delimit-cli 3.13.2 → 3.14.0

package/gateway/ai/tool_metadata.py

@@ -0,0 +1,201 @@
+"""
+Tool Metadata — Tier mappings for all Delimit MCP tools.
+
+Each tool is assigned a visibility tier:
+  - "public":       Always visible to all MCP clients.
+  - "ops_pack":     Visible when DELIMIT_SHOW_OPS=1 (or SHOW_INTERNAL/SHOW_EXPERIMENTAL).
+  - "internal":     Visible when DELIMIT_SHOW_INTERNAL=1 (or SHOW_EXPERIMENTAL).
+  - "experimental": Visible when DELIMIT_SHOW_EXPERIMENTAL=1.
+
+Tier cascade: experimental > internal > ops_pack > public.
+
+Reference: Consensus 118/119/120 — Tool Segmentation Architecture.
+"""
+
+from typing import Dict, Literal
+
+Tier = Literal["public", "ops_pack", "internal", "experimental"]
+
+# ─────────────────────────────────────────────────────────────────────
+#  TOOL_TIERS: canonical tier assignment for every registered tool.
+#
+#  ops_pack (~8):  workspace automation tools (social, notify, design
+#                  validation, screenshots, screen recording, docs gen)
+#
+#  internal (~18): founder-only tools (content pipeline, design internals,
+#                  storybook, data ops, social management, scaffolding)
+#
+#  experimental:   stubs and pass-throughs hidden behind LED-044
+#
+#  public:         everything else (the default)
+# ─────────────────────────────────────────────────────────────────────
+
+TOOL_TIERS: Dict[str, Tier] = {
+    # === Govern domain (all public) ===
+    "delimit_lint": "public",
+    "delimit_diff": "public",
+    "delimit_policy": "public",
+    "delimit_semver": "public",
+    "delimit_explain": "public",
+    "delimit_zero_spec": "public",
+    "delimit_init": "public",
+    "delimit_gov_health": "public",
+    "delimit_gov_status": "public",
+    "delimit_gov_policy": "public",
+    "delimit_gov_evaluate": "public",
+    "delimit_gov_new_task": "public",
+    "delimit_gov_run": "public",
+    "delimit_gov_verify": "public",
+    "delimit_ledger": "public",
+    "delimit_impact": "public",
+
+    # === Context domain (all public) ===
+    "delimit_memory_search": "public",
+    "delimit_memory_store": "public",
+    "delimit_memory_recent": "public",
+    "delimit_vault_search": "public",
+    "delimit_vault_health": "public",
+    "delimit_vault_snapshot": "public",
+    "delimit_context_init": "public",
+    "delimit_context_write": "public",
+    "delimit_context_read": "public",
+    "delimit_context_list": "public",
+    "delimit_context_snapshot": "public",
+    "delimit_context_branch": "public",
+    "delimit_secret_store": "public",
+    "delimit_secret_get": "public",
+    "delimit_secret_list": "public",
+    "delimit_secret_revoke": "public",
+    "delimit_secret_access_log": "public",
+
+    # === Ship domain (public + experimental) ===
+    "delimit_deploy_plan": "public",
+    "delimit_deploy_build": "public",
+    "delimit_deploy_publish": "public",
+    "delimit_deploy_verify": "experimental",
+    "delimit_deploy_rollback": "public",
+    "delimit_deploy_status": "public",
+    "delimit_deploy_site": "public",
+    "delimit_deploy_npm": "public",
+    "delimit_release_plan": "public",
+    "delimit_release_validate": "experimental",
+    "delimit_release_status": "public",
+    "delimit_release_rollback": "experimental",
+    "delimit_release_history": "experimental",
+    "delimit_release_sync": "public",
+
+    # === Observe domain (public + experimental) ===
+    "delimit_obs_metrics": "public",
+    "delimit_obs_logs": "public",
+    "delimit_obs_alerts": "experimental",
+    "delimit_obs_status": "public",
+    "delimit_cost_analyze": "public",
+    "delimit_cost_optimize": "public",
+    "delimit_cost_alert": "public",
+    "delimit_cost_controls": "public",
+
+    # === Security domain (all public) ===
+    "delimit_security_scan": "public",
+    "delimit_security_ingest": "public",
+    "delimit_security_deliberate": "public",
+    "delimit_security_audit": "public",
+    "delimit_evidence_collect": "public",
+    "delimit_evidence_verify": "public",
+
+    # === Intel domain (all public) ===
+    "delimit_intel_dataset_register": "public",
+    "delimit_intel_dataset_list": "public",
+    "delimit_intel_dataset_freeze": "public",
+    "delimit_intel_snapshot_ingest": "public",
+    "delimit_intel_query": "public",
+
+    # === Repo domain (experimental stubs) ===
+    "delimit_repo_diagnose": "experimental",
+    "delimit_repo_analyze": "experimental",
+    "delimit_repo_config_validate": "experimental",
+    "delimit_repo_config_audit": "experimental",
+
+    # === Test domain (public + experimental) ===
+    "delimit_test_generate": "public",
+    "delimit_test_coverage": "experimental",
+    "delimit_test_smoke": "public",
+
+    # === Orchestrate domain (all public) ===
+    "delimit_os_plan": "public",
+    "delimit_os_status": "public",
+    "delimit_os_gates": "public",
+    "delimit_ledger_add": "public",
+    "delimit_ledger_done": "public",
+    "delimit_ledger_list": "public",
+    "delimit_ledger_context": "public",
+    "delimit_ventures": "public",
+    "delimit_models": "public",
+    "delimit_deliberate": "public",
+    "delimit_sensor_github_issue": "public",
+    "delimit_resource_list": "public",
+    "delimit_resource_get": "public",
+    "delimit_resource_drivers": "public",
+    "delimit_tracker_sync": "public",
+    "delimit_webhook_manage": "public",
+    "delimit_agent_dispatch": "public",
+    "delimit_agent_status": "public",
+    "delimit_agent_complete": "public",
+    "delimit_agent_handoff": "public",
+    "delimit_next_task": "public",
+    "delimit_task_complete": "public",
+    "delimit_loop_status": "public",
+    "delimit_loop_config": "public",
+    "delimit_daemon_status": "public",
+    "delimit_daemon_run": "public",
+    "delimit_daemon_classify": "public",
+    "delimit_config_export": "public",
+    "delimit_config_import": "public",
+    "delimit_changelog": "public",
+
+    # === Utility (all public) ===
+    "delimit_version": "public",
+    "delimit_help": "public",
+    "delimit_diagnose": "public",
+    "delimit_activate": "public",
+    "delimit_license_status": "public",
+    "delimit_scan": "public",
+    "delimit_quickstart": "public",
+
+    # ═══════════════════════════════════════════════════════════════
+    #  Workspace-ops tier (~8 tools)
+    #  Visible with DELIMIT_SHOW_OPS=1 or DELIMIT_SHOW_INTERNAL=1
+    # ═══════════════════════════════════════════════════════════════
+    "delimit_social_post": "ops_pack",
+    "delimit_social_generate": "ops_pack",
+    "delimit_social_approve": "ops_pack",
+    "delimit_notify": "ops_pack",
+    "delimit_design_validate_responsive": "ops_pack",
+    "delimit_screenshot": "ops_pack",
+    "delimit_screen_record": "ops_pack",
+    "delimit_docs_generate": "ops_pack",
+
+    # ═══════════════════════════════════════════════════════════════
+    #  Internal tier (~18 tools)
+    #  Visible with DELIMIT_SHOW_INTERNAL=1
+    # ═══════════════════════════════════════════════════════════════
+    "delimit_content_schedule": "internal",
+    "delimit_content_publish": "internal",
+    "delimit_content_queue": "internal",
+    "delimit_inbox_daemon": "internal",
+    "delimit_notify_inbox": "internal",
+    "delimit_design_generate_component": "internal",
+    "delimit_design_extract_tokens": "internal",
+    "delimit_design_component_library": "internal",
+    "delimit_design_generate_tailwind": "internal",
+    "delimit_story_generate": "internal",
+    "delimit_story_build": "internal",
+    "delimit_story_visual_test": "internal",
+    "delimit_story_accessibility": "internal",
+    "delimit_data_backup": "internal",
+    "delimit_data_migrate": "internal",
+    "delimit_data_validate": "internal",
+    "delimit_social_history": "internal",
+    "delimit_social_accounts": "internal",
+    "delimit_generate_scaffold": "internal",
+    "delimit_generate_template": "internal",
+}

package/lib/cross-model-hooks.js

@@ -30,6 +30,8 @@ function loadHookConfig() {
         session_start: true,
         pre_tool: true,
         pre_commit: true,
+        conditional_hooks: true,
+        deploy_audit: true,
         deliberate_on_commit: false,
         show_strategy_items: true,
     };
@@ -125,9 +127,63 @@ function detectAITools() {
 // Hook installers per tool
 // ---------------------------------------------------------------------------
 
+/**
+ * Check if a Claude Code hook group array already contains a delimit hook
+ * matching the given command substring.
+ */
+function findClaudeHookGroup(hookGroups, commandSubstring) {
+    if (!Array.isArray(hookGroups)) return null;
+    for (const group of hookGroups) {
+        // Support both nested format (group.hooks[].command) and flat format (group.command)
+        if (group.hooks && Array.isArray(group.hooks)) {
+            if (group.hooks.some(h => h.command && h.command.includes(commandSubstring))) {
+                return group;
+            }
+        }
+        if (group.command && group.command.includes(commandSubstring)) {
+            return group;
+        }
+    }
+    return null;
+}
+
+/**
+ * Migrate a flat-format hook entry to the nested Claude Code format.
+ * Flat: { type, command, matcher, if }
+ * Nested: { matcher, if, hooks: [{ type, command }] }
+ */
+function migrateToNestedFormat(hookGroup) {
+    if (hookGroup.hooks && Array.isArray(hookGroup.hooks)) {
+        return hookGroup; // Already nested
+    }
+    const nested = { matcher: hookGroup.matcher || '' };
+    if (hookGroup.if) nested.if = hookGroup.if;
+    nested.hooks = [{ type: hookGroup.type || 'command', command: hookGroup.command }];
+    return nested;
+}
+
 /**
  * Install hooks into Claude Code's ~/.claude/settings.json
- * Claude Code supports native hooks: SessionStart, PreToolUse, PostToolUse, etc.
+ *
+ * Claude Code hook format (nested):
+ *   {
+ *     "hooks": {
+ *       "EventName": [
+ *         {
+ *           "matcher": "ToolPattern",
+ *           "if": "condition expression",
+ *           "hooks": [
+ *             { "type": "command", "command": "...", "timeout": 30 }
+ *           ]
+ *         }
+ *       ]
+ *     }
+ *   }
+ *
+ * LED-234: Adds conditional hooks that fire only when relevant files change:
+ *   1. PostToolUse (Edit|Write) + spec patterns -> delimit lint
+ *   2. PreToolUse (Bash) + git commit -> delimit doctor
+ *   3. PreToolUse (Bash) + deploy patterns -> delimit security-audit
  */
 function installClaudeHooks(tool, hookConfig) {
     const configPath = tool.configPath;
@@ -148,73 +204,133 @@ function installClaudeHooks(tool, hookConfig) {
     const npxCmd = 'npx delimit-cli';
     const changes = [];
 
-    // SessionStart hook
+    // --- SessionStart hook (no condition) ---
     if (hookConfig.session_start) {
-        const sessionHook = {
-            type: 'command',
-            command: `${npxCmd} hook session-start`,
-        };
         if (!config.hooks.SessionStart) {
             config.hooks.SessionStart = [];
         }
-        // Check if already installed
-        const existing = config.hooks.SessionStart.find(
-            h => h.command && h.command.includes('delimit-cli hook session-start')
-        );
+        const existing = findClaudeHookGroup(config.hooks.SessionStart, 'delimit-cli hook session-start');
         if (!existing) {
-            config.hooks.SessionStart.push(sessionHook);
+            config.hooks.SessionStart.push({
+                matcher: '',
+                hooks: [{
+                    type: 'command',
+                    command: `${npxCmd} hook session-start`,
+                }],
+            });
             changes.push('SessionStart');
         }
     }
 
-    // PreToolUse hook — scoped to Edit/Write on OpenAPI/Swagger spec files
+    // --- PreToolUse: pre-tool hook scoped to Edit/Write on spec files ---
     if (hookConfig.pre_tool) {
-        const preToolHook = {
-            type: 'command',
-            command: `${npxCmd} hook pre-tool $TOOL_NAME`,
-            matcher: 'Edit|Write',
-            if: "Edit && (path_matches('**/openapi*') || path_matches('**/swagger*') || path_matches('**/*.yaml') || path_matches('**/*.yml'))",
-        };
         if (!config.hooks.PreToolUse) {
             config.hooks.PreToolUse = [];
         }
-        const existing = config.hooks.PreToolUse.find(
-            h => h.command && h.command.includes('delimit-cli hook pre-tool')
-        );
+        const existing = findClaudeHookGroup(config.hooks.PreToolUse, 'delimit-cli hook pre-tool');
         if (existing) {
-            // Upgrade existing hook to include conditional `if` field
-            if (!existing.if) {
-                existing.matcher = preToolHook.matcher;
-                existing.command = preToolHook.command;
-                existing.if = preToolHook.if;
+            // Upgrade flat-format hook to nested + add if condition if missing
+            const migrated = migrateToNestedFormat(existing);
+            if (!migrated.if) {
+                const idx = config.hooks.PreToolUse.indexOf(existing);
+                migrated.matcher = 'Edit|Write';
+                migrated.if = "Edit && (path_matches('**/openapi*') || path_matches('**/swagger*') || path_matches('**/*.yaml') || path_matches('**/*.yml'))";
+                migrated.hooks = [{ type: 'command', command: `${npxCmd} hook pre-tool $TOOL_NAME` }];
+                config.hooks.PreToolUse[idx] = migrated;
                 changes.push('PreToolUse (upgraded)');
             }
         } else {
-            config.hooks.PreToolUse.push(preToolHook);
+            config.hooks.PreToolUse.push({
+                matcher: 'Edit|Write',
+                if: "Edit && (path_matches('**/openapi*') || path_matches('**/swagger*') || path_matches('**/*.yaml') || path_matches('**/*.yml'))",
+                hooks: [{
+                    type: 'command',
+                    command: `${npxCmd} hook pre-tool $TOOL_NAME`,
+                }],
+            });
             changes.push('PreToolUse');
         }
     }
 
-    // PreToolUse hook — pre-commit governance on git commit/push
+    // --- PreToolUse: pre-commit governance on git commit/push ---
     if (hookConfig.pre_commit) {
-        const preCommitHook = {
-            type: 'command',
-            command: `${npxCmd} hook pre-commit`,
-            matcher: 'Bash',
-            if: "Bash && (input_contains('git commit') || input_contains('git push'))",
-        };
         if (!config.hooks.PreToolUse) {
             config.hooks.PreToolUse = [];
         }
-        const existing = config.hooks.PreToolUse.find(
-            h => h.command && h.command.includes('delimit-cli hook pre-commit')
-        );
+        const existing = findClaudeHookGroup(config.hooks.PreToolUse, 'delimit-cli hook pre-commit');
         if (!existing) {
-            config.hooks.PreToolUse.push(preCommitHook);
+            config.hooks.PreToolUse.push({
+                matcher: 'Bash',
+                if: "Bash && (input_contains('git commit') || input_contains('git push'))",
+                hooks: [{
+                    type: 'command',
+                    command: `${npxCmd} hook pre-commit`,
+                }],
+            });
             changes.push('PreCommit');
         }
     }
 
+    // --- LED-234: Conditional hooks (opt-in via conditional_hooks config) ---
+    if (hookConfig.conditional_hooks !== false) {
+
+        // 1. PostToolUse: auto-lint after editing OpenAPI spec files
+        if (!config.hooks.PostToolUse) {
+            config.hooks.PostToolUse = [];
+        }
+        const specLintCmd = 'delimit-cli lint';
+        const existingSpecLint = findClaudeHookGroup(config.hooks.PostToolUse, specLintCmd);
+        if (!existingSpecLint) {
+            config.hooks.PostToolUse.push({
+                matcher: 'Edit|Write',
+                if: "filePath matches '**/*openapi*.yaml' or filePath matches '**/*openapi*.yml' or filePath matches '**/*openapi*.json' or filePath matches '**/*swagger*.yaml' or filePath matches '**/*swagger*.yml' or filePath matches '**/*swagger*.json' or filePath matches '**/api/*.yaml' or filePath matches '**/api/*.yml' or filePath matches '**/specs/**'",
+                hooks: [{
+                    type: 'command',
+                    command: `${npxCmd} lint "$DELIMIT_FILE_PATH"`,
+                    timeout: 30,
+                }],
+            });
+            changes.push('PostToolUse:spec-lint');
+        }
+
+        // 2. PreToolUse: repo diagnose before git commit (uses doctor command)
+        if (!config.hooks.PreToolUse) {
+            config.hooks.PreToolUse = [];
+        }
+        const doctorCmd = 'delimit-cli doctor';
+        const existingDoctor = findClaudeHookGroup(config.hooks.PreToolUse, doctorCmd);
+        if (!existingDoctor) {
+            config.hooks.PreToolUse.push({
+                matcher: 'Bash',
+                if: "command matches 'git commit'",
+                hooks: [{
+                    type: 'command',
+                    command: `${npxCmd} doctor`,
+                    timeout: 15,
+                }],
+            });
+            changes.push('PreToolUse:doctor');
+        }
+
+        // 3. PreToolUse: security audit before deploy/publish/release commands
+        if (hookConfig.deploy_audit !== false) {
+            const securityCmd = 'delimit-cli security-audit';
+            const existingSecurity = findClaudeHookGroup(config.hooks.PreToolUse, securityCmd);
+            if (!existingSecurity) {
+                config.hooks.PreToolUse.push({
+                    matcher: 'Bash',
+                    if: "command matches 'npm publish' or command matches 'npx deploy' or command matches 'deploy' or command matches 'release'",
+                    hooks: [{
+                        type: 'command',
+                        command: `${npxCmd} security-audit`,
+                        timeout: 30,
+                    }],
+                });
+                changes.push('PreToolUse:deploy-audit');
+            }
+        }
+    }
+
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
     return changes;
 }
@@ -235,10 +351,12 @@ function installCodexHooks(tool, hookConfig) {
         const delimitBlock = `<!-- delimit:hooks-start -->
 ## Delimit Governance
 
-On every session start, run this command to check governance status:
+On every session start:
+1. Run this command to check governance status:
 \`\`\`
 npx delimit-cli hook session-start
 \`\`\`
+2. Call \`delimit_inbox_daemon(action="start")\` to start email polling for approvals.
 
 Before committing changes, run:
 \`\`\`
@@ -311,7 +429,8 @@ function installGeminiHooks(tool, hookConfig) {
 
     const govInstructions = [
         'Delimit governance is active.',
-        'On session start, run: npx delimit-cli hook session-start',
+        'On session start: (1) run: npx delimit-cli hook session-start,',
+        '(2) call delimit_inbox_daemon(action="start") to start email polling.',
         'Before committing, run: npx delimit-cli hook pre-commit',
         'After editing API specs, run: npx delimit-cli hook pre-tool Edit',
         'Call delimit_ledger_context and delimit_gov_health via MCP when available.',
@@ -331,6 +450,7 @@ function installGeminiHooks(tool, hookConfig) {
 
 On every session start:
 1. Run \`npx delimit-cli hook session-start\` to check open tasks and governance status
+2. Call \`delimit_inbox_daemon(action="start")\` to start email polling for approvals
 
 After editing code:
 - After editing API specs: run \`npx delimit-cli hook pre-tool Edit\`
@@ -392,9 +512,14 @@ function removeClaudeHooks() {
         for (const event of ['SessionStart', 'PreToolUse', 'PostToolUse']) {
             if (Array.isArray(config.hooks[event])) {
                 const before = config.hooks[event].length;
-                config.hooks[event] = config.hooks[event].filter(
-                    h => !(h.command && h.command.includes('delimit-cli'))
-                );
+                config.hooks[event] = config.hooks[event].filter(h => {
+                    // Nested format: check hooks[].command
+                    if (h.hooks && Array.isArray(h.hooks)) {
+                        return !h.hooks.some(inner => inner.command && inner.command.includes('delimit-cli'));
+                    }
+                    // Flat format: check h.command directly
+                    return !(h.command && h.command.includes('delimit-cli'));
+                });
                 if (config.hooks[event].length === 0) {
                     delete config.hooks[event];
                 }
@@ -671,6 +796,9 @@ async function hookSessionStart() {
         }
     } catch { /* not in git repo */ }
 
+    // Remind AI to start inbox daemon
+    lines.push('[Delimit] Action required: call delimit_inbox_daemon(action="start") to enable email-based approvals');
+
     lines.push('');
     process.stdout.write(lines.join('\n') + '\n');
 }
@@ -849,4 +977,6 @@ module.exports = {
     hookPreCommit,
     countPendingStrategyItems,
     getTopStrategyItem,
+    findClaudeHookGroup,
+    migrateToNestedFormat,
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "delimit-cli",
   "mcpName": "io.github.delimit-ai/delimit-mcp-server",
-  "version": "3.13.2",
+  "version": "3.14.0",
   "description": "Unify Claude Code, Codex, Cursor, and Gemini CLI with persistent context, governance, and multi-model debate.",
   "main": "index.js",
   "files": [