hub-launch 1.16.0 → 1.18.0

package/dist/templates/scripts/hula-schedule-manage.sh

@@ -1,159 +0,0 @@
-#!/usr/bin/env bash
-# hula-schedule-manage.sh — management surface for the /hula-schedule skill
-# Usage (exactly one action per call):
-#   bash .github/scripts/hula-schedule-manage.sh --list
-#   bash .github/scripts/hula-schedule-manage.sh --list-schedules
-#   bash .github/scripts/hula-schedule-manage.sh --show <runId>
-#   bash .github/scripts/hula-schedule-manage.sh --run-now <scheduleId>
-#   bash .github/scripts/hula-schedule-manage.sh --cancel-schedule <scheduleId>
-#   bash .github/scripts/hula-schedule-manage.sh --publish-skill <repo-relative-path>
-#   bash .github/scripts/hula-schedule-manage.sh --delete-skill <repo-relative-path>
-#
-# Each invocation maps to the corresponding `hula schedule …` call, captures its
-# output, and emits a single structured JSON object to stdout; all other output
-# goes to stderr.
-#
-# JSON contract (stdout):
-#   read verbs    : {"status":"success","kind":"list|list-schedules|show","cliOutput":"…"}
-#   run-now       : {"status":"success","kind":"run-now","runId":"…","cliOutput":"…"}
-#   cancel        : {"status":"success","kind":"cancel-schedule","scheduleId":"…","cliOutput":"…"}
-#   publish-skill : {"status":"success","kind":"publish-skill","path":"…","cliOutput":"…"}
-#   delete-skill  : {"status":"success","kind":"delete-skill","path":"…","cliOutput":"…"}
-#   failure       : {"status":"error","code":<n>,"message":"…"}
-#
-# Exit codes: 0=success, 1=user error, 2=tool error
-#
-# Security: never prints secrets. Credentials are resolved inside the CLI from
-# flags/config/env — they are NOT passed by this script. --publish-skill and
-# --delete-skill reject path traversal and require a .hublaunch/skills/ path.
-
-set -euo pipefail
-
-# ── helpers ────────────────────────────────────────────────────────────────────
-
-json_escape() {
-  if command -v jq &>/dev/null; then
-    # jq -Rs . reads stdin as a raw string and outputs a JSON string (with surrounding quotes).
-    # Strip the surrounding quotes; the escaped content is safe to embed in JSON.
-    printf '%s' "$1" | jq -Rs . | sed 's/^"//;s/"$//'
-  else
-    # Fallback: escape backslashes and double quotes, collapse control chars to spaces
-    printf '%s' "$1" \
-      | sed 's/\\/\\\\/g; s/"/\\"/g' \
-      | tr '\n\r\t' '   '
-  fi
-}
-
-die() {
-  local code="$1"; shift
-  local safe_msg
-  safe_msg=$(json_escape "$*")
-  printf '{"status":"error","code":%d,"message":"%s"}\n' "$code" "$safe_msg" >&1
-  exit "$code"
-}
-
-# Validate a skill path: must be repo-relative, under .hublaunch/skills/, no traversal.
-validate_skill_path() {
-  local p="$1"
-  case "$p" in
-    /*) die 1 "Skill path must be repo-relative, not absolute: ${p}" ;;
-  esac
-  if printf '%s' "$p" | grep -q '\.\.'; then
-    die 1 "Invalid skill path (path traversal not allowed): ${p}"
-  fi
-  case "$p" in
-    .hublaunch/skills/*) : ;;
-    *) die 1 "Skill path must be under .hublaunch/skills/ — got ${p}" ;;
-  esac
-}
-
-# ── argument parsing ────────────────────────────────────────────────────────────
-# Exactly one action flag is allowed per call.
-
-ACTION=''
-ARG=''
-
-set_action() {
-  if [[ -n "$ACTION" ]]; then
-    die 1 "Provide exactly one action (got --$ACTION and $1)."
-  fi
-  ACTION="$1"
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --list)                   set_action 'list'; shift ;;
-    --list-schedules)         set_action 'list-schedules'; shift ;;
-    --show)                   set_action 'show'; ARG="$2"; shift 2 ;;
-    --show=*)                 set_action 'show'; ARG="${1#--show=}"; shift ;;
-    --run-now)                set_action 'run-now'; ARG="$2"; shift 2 ;;
-    --run-now=*)              set_action 'run-now'; ARG="${1#--run-now=}"; shift ;;
-    --cancel-schedule)        set_action 'cancel-schedule'; ARG="$2"; shift 2 ;;
-    --cancel-schedule=*)      set_action 'cancel-schedule'; ARG="${1#--cancel-schedule=}"; shift ;;
-    --publish-skill)          set_action 'publish-skill'; ARG="$2"; shift 2 ;;
-    --publish-skill=*)        set_action 'publish-skill'; ARG="${1#--publish-skill=}"; shift ;;
-    --delete-skill)           set_action 'delete-skill'; ARG="$2"; shift 2 ;;
-    --delete-skill=*)         set_action 'delete-skill'; ARG="${1#--delete-skill=}"; shift ;;
-    *)                        die 1 "Unexpected argument: $1" ;;
-  esac
-done
-
-if [[ -z "$ACTION" ]]; then
-  die 1 "Usage: bash .github/scripts/hula-schedule-manage.sh (--list | --list-schedules | --show <id> | --run-now <id> | --cancel-schedule <id> | --publish-skill <path> | --delete-skill <path>)"
-fi
-
-# Actions that require an argument.
-case "$ACTION" in
-  show|run-now|cancel-schedule|publish-skill|delete-skill)
-    [[ -n "$ARG" ]] || die 1 "--$ACTION requires an argument." ;;
-esac
-
-# Path validation for skill file actions.
-case "$ACTION" in
-  publish-skill|delete-skill) validate_skill_path "$ARG" ;;
-esac
-
-# ── Build and run the hula schedule invocation ────────────────────────────────
-
-CLI_ARGS=()
-case "$ACTION" in
-  list)            CLI_ARGS=(--list) ;;
-  list-schedules)  CLI_ARGS=(--list-schedules) ;;
-  show)            CLI_ARGS=(--show "$ARG") ;;
-  run-now)         CLI_ARGS=(--run-now "$ARG") ;;
-  cancel-schedule) CLI_ARGS=(--cancel-schedule "$ARG") ;;
-  publish-skill)   CLI_ARGS=(--publish-skill "$ARG") ;;
-  delete-skill)    CLI_ARGS=(--delete-skill "$ARG") ;;
-esac
-
-printf '⚙️  hula schedule --%s...\n' "$ACTION" >&2
-
-OUTPUT=$(hula schedule "${CLI_ARGS[@]}" 2>&1) || die 2 "Management action failed: $OUTPUT"
-
-SAFE_OUTPUT=$(json_escape "$OUTPUT")
-
-# ── Emit the structured JSON result ──────────────────────────────────────────
-
-case "$ACTION" in
-  list|list-schedules|show)
-    printf '{"status":"success","kind":"%s","cliOutput":"%s"}\n' \
-      "$ACTION" "$SAFE_OUTPUT"
-    ;;
-  run-now)
-    # The CLI prints "  ID:        <id>" for the new run.
-    RUN_ID=$(printf '%s' "$OUTPUT" | grep -E '^\s*ID:' | head -1 | sed -E 's/^\s*ID:\s*//') || true
-    SAFE_ID=$(json_escape "$RUN_ID")
-    printf '{"status":"success","kind":"run-now","runId":"%s","cliOutput":"%s"}\n' \
-      "$SAFE_ID" "$SAFE_OUTPUT"
-    ;;
-  cancel-schedule)
-    SAFE_ID=$(json_escape "$ARG")
-    printf '{"status":"success","kind":"cancel-schedule","scheduleId":"%s","cliOutput":"%s"}\n' \
-      "$SAFE_ID" "$SAFE_OUTPUT"
-    ;;
-  publish-skill|delete-skill)
-    SAFE_PATH=$(json_escape "$ARG")
-    printf '{"status":"success","kind":"%s","path":"%s","cliOutput":"%s"}\n' \
-      "$ACTION" "$SAFE_PATH" "$SAFE_OUTPUT"
-    ;;
-esac

package/dist/templates/scripts/hula-schedule-run.sh

@@ -1,148 +0,0 @@
-#!/usr/bin/env bash
-# hula-schedule-run.sh — runs the hula schedule workflow for the /hula-schedule skill
-# Usage:
-#   bash .github/scripts/hula-schedule-run.sh \
-#     (--built-in <name> | --action-path <path>) \
-#     [--entry-point <path>] [--outcome-type <pr|plan|feedback>] [--schedule "<cron>"] \
-#     [--pr-policy <always|skip-if-open|close-previous>] [--update-notification-url <url>]
-#
-# Performs: hula schedule (one-off run, or a recurring schedule when --schedule is given).
-# Outputs a single structured JSON object to stdout; all other output goes to stderr.
-#
-# JSON contract (stdout):
-#   one-off run : {"status":"success","kind":"run","runId":"…","prUrl":"…","cliOutput":"…"}
-#   schedule    : {"status":"success","kind":"schedule","scheduleId":"…","cronExpr":"…","cliOutput":"…"}
-#   failure     : {"status":"error","code":<n>,"message":"…"}
-#
-# Exit codes: 0=success, 1=user error, 2=tool error
-#
-# Security: never prints secrets. Credentials are resolved inside the CLI from
-# flags/config/env — they are NOT passed by this script.
-
-set -euo pipefail
-
-# ── helpers ────────────────────────────────────────────────────────────────────
-
-json_escape() {
-  if command -v jq &>/dev/null; then
-    # jq -Rs . reads stdin as a raw string and outputs a JSON string (with surrounding quotes).
-    # Strip the surrounding quotes; the escaped content is safe to embed in JSON.
-    printf '%s' "$1" | jq -Rs . | sed 's/^"//;s/"$//'
-  else
-    # Fallback: escape backslashes and double quotes, collapse control chars to spaces
-    printf '%s' "$1" \
-      | sed 's/\\/\\\\/g; s/"/\\"/g' \
-      | tr '\n\r\t' '   '
-  fi
-}
-
-die() {
-  local code="$1"; shift
-  local safe_msg
-  safe_msg=$(json_escape "$*")
-  printf '{"status":"error","code":%d,"message":"%s"}\n' "$code" "$safe_msg" >&1
-  exit "$code"
-}
-
-# ── argument parsing ────────────────────────────────────────────────────────────
-
-BUILT_IN=''
-ACTION_PATH=''
-ENTRY_POINT=''
-OUTCOME_TYPE=''
-SCHEDULE=''
-PR_POLICY=''
-UPDATE_NOTIFICATION_URL=''
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --built-in)        BUILT_IN="$2"; shift 2 ;;
-    --built-in=*)      BUILT_IN="${1#--built-in=}"; shift ;;
-    --action-path)     ACTION_PATH="$2"; shift 2 ;;
-    --action-path=*)   ACTION_PATH="${1#--action-path=}"; shift ;;
-    --entry-point)     ENTRY_POINT="$2"; shift 2 ;;
-    --entry-point=*)   ENTRY_POINT="${1#--entry-point=}"; shift ;;
-    --outcome-type)    OUTCOME_TYPE="$2"; shift 2 ;;
-    --outcome-type=*)  OUTCOME_TYPE="${1#--outcome-type=}"; shift ;;
-    --schedule)        SCHEDULE="$2"; shift 2 ;;
-    --schedule=*)      SCHEDULE="${1#--schedule=}"; shift ;;
-    --pr-policy)       PR_POLICY="$2"; shift 2 ;;
-    --pr-policy=*)     PR_POLICY="${1#--pr-policy=}"; shift ;;
-    --update-notification-url)     UPDATE_NOTIFICATION_URL="$2"; shift 2 ;;
-    --update-notification-url=*)   UPDATE_NOTIFICATION_URL="${1#--update-notification-url=}"; shift ;;
-    *)                 die 1 "Unexpected argument: $1" ;;
-  esac
-done
-
-# Exactly one of --built-in / --action-path is required.
-if [[ -n "$BUILT_IN" && -n "$ACTION_PATH" ]]; then
-  die 1 "Provide either --built-in or --action-path, not both."
-fi
-if [[ -z "$BUILT_IN" && -z "$ACTION_PATH" ]]; then
-  die 1 "Usage: bash .github/scripts/hula-schedule-run.sh (--built-in <name> | --action-path <path>) [--entry-point <path>] [--outcome-type <pr|plan|feedback>] [--schedule \"<cron>\"] [--pr-policy <always|skip-if-open|close-previous>]"
-fi
-
-# Reject directory-traversal in --action-path, except for https:// URLs.
-if [[ -n "$ACTION_PATH" ]] && [[ "$ACTION_PATH" != https://* ]]; then
-  if printf '%s' "$ACTION_PATH" | grep -q '\.\.'; then
-    die 1 "Invalid action path (path traversal not allowed): ${ACTION_PATH}"
-  fi
-fi
-
-# ── Run hula schedule ─────────────────────────────────────────────────────────
-
-ARGS=()
-if [[ -n "$BUILT_IN" ]]; then
-  ARGS+=(--built-in "$BUILT_IN")
-else
-  ARGS+=(--action-path "$ACTION_PATH")
-fi
-[[ -n "$ENTRY_POINT" ]]  && ARGS+=(--entry-point "$ENTRY_POINT")
-[[ -n "$OUTCOME_TYPE" ]] && ARGS+=(--outcome-type "$OUTCOME_TYPE")
-[[ -n "$SCHEDULE" ]]     && ARGS+=(--schedule "$SCHEDULE")
-[[ -n "$PR_POLICY" ]]    && ARGS+=(--pr-policy "$PR_POLICY")
-[[ -n "$UPDATE_NOTIFICATION_URL" ]] && ARGS+=(--update-notification-url "$UPDATE_NOTIFICATION_URL")
-
-if [[ -n "$SCHEDULE" ]]; then
-  printf '⏰ Scheduling action (%s)...\n' "$SCHEDULE" >&2
-else
-  printf '🚀 Running action...\n' >&2
-fi
-
-OUTPUT=$(hula schedule "${ARGS[@]}" 2>&1) || die 2 "Execute failed: $OUTPUT"
-
-# ── Parse identifiers from the human-readable CLI output ─────────────────────
-# Parsing is intentionally tolerant: a missing identifier becomes an empty
-# string and we still report success, falling back to the raw cliOutput.
-
-# Distinguish a schedule from a one-off run by the CLI's success banner.
-if printf '%s' "$OUTPUT" | grep -q 'Schedule created successfully'; then
-  KIND='schedule'
-elif printf '%s' "$OUTPUT" | grep -q 'Execute action queued successfully'; then
-  KIND='run'
-elif [[ -n "$SCHEDULE" ]]; then
-  KIND='schedule'
-else
-  KIND='run'
-fi
-
-# The CLI prints "  ID:        <id>" for the run/schedule identifier.
-PARSED_ID=$(printf '%s' "$OUTPUT" | grep -E '^\s*ID:' | head -1 | sed -E 's/^\s*ID:\s*//') || true
-SAFE_OUTPUT=$(json_escape "$OUTPUT")
-
-if [[ "$KIND" == 'schedule' ]]; then
-  # "  Cron:    <expr>" — fall back to the schedule we sent if the label is absent.
-  CRON_EXPR=$(printf '%s' "$OUTPUT" | grep -E '^\s*Cron:' | head -1 | sed -E 's/^\s*Cron:\s*//') || true
-  [[ -z "$CRON_EXPR" ]] && CRON_EXPR="$SCHEDULE"
-  SAFE_ID=$(json_escape "$PARSED_ID")
-  SAFE_CRON=$(json_escape "$CRON_EXPR")
-  printf '{"status":"success","kind":"schedule","scheduleId":"%s","cronExpr":"%s","cliOutput":"%s"}\n' \
-    "$SAFE_ID" "$SAFE_CRON" "$SAFE_OUTPUT"
-else
-  # "  PR:        <url>"
-  PR_URL=$(printf '%s' "$OUTPUT" | grep -E '^\s*PR:' | head -1 | sed -E 's/^\s*PR:\s*//') || true
-  SAFE_ID=$(json_escape "$PARSED_ID")
-  SAFE_PR=$(json_escape "$PR_URL")
-  printf '{"status":"success","kind":"run","runId":"%s","prUrl":"%s","cliOutput":"%s"}\n' \
-    "$SAFE_ID" "$SAFE_PR" "$SAFE_OUTPUT"
-fi

package/dist/templates/scripts/hula-session-hook.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-# hula-session-hook.sh — Claude Code PreToolUse hook (matcher: Bash).
-#
-# Captures the Claude Code session id of the chat session that runs
-# /hula-launch, so the hula CLI can send it to hula-server as
-# `clientSessionId` (launch-session provenance; hula-server PR #419).
-#
-# Why a hook: bash subprocesses cannot learn the session id any other way —
-# CLAUDE_SESSION_ID is not exported to the Bash tool, and the model does not
-# know its own id. Hooks are the one place Claude Code provides it.
-#
-# Installed to .github/scripts/ and registered under hooks.PreToolUse in the
-# consumer repo's .claude/settings.json by `hula init`. Costs nothing: it is
-# a local shell script (no tokens, no API calls) that no-ops in ~5ms for any
-# Bash call that is not a hula-launch-run.sh invocation.
-#
-# Input (stdin): hook JSON with .session_id, .cwd and .tool_input.command
-# Output: $HOME/.hublaunch-sessions/<repo-dir-name>/<branch>.json
-# Always exits 0 — a capture failure must never block the tool call.
-
-INPUT="$(cat)"
-
-CMD="$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)"
-case "$CMD" in
-  *hula-launch-run.sh*) ;;   # our target — continue
-  *) exit 0 ;;               # any other Bash call — ignore
-esac
-
-SESSION_ID="$(printf '%s' "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)"
-CWD="$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)"
-[ -z "$SESSION_ID" ] && exit 0
-
-# --- extract the branch from the launch command ------------------------------
-# Forms (see hula-launch-run.sh usage):
-#   bash .github/scripts/hula-launch-run.sh <plan-path> <branch> [--handoff u] [--test] [--kill-and-relaunch]
-#   bash .github/scripts/hula-launch-run.sh <branch> --kill        (no new task -> skip)
-AFTER="${CMD#*hula-launch-run.sh}"
-# shellcheck disable=SC2086
-set -- $AFTER
-
-POSITIONAL=()
-KILL_ONLY=false
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --handoff) shift 2 || break ;;
-    --kill) KILL_ONLY=true; shift ;;
-    --test|--kill-and-relaunch) shift ;;
-    --*) shift ;;
-    *) POSITIONAL+=("$1"); shift ;;
-  esac
-done
-
-$KILL_ONLY && exit 0                       # pure kill: no new task launched
-[ "${#POSITIONAL[@]}" -lt 2 ] && exit 0    # need <plan-path> <branch>
-BRANCH="${POSITIONAL[1]}"
-# Keep only filename-safe chars; fold any path separator into '-'.
-BRANCH="$(printf '%s' "$BRANCH" | tr -cd 'A-Za-z0-9._/-' | tr '/' '-')"
-[ -z "$BRANCH" ] && exit 0
-
-REPO_NAME="$(basename "${CWD:-$PWD}")"
-OUT_DIR="$HOME/.hublaunch-sessions/$REPO_NAME"
-mkdir -p "$OUT_DIR"
-
-jq -n --arg sid "$SESSION_ID" --arg branch "$BRANCH" --arg cwd "$CWD" \
-  '{sessionId:$sid, branch:$branch, cwd:$cwd, recordedAt:(now|todate)}' \
-  > "$OUT_DIR/$BRANCH.json" 2>/dev/null
-
-exit 0

package/dist/templates/scripts/hula-verify-gather.sh

@@ -1,135 +0,0 @@
-#!/usr/bin/env bash
-# hula-verify-gather.sh — Steps 2-5 of the hula.verify workflow
-# Usage: bash .github/scripts/hula-verify-gather.sh <issue-number>
-#
-# Fetches issue details, finds associated PR, gathers PR files and diff.
-# Outputs structured JSON to stdout; all other output goes to stderr.
-# Exit codes: 0=success, 1=user error, 2=tool error
-
-set -euo pipefail
-
-# ── helpers ────────────────────────────────────────────────────────────────────
-
-json_escape() {
-  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/$/\\n/g' | tr -d '\n' | sed 's/\\n$//'
-}
-
-die() {
-  local code="$1"; shift
-  local safe_msg
-  safe_msg=$(json_escape "$*")
-  printf '{"status":"error","code":%d,"message":"%s"}\n' "$code" "$safe_msg" >&1
-  exit "$code"
-}
-
-# ── argument parsing ────────────────────────────────────────────────────────────
-
-ISSUE_NUMBER=''
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    [0-9]*)
-      ISSUE_NUMBER="$1"; shift ;;
-    *)
-      die 1 "Unknown argument: $1" ;;
-  esac
-done
-
-if [[ -z "$ISSUE_NUMBER" ]]; then
-  die 1 "Usage: bash .github/scripts/hula-verify-gather.sh <issue-number>"
-fi
-
-# ── Step 2: Fetch issue details ────────────────────────────────────────────────
-
-printf '🔍 Fetching issue #%s...\n' "$ISSUE_NUMBER" >&2
-
-ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" --json title,body,number,url,state 2>/dev/null) \
-  || die 1 "Issue #${ISSUE_NUMBER} not found or not accessible."
-
-ISSUE_TITLE=$(printf '%s' "$ISSUE_JSON" | grep -o '"title":"[^"]*"' | head -1 | sed 's/"title":"//;s/"$//')
-ISSUE_STATE=$(printf '%s' "$ISSUE_JSON" | grep -o '"state":"[^"]*"' | head -1 | sed 's/"state":"//;s/"$//')
-ISSUE_URL=$(printf '%s' "$ISSUE_JSON" | grep -o '"url":"[^"]*"' | head -1 | sed 's/"url":"//;s/"$//')
-
-# ── Step 3: Find associated PR ────────────────────────────────────────────────
-
-printf '🔗 Looking for PR linked to issue #%s...\n' "$ISSUE_NUMBER" >&2
-
-# Try linked search first (works when PR is formally linked via GitHub)
-PR_NUMBER=$(gh pr list --search "linked:${ISSUE_NUMBER}" --json number -q '.[0].number' 2>/dev/null) || true
-
-if [[ -z "$PR_NUMBER" ]]; then
-  # Fallback: search PR bodies for issue references
-  # Handles both short format (#N) and full-path format (owner/repo#N)
-  # Uses gh's built-in jq (-q) — no external jq required
-  JQ_EXPR='.[] | select(.body != null) | select(.body | test("(Fixes|Closes|Resolves)[ ]+([A-Za-z0-9._-]+/[A-Za-z0-9._-]+)?#'"${ISSUE_NUMBER}"'([^0-9]|$)|(^|[^0-9])#'"${ISSUE_NUMBER}"'([^0-9]|$)"; "i")) | .number'
-  PR_NUMBER=$(gh pr list --json number,body --limit 100 -q "$JQ_EXPR" 2>/dev/null | head -1) || true
-fi
-
-if [[ -z "$PR_NUMBER" ]]; then
-  die 1 "No PR found for issue #${ISSUE_NUMBER}. The implementation may not have started yet."
-fi
-
-# Fetch full PR details via pr view (reliable single-object JSON)
-PR_DETAILS=$(gh pr view "$PR_NUMBER" --json number,title,url,state,headRefName,isDraft 2>/dev/null) \
-  || die 2 "Failed to fetch details for PR #${PR_NUMBER}."
-
-PR_TITLE=$(printf '%s' "$PR_DETAILS" | grep -o '"title":"[^"]*"' | head -1 | sed 's/"title":"//;s/"$//')
-PR_URL=$(printf '%s' "$PR_DETAILS" | grep -o '"url":"[^"]*"' | head -1 | sed 's/"url":"//;s/"$//')
-PR_STATE=$(printf '%s' "$PR_DETAILS" | grep -o '"state":"[^"]*"' | head -1 | sed 's/"state":"//;s/"$//')
-PR_BRANCH=$(printf '%s' "$PR_DETAILS" | grep -o '"headRefName":"[^"]*"' | head -1 | sed 's/"headRefName":"//;s/"$//')
-PR_DRAFT=$(printf '%s' "$PR_DETAILS" | grep -o '"isDraft":[a-z]*' | head -1 | sed 's/"isDraft"://')
-
-# ── Step 4: Fetch PR file changes ─────────────────────────────────────────────
-
-printf '📊 Fetching changed files for PR #%s...\n' "$PR_NUMBER" >&2
-
-PR_FILES_JSON=$(gh pr view "$PR_NUMBER" --json files,additions,deletions 2>/dev/null) \
-  || die 2 "Failed to fetch PR files for PR #${PR_NUMBER}."
-
-TOTAL_ADDITIONS=$(printf '%s' "$PR_FILES_JSON" | grep -o '"additions":[0-9]*' | tail -1 | sed 's/"additions"://')
-TOTAL_DELETIONS=$(printf '%s' "$PR_FILES_JSON" | grep -o '"deletions":[0-9]*' | tail -1 | sed 's/"deletions"://')
-
-# Count files by category (rough heuristic)
-FILES_LIST=$(printf '%s' "$PR_FILES_JSON" | grep -o '"path":"[^"]*"' | sed 's/"path":"//;s/"$//')
-
-CODE_COUNT=0
-TEST_COUNT=0
-DOC_COUNT=0
-CONFIG_COUNT=0
-TOTAL_COUNT=0
-
-while IFS= read -r fpath; do
-  [[ -z "$fpath" ]] && continue
-  TOTAL_COUNT=$((TOTAL_COUNT + 1))
-  case "$fpath" in
-    *.test.*|*.spec.*|*/__tests__/*|*/test/*|*/tests/*) TEST_COUNT=$((TEST_COUNT + 1)) ;;
-    *.md|docs/*|README*|CHANGELOG*|DOCUMENTATION*) DOC_COUNT=$((DOC_COUNT + 1)) ;;
-    package.json|package-lock.json|tsconfig*|*.config.*|*.json|*.yaml|*.yml) CONFIG_COUNT=$((CONFIG_COUNT + 1)) ;;
-    *) CODE_COUNT=$((CODE_COUNT + 1)) ;;
-  esac
-done <<< "$FILES_LIST"
-
-# ── Step 5: Fetch PR diff ─────────────────────────────────────────────────────
-
-printf '📄 Fetching PR diff...\n' >&2
-
-DIFF_FILE="/tmp/hula-verify-diff-${PR_NUMBER}.patch"
-gh pr diff "$PR_NUMBER" > "$DIFF_FILE" 2>/dev/null \
-  || printf '⚠️  Could not fetch PR diff (PR may be too large or not accessible)\n' >&2
-
-# ── Output result ─────────────────────────────────────────────────────────────
-
-SAFE_ISSUE_TITLE=$(json_escape "$ISSUE_TITLE")
-SAFE_PR_TITLE=$(json_escape "$PR_TITLE")
-SAFE_PR_URL=$(json_escape "$PR_URL")
-SAFE_ISSUE_URL=$(json_escape "$ISSUE_URL")
-SAFE_PR_BRANCH=$(json_escape "$PR_BRANCH")
-SAFE_DIFF_FILE=$(json_escape "$DIFF_FILE")
-PR_DRAFT_VAL="${PR_DRAFT:-false}"
-
-printf '{"status":"success","issueNumber":%s,"issueTitle":"%s","issueState":"%s","issueUrl":"%s","prNumber":%s,"prTitle":"%s","prUrl":"%s","prState":"%s","prBranch":"%s","prIsDraft":%s,"diffFile":"%s","filesChanged":{"total":%d,"code":%d,"test":%d,"doc":%d,"config":%d},"lines":{"additions":%s,"deletions":%s}}\n' \
-  "$ISSUE_NUMBER" "$SAFE_ISSUE_TITLE" "$ISSUE_STATE" "$SAFE_ISSUE_URL" \
-  "$PR_NUMBER" "$SAFE_PR_TITLE" "$SAFE_PR_URL" "$PR_STATE" "$SAFE_PR_BRANCH" "$PR_DRAFT_VAL" \
-  "$SAFE_DIFF_FILE" \
-  "$TOTAL_COUNT" "$CODE_COUNT" "$TEST_COUNT" "$DOC_COUNT" "$CONFIG_COUNT" \
-  "${TOTAL_ADDITIONS:-0}" "${TOTAL_DELETIONS:-0}"

package/dist/templates/scripts/hula-verify-post.sh

@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-# hula-verify-post.sh — Step 8 of the hula.verify workflow
-# Usage: bash .github/scripts/hula-verify-post.sh <pr-number> <report-file>
-#
-# Posts a verification report as a PR comment mentioning @copilot.
-# Outputs structured JSON to stdout; all other output goes to stderr.
-# Exit codes: 0=success, 1=user error, 2=tool error
-
-set -euo pipefail
-
-# ── helpers ────────────────────────────────────────────────────────────────────
-
-json_escape() {
-  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/$/\\n/g' | tr -d '\n' | sed 's/\\n$//'
-}
-
-die() {
-  local code="$1"; shift
-  local safe_msg
-  safe_msg=$(json_escape "$*")
-  printf '{"status":"error","code":%d,"message":"%s"}\n' "$code" "$safe_msg" >&1
-  exit "$code"
-}
-
-# ── argument parsing ────────────────────────────────────────────────────────────
-
-PR_NUMBER=''
-REPORT_FILE=''
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    [0-9]*)
-      if [[ -z "$PR_NUMBER" ]]; then
-        PR_NUMBER="$1"
-      else
-        die 1 "Unexpected positional argument: $1"
-      fi
-      shift ;;
-    *)
-      if [[ -z "$REPORT_FILE" ]]; then
-        REPORT_FILE="$1"
-      else
-        die 1 "Unknown argument: $1"
-      fi
-      shift ;;
-  esac
-done
-
-if [[ -z "$PR_NUMBER" ]]; then
-  die 1 "Usage: bash .github/scripts/hula-verify-post.sh <pr-number> <report-file>"
-fi
-
-if [[ -z "$REPORT_FILE" ]]; then
-  die 1 "Report file path is required as second argument."
-fi
-
-if [[ ! -f "$REPORT_FILE" ]]; then
-  die 1 "Report file not found: ${REPORT_FILE}"
-fi
-
-# ── Build comment body with @copilot mention ──────────────────────────────────
-
-COMMENT_TMP="/tmp/hula-verify-comment-${PR_NUMBER}.md"
-
-{
-  printf '@copilot Please review this verification report and address any gaps.\n\n'
-  cat "$REPORT_FILE"
-} > "$COMMENT_TMP"
-
-# ── Post comment ──────────────────────────────────────────────────────────────
-
-printf '📝 Posting verification report to PR #%s...\n' "$PR_NUMBER" >&2
-
-COMMENT_URL=$(gh pr comment "$PR_NUMBER" --body-file "$COMMENT_TMP" 2>/dev/null) \
-  || die 2 "Failed to post comment to PR #${PR_NUMBER}. You can copy the report manually."
-
-rm -f "$COMMENT_TMP"
-
-# ── Output result ─────────────────────────────────────────────────────────────
-
-SAFE_URL=$(json_escape "${COMMENT_URL:-}")
-
-printf '{"status":"success","prNumber":%s,"commentUrl":"%s"}\n' \
-  "$PR_NUMBER" "$SAFE_URL"