devrites 2.6.0 → 3.0.0

package/update.sh

@@ -1,196 +1,40 @@
 #!/usr/bin/env bash
-# update.sh — upgrade an existing DevRites install to the latest GitHub Release.
-#
-#   ./update.sh                       upgrade the install in the current directory
-#   ./update.sh --target DIR          upgrade the install in DIR
-#   ./update.sh --to vX.Y.Z           pin to a specific release tag instead of latest
-#   ./update.sh --check               report installed vs latest, do not change anything
-#   ./update.sh --force               re-install even if already at the latest version
-#   ./update.sh --pre                 allow pre-release tags (default: stable only)
-#
-# Env:
-#   DEVRITES_UPDATE_BUNDLE=PATH       use a local .tar.gz instead of downloading
-#                                     (air-gapped upgrades; also used by tests)
-#
-# How it works:
-#   1. Reads the installed version + flags from .claude/devrites.manifest.
-#   2. Asks the GitHub API for the latest release tag (or the tag passed via --to).
-#   3. If newer, downloads the release tarball, extracts to a temp dir,
-#      and re-runs the bundled install.sh with the same flags the user
-#      originally installed with — preserving .devrites/ feature state.
-#
-# Requires: curl, tar. (jq optional; falls back to sed parsing.)
-
+# update.sh - bootstrap shim for the engine-owned DevRites updater.
 set -u
 
-REPO="ViktorsBaikers/DevRites"
-API="https://api.github.com/repos/$REPO"
-
-# ---- args ----------------------------------------------------------------
-TARGET="$PWD"
-PIN_TAG=""
-CHECK_ONLY=0
-FORCE=0
-ALLOW_PRE=0
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --target)  shift; [ $# -gt 0 ] || { echo "error: --target needs a directory" >&2; exit 1; }; TARGET="$1" ;;
-    --target=*) TARGET="${1#*=}" ;;
-    --to)      shift; [ $# -gt 0 ] || { echo "error: --to needs a tag" >&2; exit 1; }; PIN_TAG="$1" ;;
-    --to=*)    PIN_TAG="${1#*=}" ;;
-    --check)   CHECK_ONLY=1 ;;
-    --force)   FORCE=1 ;;
-    --pre)     ALLOW_PRE=1 ;;
-    -h|--help) sed -n '2,22p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
-    *)         echo "error: unknown option: $1 (try --help)" >&2; exit 1 ;;
-  esac
-  shift
-done
-
-# ---- pretty -------------------------------------------------------------
-if [ -t 1 ]; then
-  B="$(printf '\033[1m')"; R="$(printf '\033[0m')"
-  G="$(printf '\033[32m')"; C="$(printf '\033[36m')"; Y="$(printf '\033[33m')"
-else
-  B=""; R=""; G=""; C=""; Y=""
-fi
-say()  { printf '%s\n' "$*"; }
-info() { printf '%s%s%s\n' "$C" "$*" "$R"; }
-ok()   { printf '%s%s%s\n' "$G" "$*" "$R"; }
-warn() { printf '%swarning:%s %s\n' "$Y" "$R" "$*" >&2; }
-die()  { printf 'error: %s\n' "$*" >&2; exit 1; }
-
-# ---- prerequisites -------------------------------------------------------
-command -v curl >/dev/null 2>&1 || die "curl is required"
-command -v tar  >/dev/null 2>&1 || die "tar is required"
-
-# ---- locate install ------------------------------------------------------
-[ -d "$TARGET" ] || die "target is not a directory: $TARGET"
-TARGET="$(cd "$TARGET" && pwd -P)"
-MANIFEST="$TARGET/.claude/devrites.manifest"
-[ -f "$MANIFEST" ] || die "no DevRites install found at $TARGET (missing .claude/devrites.manifest). Run install.sh first."
-
-INSTALLED_VERSION="$(sed -n 's/^# devrites-version:[[:space:]]*//p' "$MANIFEST" | head -n1)"
-INSTALL_FLAGS="$(sed -n 's/^# devrites-flags:[[:space:]]*//p' "$MANIFEST" | head -n1)"
-[ -n "$INSTALLED_VERSION" ] || INSTALLED_VERSION="unknown"
-
-info "DevRites update"
-say  "  project:   $TARGET"
-say  "  installed: ${B}$INSTALLED_VERSION${R}"
-[ -n "$INSTALL_FLAGS" ] && say "  flags:     $INSTALL_FLAGS"
-
-# ---- resolve target tag --------------------------------------------------
-if [ -n "$PIN_TAG" ]; then
-  LATEST_TAG="$PIN_TAG"
-else
-  if [ "$ALLOW_PRE" -eq 1 ]; then
-    # All releases, take the first one
-    LATEST_TAG="$(curl -fsSL "$API/releases" 2>/dev/null \
-      | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
-      | head -n1)"
-  else
-    LATEST_TAG="$(curl -fsSL "$API/releases/latest" 2>/dev/null \
-      | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
-      | head -n1)"
-  fi
-  [ -n "$LATEST_TAG" ] || die "could not resolve the latest release tag from GitHub. Check connectivity, or pass --to vX.Y.Z."
-fi
-LATEST_VERSION="${LATEST_TAG#v}"
-say "  latest:    ${B}$LATEST_VERSION${R}"
+SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd -P)" || SELF_DIR=""
+DEVRITES_REPO="${DEVRITES_REPO:-ViktorsBaikers/DevRites}"
+DEVRITES_REF="${DEVRITES_REF:-}"
 
-# ---- semver compare ------------------------------------------------------
-# Returns 0 if $1 > $2, 1 if equal, 2 if $1 < $2. Pre-release tags compare as lower.
-semver_cmp() {
-  _a="${1%%-*}"; _b="${2%%-*}"
-  _ap="${1#${_a}}"; _bp="${2#${_b}}"
-  IFS=. read -r a1 a2 a3 <<EOF
-$_a
-EOF
-  IFS=. read -r b1 b2 b3 <<EOF
-$_b
-EOF
-  a1=${a1:-0}; a2=${a2:-0}; a3=${a3:-0}
-  b1=${b1:-0}; b2=${b2:-0}; b3=${b3:-0}
-  if   [ "$a1" -gt "$b1" ]; then return 0
-  elif [ "$a1" -lt "$b1" ]; then return 2
-  elif [ "$a2" -gt "$b2" ]; then return 0
-  elif [ "$a2" -lt "$b2" ]; then return 2
-  elif [ "$a3" -gt "$b3" ]; then return 0
-  elif [ "$a3" -lt "$b3" ]; then return 2
+delegate_bootstrap() {
+  if [ "${DEVRITES_BOOTSTRAPPED:-0}" = "1" ]; then
+    echo "error: bootstrap re-exec did not find pack/ - aborting to avoid a loop." >&2
+    exit 1
   fi
-  # core equal — pre-release < release
-  if   [ -z "$_ap" ] && [ -n "$_bp" ]; then return 0
-  elif [ -n "$_ap" ] && [ -z "$_bp" ]; then return 2
-  fi
-  return 1
-}
-
-NEEDS_UPDATE=0
-if [ "$INSTALLED_VERSION" = "unknown" ]; then
-  NEEDS_UPDATE=1
-  warn "installed version unknown — treating as out-of-date."
-else
-  semver_cmp "$LATEST_VERSION" "$INSTALLED_VERSION"
-  case $? in
-    0) NEEDS_UPDATE=1 ;;
-    1) NEEDS_UPDATE=0 ;;
-    2) warn "installed version ($INSTALLED_VERSION) is newer than latest release ($LATEST_VERSION)." ;;
-  esac
-fi
-
-if [ "$CHECK_ONLY" -eq 1 ]; then
-  if [ "$NEEDS_UPDATE" -eq 1 ]; then
-    info "update available: $INSTALLED_VERSION → $LATEST_VERSION"
-    exit 10
+  command -v curl >/dev/null 2>&1 || { echo "error: curl is required for the network updater." >&2; exit 1; }
+  if [ -n "$DEVRITES_REF" ]; then
+    ref="$DEVRITES_REF"
   else
-    ok "up to date."
-    exit 0
+    ref="$(curl -fsSL "https://api.github.com/repos/$DEVRITES_REPO/releases/latest" 2>/dev/null | sed -n 's/.*"tag_name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)"
   fi
-fi
-
-if [ "$NEEDS_UPDATE" -eq 0 ] && [ "$FORCE" -eq 0 ]; then
-  ok "already at $LATEST_VERSION — nothing to do (use --force to reinstall)."
-  exit 0
-fi
-
-# ---- download release tarball -------------------------------------------
-TMP="$(mktemp -d 2>/dev/null || echo "${TMPDIR:-/tmp}/devrites-update.$$")"
-mkdir -p "$TMP"
-cleanup() { rm -rf "$TMP"; }
-trap cleanup EXIT
-
-ARTIFACT="devrites-${LATEST_TAG}.tar.gz"
-URL="https://github.com/$REPO/releases/download/$LATEST_TAG/$ARTIFACT"
-SRC_TARBALL_URL="https://github.com/$REPO/archive/refs/tags/$LATEST_TAG.tar.gz"
+  ref="${ref:-main}"
+  url="https://raw.githubusercontent.com/$DEVRITES_REPO/$ref/install.sh"
+  tmp="$(mktemp 2>/dev/null || echo "${TMPDIR:-/tmp}/devrites-install.$$")"
+  curl -fsSL -o "$tmp" "$url" || { echo "error: could not download DevRites bootstrap from $url" >&2; rm -f "$tmp"; exit 1; }
+  bash "$tmp" update "$@"
+  rc="$?"
+  rm -f "$tmp"
+  exit "$rc"
+}
 
-# DEVRITES_UPDATE_BUNDLE — optional escape hatch for air-gapped upgrades and
-# tests: a readable local .tar.gz to use instead of downloading from GitHub.
-if [ -n "${DEVRITES_UPDATE_BUNDLE:-}" ]; then
-  [ -r "$DEVRITES_UPDATE_BUNDLE" ] || die "DEVRITES_UPDATE_BUNDLE not readable: $DEVRITES_UPDATE_BUNDLE"
-  info "using local bundle $DEVRITES_UPDATE_BUNDLE (DEVRITES_UPDATE_BUNDLE set) …"
-  cp "$DEVRITES_UPDATE_BUNDLE" "$TMP/$ARTIFACT" || die "could not copy $DEVRITES_UPDATE_BUNDLE"
-else
-  info "downloading $ARTIFACT …"
-  if ! curl -fsSL -o "$TMP/$ARTIFACT" "$URL" 2>/dev/null; then
-    warn "release artifact $ARTIFACT not found; falling back to the source tarball ($LATEST_TAG)."
-    ARTIFACT="src-$LATEST_TAG.tar.gz"
-    curl -fsSL -o "$TMP/$ARTIFACT" "$SRC_TARBALL_URL" || die "could not download $SRC_TARBALL_URL"
-  fi
+if [ -z "$SELF_DIR" ] || [ ! -d "$SELF_DIR/pack" ]; then
+  delegate_bootstrap "$@"
 fi
 
-tar -C "$TMP" -xzf "$TMP/$ARTIFACT"
-EXTRACTED="$(find "$TMP" -maxdepth 1 -mindepth 1 -type d | head -n1)"
-[ -n "$EXTRACTED" ] && [ -f "$EXTRACTED/install.sh" ] || die "extracted bundle has no install.sh: $EXTRACTED"
-# GitHub source tarballs strip +x; restore it before re-exec.
-chmod +x "$EXTRACTED/install.sh" "$EXTRACTED"/scripts/*.sh 2>/dev/null || true
-
-# ---- re-run installer with the original flags + --force -----------------
-info "running installer (with --force) — preserving .devrites/ feature state …"
-# shellcheck disable=SC2086
-bash "$EXTRACTED/install.sh" --target "$TARGET" --force $INSTALL_FLAGS \
-  || die "installer failed; the previous install is still in place."
+INSTALL_LIB="$SELF_DIR/scripts/install-lib.sh"
+[ -f "$INSTALL_LIB" ] || { echo "error: extracted bundle is missing scripts/install-lib.sh" >&2; exit 1; }
+. "$INSTALL_LIB"
 
-ok "DevRites upgraded: $INSTALLED_VERSION → $LATEST_VERSION"
-say "  run ${C}/rite${R} or ${C}/rite-status${R} to continue where you left off."
-exit 0
+ENGINE="$(dr_acquire_engine "$SELF_DIR" update "$DEVRITES_REPO")" || { echo "error: could not acquire devrites-engine." >&2; exit 1; }
+export DEVRITES_ENGINE_CLI="$ENGINE"
+exec "$ENGINE" update --source-dir "$SELF_DIR" "$@"

package/docs/cli-mcp.md

@@ -1,62 +0,0 @@
-# Tool-agnostic state core — the `devrites` CLI + MCP server
-
-DevRites' discipline lives in the `.devrites/` Markdown files and the state scripts under
-`devrites-lib/scripts/`, **not** in the Claude Code harness. So any tool — Cursor, Codex,
-Gemini CLI, a CI job, or a human — can drive a DevRites workflow through the same files.
-Two portable surfaces expose them.
-
-## The `devrites` CLI
-
-Installed at `.claude/skills/devrites-lib/scripts/devrites.sh` (ships on both the bash
-installer and the plugin). Run it from the project root:
-
-```bash
-D=.claude/skills/devrites-lib/scripts/devrites.sh
-bash "$D" orient            # workspace digest for the active feature (read-only)
-bash "$D" ready             # build-readiness gate      (exit 0 ready · 2/3/4/5 not)
-bash "$D" evidence-fresh    # evidence-freshness gate   (exit 0 fresh · 3 stale)
-bash "$D" acceptance        # acceptance-criteria gate  (exit 0 proven · 1 gap)
-bash "$D" active | list | use <slug>
-bash "$D" resolve <qid> "<answer>"   # answer a HITL gate
-bash "$D" help
-```
-
-Each command is a thin wrapper over an existing state script, so the **exit code is the
-gate**: a non-zero `ready` / `evidence-fresh` / `acceptance` is a hard stop, scriptable in
-any agent's loop or a pre-merge CI step. `devrites help` lists them all.
-
-## The MCP server
-
-`mcp/devrites-mcp.mjs` is a dependency-free MCP **stdio** server that exposes the
-read/gate operations as MCP tools (`devrites_orient`, `devrites_ready`,
-`devrites_evidence_fresh`, `devrites_acceptance`, `devrites_status`, `devrites_active`,
-`devrites_list`, `devrites_use`). It shells out to the CLI, so it stays a thin surface over
-the same scripts — no SDK, no dependencies.
-
-For Codex installs, DevRites copies the server to `.codex/mcp/devrites-mcp.mjs` and
-adds a marked `[mcp_servers.devrites]` block to `.codex/config.toml`. After the project
-`.codex/` layer is trusted, Codex can use those MCP tools directly.
-
-For other MCP clients, register the source server in a project's `.mcp.json`, running
-from the project root (it auto-finds the installed CLI; override the path with the
-`DEVRITES_CLI` env var):
-
-```json
-{
-  "mcpServers": {
-    "devrites": { "command": "node", "args": ["/abs/path/to/mcp/devrites-mcp.mjs"] }
-  }
-}
-```
-
-Now any MCP client can ask "is this feature ready to ship?" and the server runs the
-deterministic gates against `.devrites/` — the same verdict the lifecycle skills compute,
-available to tools that don't speak DevRites' skill prose.
-
-## Why this exists
-
-Spec-kit, task-master, and BMAD all run across many agents; DevRites was Claude-Code-only.
-Its workspace and rules were already tool-agnostic *data* — the CLI and MCP server are the
-thin shims that make the *workflow* drivable from anywhere, without reimplementing the
-discipline. The deterministic gates (`ready`, `evidence-fresh`, `acceptance`) are the same
-scripts the skills call, so a verdict from the CLI, the MCP server, or `/rite-seal` agrees.

package/mcp/devrites-mcp.mjs

@@ -1,105 +0,0 @@
-#!/usr/bin/env node
-// devrites-mcp — a tiny, dependency-free MCP stdio server exposing the
-// `.devrites/` workflow state as tools, so any MCP-capable agent (Claude,
-// Cursor, Codex, Gemini CLI, …) can orient/gate/advance a DevRites workflow.
-// It is a thin wrapper over the devrites CLI (devrites-lib/scripts/devrites.sh)
-// — the discipline lives in the .devrites/ files + the shell scripts; this just
-// surfaces them over MCP. Newline-delimited JSON-RPC over stdio, no SDK.
-//
-// Register (project .mcp.json), running from the project root:
-//   { "mcpServers": { "devrites": { "command": "node",
-//       "args": ["mcp/devrites-mcp.mjs"] } } }
-// Override the CLI path with env DEVRITES_CLI if not installed at the defaults.
-
-import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-
-const CWD = process.cwd();
-const CLI =
-  process.env.DEVRITES_CLI ||
-  ['.claude/skills/devrites-lib/scripts/devrites.sh',
-   'pack/.claude/skills/devrites-lib/scripts/devrites.sh'].find(p => existsSync(p)) ||
-  '.claude/skills/devrites-lib/scripts/devrites.sh';
-
-// Tool name -> { sub: CLI subcommand, slug: takes optional slug, desc }
-const TOOLS = {
-  devrites_orient:         { sub: 'orient',         slug: true,  desc: 'Orientation digest for the active (or named) DevRites feature: state.md, artifacts, run mode, open-question tally. Read-only.' },
-  devrites_status:         { sub: 'status',         slug: true,  desc: 'Alias for orient — where the active feature stands.' },
-  devrites_ready:          { sub: 'ready',          slug: true,  desc: 'Build-readiness gate. Non-zero when the plan is not approved / awaiting human / blocked.' },
-  devrites_evidence_fresh: { sub: 'evidence-fresh', slug: true,  desc: 'Evidence-freshness gate: fails when a touched file is newer than the recorded proof.' },
-  devrites_acceptance:     { sub: 'acceptance',     slug: true,  desc: 'Acceptance-criteria gate: fails unless every spec [ACn] criterion is checked (proven) in seal.md.' },
-  devrites_active:         { sub: 'active',          slug: false, desc: 'Print the active feature slug (.devrites/ACTIVE).' },
-  devrites_list:           { sub: 'list',            slug: false, desc: 'List the DevRites workspace slugs under .devrites/work/.' },
-  devrites_use:            { sub: 'use',             slug: 'req', desc: 'Re-point .devrites/ACTIVE to <slug> (slug required).' },
-};
-
-function toolList() {
-  return Object.entries(TOOLS).map(([name, t]) => ({
-    name,
-    description: t.desc,
-    inputSchema: t.slug
-      ? { type: 'object',
-          properties: { slug: { type: 'string', description: 'feature slug (defaults to .devrites/ACTIVE)' } },
-          required: t.slug === 'req' ? ['slug'] : [] }
-      : { type: 'object', properties: {} },
-  }));
-}
-
-function runTool(name, args) {
-  const t = TOOLS[name];
-  if (!t) return { isError: true, text: `unknown tool: ${name}` };
-  const parts = [t.sub];
-  if (t.slug && args && typeof args.slug === 'string' && args.slug) parts.push(args.slug);
-  const r = spawnSync('bash', [CLI, ...parts], { cwd: CWD, encoding: 'utf8' });
-  const out = `${r.stdout || ''}${r.stderr || ''}`.trim() || `(exit ${r.status})`;
-  return { isError: r.status !== 0, text: out };
-}
-
-function send(msg) { process.stdout.write(JSON.stringify(msg) + '\n'); }
-function ok(id, result) { send({ jsonrpc: '2.0', id, result }); }
-function err(id, code, message) { send({ jsonrpc: '2.0', id, error: { code, message } }); }
-
-function handle(msg) {
-  const { id, method, params } = msg;
-  const isNotification = id === undefined || id === null;
-  switch (method) {
-    case 'initialize':
-      return ok(id, {
-        protocolVersion: (params && params.protocolVersion) || '2024-11-05',
-        capabilities: { tools: {} },
-        serverInfo: { name: 'devrites', version: '1.0.0' },
-        instructions:
-          'DevRites exposes deterministic workflow state and gates for the current repo. Use devrites_status/orient to inspect the active feature, devrites_ready before build work, devrites_evidence_fresh and devrites_acceptance before seal/ship, and devrites_use only when the user asks to switch the active feature.',
-      });
-    case 'notifications/initialized':
-    case 'initialized':
-      return; // notification, no reply
-    case 'ping':
-      return ok(id, {});
-    case 'tools/list':
-      return ok(id, { tools: toolList() });
-    case 'tools/call': {
-      const name = params && params.name;
-      const res = runTool(name, (params && params.arguments) || {});
-      return ok(id, { content: [{ type: 'text', text: res.text }], isError: res.isError });
-    }
-    default:
-      if (!isNotification) err(id, -32601, `method not found: ${method}`);
-  }
-}
-
-let buf = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', chunk => {
-  buf += chunk;
-  let nl;
-  while ((nl = buf.indexOf('\n')) >= 0) {
-    const line = buf.slice(0, nl).trim();
-    buf = buf.slice(nl + 1);
-    if (!line) continue;
-    let msg;
-    try { msg = JSON.parse(line); } catch { continue; }
-    try { handle(msg); } catch (e) { if (msg && msg.id != null) err(msg.id, -32603, String(e)); }
-  }
-});
-process.stdin.on('end', () => process.exit(0));

package/pack/.claude/hooks/devrites-a1-guard.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-# DevRites PreToolUse hook — A1 pre-block: keep the /rite-build ORCHESTRATOR from editing
-# source while a slice is mid-build. The slice-wright (a Task subagent) is the only sanctioned
-# writer of code + tests; the orchestrator writes only .devrites/ bookkeeping. This hook is the
-# optional pre-block companion to the reconcile.sh post-hoc gate (which always runs).
-#
-# Safety model: FAIL-OPEN, and OBSERVE by default.
-#   - It NEVER blocks unless ALL hold: a build window is open, the edit is to a source file,
-#     it came from the MAIN thread (no agent_id/agent_type), and enforce mode is on.
-#   - On any doubt — no active workspace, no open window, no node, unparseable payload, a
-#     subagent caller, a .devrites/ path, the inline fallback — it exits 0 and stays silent.
-#   - Default mode is "observe": it LOGS what it would block (to .a1-guard.log) and allows.
-#     Flip to enforce only AFTER confirming the log never flags the wright's own edits — that
-#     confirms this agent surface populates agent_id/agent_type for subagents (older builds may not;
-#     if the log flags wright edits, subagent identity is unavailable here — stay in observe).
-#
-# Enable enforce (either one):
-#   export DEVRITES_A1_HOOK=enforce          # session-wide
-#   touch .devrites/work/<slug>/.a1-enforce  # per-feature
-#
-# Window: opened by `reconcile.sh snapshot` (writes .reconcile-base) before dispatch, closed by
-# a clean `reconcile.sh check`. A violation leaves it open so inline patching stays blocked
-# until the wright is re-dispatched. A stale window (abandoned build) → clear with
-# `rm .devrites/work/<slug>/.reconcile-base` or re-run the check.
-set -u
-
-input="$(cat)"
-
-# Fast path: must look like a tool call at all.
-case "$input" in *'"tool_name"'*) : ;; *) exit 0 ;; esac
-
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-
-# No active DevRites feature → not our concern (keeps non-DevRites projects untouched).
-[ -f "$root/.devrites/ACTIVE" ] || exit 0
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null)"
-[ -n "$slug" ] || exit 0
-d="$root/.devrites/work/$slug"
-
-# Mid-build window open? Only armed between a reconcile snapshot and its check. This scoping is
-# what keeps the hook off /rite-polish, /rite-quick, and ordinary manual edits — they edit
-# source from the main thread too, legitimately, and no window is open then.
-[ -f "$d/.reconcile-base" ] || exit 0
-
-# Inline fallback: the orchestrator is legitimately the writer (no wright was dispatched).
-[ -f "$d/.reconcile-inline" ] && exit 0
-
-# Parse with node (ships with Claude Code). No node or a parse failure → fail open.
-command -v node >/dev/null 2>&1 || exit 0
-tool="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{process.stdout.write(JSON.parse(s).tool_name||"")}catch(e){}})' 2>/dev/null)"
-fpath="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const ti=JSON.parse(s).tool_input||{};process.stdout.write(ti.file_path||ti.path||"")}catch(e){}})' 2>/dev/null)"
-agent="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const p=JSON.parse(s);process.stdout.write(p.agent_id||p.agent_type||"")}catch(e){}})' 2>/dev/null)"
-[ -n "$tool" ] || exit 0
-
-# Only Edit-family writes can touch source.
-case "$tool" in Edit|Write|MultiEdit|NotebookEdit|apply_patch) : ;; *) exit 0 ;; esac
-
-# Subagent caller (the wright) → allow. Claude uses agent_id; Codex uses agent_type.
-[ -n "$agent" ] && exit 0
-
-# Can't tell the path or patch target → fail open.
-if [ "$tool" = "apply_patch" ]; then
-  source_patch="$(printf '%s' "$input" | ROOT="$root" node -e '
-    let s=""; process.stdin.on("data", d => s += d).on("end", () => {
-      try {
-        const root = process.env.ROOT || "";
-        const cmd = (JSON.parse(s).tool_input || {}).command || "";
-        const paths = [...cmd.matchAll(/^\*\*\* (?:(?:Add|Update|Delete) File|Move to): (.+)$/gm)].map(m => m[1]);
-        if (!paths.length) return;
-        const source = paths.some(p => {
-          const abs = p.startsWith("/") ? p : `${root}/${p}`;
-          return !abs.startsWith(`${root}/.devrites/`);
-        });
-        process.stdout.write(source ? "1" : "0");
-      } catch {}
-    });
-  ' 2>/dev/null)"
-  [ "$source_patch" = "1" ] || exit 0
-  abs="apply_patch"
-else
-  [ -n "$fpath" ] || exit 0
-  case "$fpath" in /*) abs="$fpath" ;; *) abs="$root/$fpath" ;; esac
-  # Bookkeeping under .devrites/ is the orchestrator's own legit target → allow.
-  case "$abs" in "$root/.devrites/"*) exit 0 ;; esac
-fi
-
-# Reaching here = the MAIN thread is about to edit a SOURCE file mid-build. That is the A1
-# breach. Observe (default) logs and allows; enforce denies.
-mode="${DEVRITES_A1_HOOK:-observe}"
-[ -f "$d/.a1-enforce" ] && mode="enforce"
-
-if [ "$mode" = "enforce" ]; then
-  printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"DevRites A1: the orchestrator must not edit source mid-build — the slice-wright is the only writer. Re-dispatch the wright (continue it once) or stop + escalate; do not patch the code yourself. (devrites-a1-guard)"}}'
-  exit 0
-fi
-
-# Observe mode — record what enforce WOULD have blocked, then allow.
-printf '%s\tWOULD-BLOCK\t%s\t%s\n' "$(date '+%Y-%m-%dT%H:%M:%S' 2>/dev/null || echo '?')" "$tool" "$abs" >> "$d/.a1-guard.log" 2>/dev/null || true
-exit 0

package/pack/.claude/hooks/devrites-allow.sh

@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-# DevRites PreToolUse hook — auto-approve the pack's READ-ONLY orientation/gate scripts so
-# they stop triggering a permission prompt on every skill run.
-#
-# Safety model: FAIL-OPEN. This hook never denies and never blocks. It only ever EMITS an
-# `allow` for a command that (a) runs one of five known read-only DevRites scripts AND
-# (b) contains no dangerous/exfiltration tokens. On any doubt it prints nothing and exits 0, pack-scan-ignore: describes the hook's own exfil filter, not a payload
-# which leaves Claude Code's normal permission flow untouched. Mutating DevRites scripts
-# (resolve.sh / tick-afk.sh / close-out.sh) are intentionally NOT covered — they still prompt.
-set -u
-
-input="$(cat)"
-
-# Fast path: 99% of Bash commands have nothing to do with DevRites — skip without spawning node.
-case "$input" in *devrites-lib/scripts/*) : ;; *) exit 0 ;; esac
-
-# Extract the actual command string. Use node (ships with Claude Code) for correct JSON;
-# if it's unavailable or parsing fails, fall through to the normal prompt.
-command -v node >/dev/null 2>&1 || exit 0
-cmd="$(printf '%s' "$input" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{try{const j=JSON.parse(s);process.stdout.write((j.tool_input&&j.tool_input.command)||"")}catch(e){}})' 2>/dev/null)"
-[ -n "$cmd" ] || exit 0
-
-# (a) Must actually invoke one of the five read-only helpers.
-case "$cmd" in
-  *devrites-lib/scripts/preamble.sh*|\
-  *devrites-lib/scripts/progress.sh*|\
-  *devrites-lib/scripts/readiness.sh*|\
-  *devrites-lib/scripts/evidence-fresh.sh*|\
-  *devrites-lib/scripts/check-acceptance.sh*) : ;;
-  *) exit 0 ;;
-esac
-
-# (b) Defense in depth — refuse to auto-approve a compound command that could do harm or
-# exfiltrate. The legit resolver snippets only use `[ -f ]`, var assignment, `bash "$VAR"`,
-# `echo`, and && / ||. Anything below -> fall through to a normal prompt.
-case "$cmd" in
-  *" rm "*|*"rm -"*|*" mv "*|*" dd "*|*mkfs*|*" > /"*|*">/"*|*" >> "*|*">> "*|\
-  *chmod*|*chown*|*sudo*|*curl*|*wget*|*" scp "*|*" ssh "*|*'$('*|*'`'*|\
-  *eval*|*base64*|*xargs*|*"git push"*|*"git commit"*|*"git reset"*|*"git checkout"*|\
-  *" npm "*|*npx\ *|*pnpm*|*" yarn "*|*" pip "*|*python\ -c*|*node\ -e*|*perl\ *|*ruby\ -e*) exit 0 ;;
-esac
-
-printf '%s\n' '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"DevRites read-only orientation/gate script — auto-approved by the devrites-allow hook"}}'
-exit 0

package/pack/.claude/hooks/devrites-cursor.sh

@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-# DevRites UserPromptSubmit hook — re-inject the active feature's cursor each turn so the
-# load-bearing next-action sits at the high-attention end of context (fights lost-in-the-middle
-# on a long phase; pairs with the SessionStart orientation). Tiny + read-only; silent on
-# non-DevRites projects. Its stdout is added to the model's context for this turn.
-set -u
-
-root="${CLAUDE_PROJECT_DIR:-$PWD}"
-[ -f "$root/.devrites/ACTIVE" ] || exit 0
-slug="$(tr -d '[:space:]' < "$root/.devrites/ACTIVE" 2>/dev/null)"
-[ -n "$slug" ] || exit 0
-d="$root/.devrites/work/$slug"
-[ -d "$d" ] || exit 0
-state="$d/state.md"
-
-next="$(grep -iE '^[-[:space:]]*Next step:' "$state" 2>/dev/null | head -1 | sed -E 's/^[-[:space:]]*Next step:[[:space:]]*//')"
-status="$(grep -iE '^[-[:space:]]*Status:' "$state" 2>/dev/null | head -1 | sed -E 's/^[-[:space:]]*Status:[[:space:]]*//')"
-gates="$(grep -ciE '^[[:space:]]*status:[[:space:]]*open' "$d/questions.md" 2>/dev/null || echo 0)"
-afk=""
-[ -f "$root/.devrites/AFK" ] && afk="$(grep -iE 'AFK slices remaining:' "$state" 2>/dev/null | head -1 | sed -E 's/.*remaining:[[:space:]]*//')"
-
-echo "DevRites cursor — active feature: $slug"
-[ -n "$status" ] && echo "  status: $status"
-[ -n "$next" ] && echo "  next: $next"
-echo "  open questions: ${gates:-0}"
-[ -n "$afk" ] && echo "  AFK slices remaining: $afk"
-[ -f "$d/.red" ] && echo "  ⚠ tests/build RED — resolve before stopping"
-exit 0

package/pack/.claude/hooks/devrites-orient.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-# DevRites SessionStart hook — two read-only jobs, both silent unless they have something to say:
-#   1. surface DevRites health issues (stale ACTIVE, corrupt workspace, broken hook wiring, …)
-#      via doctor.sh — only when there ARE issues (silent-when-healthy);
-#   2. inject the active feature's orientation digest so the model knows a workflow is in flight.
-# Silent on non-DevRites projects and on any failure — this is an enhancement, never a
-# dependency. Read-only; never blocks.
-set -u
-
-# Resolve shared scripts across install layouts (mirror the skill resolver).
-P=".claude/skills/devrites-lib/scripts/preamble.sh"
-[ -f "$P" ] || P="${CLAUDE_PLUGIN_ROOT:-}/pack/.claude/skills/devrites-lib/scripts/preamble.sh"
-[ -f "$P" ] || P="pack/.claude/skills/devrites-lib/scripts/preamble.sh"
-D=".claude/skills/devrites-lib/scripts/doctor.sh"
-[ -f "$D" ] || D="${CLAUDE_PLUGIN_ROOT:-}/pack/.claude/skills/devrites-lib/scripts/doctor.sh"
-[ -f "$D" ] || D="pack/.claude/skills/devrites-lib/scripts/doctor.sh"
-L=".claude/skills/devrites-lib/scripts/learnings.sh"
-[ -f "$L" ] || L="${CLAUDE_PLUGIN_ROOT:-}/pack/.claude/skills/devrites-lib/scripts/learnings.sh"
-[ -f "$L" ] || L="pack/.claude/skills/devrites-lib/scripts/learnings.sh"
-
-# Not a DevRites project -> stay silent.
-[ -d ".devrites" ] || exit 0
-
-# 1. Health sweep — prints issue lines only (empty when healthy).
-health=""
-[ -f "$D" ] && health="$(bash "$D" 2>/dev/null)"
-
-# 2. Orientation digest — only when there's an active workspace.
-digest=""
-if [ -f "$P" ]; then
-  slug="$(cat .devrites/ACTIVE 2>/dev/null | tr -d '[:space:]')"
-  if [ -n "$slug" ] && [ -d ".devrites/work/$slug" ]; then
-    digest="$(bash "$P" 2>/dev/null)"
-  fi
-fi
-
-# 3. Learnings nudge — silent unless a pattern recurs across shipped features (snoozes after review).
-nudge=""
-[ -f "$L" ] && nudge="$(bash "$L" nudge 2>/dev/null)"
-
-# Nothing to say -> stay silent.
-[ -z "$health" ] && [ -z "$digest" ] && [ -z "$nudge" ] && exit 0
-
-ctx=""
-[ -n "$health" ] && ctx="⚠ DevRites health — issues found at session start (advisory; run /rite-doctor for the full report):"$'\n'"$health"$'\n\n'
-[ -n "$digest" ] && ctx="${ctx}DevRites workflow active — live workspace orientation (from preamble.sh):"$'\n\n'"$digest"$'\n\n'"This is the current state; a /rite-* command will re-run its own step-0 preamble."
-[ -n "$nudge" ] && ctx="${ctx}"$'\n\n'"$nudge"
-
-# Emit as additionalContext, JSON-encoded via node (skip if node is absent — each skill's
-# own step-0 preamble still orients, and the health block degrades to nothing).
-command -v node >/dev/null 2>&1 || exit 0
-printf '%s' "$ctx" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:s}}));});' 2>/dev/null || exit 0
-exit 0