m.evidence.push(ev(f, i + 1, raw));
+        }
+      });
+    }
+  }
+  out.served = served;
+  if (!served.size) return;
+  for (const [h, to] of served) {
+    const q = h.replace(/[.]/g, '\\.');
+    const re = new RegExp(`(["'\`])${q}\\1|://${q}(?=[/:"'\`]|$)`);
+    for (const m of st.modules) {
+      if (m === to) continue;
+      for (const f of m.files) {
+        if (isTestPath(f)) continue;
+        const src = pj.read(f); if (!src) continue;
+        src.lines.forEach((l, i) => { if (!isComment(l) && re.test(l)) out.edges.push({ from: m.id, to: to.id, kind: 'calls', confidence: 'evidence', via: 'code', evidence: [ev(f, i + 1, h)] }); });
+      }
+    }
+    // The host was read as an external API: it is the project's own module, so its edges go there and the node goes.
+    const id = `ext:http-api:${h}`;
+    if (!ex.ext.has(id)) continue;
+    for (const e of out.edges) if (e.to === id) { e.to = to.id; e.kind = 'calls'; }
+    out.edges = out.edges.filter((e) => e.from !== e.to);
+    ex.ext.delete(id);
+  }
+}
+
 // ---- endpoints ----------------------------------------------------------------------------------------------
 // A path is compared in one spelling: lower case, one leading slash, no trailing slash, every parameter ({id},
 // :id, ${id}, <int:id>, {id:int}) as {}. A path whose start was built at run time (a variable before the first
@@ -322,6 +368,21 @@ export function endpoints(pj, st, out) {
           if (axa && axa.s && !/^https?:/.test(axa.s)) add(consumes, m, ax[2], axa.s, f, axa.at, axa.s);
         });
       }
+      // Dart consumers: a Dio client's relative path, and a full URL (http.get(Uri.parse(…)), Uri.https(host, path))
+      // only when its host is one this project serves; any other host is someone else's API. `$id` is a parameter.
+      if (/\.dart$/.test(f)) {
+        const ours = (h) => out.served?.has(h.toLowerCase());
+        const dp = (s) => s.replace(/\$\{[^}]*\}|\$\w+/g, '{x}');
+        L.forEach((l, i) => {
+          if (isComment(l)) return;
+          const dio = /\b(\w*[dD]io\w*|_?client|_?api)\.(get|post|put|patch|delete)(?:<[^()]*?>)?\(\s*(['"])(\/[^'"]*)\3/.exec(l);
+          if (dio) add(consumes, m, dio[2], dp(dio[4]), f, i, dio[4]);
+          const hp = /\.(get|post|put|patch|delete)\(\s*Uri\.parse\(\s*(['"])https?:\/\/([^/'"$]+)(\/[^'"]*)\2/.exec(l);
+          if (hp && ours(hp[3])) add(consumes, m, hp[1], dp(hp[4]), f, i, hp[4]);
+          const uh = /\bUri\.https?\(\s*(['"])([^'"$]+)\1\s*,\s*(['"])(\/[^'"]*)\3/.exec(l);
+          if (uh && ours(uh[2])) add(consumes, m, 'GET', dp(uh[4]), f, i, uh[4]);
+        });
+      }
       // Python: FastAPI / Flask / Django providers; requests / httpx consumers
       if (/\.py$/.test(f)) {
         const pre = new Map();

package/kit/eval/lib/gate-log.sh

@@ -0,0 +1,52 @@
+# Sourced, not run. The ONE rule for where the gate log is, for the gates that write it and everything that reads it
+# (the status line, gate-report, doctor). Studio's reader (server/lib/kit-telemetry.js) follows the same order.
+#
+#   1. CREW_GATE_LOG, when set: used as given (/dev/null turns recording off).
+#   2. .claude/gate-log.tsv, outside a git repository or where git ignores it (a full install ignores .claude/).
+#   3. Otherwise <git dir>/crewforth-gate-log.tsv: inside the repository's own .git, which is never committed.
+#      Before 3.2.0 the log was simply not written there, so a project that tracks .claude/ had no record of a
+#      refusal, no 🛡 on its status line and no note of a model the gate lowered (seen on a real project).
+#
+# Builtins only on the reading side, which the status line runs every few seconds. The writing side asks git
+# (one or two processes), and only when a decision is being logged.
+
+# The repository's git directory, from the project root up, without a process: _CREW_GD, or rc 1.
+crew_git_dir(){
+  local d="${1:-.}" n=0 l
+  _CREW_GD=""
+  while [ "$n" -lt 12 ]; do
+    if [ -d "$d/.git" ]; then _CREW_GD="$d/.git"; return 0; fi
+    if [ -f "$d/.git" ]; then
+      IFS= read -r l < "$d/.git" 2>/dev/null || l=""
+      case "$l" in "gitdir: "*) l="${l#gitdir: }"; l="${l%$'\r'}"
+        case "$l" in /*|[A-Za-z]:*) ;; *) l="$d/$l" ;; esac
+        [ -d "$l" ] && { _CREW_GD="$l"; return 0; } ;; esac
+      return 1
+    fi
+    [ "$d" = / ] && return 1
+    d="$d/.."; n=$((n+1))
+  done
+  return 1
+}
+
+# Where a gate writes: _CREW_GL ("" = nowhere). Run from the project root.
+crew_gate_log_write(){
+  _CREW_GL=""
+  if [ -n "${CREW_GATE_LOG:-}" ]; then _CREW_GL="$CREW_GATE_LOG"; return 0; fi
+  [ -d .claude ] || return 0
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1 || git check-ignore -q .claude/gate-log.tsv 2>/dev/null; then
+    _CREW_GL=.claude/gate-log.tsv; return 0
+  fi
+  local g; g="$(git rev-parse --absolute-git-dir 2>/dev/null)" || g=""
+  [ -n "$g" ] && [ -d "$g" ] && _CREW_GL="$g/crewforth-gate-log.tsv"
+  return 0
+}
+
+# Where a reader finds it: _CREW_GL ("" = none yet). No process.
+crew_gate_log_read(){
+  _CREW_GL=""
+  if [ -n "${CREW_GATE_LOG:-}" ]; then _CREW_GL="$CREW_GATE_LOG"; return 0; fi
+  if [ -f .claude/gate-log.tsv ]; then _CREW_GL=.claude/gate-log.tsv; return 0; fi
+  crew_git_dir . && [ -f "$_CREW_GD/crewforth-gate-log.tsv" ] && _CREW_GL="$_CREW_GD/crewforth-gate-log.tsv"
+  return 0
+}

package/kit/eval/lib/json-string.awk

@@ -0,0 +1,27 @@
+# json-string.awk — the text on stdin as the inside of a JSON string, printed with no quotes around it and no newline
+# after it. One escaper for every hook that puts dynamic text into its JSON (board-sync.sh, session-rehydrate.sh).
+#
+#   printf '%s\n' "$MSG" | LC_ALL=C awk -f json-string.awk
+#
+# jq-identical, measured on 15 inputs (quote, backslash, tab, CR, C0 controls, DEL, UTF-8, leading/trailing
+# newlines, 5000 chars): 15/15 equal to `jq -cn --arg m`. The one it replaced escaped only the quote, the backslash
+# and the newline, so a tab in a board item produced JSON the CLI cannot parse (jq rc=5) and the board silently
+# vanished from the session. The trailing newline the caller prints closes the last record, so a value ending in a
+# newline keeps it. A CR that ENDS a line is dropped on purpose: it is a CRLF line ending, not content, and MSYS gawk
+# already drops it on read (text mode) while BSD awk keeps it, measured on Windows; stripping it here makes every OS
+# emit the same bytes. A CR inside a line is still escaped as \r.
+BEGIN { ORS = ""
+  for (i = 1; i < 32; i++) ctl[i] = sprintf("%c", i)
+  nm[8] = "\\b"; nm[9] = "\\t"; nm[12] = "\\f"; nm[13] = "\\r" }
+NR > 1 { print "\\n" }
+{ s = $0; sub(/\r$/, "", s)
+  gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s)
+  for (i = 1; i < 32; i++) {
+    if (i == 10 || !index(s, ctl[i])) continue
+    r = (i in nm) ? nm[i] : sprintf("\\u%04x", i)
+    out = ""; while ((p = index(s, ctl[i])) > 0) { out = out substr(s, 1, p - 1) r; s = substr(s, p + 1) }
+    s = out s
+  }
+  d = sprintf("%c", 127)
+  if (index(s, d)) { out = ""; while ((p = index(s, d)) > 0) { out = out substr(s, 1, p - 1) "\\u007f"; s = substr(s, p + 1) }; s = out s }
+  print s }

package/kit/eval/lib/preset.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# preset.sh — an organisation's settings for Crewforth in one file, applied to a project.
+#
+#   bash preset.sh --apply <name|file.json>    from the project root; a name is one of eval/lib/presets/
+#   bash preset.sh --check <name|file.json>    is it a valid preset? Nothing is written (the installers ask first)
+#   bash preset.sh --show                      the preset in force here, or "none"
+#   bash preset.sh --list                      the presets that ship
+#
+# A preset is plain JSON (see presets/default.json for every key):
+#   critical.add / critical.remove   paths made critical, or not (globs, as `+ glob` / `- glob`)
+#   floors                           [agent, change, risk, model]: a model a class of work runs on at least
+#   verify                           commands the gate may run as a verify command
+#   lang                             en | tr, the language of what Crewforth says (only when the project has none)
+#
+# Where it goes: .claude/crew-model-rules, the file every reader of these rules already reads (the model gate,
+# agent-outcome's scan, doctor, Studio), as one marked block at the top. The project's own lines stay below it, so
+# the rule is the file's own: for a critical path the last line that matches wins, so a project's `- glob` undoes a
+# preset's `+ glob`; a floor only ever raises, so a preset's floor is a minimum a project can raise and not lower.
+# Applying again replaces the block and nothing else; the same preset twice gives the same bytes.
+#
+# rc 0 = applied (or shown) · 1 = the preset is not valid, or names nothing; nothing was written · 2 = usage
+# Every JSON read is Crewforth's own reader (settings-json.awk): no jq, no python.
+set -u
+_here="${BASH_SOURCE%[/\\]*}"; [ "$_here" = "${BASH_SOURCE}" ] && _here=.
+SJ="$_here/settings-json.awk"; DIR="$_here/presets"
+RULES=.claude/crew-model-rules; CONF=.claude/kit.conf
+BEGIN_MARK='# ---- preset:'; END_MARK='# ---- end of preset (lines below are this project'"'"'s own and win over it, see preset.sh) ----'
+
+die(){ echo "preset: $*" >&2; exit 1; }
+jget(){ awk -v op=get -v path="$1" -f "$SJ" "$2" 2>/dev/null; }
+jstrings(){ awk -v op=strings -v path="$1" -f "$SJ" "$2" 2>/dev/null; }
+jlen(){ local n; n="$(awk -v op=len -v path="$1" -f "$SJ" "$2" 2>/dev/null)"; printf '%s' "${n:-0}"; }
+
+case "${1:-}" in
+  --list) for f in "$DIR"/*.json; do [ -f "$f" ] || continue; n="${f##*/}"; printf '%s\n' "${n%.json}"; done; exit 0 ;;
+  --show)
+    [ -f "$RULES" ] || { echo none; exit 0; }
+    while IFS= read -r l || [ -n "$l" ]; do case "$l" in "$BEGIN_MARK "*) l="${l#"$BEGIN_MARK "}"; echo "${l%% *}"; exit 0 ;; esac; done < "$RULES"
+    echo none; exit 0 ;;
+  --apply|--check) [ -n "${2:-}" ] || { echo "usage: preset.sh --apply|--check <name|file.json> | --show | --list" >&2; exit 2; } ;;
+  *) echo "usage: preset.sh --apply|--check <name|file.json> | --show | --list" >&2; exit 2 ;;
+esac
+MODE="$1"
+[ "$MODE" = --check ] || [ -d .claude ] || die "no .claude/ here: run it from the root of a project Crewforth is installed in"
+
+# ---- which file ----
+P="$2"
+case "$P" in *.json|*/*) ;; *) P="$DIR/$P.json" ;; esac
+[ -f "$P" ] || die "no preset at $P (the ones that ship: $(bash "$0" --list 2>/dev/null | tr '\n' ' '))"
+awk -v op=validate -f "$SJ" "$P" 2>/dev/null || die "$P is not a JSON object"
+NAME="$(jget name "$P")"; NAME="${NAME#\"}"; NAME="${NAME%\"}"
+case "$NAME" in ''|*[!a-z0-9-]*) die "$P: name must be lower case letters, digits and -" ;; esac
+
+# ---- what it says, checked before anything is written ----
+LINES=()
+for k in add remove; do
+  sign='+'; [ "$k" = remove ] && sign='-'
+  while IFS= read -r g; do
+    [ -n "$g" ] || continue
+    case "$g" in *[[:space:]\#]*) die "$P: critical.$k holds '$g', which has a space or a #" ;; esac
+    LINES+=("$sign $g")
+  done < <(jstrings "critical.$k" "$P")
+done
+nf="$(jlen floors "$P")"; i=0
+while [ "$i" -lt "$nf" ]; do
+  f=(); while IFS= read -r w; do f+=("$w"); done < <(jstrings "floors.$i" "$P")
+  [ "${#f[@]}" = 4 ] || die "$P: floors[$i] is not [agent, change, risk, model]"
+  case "${f[3]}" in haiku|sonnet|opus) ;; *) die "$P: floors[$i] names the model '${f[3]}', not haiku, sonnet or opus" ;; esac
+  for w in "${f[@]}"; do case "$w" in ''|*[[:space:]\#]*) die "$P: floors[$i] has an empty word, a space or a #" ;; esac; done
+  LINES+=("floor ${f[0]} ${f[1]} ${f[2]} ${f[3]}"); i=$((i+1))
+done
+while IFS= read -r c; do
+  [ -n "$c" ] || continue
+  case "$c" in *[\;\&\|\<\>\`\$\#]*) die "$P: verify '$c' has a shell operator or a #; the gate runs a verify command as one command" ;; esac
+  LINES+=("verify $c")
+done < <(jstrings verify "$P")
+LANGV="$(jget lang "$P")"; LANGV="${LANGV#\"}"; LANGV="${LANGV%\"}"
+case "$LANGV" in ''|null|en|tr) ;; *) die "$P: lang is '$LANGV', not en or tr" ;; esac
+for k in $(awk -v op=keys -f "$SJ" "$P" 2>/dev/null); do
+  case "$k" in about|name|critical|floors|verify|lang) ;; *) die "$P: unknown key '$k' (about, name, critical, floors, verify, lang)" ;; esac
+done
+
+[ "$MODE" = --check ] && { echo "preset: $NAME is valid — ${#LINES[@]} line(s)"; exit 0; }
+
+# ---- the block, at the top of the rules file; the project's own lines kept below it ----
+OWN=""
+if [ -f "$RULES" ]; then
+  skip=0
+  while IFS= read -r l || [ -n "$l" ]; do
+    case "$l" in "$BEGIN_MARK "*) skip=1; continue ;; "$END_MARK") skip=0; continue ;; esac
+    [ "$skip" = 1 ] || OWN+="$l"$'\n'
+  done < "$RULES"
+fi
+T="$RULES.preset.$$"
+{
+  printf '%s %s (written by preset.sh; apply again to change it, edit your own lines below) ----\n' "$BEGIN_MARK" "$NAME"
+  for l in ${LINES[@]+"${LINES[@]}"}; do printf '%s\n' "$l"; done
+  printf '%s\n' "$END_MARK"
+  printf '%s' "$OWN"
+} > "$T" && mv -f "$T" "$RULES" || { rm -f "$T"; die "could not write $RULES"; }
+
+# ---- kit.conf: the preset's language, only where the project has none. Which preset is in force is said once, by
+# the block's own first line (--show reads it): kit.conf is rewritten by every update, the rules file is not.
+if [ -f "$CONF" ] && case "$LANGV" in en|tr) true ;; *) false ;; esac; then
+  hadlang=0; while IFS= read -r l || [ -n "$l" ]; do case "$l" in lang=*) hadlang=1 ;; esac; done < "$CONF"
+  [ "$hadlang" = 0 ] && printf 'lang=%s\n' "$LANGV" >> "$CONF"
+fi
+echo "preset: $NAME applied — ${#LINES[@]} line(s) in $RULES; your own lines below the block were kept"
+exit 0

package/kit/eval/lib/presets/default.json

@@ -0,0 +1,7 @@
+{
+  "about": "Crewforth as it ships: no line of its own. Every key a preset may hold is here, empty. critical.add and critical.remove are globs made critical or not (a critical path runs on opus and only an agent on opus writes there); floors are [agent, change, risk, model] with * for any, a model a class of work runs on at least; verify are commands the model gate may run as a card's verify command; lang (en or tr) is used only where the project has no language yet.",
+  "name": "default",
+  "critical": { "add": [], "remove": [] },
+  "floors": [],
+  "verify": []
+}

package/kit/eval/lib/presets/solo.json

@@ -0,0 +1,7 @@
+{
+  "about": "For one person on their own project: the common test commands may run as a card's verify command, so cheap work can be checked and run on haiku; no path is added.",
+  "name": "solo",
+  "critical": { "add": [], "remove": [] },
+  "floors": [],
+  "verify": ["npm test", "pnpm test", "yarn test", "pytest", "go test ./...", "cargo test", "dotnet test", "flutter test"]
+}

package/kit/eval/lib/presets/strict.json

@@ -0,0 +1,11 @@
+{
+  "about": "For a team that ships to production from this repository: what deploys it is critical too, and the referees of the work run on opus whatever the risk.",
+  "name": "strict",
+  "critical": { "add": ["infra", "deploy", "terraform", "k8s", "helm", ".github/workflows"], "remove": [] },
+  "floors": [
+    ["crew-review-agent", "*", "*", "opus"],
+    ["*", "test-write", "*", "opus"],
+    ["*", "audit", "*", "opus"]
+  ],
+  "verify": []
+}

package/kit/eval/lib/preview.sh

@@ -0,0 +1,150 @@
+# Sourced, not run. What a risky command would have touched, in one line, for the gate that stops or asks about it:
+# the user reads "it would delete 7 uncommitted changes", not only "git reset --hard".
+#
+#   crew_preview <kind> <command>   -> _CREW_PV ("" when there is nothing to say)
+#     reset    git reset --hard: the uncommitted changes to tracked files it discards, and the commits it drops
+#              from the branch when it names a target (git reset --hard HEAD~3)
+#     clean    git clean -f…: the same command as a dry run (-n, with its -d / -x / -X), and how many paths it lists
+#     push     git push --force: the commits on the remote branch the local one does not have, as of the last fetch
+#     rm       rm -r…: the files under each named target inside the project; a target outside it, or a pattern, is
+#              not counted and the line says so
+#     commit   an approved commit: the files and lines it takes (the staged ones, the tracked changes too for -a)
+#     push-ask an approved push: the commits it sends, the first three by subject
+#
+# READ ONLY. Every command here only reads (status, diff --stat, rev-list, log, clean -n, find), nothing fetches,
+# and a count of files stops at 10 000. The caller runs this in a subshell and prints what comes back: a preview
+# that fails, or ends the shell, leaves the gate's decision as it was. It never decides anything.
+
+_PV_MAX=10000
+
+# Is this a repository, without a process where the gate log's helper is loaded (it is, in the gates).
+_pv_repo(){ if declare -F crew_git_dir >/dev/null 2>&1; then crew_git_dir .; else git rev-parse --is-inside-work-tree >/dev/null 2>&1; fi; }
+
+# The current branch's upstream as remote/branch, read from HEAD and the config with builtins: _PV_UP ("" = none).
+# A push is asked about on the hot path of a gate whose cost is pinned per call, so the common case (no upstream
+# yet) opens no process at all. A linked worktree keeps HEAD in its own git dir and the config in the common one.
+_pv_upstream(){
+  _PV_UP=""; local gd="" cd l br="" sec="" rem="" mer=""
+  declare -F crew_git_dir >/dev/null 2>&1 && crew_git_dir . && gd="$_CREW_GD"
+  [ -n "$gd" ] && [ -f "$gd/HEAD" ] || return 1
+  IFS= read -r l < "$gd/HEAD" || return 1; l="${l%$'\r'}"
+  case "$l" in "ref: refs/heads/"*) br="${l#ref: refs/heads/}" ;; *) return 1 ;; esac
+  cd="$gd"; if [ -f "$gd/commondir" ]; then IFS= read -r l < "$gd/commondir"; l="${l%$'\r'}"; case "$l" in /*|[A-Za-z]:*) cd="$l" ;; *) cd="$gd/$l" ;; esac; fi
+  [ -f "$cd/config" ] || return 1
+  while IFS= read -r l || [ -n "$l" ]; do
+    l="${l%$'\r'}"; l="${l#"${l%%[![:space:]]*}"}"
+    case "$l" in
+      "[branch \"$br\"]") sec=1 ;;
+      "["*) sec="" ;;
+      remote*=*) [ -n "$sec" ] && { rem="${l#*=}"; rem="${rem#"${rem%%[![:space:]]*}"}"; } ;;
+      merge*=*) [ -n "$sec" ] && { mer="${l#*=}"; mer="${mer#"${mer%%[![:space:]]*}"}"; } ;;
+    esac
+  done < "$cd/config"
+  [ -n "$rem" ] && [ -n "$mer" ] && [ "$rem" != . ] && _PV_UP="$rem/${mer#refs/heads/}"
+  return 0
+}
+
+_pv_words(){  # $1 = command -> _PV_W (the words after the git subcommand $2, quotes dropped)
+  local s="$1" sub="$2"
+  s="${s#*git}"; s="${s#*"$sub"}"; s="${s%%[;&|]*}"; s="${s//\"/}"; s="${s//\'/}"
+  _PV_W="$s"
+}
+
+# With pathname expansion off for the whole preview: the words of the command are split, never expanded here, so
+# `rm -rf build/*` is said as a pattern instead of each file the hook's own shell would find (measured on Windows).
+crew_preview(){
+  local _pvf=0; case "$-" in *f*) _pvf=1 ;; esac
+  set -f; _crew_preview "$@"; [ "$_pvf" = 1 ] || set +f
+  return 0
+}
+_crew_preview(){
+  _CREW_PV=""
+  local kind="$1" cmd="$2" n t w a flags line
+  case "$kind" in
+    reset|clean|push|commit|push-ask)
+      _pv_repo || { _CREW_PV="Preview: not a git work tree here, nothing counted."; return 0; } ;;
+  esac
+  case "$kind" in
+    reset)
+      n="$(git status --porcelain --untracked-files=no 2>/dev/null | wc -l)"; n="${n//[!0-9]/}"
+      _pv_words "$cmd" reset; t=""
+      for w in $_PV_W; do case "$w" in -*) ;; *) t="$w"; break ;; esac; done
+      a=""
+      if [ -n "$t" ] && git rev-parse -q --verify "$t^{commit}" >/dev/null 2>&1; then
+        a="$(git rev-list --count "$t..HEAD" 2>/dev/null)"; a="${a//[!0-9]/}"
+      fi
+      _CREW_PV="Preview: it would discard ${n:-0} uncommitted change(s) to tracked files${a:+ and drop $a commit(s) from the branch (back to $t)}."
+      ;;
+    clean)
+      _pv_words "$cmd" clean; flags="-n"
+      for w in $_PV_W; do case "$w" in
+        --) break ;;
+        -*) case "$w" in --*) ;; *) case "$w" in *d*) flags="$flags -d" ;; esac; case "$w" in *x*) flags="$flags -x" ;; *X*) flags="$flags -X" ;; esac ;; esac ;;
+      esac; done
+      # shellcheck disable=SC2086 # the flags are words of our own
+      n="$(git clean $flags 2>/dev/null | wc -l)"; n="${n//[!0-9]/}"
+      _CREW_PV="Preview: a dry run (git clean $flags) lists ${n:-0} path(s) it would delete."
+      ;;
+    push)
+      _pv_words "$cmd" push; local rem="" ref="" up=""
+      for w in $_PV_W; do case "$w" in -*) ;; *) if [ -z "$rem" ]; then rem="$w"; elif [ -z "$ref" ]; then ref="$w"; fi ;; esac; done
+      ref="${ref#+}"; ref="${ref##*:}"
+      if [ -n "$rem" ] && [ -n "$ref" ]; then up="refs/remotes/$rem/$ref"
+      else up="$(git rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null)"; fi
+      if [ -n "$up" ] && git rev-parse -q --verify "$up^{commit}" >/dev/null 2>&1; then
+        n="$(git rev-list --count "HEAD..$up" 2>/dev/null)"; n="${n//[!0-9]/}"; up="${up#refs/remotes/}"
+        if [ "${n:-0}" -gt 0 ]; then _CREW_PV="Preview: $up has $n commit(s) this branch does not, as of the last fetch; a forced push would overwrite them."
+        else _CREW_PV="Preview: as of the last fetch, $up has no commit this branch lacks; a fetch now could show otherwise."; fi
+      else
+        _CREW_PV="Preview: no remote branch known for it here (nothing fetched), so what it would overwrite is not counted."
+      fi
+      ;;
+    rm)
+      local root out="" one c
+      root="$(pwd -P 2>/dev/null)"
+      _pv_words "x $cmd" rm
+      for w in $_PV_W; do
+        case "$w" in -*|'') continue ;; *'*'*|*'?'*|'~'*|'$'*) out="${out:+$out; }$w: a pattern, not counted"; continue ;; esac
+        # A drive-letter path (D:/x, as Git Bash passes it) is absolute too: measured on Windows, it read as relative
+        # and the line said "not there" for a folder that was.
+        one="$w"; case "$one" in /*|[A-Za-z]:[/\\]*) ;; *) one="$root/$one" ;; esac
+        if [ ! -e "$one" ]; then out="${out:+$out; }$w: not there"; continue; fi
+        c="$(cd "$one" 2>/dev/null && pwd -P)" || c="$(cd "$(dirname "$one")" 2>/dev/null && pwd -P)/${one##*/}"
+        case "$c/" in "$root"/*) ;; *) out="${out:+$out; }$w: outside the project, not counted"; continue ;; esac
+        n="$(find "$one" -type f 2>/dev/null | head -n $((_PV_MAX + 1)) | wc -l)"; n="${n//[!0-9]/}"
+        [ "${n:-0}" -gt "$_PV_MAX" ] && n="more than $_PV_MAX"
+        out="${out:+$out; }$w: ${n:-0} file(s)"
+      done
+      [ -n "$out" ] && _CREW_PV="Preview: $out."
+      ;;
+    commit)
+      case " $cmd " in *' -a'*|*' --all'*|*' -[A-Za-z]*a'*) line="$(git diff HEAD --shortstat 2>/dev/null)" ;; *) line="$(git diff --cached --shortstat 2>/dev/null)" ;; esac
+      line="${line# }"
+      _CREW_PV="Preview: ${line:-nothing staged}."
+      ;;
+    push-ask)
+      local subj="" k=0 rem="" ref="" src="" tip=HEAD
+      # A push that names its remote and branch (git push origin feat/x) sends to that branch, not the upstream; and
+      # what it sends is the named LOCAL branch's commits (src of src:dst, or the name itself), not the current one's.
+      _pv_words "$cmd" push
+      for w in $_PV_W; do case "$w" in -*) ;; *) if [ -z "$rem" ]; then rem="$w"; elif [ -z "$ref" ]; then ref="$w"; fi ;; esac; done
+      ref="${ref#+}"; src="${ref%%:*}"; ref="${ref##*:}"
+      if [ -n "$src" ] && [ "$src" != HEAD ]; then
+        if [ -f "${_CREW_GD:-.git}/refs/heads/$src" ] || git rev-parse -q --verify "refs/heads/$src" >/dev/null 2>&1; then tip="refs/heads/$src"; fi
+      fi
+      if [ -n "$rem" ] && [ -n "$ref" ] && [ "$ref" != HEAD ]; then
+        if [ -f "${_CREW_GD:-.git}/refs/remotes/$rem/$ref" ] || git rev-parse -q --verify "refs/remotes/$rem/$ref" >/dev/null 2>&1; then _PV_UP="$rem/$ref"
+        else _CREW_PV="Preview: $rem/$ref is not known here; the push would create it on the remote."; return 0; fi
+      else _pv_upstream; fi
+      if [ -n "$_PV_UP" ]; then
+        # One process: the subjects of what it sends, counted here and the first three named.
+        while IFS= read -r line; do k=$((k+1)); [ "$k" -le 3 ] && subj="${subj:+$subj; }${line:0:72}"; done < <(git log --format=%s "$_PV_UP..$tip" 2>/dev/null)
+        [ "$k" -gt 3 ] && subj="$subj …"
+        _CREW_PV="Preview: it sends $k commit(s) to $_PV_UP${subj:+ — $subj}."
+      else
+        _CREW_PV="Preview: the branch has no upstream set here; what it sends is not counted."
+      fi
+      ;;
+  esac
+  return 0
+}