gentyr 1.3.0

package/cli/commands/protect.js

@@ -0,0 +1,271 @@
+/**
+ * gentyr protect / gentyr unprotect - Enable/disable root-owned file protection
+ *
+ * @module commands/protect
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { resolveFrameworkDir, detectInstallModel } from '../lib/resolve-framework.js';
+
+/** Validate a username/group to prevent command injection. */
+const SAFE_NAME_RE = /^[a-zA-Z0-9._-]{1,64}$/;
+function assertSafeName(name, label) {
+  if (!SAFE_NAME_RE.test(name)) {
+    throw new Error(`Invalid ${label}: "${name}"`);
+  }
+}
+
+const RED = '\x1b[0;31m';
+const GREEN = '\x1b[0;32m';
+const YELLOW = '\x1b[1;33m';
+const NC = '\x1b[0m';
+
+/**
+ * Get the resolved hooks directory (follows symlinks).
+ * @param {string} projectDir
+ * @returns {string}
+ */
+function getHooksDir(projectDir) {
+  const hooksPath = path.join(projectDir, '.claude', 'hooks');
+  try {
+    if (fs.lstatSync(hooksPath).isSymbolicLink()) {
+      return fs.realpathSync(hooksPath);
+    }
+  } catch {}
+  return hooksPath;
+}
+
+/**
+ * Get the original (non-root) user when running under sudo.
+ * @returns {string}
+ */
+function getOriginalUser() {
+  const user = process.env.SUDO_USER || process.env.USER || 'unknown';
+  assertSafeName(user, 'username');
+  return user;
+}
+
+/**
+ * Get the original user's group.
+ * @returns {string}
+ */
+function getOriginalGroup() {
+  const user = getOriginalUser();
+  try {
+    const group = execFileSync('id', ['-gn', user], { encoding: 'utf8', stdio: 'pipe' }).trim();
+    assertSafeName(group, 'group');
+    return group;
+  } catch {
+    return process.platform === 'darwin' ? 'staff' : user;
+  }
+}
+
+/**
+ * Apply root-owned protection to critical files.
+ * @param {string} projectDir
+ */
+function doProtect(projectDir) {
+  if (process.getuid() !== 0) {
+    console.error(`${RED}Error: protection requires sudo${NC}`);
+    console.error(`Usage: sudo npx gentyr protect`);
+    process.exit(1);
+  }
+
+  const hooksDir = getHooksDir(projectDir);
+  const rootGroup = process.platform === 'darwin' ? 'wheel' : 'root';
+
+  console.log(`${YELLOW}Enabling protection...${NC}`);
+
+  const files = [
+    path.join(hooksDir, 'pre-commit-review.js'),
+    path.join(hooksDir, 'bypass-approval-hook.js'),
+    path.join(hooksDir, 'block-no-verify.js'),
+    path.join(hooksDir, 'protected-action-gate.js'),
+    path.join(hooksDir, 'protected-action-approval-hook.js'),
+    path.join(hooksDir, 'credential-file-guard.js'),
+    path.join(hooksDir, 'secret-leak-detector.js'),
+    path.join(hooksDir, 'protected-actions.json'),
+    path.join(projectDir, '.claude', 'settings.json'),
+    path.join(projectDir, '.claude', 'protection-key'),
+    path.join(projectDir, '.mcp.json'),
+    path.join(projectDir, '.claude', 'config', 'services.json'),
+    path.join(projectDir, 'eslint.config.js'),
+    path.join(projectDir, '.husky', 'pre-commit'),
+    path.join(projectDir, 'package.json'),
+  ];
+
+  const dirs = [
+    path.join(projectDir, '.husky'),
+    path.join(projectDir, '.claude'),
+    hooksDir,
+  ];
+
+  for (const dir of dirs) {
+    if (fs.existsSync(dir)) {
+      execFileSync('chown', [`root:${rootGroup}`, dir], { stdio: 'pipe' });
+      execFileSync('chmod', ['1755', dir], { stdio: 'pipe' });
+      console.log(`  Protected dir: ${dir}`);
+    }
+  }
+
+  for (const file of files) {
+    if (fs.existsSync(file)) {
+      execFileSync('chown', [`root:${rootGroup}`, file], { stdio: 'pipe' });
+      if (file.includes('.husky/')) {
+        execFileSync('chmod', ['755', file], { stdio: 'pipe' });
+      } else {
+        execFileSync('chmod', ['644', file], { stdio: 'pipe' });
+      }
+      console.log(`  Protected: ${file}`);
+    }
+  }
+
+  // Write state
+  const stateFile = path.join(projectDir, '.claude', 'protection-state.json');
+  fs.writeFileSync(stateFile, JSON.stringify({
+    protected: true,
+    timestamp: new Date().toISOString(),
+    modified_by: getOriginalUser(),
+  }, null, 2) + '\n');
+  execFileSync('chmod', ['644', stateFile], { stdio: 'pipe' });
+
+  console.log(`${GREEN}Protection enabled. Agents cannot modify critical files.${NC}`);
+}
+
+/**
+ * Disable root-owned protection.
+ * @param {string} projectDir
+ */
+function doUnprotect(projectDir) {
+  if (process.getuid() !== 0) {
+    console.error(`${RED}Error: unprotection requires sudo${NC}`);
+    console.error(`Usage: sudo npx gentyr unprotect`);
+    process.exit(1);
+  }
+
+  const hooksDir = getHooksDir(projectDir);
+  const originalUser = getOriginalUser();
+  const originalGroup = getOriginalGroup();
+
+  console.log(`${YELLOW}Disabling protection...${NC}`);
+
+  const files = [
+    path.join(hooksDir, 'pre-commit-review.js'),
+    path.join(hooksDir, 'bypass-approval-hook.js'),
+    path.join(hooksDir, 'block-no-verify.js'),
+    path.join(hooksDir, 'protected-action-gate.js'),
+    path.join(hooksDir, 'protected-action-approval-hook.js'),
+    path.join(hooksDir, 'credential-file-guard.js'),
+    path.join(hooksDir, 'secret-leak-detector.js'),
+    path.join(hooksDir, 'protected-actions.json'),
+    path.join(projectDir, '.claude', 'settings.json'),
+    path.join(projectDir, '.claude', 'TESTING.md'),
+    path.join(projectDir, '.claude', 'protection-key'),
+    path.join(projectDir, 'eslint.config.js'),
+    path.join(projectDir, '.husky', 'pre-commit'),
+    path.join(projectDir, '.husky', 'post-commit'),
+    path.join(projectDir, '.husky', 'pre-push'),
+    path.join(projectDir, '.mcp.json'),
+    path.join(projectDir, 'package.json'),
+  ];
+
+  const dirs = [
+    path.join(projectDir, '.husky'),
+    path.join(projectDir, '.claude'),
+    hooksDir,
+  ];
+
+  const ownership = `${originalUser}:${originalGroup}`;
+
+  for (const file of files) {
+    if (fs.existsSync(file)) {
+      execFileSync('chown', [ownership, file], { stdio: 'pipe' });
+      execFileSync('chmod', ['644', file], { stdio: 'pipe' });
+      console.log(`  Unprotected: ${file}`);
+    }
+  }
+
+  for (const dir of dirs) {
+    if (fs.existsSync(dir)) {
+      execFileSync('chown', [ownership, dir], { stdio: 'pipe' });
+      execFileSync('chmod', ['755', dir], { stdio: 'pipe' });
+      console.log(`  Unprotected dir: ${dir}`);
+    }
+  }
+
+  // Bulk-fix remaining root-owned files
+  const fixDirs = [
+    [path.join(projectDir, '.husky'), 1],
+    [path.join(projectDir, '.claude'), 1],
+    [path.join(projectDir, '.claude', 'state'), 1],
+  ];
+  for (const [dir, depth] of fixDirs) {
+    if (fs.existsSync(dir)) {
+      try {
+        execFileSync('find', [dir, '-maxdepth', String(depth), '-type', 'f', '-user', 'root', '-exec', 'chown', ownership, '{}', ';'], { stdio: 'pipe' });
+      } catch {}
+    }
+  }
+
+  // Fix agents directory
+  const agentsDir = path.join(projectDir, '.claude', 'agents');
+  if (fs.existsSync(agentsDir)) {
+    execFileSync('chown', [ownership, agentsDir], { stdio: 'pipe' });
+    execFileSync('chmod', ['755', agentsDir], { stdio: 'pipe' });
+    try {
+      execFileSync('find', [agentsDir, '-maxdepth', '1', '-user', 'root', '-exec', 'chown', '-h', ownership, '{}', ';'], { stdio: 'pipe' });
+    } catch {}
+  }
+
+  // Fix reporters directory
+  const reportersDir = path.join(projectDir, '.claude', 'reporters');
+  if (fs.existsSync(reportersDir)) {
+    execFileSync('chown', [ownership, reportersDir], { stdio: 'pipe' });
+    execFileSync('chmod', ['755', reportersDir], { stdio: 'pipe' });
+    try {
+      execFileSync('find', [reportersDir, '-maxdepth', '1', '-user', 'root', '-exec', 'chown', '-h', ownership, '{}', ';'], { stdio: 'pipe' });
+    } catch {}
+  }
+
+  // Fix framework build directories
+  const frameworkDir = resolveFrameworkDir(projectDir);
+  if (frameworkDir) {
+    for (const subdir of ['packages/mcp-servers/dist', 'packages/mcp-servers/node_modules', 'node_modules']) {
+      const dir = path.join(frameworkDir, subdir);
+      if (fs.existsSync(dir)) {
+        execFileSync('chown', ['-R', ownership, dir], { stdio: 'pipe' });
+        console.log(`  Unprotected dir: ${dir}`);
+      }
+    }
+  }
+
+  // Write state
+  fs.writeFileSync(path.join(projectDir, '.claude', 'protection-state.json'), JSON.stringify({
+    protected: false,
+    timestamp: new Date().toISOString(),
+    modified_by: originalUser,
+  }, null, 2) + '\n');
+
+  console.log(`${GREEN}Protection disabled.${NC}`);
+}
+
+export default async function protect(args) {
+  const projectDir = process.cwd();
+
+  const model = detectInstallModel(projectDir);
+  if (!model) {
+    console.error(`${RED}Error: GENTYR not found in this project.${NC}`);
+    process.exit(1);
+  }
+
+  // Check for --mode unprotect (set by CLI dispatcher for 'gentyr unprotect')
+  const isUnprotect = args.includes('--mode') && args[args.indexOf('--mode') + 1] === 'unprotect';
+
+  if (isUnprotect) {
+    doUnprotect(projectDir);
+  } else {
+    doProtect(projectDir);
+  }
+}

package/cli/commands/scaffold.js

@@ -0,0 +1,48 @@
+/**
+ * gentyr scaffold - Scaffold a new project
+ *
+ * Wraps the existing scaffold logic from setup.sh.
+ * Usage: npx gentyr scaffold --path /path/to/new-project
+ *
+ * @module commands/scaffold
+ */
+
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const RED = '\x1b[0;31m';
+const NC = '\x1b[0m';
+
+export default async function scaffold(args) {
+  // Delegate to setup.sh --scaffold for now since it has interactive prompts
+  // that are complex to replicate in Node.js
+  const frameworkDir = path.resolve(__dirname, '..', '..');
+  const setupScript = path.join(frameworkDir, 'scripts', 'setup.sh');
+
+  // Build args for setup.sh
+  const setupArgs = ['--scaffold'];
+
+  // Forward --path argument
+  const pathIdx = args.indexOf('--path');
+  if (pathIdx !== -1 && args[pathIdx + 1]) {
+    setupArgs.push('--path', args[pathIdx + 1]);
+  } else if (args.length > 0 && !args[0].startsWith('-')) {
+    // Allow: npx gentyr scaffold /path/to/project
+    setupArgs.push('--path', args[0]);
+  } else {
+    console.error(`${RED}Error: --path is required${NC}`);
+    console.error('Usage: npx gentyr scaffold --path /path/to/new-project');
+    process.exit(1);
+  }
+
+  try {
+    execFileSync(setupScript, setupArgs, { stdio: 'inherit', timeout: 120000 });
+  } catch (err) {
+    if (err.status) process.exit(err.status);
+    throw err;
+  }
+}

package/cli/commands/status.js

@@ -0,0 +1,133 @@
+/**
+ * gentyr status - Show installation state
+ *
+ * @module commands/status
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveFrameworkDir, resolveFrameworkRelative, detectInstallModel } from '../lib/resolve-framework.js';
+import { readState, readFrameworkVersion, computeConfigHash, computeClaudeMdHash } from '../lib/state.js';
+
+const RED = '\x1b[0;31m';
+const GREEN = '\x1b[0;32m';
+const YELLOW = '\x1b[1;33m';
+const NC = '\x1b[0m';
+
+export default async function status() {
+  const projectDir = process.cwd();
+  const model = detectInstallModel(projectDir);
+
+  console.log('GENTYR Installation Status');
+  console.log('==========================');
+  console.log('');
+
+  if (!model) {
+    console.log(`${RED}Not installed${NC}`);
+    console.log('');
+    console.log('To install:');
+    console.log('  pnpm link ~/git/gentyr');
+    console.log('  npx gentyr init');
+    process.exit(0);
+  }
+
+  const frameworkDir = resolveFrameworkDir(projectDir);
+  const frameworkRel = resolveFrameworkRelative(projectDir);
+  const state = readState(projectDir);
+  const currentVersion = readFrameworkVersion(frameworkDir);
+
+  console.log(`Install model:    ${model === 'npm' ? GREEN + 'npm (node_modules/gentyr)' : YELLOW + 'legacy (.claude-framework)'} ${NC}`);
+  console.log(`Framework path:   ${frameworkDir}`);
+  console.log(`Relative path:    ${frameworkRel}`);
+  console.log(`Current version:  ${currentVersion}`);
+  console.log('');
+
+  if (state) {
+    const synced = state.version === currentVersion;
+    console.log(`Last synced:      ${state.lastSync || 'unknown'}`);
+    console.log(`Synced version:   ${state.version} ${synced ? GREEN + '(up to date)' : RED + '(outdated - run npx gentyr sync)'} ${NC}`);
+
+    // Check config hash
+    const currentHash = computeConfigHash(frameworkDir);
+    const configMatch = state.configHash === currentHash;
+    console.log(`Config hash:      ${configMatch ? GREEN + 'match' : YELLOW + 'differs (run npx gentyr sync)'} ${NC}`);
+
+    // Check CLAUDE.md hash
+    const currentMdHash = computeClaudeMdHash(frameworkDir);
+    const mdMatch = state.claudeMdHash === currentMdHash;
+    console.log(`CLAUDE.md hash:   ${mdMatch ? GREEN + 'match' : YELLOW + 'differs'} ${NC}`);
+
+    console.log(`Agents:           ${state.agentList?.length || 0} framework agents`);
+    console.log(`State version:    ${state.stateFilesVersion}`);
+  } else {
+    console.log(`${YELLOW}No sync state found - run npx gentyr sync${NC}`);
+  }
+
+  // Check protection state
+  console.log('');
+  const protectionState = path.join(projectDir, '.claude', 'protection-state.json');
+  try {
+    const ps = JSON.parse(fs.readFileSync(protectionState, 'utf8'));
+    const isProtected = ps.protected === true;
+    console.log(`Protection:       ${isProtected ? GREEN + 'enabled' : 'disabled'} ${NC}`);
+    if (ps.timestamp) console.log(`Last changed:     ${ps.timestamp}`);
+    if (ps.modified_by) console.log(`Modified by:      ${ps.modified_by}`);
+  } catch {
+    console.log('Protection:       unknown');
+  }
+
+  // Check symlinks
+  console.log('');
+  console.log('Symlinks:');
+  for (const name of ['commands', 'hooks', 'mcp', 'docs']) {
+    const linkPath = path.join(projectDir, '.claude', name);
+    try {
+      const stat = fs.lstatSync(linkPath);
+      if (stat.isSymbolicLink()) {
+        const target = fs.readlinkSync(linkPath);
+        console.log(`  .claude/${name} -> ${target} ${GREEN}OK${NC}`);
+      } else {
+        console.log(`  .claude/${name} ${YELLOW}(real directory, not symlink)${NC}`);
+      }
+    } catch {
+      console.log(`  .claude/${name} ${RED}MISSING${NC}`);
+    }
+  }
+
+  // Check MCP servers dist
+  console.log('');
+  const distDir = path.join(frameworkDir, 'packages', 'mcp-servers', 'dist');
+  if (fs.existsSync(distDir)) {
+    const srcDir = path.join(frameworkDir, 'packages', 'mcp-servers', 'src');
+    try {
+      const srcMtime = getNewestMtime(srcDir);
+      const distMtime = getNewestMtime(distDir);
+      const stale = srcMtime > distMtime;
+      console.log(`MCP servers:      ${stale ? YELLOW + 'stale (run npx gentyr sync)' : GREEN + 'up to date'} ${NC}`);
+    } catch {
+      console.log(`MCP servers:      ${GREEN}built${NC}`);
+    }
+  } else {
+    console.log(`MCP servers:      ${RED}not built (run npx gentyr sync)${NC}`);
+  }
+}
+
+/**
+ * Get the newest mtime in a directory (recursive).
+ * @param {string} dir
+ * @returns {number}
+ */
+function getNewestMtime(dir) {
+  let newest = 0;
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name === 'node_modules') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      newest = Math.max(newest, getNewestMtime(full));
+    } else {
+      newest = Math.max(newest, fs.statSync(full).mtimeMs);
+    }
+  }
+  return newest;
+}

package/cli/commands/sync.js

@@ -0,0 +1,101 @@
+/**
+ * gentyr sync - Force sync (rebuild MCP servers + re-merge configs)
+ *
+ * @module commands/sync
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { resolveFrameworkDir, resolveFrameworkRelative, detectInstallModel } from '../lib/resolve-framework.js';
+import { generateMcpJson, mergeSettings, updateClaudeMd } from '../lib/config-gen.js';
+import { createAgentSymlinks } from '../lib/symlinks.js';
+import { buildState, writeState, getFrameworkAgents } from '../lib/state.js';
+
+const RED = '\x1b[0;31m';
+const GREEN = '\x1b[0;32m';
+const YELLOW = '\x1b[1;33m';
+const NC = '\x1b[0m';
+
+export default async function sync(args) {
+  const projectDir = process.cwd();
+
+  const model = detectInstallModel(projectDir);
+  if (!model) {
+    console.error(`${RED}Error: GENTYR not found in this project.${NC}`);
+    console.error('Run `npx gentyr init` first.');
+    process.exit(1);
+  }
+
+  const frameworkDir = resolveFrameworkDir(projectDir);
+  const frameworkRel = resolveFrameworkRelative(projectDir);
+  const agents = getFrameworkAgents(frameworkDir);
+
+  console.log(`${GREEN}Syncing GENTYR...${NC}`);
+
+  // 1. Re-merge settings.json
+  console.log(`\n${YELLOW}Merging settings.json...${NC}`);
+  mergeSettings(projectDir, frameworkDir);
+
+  // 2. Regenerate .mcp.json
+  console.log(`\n${YELLOW}Regenerating .mcp.json...${NC}`);
+  generateMcpJson(projectDir, frameworkDir, frameworkRel);
+
+  // 3. Update CLAUDE.md
+  console.log(`\n${YELLOW}Updating CLAUDE.md...${NC}`);
+  updateClaudeMd(projectDir, frameworkDir);
+
+  // 4. Sync agent symlinks
+  console.log(`\n${YELLOW}Syncing agent symlinks...${NC}`);
+  createAgentSymlinks(projectDir, frameworkRel, agents);
+
+  // 5. Sync husky hooks
+  console.log(`\n${YELLOW}Syncing husky hooks...${NC}`);
+  const huskyDir = path.join(frameworkDir, 'husky');
+  const projectHuskyDir = path.join(projectDir, '.husky');
+  if (fs.existsSync(huskyDir) && fs.existsSync(projectHuskyDir)) {
+    for (const hook of fs.readdirSync(huskyDir)) {
+      const src = path.join(huskyDir, hook);
+      const dst = path.join(projectHuskyDir, hook);
+      try {
+        fs.copyFileSync(src, dst);
+        fs.chmodSync(dst, 0o755);
+        console.log(`  Synced: .husky/${hook}`);
+      } catch {
+        console.log(`  ${YELLOW}Skipped .husky/${hook} (not writable)${NC}`);
+      }
+    }
+  }
+
+  // 6. Rebuild MCP servers
+  console.log(`\n${YELLOW}Rebuilding MCP servers...${NC}`);
+  const mcpDir = path.join(frameworkDir, 'packages', 'mcp-servers');
+  try {
+    execFileSync('npm', ['install', '--no-fund', '--no-audit'], { cwd: mcpDir, stdio: 'pipe', timeout: 120000 });
+    console.log('  Dependencies installed');
+    execFileSync('npm', ['run', 'build'], { cwd: mcpDir, stdio: 'pipe', timeout: 120000 });
+    console.log('  TypeScript built');
+  } catch (err) {
+    console.log(`  ${YELLOW}Warning: MCP server build failed: ${err.message}${NC}`);
+  }
+
+  // 7. Regenerate launchd plists (macOS only)
+  if (process.platform === 'darwin') {
+    const script = path.join(frameworkDir, 'scripts', 'setup-automation-service.sh');
+    if (fs.existsSync(script)) {
+      console.log(`\n${YELLOW}Updating automation services...${NC}`);
+      try {
+        execFileSync(script, ['setup', '--path', projectDir], { stdio: 'inherit', timeout: 60000 });
+      } catch {
+        console.log(`  ${YELLOW}Automation service update failed (non-fatal)${NC}`);
+      }
+    }
+  }
+
+  // 8. Write state
+  const state = buildState(frameworkDir, model);
+  writeState(projectDir, state);
+
+  console.log('');
+  console.log(`${GREEN}Sync complete (v${state.version})${NC}`);
+}