dw-kit 1.9.2 → 1.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/rules/dw.md +14 -3
- package/.claude/skills/dw-flow/SKILL.md +35 -2
- package/.claude/skills/dw-goal/SKILL.md +22 -1
- package/.dw/config/config.schema.json +24 -0
- package/.dw/config/dw.config.yml +14 -0
- package/.dw/core/HARNESS.md +157 -0
- package/.dw/core/schemas/events/gate_auto_approved.schema.json +36 -0
- package/.dw/core/schemas/events/hard_stop.schema.json +35 -0
- package/.dw/core/schemas/events/index.json +28 -2
- package/.dw/core/schemas/events/overnight_wrapup.schema.json +29 -0
- package/.dw/core/schemas/events/parked.schema.json +39 -0
- package/.dw/core/schemas/events/subtask_completed.schema.json +35 -0
- package/.dw/core/schemas/overnight-digest.schema.json +113 -0
- package/.dw/core/templates/autopilot-cron.sh +28 -0
- package/README.md +152 -121
- package/package.json +4 -1
- package/src/cli.mjs +63 -0
- package/src/commands/autopilot.mjs +65 -0
- package/src/commands/doctor.mjs +17 -1
- package/src/commands/overnight.mjs +35 -0
- package/src/commands/trust.mjs +79 -0
- package/src/commands/voice.mjs +431 -2
- package/src/lib/autopilot-contract.mjs +97 -0
- package/src/lib/board-data.mjs +23 -57
- package/src/lib/config.mjs +56 -0
- package/src/lib/event-schema.mjs +28 -0
- package/src/lib/goal-driver.mjs +312 -0
- package/src/lib/goal-events.mjs +4 -1
- package/src/lib/goal-progress.mjs +193 -0
- package/src/lib/overnight-digest.mjs +241 -0
- package/src/lib/process-kill.mjs +77 -0
- package/src/lib/task-md-utils.mjs +78 -0
- package/src/lib/tls-helpers.mjs +28 -6
- package/src/lib/trust.mjs +139 -0
|
@@ -0,0 +1,113 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "https://github.com/dv-workflow/dv-workflow/schemas/overnight-digest.schema.json",
|
|
4
|
+
"title": "DW Read-Contract: overnight-digest@v1",
|
|
5
|
+
"description": "Machine-readable summary of one Overnight Autopilot run (ADR-0023). The human-facing OVERNIGHT.md is rendered from this shape; external dashboards/adapters consume it. Produced by summarizeRun() over .dw/events-global.jsonl.",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"additionalProperties": false,
|
|
8
|
+
"required": ["schema_version", "counts", "stopReason"],
|
|
9
|
+
"properties": {
|
|
10
|
+
"schema_version": { "type": "string", "const": "overnight-digest@v1" },
|
|
11
|
+
"date": { "type": "string", "description": "ISO date (YYYY-MM-DD) of the run" },
|
|
12
|
+
"goal": { "type": ["string", "null"], "description": "Goal id/title the run pursued" },
|
|
13
|
+
"counts": {
|
|
14
|
+
"type": "object",
|
|
15
|
+
"additionalProperties": false,
|
|
16
|
+
"required": ["done", "parked", "hardStops", "autoApproved"],
|
|
17
|
+
"properties": {
|
|
18
|
+
"done": { "type": "integer", "minimum": 0 },
|
|
19
|
+
"parked": { "type": "integer", "minimum": 0 },
|
|
20
|
+
"hardStops": { "type": "integer", "minimum": 0 },
|
|
21
|
+
"autoApproved": { "type": "integer", "minimum": 0 }
|
|
22
|
+
}
|
|
23
|
+
},
|
|
24
|
+
"stopReason": {
|
|
25
|
+
"type": "string",
|
|
26
|
+
"description": "Why the run stopped",
|
|
27
|
+
"examples": ["budget", "done", "no-progress", "unknown"]
|
|
28
|
+
},
|
|
29
|
+
"wrapupSeen": {
|
|
30
|
+
"type": "boolean",
|
|
31
|
+
"description": "Whether an overnight_wrapup event was present (false = run may have crashed)"
|
|
32
|
+
},
|
|
33
|
+
"done": {
|
|
34
|
+
"type": "array",
|
|
35
|
+
"items": {
|
|
36
|
+
"type": "object",
|
|
37
|
+
"properties": {
|
|
38
|
+
"subtask": { "type": "string" },
|
|
39
|
+
"commit": { "type": "string" },
|
|
40
|
+
"summary": { "type": "string" }
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
},
|
|
44
|
+
"autoApproved": {
|
|
45
|
+
"type": "array",
|
|
46
|
+
"description": "Gates Trust Mode waved (event: gate_auto_approved)",
|
|
47
|
+
"items": {
|
|
48
|
+
"type": "object",
|
|
49
|
+
"properties": {
|
|
50
|
+
"gate": { "type": "string" },
|
|
51
|
+
"task": { "type": ["string", "null"] },
|
|
52
|
+
"reason": { "type": "string" },
|
|
53
|
+
"evidence": {
|
|
54
|
+
"type": "object",
|
|
55
|
+
"description": "EVD verify — the basis cited for the auto-approval, not just the outcome",
|
|
56
|
+
"properties": {
|
|
57
|
+
"tests": {
|
|
58
|
+
"type": "object",
|
|
59
|
+
"properties": {
|
|
60
|
+
"command": { "type": "string" },
|
|
61
|
+
"passed": { "type": "integer" },
|
|
62
|
+
"failed": { "type": "integer" },
|
|
63
|
+
"exit": { "type": "integer" }
|
|
64
|
+
}
|
|
65
|
+
},
|
|
66
|
+
"review": {
|
|
67
|
+
"type": "object",
|
|
68
|
+
"properties": {
|
|
69
|
+
"critical": { "type": "integer", "minimum": 0 },
|
|
70
|
+
"warning": { "type": "integer", "minimum": 0 },
|
|
71
|
+
"suggestion": { "type": "integer", "minimum": 0 }
|
|
72
|
+
}
|
|
73
|
+
},
|
|
74
|
+
"diff": {
|
|
75
|
+
"type": "object",
|
|
76
|
+
"properties": {
|
|
77
|
+
"files": { "type": "integer" },
|
|
78
|
+
"insertions": { "type": "integer" },
|
|
79
|
+
"deletions": { "type": "integer" },
|
|
80
|
+
"within_scope": { "type": "boolean" }
|
|
81
|
+
}
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
}
|
|
87
|
+
},
|
|
88
|
+
"parked": {
|
|
89
|
+
"type": "array",
|
|
90
|
+
"description": "Decisions the agent refused to guess on — the human acts on these",
|
|
91
|
+
"items": {
|
|
92
|
+
"type": "object",
|
|
93
|
+
"properties": {
|
|
94
|
+
"item": { "type": "string" },
|
|
95
|
+
"question": { "type": "string" },
|
|
96
|
+
"options": { "type": "array", "items": { "type": "string" } }
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
},
|
|
100
|
+
"hardStops": {
|
|
101
|
+
"type": "array",
|
|
102
|
+
"description": "Guard / Critical blocks that fired",
|
|
103
|
+
"items": {
|
|
104
|
+
"type": "object",
|
|
105
|
+
"properties": {
|
|
106
|
+
"gate": { "type": "string" },
|
|
107
|
+
"blocker": { "type": "string" },
|
|
108
|
+
"reason": { "type": "string" }
|
|
109
|
+
}
|
|
110
|
+
}
|
|
111
|
+
}
|
|
112
|
+
}
|
|
113
|
+
}
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
#!/usr/bin/env bash
|
|
2
|
+
# Overnight Autopilot recipe (ADR-0023). Scheduling lives in YOUR cron/CI — the
|
|
3
|
+
# toolkit ships no daemon (ADR-0021). Copy, set the two vars, add to crontab:
|
|
4
|
+
# 0 1 * * * /path/to/autopilot-cron.sh >> ~/dw-autopilot.log 2>&1
|
|
5
|
+
set -euo pipefail
|
|
6
|
+
|
|
7
|
+
PROJECT_DIR="${PROJECT_DIR:-$HOME/your-project}"
|
|
8
|
+
GOAL_ID="${GOAL_ID:-G-your-goal}"
|
|
9
|
+
MAX_ITER="${MAX_ITER:-8}"
|
|
10
|
+
|
|
11
|
+
cd "$PROJECT_DIR"
|
|
12
|
+
|
|
13
|
+
# INPUT contract — refuse to start in an unsafe state (dirty tree, no budget, …).
|
|
14
|
+
if ! dw autopilot preflight --goal "$GOAL_ID" --max-iter "$MAX_ITER"; then
|
|
15
|
+
echo "autopilot: preflight failed — not running tonight."
|
|
16
|
+
exit 0
|
|
17
|
+
fi
|
|
18
|
+
|
|
19
|
+
# Drive the goal unattended with Trust Mode. Gates auto-approve per your config;
|
|
20
|
+
# Guards + Critical findings + GATE B still hard-stop. Safe-park on ambiguity.
|
|
21
|
+
dw goal --auto=full --trust --max-iter "$MAX_ITER" "$GOAL_ID" || true
|
|
22
|
+
|
|
23
|
+
# OUTPUT contract — verify the end-state, then render the morning digest.
|
|
24
|
+
dw autopilot postflight --require-wrapup || true # verdict is still written below
|
|
25
|
+
dw overnight digest --goal "$GOAL_ID"
|
|
26
|
+
|
|
27
|
+
# NEVER push here. Local commits only — review OVERNIGHT.md and push yourself.
|
|
28
|
+
echo "autopilot: done — review OVERNIGHT.md in $PROJECT_DIR"
|
package/README.md
CHANGED
|
@@ -1,201 +1,232 @@
|
|
|
1
1
|
# dw-kit
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
🇬🇧 **English** · [🇻🇳 Tiếng Việt](README-vi.md)
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
[](https://www.npmjs.com/package/dw-kit)
|
|
6
|
+
[](https://www.npmjs.com/package/dw-kit)
|
|
7
|
+
[](https://nodejs.org)
|
|
8
|
+
[](LICENSE)
|
|
6
9
|
|
|
7
|
-
|
|
10
|
+
> A **governance harness for AI-assisted development**. Give your coding agent a repeatable workflow, safety guards, and a memory that outlives the chat window — so it ships review-ready work instead of confident guesses.
|
|
8
11
|
|
|
9
|
-
|
|
12
|
+
```bash
|
|
13
|
+
npm install -g dw-kit && dw init
|
|
14
|
+
```
|
|
10
15
|
|
|
11
|
-
|
|
16
|
+
Then, inside your AI IDE:
|
|
12
17
|
|
|
13
18
|
```
|
|
14
|
-
|
|
19
|
+
/dw:flow build the thing you actually want
|
|
15
20
|
```
|
|
16
21
|
|
|
17
|
-
|
|
22
|
+
That's it. `dw` drives the rest — and **stops for your approval** before it writes code.
|
|
18
23
|
|
|
19
|
-
|
|
24
|
+
> **Works with any agentic CLI** — Claude Code, Codex, Gemini, Cursor, Windsurf, Copilot. The `dw` CLI and the Markdown methodology are universal: if your agent can read files and run a shell, it can run dw-kit. The *full* harness (hooks, skill automation, multi-agent orchestration) is first-class on **[Claude Code](https://claude.ai/code)**; a generic adapter gives everything else the methodology layer.
|
|
20
25
|
|
|
21
|
-
|
|
26
|
+
---
|
|
22
27
|
|
|
23
|
-
|
|
28
|
+
## Why dw-kit?
|
|
24
29
|
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
30
|
+
AI agents are fast but stateless: they forget context between sessions, skip planning, and have no notion of "wait, get a human to look at this first." dw-kit wraps your agent in a lightweight process so the speed stays and the chaos doesn't.
|
|
31
|
+
|
|
32
|
+
```
|
|
33
|
+
Initialize → Understand → Plan → Execute → Verify → Close
|
|
34
|
+
│ │ │ │ │ │
|
|
35
|
+
scope survey design TDD, quality handoff
|
|
36
|
+
+ docs code (✋ STOP 1 commit gates + notes +
|
|
37
|
+
for OK) /subtask review archive
|
|
38
|
+
```
|
|
32
39
|
|
|
33
|
-
|
|
40
|
+
- **✋ Human checkpoints** — the agent pauses at Plan for your sign-off, never silently barrels ahead.
|
|
41
|
+
- **🛡️ Guards** — hooks block commits of secrets, `.env`, and unsafe edits before they happen.
|
|
42
|
+
- **🧠 Memory that survives sessions** — decisions, task docs, and handoff notes let the next session resume cold.
|
|
43
|
+
- **🌏 Fully bilingual** — English + Vietnamese UX out of the box.
|
|
34
44
|
|
|
35
45
|
---
|
|
36
46
|
|
|
37
|
-
##
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
**Drift fix structurally.** v2 split `spec.md` + `tracking.md` was leaking status markers across both files. v3 puts everything in one `task.md` (Sections 1-7: Snapshot · Intent · Tracker · Changelog · Handoff · Annexes · Debate). Status lives ONLY in Section 3 — enforced by `dw task lint` strict default.
|
|
57
|
-
|
|
58
|
-
- **`dw task new <name>`** — scaffold v3 task from template, frontmatter ajv-validated.
|
|
59
|
-
- **`dw task show [name]`** — ANSI terminal snapshot (~30 lines).
|
|
60
|
-
- **`dw task view [name]`** — lean HTML dashboard in browser. 4 cards: snapshot + progress bar + subtask tracker + recent activity + handoff. ~10KB, self-contained (no CDN), scan-in-5-seconds. Trace `task.md` for full details.
|
|
61
|
-
- **`dw task watch [name]`** — live-preview server. fs.watch + 800ms debounce + browser auto-refresh on save. Pair-with-agent workflow.
|
|
62
|
-
- **`dw task render [name]`** — `timeline.svg` sidecar via `dw-kit-render` (satori+resvg). Bounded composition. Mermaid Gantt fallback if sub-package absent.
|
|
63
|
-
- **`dw task lint [name]`** — schema validate + drift-marker detect + line-cap thresholds. Default `strict` (exit 1 on errors). Configurable via `task.lint: warn|off`.
|
|
64
|
-
- **`dw task migrate <name>`** — v2 → v3 with `--dry-run`, `--diff`, `--rollback`, `--all`. `.v2bak` backups preserved (gitignored).
|
|
65
|
-
- **`dw task rotate [name]`** — auto Section-4 overflow > 400 lines → `timeline-history.md`. Invoked by `stop-check` hook.
|
|
66
|
-
- **3-tier auto-sync**: `stop-check` (session end) · `pre-commit-gate` (commit gate) · `dw task watch` (real-time opt-in).
|
|
67
|
-
- **7 skills v3-aware** (task-init / execute / handoff / research / plan / decision / retroactive) — read v3 first, fall back v2/v1.
|
|
68
|
-
|
|
69
|
-
### What's in v1.3.6 for your team
|
|
70
|
-
|
|
71
|
-
Reaction time when a supply-chain incident drops goes from 24-72 hours (wait for OSV index + npm publish cycle) to **~1 hour** (AI edits lockfile → hook fires → heuristic flags BEFORE anyone knows).
|
|
72
|
-
|
|
73
|
-
- **3-pillar default scan** — `dw security-scan` now runs OSV snapshot + curated IoC fixture + AI-Native heuristic in one go. Heuristic only probes NEW/bumped packages from `git show HEAD:package-lock.json` diff — typical edit = 1-5 packages probed, not 1000+.
|
|
74
|
-
- **npm registry metadata heuristic** — composite scoring on `recent_publish` (<72h), `popular_package` (≥10k weekly DL), `maintainer_change_recent`, `major_version_jump`, `typo_squat`. Per-package metadata cached 1h. Tunable threshold via `.dw/config/dw.config.yml`.
|
|
75
|
-
- **Version-aware IoC fixture** — `affected_range` per entry. Concrete versions out-of-range are skipped (no false positives). Range specs (`^1.169.0`) emit ambiguity warnings with severity downgrade.
|
|
76
|
-
- **Hook fires `dw security-scan --heuristic-only`** on Claude Code lockfile edit — fast diff-only check.
|
|
77
|
-
- **Telemetry per pillar** — `source: 'osv' | 'fixture' | 'heuristic'` tracked separately so the 2026-08-12 sunset review attributes catches to the right pillar.
|
|
78
|
-
- **`>1000 packages`** crash bug from v1.3.5 fixed (chunked OSV batches).
|
|
79
|
-
|
|
80
|
-
### What's in v1.3.5 for your team
|
|
81
|
-
|
|
82
|
-
- **`dw security-scan`** — scan for known supply-chain advisories against your project's `package-lock.json` (full match) or `package.json` (pre-install approximate). Uses [OSV.dev](https://osv.dev/) as data source (multi-maintainer upstream feed; no solo-curated bundle to go stale).
|
|
83
|
-
- **AI-aware hook** — fires when Claude Code edits a lockfile. Auto-wired by `dw init --preset team` or `--preset enterprise`; opt-in OFF for `--preset solo`.
|
|
84
|
-
- **Scoped `.gitignore`** — `dw init` and `dw upgrade` write `.dw/.gitignore` and `.claude/.gitignore` managed blocks. Framework files stay out of your repo; tasks/decisions/docs/config stay in.
|
|
85
|
-
- **`dw doctor`** has a new security section that fails loud if advisory snapshot is stale (>7 days) or schema-incompatible.
|
|
86
|
-
- **Sunset rule** — feature retires silently in v1.4.x if 90-day telemetry shows zero real catches OR >5% false-positive rate. Disciplined experiment, not panic ship.
|
|
47
|
+
## Built to self-correct — with you in the loop
|
|
48
|
+
|
|
49
|
+
Two mechanisms keep the agent honest instead of merely busy.
|
|
50
|
+
|
|
51
|
+
**The pursuit loop — `/dw:goal`.** Most agents optimize for *"I did the task."* dw-kit optimizes for the *outcome*. Give it a Goal with measurable Key Results and it runs an OODA-style loop, re-measuring the gap every pass. When an approach fails it **escalates its thinking** — climbs a reasoning ladder — instead of retrying the same move. It exits only when the KR actually hits target, not when it runs out of steam. *(ADR-0016)*
|
|
52
|
+
|
|
53
|
+
```
|
|
54
|
+
measure gap → act → re-measure ──┐
|
|
55
|
+
▲ │
|
|
56
|
+
└──── stuck? escalate ◀──────┘ climb the ladder, don't repeat
|
|
57
|
+
exit only when the Key Result is met
|
|
58
|
+
```
|
|
59
|
+
|
|
60
|
+
Autonomy is a dial: **supervised** (stop every loop) → **checkpoint** (`--auto`, stop at each KR) → **full** (`--auto=full`, hard-stops only), bounded by `--max-iter`.
|
|
61
|
+
|
|
62
|
+
**Adversarial review, then you — `/dw:plan`.** Before a plan ever reaches you, dw grills it with a **red-team / blue-team debate**: red attacks for failure modes and hidden assumptions, blue strengthens or concedes. You receive the *sharpened* plan plus what was contested — then **execution stops for your approval.** The same reflex recurs at **Verify** (`/dw:review`: correctness · security · conventions · coverage) and at every commit gate. The agent proposes; you decide and steer.
|
|
63
|
+
|
|
64
|
+
> Debate is depth-aware — off for `quick`, auto-triggered on high-stakes signals for `standard`, on by default for `thorough`. Override with `--debate` / `--no-debate`.
|
|
87
65
|
|
|
88
66
|
---
|
|
89
67
|
|
|
90
|
-
##
|
|
68
|
+
## The harness: how dw governs your agent
|
|
69
|
+
|
|
70
|
+
dw-kit sits *above* your coding agent as a thin governance harness — three durable layers it reads and writes as it works:
|
|
71
|
+
|
|
72
|
+
| Layer | Manages | Artifacts |
|
|
73
|
+
|-------|---------|-----------|
|
|
74
|
+
| **Context** | What the agent knows, every session | `CLAUDE.md`, ADRs (`/dw:decision`), handoff notes |
|
|
75
|
+
| **Tasks** | One source of truth per unit of work | `task.md` (v3 — lint + schema, status drift-proof), `ACTIVE.md` index |
|
|
76
|
+
| **Goals** | Outcomes above the task line | `dw goal *`, Key Results, task ↔ goal links |
|
|
77
|
+
|
|
78
|
+
Because this state lives in **plain files, not a chat window**, it survives session resets, model swaps, and handoffs between agents or humans — the part a session-scoped IDE assistant structurally cannot own.
|
|
79
|
+
|
|
80
|
+
### Parallel multi-agent orchestration (Agent OS)
|
|
81
|
+
|
|
82
|
+
A task rarely needs just one agent. **Agent OS** lets an orchestrator split a `task.md` into bounded work units and hand them to *different* agents running **in parallel** — say Claude Code on the API, Codex on the tests, Gemini on the docs, a human on the tricky migration:
|
|
91
83
|
|
|
92
84
|
```bash
|
|
93
|
-
|
|
85
|
+
dw agent claim payments --subtasks ST-1 --write "src/api/**" --vendor claude --lease 1h
|
|
86
|
+
dw agent claim payments --subtasks ST-2 --write "test/**" --vendor codex
|
|
87
|
+
dw agent conflicts # exit 1 if two claims overlap on files or subtasks
|
|
94
88
|
```
|
|
95
89
|
|
|
90
|
+
Each agent **claims** its subtasks + file scope before editing, so parallel work doesn't collide. It's **cooperative, not forced**: overlaps are caught by `dw agent conflicts` and the `pre-commit-gate` hook, every agent's report merges back into the one `task.md`, and the **orchestrator stops for your approval before any push.** *(ADR-0009)*
|
|
91
|
+
|
|
96
92
|
---
|
|
97
93
|
|
|
98
94
|
## Quick start
|
|
99
95
|
|
|
100
|
-
Setup dw in project directory:
|
|
101
|
-
|
|
102
96
|
```bash
|
|
97
|
+
# 1. Install
|
|
98
|
+
npm install -g dw-kit
|
|
99
|
+
|
|
100
|
+
# 2. Set up in your project (wizard, or --solo for zero-config)
|
|
103
101
|
dw init
|
|
102
|
+
dw init --solo # vibe-coder mode: guards only, no task docs
|
|
103
|
+
|
|
104
|
+
# 3. Drive a task from your AI IDE
|
|
105
|
+
/dw:flow add user authentication
|
|
104
106
|
```
|
|
105
107
|
|
|
106
|
-
|
|
108
|
+
Other skills worth knowing:
|
|
107
109
|
|
|
108
110
|
```
|
|
109
|
-
/dw:
|
|
111
|
+
/dw:prompt # turn a vague idea into a sharp, actionable prompt
|
|
112
|
+
/dw:plan # plan + red/blue self-critique, then stop for approval
|
|
113
|
+
/dw:review # correctness · security · conventions · coverage
|
|
114
|
+
/dw:decision # capture an architectural decision (ADR)
|
|
115
|
+
/dw:goal # drive a Goal toward its Key Results (pursuit loop)
|
|
110
116
|
```
|
|
111
117
|
|
|
112
118
|
---
|
|
113
119
|
|
|
114
|
-
|
|
120
|
+
## Tutorial: ship your first feature
|
|
121
|
+
|
|
122
|
+
```bash
|
|
123
|
+
dw init # one-time: scaffold .dw/ + .claude/ in your repo
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
Then, inside Claude Code:
|
|
115
127
|
|
|
116
128
|
```
|
|
117
|
-
/dw:
|
|
118
|
-
/dw:thinking
|
|
119
|
-
/dw:decision
|
|
120
|
-
...
|
|
129
|
+
/dw:flow add password reset via email
|
|
121
130
|
```
|
|
122
131
|
|
|
123
|
-
|
|
132
|
+
What unfolds, in order:
|
|
124
133
|
|
|
125
|
-
|
|
134
|
+
1. **Initialize + Understand** — dw scopes the task, scaffolds a `task.md`, and surveys your auth code (no edits yet).
|
|
135
|
+
2. **Plan** — proposes subtasks, self-critiques red/blue, then **stops.** You reply *"go"* or steer.
|
|
136
|
+
3. **Execute** — implements subtask-by-subtask, TDD, one commit each (or fan the subtasks out to parallel agents via Agent OS). Secrets / `.env` are blocked at the gate.
|
|
137
|
+
4. **Verify** — runs your tests + a `/dw:review` pass (correctness · security · conventions).
|
|
138
|
+
5. **Close** — writes handoff notes so tomorrow's session resumes without you re-explaining.
|
|
126
139
|
|
|
127
|
-
|
|
140
|
+
Prefer manual control? Run the phases yourself and approve between each:
|
|
128
141
|
|
|
129
|
-
```bash
|
|
130
|
-
dw init # setup wizard / presets
|
|
131
|
-
dw init --solo # zero-config solo dev setup (v1.3)
|
|
132
|
-
dw validate # validate .dw/config/dw.config.yml
|
|
133
|
-
dw doctor # installation health check
|
|
134
|
-
dw upgrade # update toolkit files (override-aware)
|
|
135
|
-
dw upgrade --check # check for updates only
|
|
136
|
-
dw upgrade --dry-run # preview changes
|
|
137
|
-
dw prompt # build a well-structured task prompt (autocomplete + wizard)
|
|
138
|
-
dw prompt --text "..." # non-interactive: structure a description directly
|
|
139
|
-
dw active # regenerate .dw/tasks/ACTIVE.md index (v1.3)
|
|
140
|
-
dw metrics # inspect local telemetry (v1.3, opt-out via DW_NO_TELEMETRY=1)
|
|
141
|
-
dw dashboard # active tasks + ADRs + telemetry summary (v1.3)
|
|
142
|
-
dw claude-vn-fix # patch Claude CLI to fix Vietnamese IME (backup/restore)
|
|
143
142
|
```
|
|
144
|
-
|
|
145
|
-
|
|
143
|
+
/dw:plan → (you review) → /dw:execute → /dw:review → /dw:commit
|
|
144
|
+
```
|
|
146
145
|
|
|
147
146
|
---
|
|
148
147
|
|
|
149
|
-
##
|
|
148
|
+
## Pick your depth
|
|
150
149
|
|
|
151
|
-
|
|
150
|
+
One size never fits all. Set a default, override per task when risk rises.
|
|
152
151
|
|
|
153
152
|
| Depth | Best for | Workflow |
|
|
154
153
|
|-------|----------|----------|
|
|
155
|
-
| `quick` |
|
|
156
|
-
| `standard` |
|
|
157
|
-
| `thorough` |
|
|
158
|
-
|
|
159
|
-
Configured in `.dw/config/dw.config.yml`:
|
|
154
|
+
| `quick` | Hotfix, familiar code, solo | Understand → Execute → Close |
|
|
155
|
+
| `standard` | New features, small teams | Full 6 phases |
|
|
156
|
+
| `thorough` | API / DB / security changes | Full workflow + arch-review + test-plan + debate |
|
|
160
157
|
|
|
161
158
|
```yaml
|
|
159
|
+
# .dw/config/dw.config.yml
|
|
162
160
|
workflow:
|
|
163
161
|
default_depth: "standard"
|
|
164
162
|
```
|
|
165
163
|
|
|
166
164
|
---
|
|
167
165
|
|
|
168
|
-
##
|
|
166
|
+
## Core commands
|
|
167
|
+
|
|
168
|
+
```bash
|
|
169
|
+
dw init [--solo] # setup wizard / presets (solo · team · enterprise)
|
|
170
|
+
dw doctor # installation health check
|
|
171
|
+
dw upgrade [--check] # update toolkit files (keeps your customizations)
|
|
172
|
+
dw task new <name> # scaffold a v3 task doc
|
|
173
|
+
dw task show [name] # ANSI snapshot of a task
|
|
174
|
+
dw goal status # Goals → Key Results progress
|
|
175
|
+
dw trust status # Trust Mode — opt-in gate auto-approval (ADR-0022, off by default)
|
|
176
|
+
dw autopilot preflight # gate an unattended overnight run (ADR-0023); + `dw overnight digest`
|
|
177
|
+
dw security-scan # AI-native supply-chain guard (OSV + heuristics)
|
|
178
|
+
dw dashboard # active tasks + ADRs + telemetry summary
|
|
179
|
+
dw metrics # local-only telemetry (opt out: DW_NO_TELEMETRY=1)
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
Full command reference and skills index live in [`docs/`](docs/).
|
|
183
|
+
|
|
184
|
+
---
|
|
185
|
+
|
|
186
|
+
## What gets added to your repo
|
|
169
187
|
|
|
170
188
|
```
|
|
171
189
|
.dw/
|
|
172
190
|
core/ methodology + PILLARS.md
|
|
173
191
|
config/ dw.config.yml (+ optional .local.yml)
|
|
174
|
-
decisions/ ADRs
|
|
175
|
-
tasks/ task docs + ACTIVE.md index
|
|
176
|
-
metrics/ local telemetry (
|
|
177
|
-
.claude/
|
|
178
|
-
CLAUDE.md
|
|
192
|
+
decisions/ ADRs — architectural decision records
|
|
193
|
+
tasks/ task docs + ACTIVE.md index
|
|
194
|
+
metrics/ local telemetry (opt-out)
|
|
195
|
+
.claude/ skills, hooks, agents, rules for your AI IDE
|
|
196
|
+
CLAUDE.md project context the agent reads on every session
|
|
179
197
|
```
|
|
180
198
|
|
|
199
|
+
Everything is plain Markdown + YAML — auditable, diff-able, and yours.
|
|
200
|
+
|
|
181
201
|
---
|
|
182
202
|
|
|
183
|
-
## 5
|
|
203
|
+
## The 5 pillars
|
|
184
204
|
|
|
185
|
-
dw-kit is a **context-first governance layer
|
|
205
|
+
dw-kit is a **context-first governance layer**, not a prescriptive engine. Five verb-based pillars:
|
|
186
206
|
|
|
187
207
|
| Pillar | Purpose | Examples |
|
|
188
208
|
|--------|---------|----------|
|
|
189
|
-
| **Guards** | Safety before action | `
|
|
190
|
-
| **Surfaces** | Make state visible | `ACTIVE.md`, `dw dashboard
|
|
191
|
-
| **Records** | Preserve memory | ADRs
|
|
192
|
-
| **Bridges** | Continuity across sessions
|
|
193
|
-
| **Tunes** | Adapt to team shape | presets
|
|
209
|
+
| **Guards** | Safety before action | `privacy-block`, `pre-commit-gate` |
|
|
210
|
+
| **Surfaces** | Make state visible | `ACTIVE.md`, `dw dashboard` |
|
|
211
|
+
| **Records** | Preserve memory | ADRs, task docs |
|
|
212
|
+
| **Bridges** | Continuity across sessions | auto-handoff, `task.md` |
|
|
213
|
+
| **Tunes** | Adapt to team shape | presets, config flags |
|
|
214
|
+
|
|
215
|
+
**Design principle — the obsolescence test:** every feature must answer *"will this be more valuable when AI is smarter?"* If not, it gets cut.
|
|
216
|
+
|
|
217
|
+
Full spec: [`.dw/core/PILLARS.md`](.dw/core/PILLARS.md).
|
|
218
|
+
|
|
219
|
+
---
|
|
220
|
+
|
|
221
|
+
## Requirements
|
|
222
|
+
|
|
223
|
+
- **Node.js ≥ 18**
|
|
224
|
+
- An agentic coding tool with a CLI — [Claude Code](https://claude.ai/code) (full harness) or any other agent / IDE via the generic adapter (methodology layer)
|
|
194
225
|
|
|
195
|
-
|
|
226
|
+
## Links
|
|
196
227
|
|
|
197
|
-
|
|
228
|
+
[Changelog](CHANGELOG.md) · [Releases](https://github.com/dv-workflow/dv-workflow/releases) · [Security policy](SECURITY.md) · [License (Apache-2.0)](LICENSE)
|
|
198
229
|
|
|
199
230
|
---
|
|
200
231
|
|
|
201
|
-
|
|
232
|
+
Made with care by [huygdv](mailto:huygdv19@gmail.com) · [Report an issue](https://github.com/dv-workflow/dv-workflow/issues)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "dw-kit",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.10.0",
|
|
4
4
|
"description": "AI development workflow toolkit — structured, quality-assured, team-ready. From requirements to dashboard.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -87,6 +87,9 @@
|
|
|
87
87
|
"url": "git+https://github.com/dv-workflow/dv-workflow.git"
|
|
88
88
|
},
|
|
89
89
|
"homepage": "https://github.com/dv-workflow/dv-workflow#readme",
|
|
90
|
+
"bugs": {
|
|
91
|
+
"url": "https://github.com/dv-workflow/dv-workflow/issues"
|
|
92
|
+
},
|
|
90
93
|
"dependencies": {
|
|
91
94
|
"ajv": "^8.18.0",
|
|
92
95
|
"chalk": "^5.6.2",
|
package/src/cli.mjs
CHANGED
|
@@ -219,6 +219,69 @@ export function run(argv) {
|
|
|
219
219
|
await decisionIndexCommand(opts);
|
|
220
220
|
});
|
|
221
221
|
|
|
222
|
+
const trustCmd = program
|
|
223
|
+
.command('trust')
|
|
224
|
+
.description('Trust Mode (ADR-0022): opt-in auto-approval for dw:flow convenience gates — Guards + Critical never relaxed');
|
|
225
|
+
|
|
226
|
+
trustCmd
|
|
227
|
+
.command('status')
|
|
228
|
+
.description('Show resolved Trust Mode state for this project')
|
|
229
|
+
.action(async () => {
|
|
230
|
+
const { trustStatusCommand } = await import('./commands/trust.mjs');
|
|
231
|
+
await trustStatusCommand();
|
|
232
|
+
});
|
|
233
|
+
|
|
234
|
+
trustCmd
|
|
235
|
+
.command('gate <name>')
|
|
236
|
+
.description('Deterministic gate decision (scope|plan|changes|arch). Exit 0 = auto-approve, 10 = manual stop')
|
|
237
|
+
.option('--trust <gates>', 'One-shot trust for this call: true | comma-separated gate ids')
|
|
238
|
+
.option('--critical', 'A Critical review finding exists (forces GATE D manual)')
|
|
239
|
+
.option('--task <name>', 'Task the gate belongs to (recorded in the audit event)')
|
|
240
|
+
.option('--evidence <json>', 'EVD verify: JSON basis, e.g. {"tests":{"exit":0},"review":{"critical":0}}')
|
|
241
|
+
.option('--run-count <n>', 'Auto-approvals so far this run (enforces workflow.trust.max_auto_subtasks)')
|
|
242
|
+
.action(async (name, opts) => {
|
|
243
|
+
const { trustGateCommand } = await import('./commands/trust.mjs');
|
|
244
|
+
await trustGateCommand(name, opts);
|
|
245
|
+
});
|
|
246
|
+
|
|
247
|
+
const autopilotCmd = program
|
|
248
|
+
.command('autopilot')
|
|
249
|
+
.description('Overnight Autopilot contract (ADR-0023): preflight (INPUT) + postflight (OUTPUT) assertions');
|
|
250
|
+
|
|
251
|
+
autopilotCmd
|
|
252
|
+
.command('preflight')
|
|
253
|
+
.description('Assert it is safe to START an unattended run (clean tree · budget · trust bounded · tests · goal). Exit 0 = clear, 1 = blocked')
|
|
254
|
+
.option('--goal <id>', 'Goal id the run will pursue')
|
|
255
|
+
.option('--max-iter <n>', 'Iteration budget for this run')
|
|
256
|
+
.action(async (opts) => {
|
|
257
|
+
const { autopilotPreflightCommand } = await import('./commands/autopilot.mjs');
|
|
258
|
+
await autopilotPreflightCommand(opts);
|
|
259
|
+
});
|
|
260
|
+
|
|
261
|
+
autopilotCmd
|
|
262
|
+
.command('postflight')
|
|
263
|
+
.description('Assert the run ended in a safe, reviewable state (digest written · wrap-up · local-only). Exit 0 = clean, 1 = unsafe')
|
|
264
|
+
.option('--require-wrapup', 'Treat a missing overnight_wrapup event as a blocking failure')
|
|
265
|
+
.action(async (opts) => {
|
|
266
|
+
const { autopilotPostflightCommand } = await import('./commands/autopilot.mjs');
|
|
267
|
+
await autopilotPostflightCommand(opts);
|
|
268
|
+
});
|
|
269
|
+
|
|
270
|
+
const overnightCmd = program
|
|
271
|
+
.command('overnight')
|
|
272
|
+
.description('Overnight Autopilot (ADR-0023): morning-review digest for unattended runs');
|
|
273
|
+
|
|
274
|
+
overnightCmd
|
|
275
|
+
.command('digest')
|
|
276
|
+
.description('Render OVERNIGHT.md from recent .dw/events-global.jsonl run events')
|
|
277
|
+
.option('--stdout', 'Print to stdout instead of writing OVERNIGHT.md')
|
|
278
|
+
.option('--limit <n>', 'How many recent events to scan (default 500)')
|
|
279
|
+
.option('--goal <id>', 'Goal id/title the run pursued (for the header)')
|
|
280
|
+
.action(async (opts) => {
|
|
281
|
+
const { overnightDigestCommand } = await import('./commands/overnight.mjs');
|
|
282
|
+
await overnightDigestCommand(opts);
|
|
283
|
+
});
|
|
284
|
+
|
|
222
285
|
const agentCmd = program
|
|
223
286
|
.command('agent')
|
|
224
287
|
.description('Agent OS multi-agent orchestration (ADR-0009): claim · release · renew · expire · claims · reports · conflicts · check-staged · verify');
|