learnship 2.1.2 → 2.2.0

package/hooks/learnship-prompt-guard.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// learnship-hook-version: 2.2.0
+// Prompt Injection Guard — PreToolUse hook
+// Scans file content being written to .planning/ for prompt injection patterns.
+// Defense-in-depth: catches injected instructions before they enter agent context.
+//
+// Triggers on: Write and Edit tool calls targeting .planning/ files
+// Action: Advisory warning (does not block)
+
+const fs = require('fs');
+const path = require('path');
+
+const INJECTION_PATTERNS = [
+  /ignore\s+(all\s+)?previous\s+instructions/i,
+  /ignore\s+(all\s+)?above\s+instructions/i,
+  /disregard\s+(all\s+)?previous/i,
+  /forget\s+(all\s+)?(your\s+)?instructions/i,
+  /override\s+(system|previous)\s+(prompt|instructions)/i,
+  /you\s+are\s+now\s+(?:a|an|the)\s+/i,
+  /act\s+as\s+(?:a|an|the)\s+(?!plan|phase|wave)/i,
+  /pretend\s+(?:you(?:'re| are)\s+|to\s+be\s+)/i,
+  /from\s+now\s+on,?\s+you\s+(?:are|will|should|must)/i,
+  /(?:print|output|reveal|show|display|repeat)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions)/i,
+  /<\/?(?:system|assistant|human)>/i,
+  /\[SYSTEM\]/i,
+  /\[INST\]/i,
+  /<<\s*SYS\s*>>/i,
+];
+
+let input = '';
+const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => input += chunk);
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    const data = JSON.parse(input);
+    const toolName = data.tool_name;
+
+    if (toolName !== 'Write' && toolName !== 'Edit') process.exit(0);
+
+    const filePath = data.tool_input?.file_path || '';
+    if (!filePath.includes('.planning/') && !filePath.includes('.planning\\')) process.exit(0);
+
+    const content = data.tool_input?.content || data.tool_input?.new_string || '';
+    if (!content) process.exit(0);
+
+    const findings = [];
+    for (const pattern of INJECTION_PATTERNS) {
+      if (pattern.test(content)) findings.push(pattern.source);
+    }
+
+    // Check for suspicious invisible Unicode
+    if (/[\u200B-\u200F\u2028-\u202F\uFEFF\u00AD]/.test(content)) {
+      findings.push('invisible-unicode-characters');
+    }
+
+    if (findings.length === 0) process.exit(0);
+
+    const output = {
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        additionalContext: `\u26a0\ufe0f PROMPT INJECTION WARNING: Content being written to ${path.basename(filePath)} ` +
+          `triggered ${findings.length} injection detection pattern(s): ${findings.join(', ')}. ` +
+          'This content will become part of agent context. Review the text for embedded ' +
+          'instructions that could manipulate agent behavior. If the content is legitimate ' +
+          '(e.g., documentation about prompt injection), proceed normally.',
+      },
+    };
+
+    process.stdout.write(JSON.stringify(output));
+  } catch {
+    process.exit(0);
+  }
+});

package/hooks/learnship-session-state.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+// learnship-hook-version: 2.2.0
+// Session State — SessionStart hook
+// Injects project state reminder on every session start for orientation.
+// Also checks for learnship updates in the background.
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawn } = require('child_process');
+
+// --- Session state injection ---
+
+function getStateContext() {
+  const lines = [];
+
+  if (fs.existsSync('.planning/STATE.md')) {
+    lines.push('## Project State Reminder');
+    lines.push('');
+    lines.push('STATE.md exists - check for blockers and current phase.');
+    try {
+      const content = fs.readFileSync('.planning/STATE.md', 'utf8');
+      const head = content.split('\n').slice(0, 20).join('\n');
+      lines.push(head);
+    } catch (e) {}
+  } else {
+    lines.push('No .planning/ found - suggest /new-project if starting new work.');
+  }
+
+  lines.push('');
+
+  if (fs.existsSync('.planning/config.json')) {
+    try {
+      const config = JSON.parse(fs.readFileSync('.planning/config.json', 'utf8'));
+      if (config.mode) lines.push(`Config: mode="${config.mode}"`);
+      if (config.context) lines.push(`Context profile: ${config.context}`);
+    } catch (e) {}
+  }
+
+  return lines.join('\n');
+}
+
+// --- Update check (background, non-blocking) ---
+
+function checkForUpdates(configDir) {
+  const cacheDir = path.join(os.homedir(), '.cache', 'learnship');
+  try { fs.mkdirSync(cacheDir, { recursive: true }); } catch (e) {}
+
+  const versionFile = path.join(configDir, 'learnship', 'VERSION');
+  let installed = '0.0.0';
+  try {
+    if (fs.existsSync(versionFile)) {
+      installed = fs.readFileSync(versionFile, 'utf8').trim();
+    }
+  } catch (e) {}
+
+  const cacheFile = path.join(cacheDir, 'update-check.json');
+
+  const child = spawn(process.execPath, ['-e', `
+    const fs = require('fs');
+    const { execSync } = require('child_process');
+
+    function isNewer(a, b) {
+      const pa = (a || '').split('.').map(s => Number(s.replace(/-.*/, '')) || 0);
+      const pb = (b || '').split('.').map(s => Number(s.replace(/-.*/, '')) || 0);
+      for (let i = 0; i < 3; i++) {
+        if (pa[i] > pb[i]) return true;
+        if (pa[i] < pb[i]) return false;
+      }
+      return false;
+    }
+
+    const installed = ${JSON.stringify(installed)};
+    const cacheFile = ${JSON.stringify(cacheFile)};
+
+    let latest = null;
+    try {
+      latest = execSync('npm view learnship version', { encoding: 'utf8', timeout: 10000, windowsHide: true }).trim();
+    } catch (e) {}
+
+    const result = {
+      update_available: latest && isNewer(latest, installed),
+      installed,
+      latest: latest || 'unknown',
+      checked: Math.floor(Date.now() / 1000)
+    };
+
+    fs.writeFileSync(cacheFile, JSON.stringify(result));
+  `], {
+    stdio: 'ignore',
+    windowsHide: true,
+    detached: true
+  });
+
+  child.unref();
+}
+
+// --- Main ---
+
+let input = '';
+const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', chunk => input += chunk);
+process.stdin.on('end', () => {
+  clearTimeout(stdinTimeout);
+  try {
+    const data = JSON.parse(input);
+    const cwd = data.cwd || process.cwd();
+
+    // Determine config directory
+    const homeDir = os.homedir();
+    let configDir = process.env.CLAUDE_CONFIG_DIR || path.join(homeDir, '.claude');
+    // Also check project-local .claude/
+    const localConfigDir = path.join(cwd, '.claude');
+    if (fs.existsSync(path.join(localConfigDir, 'learnship', 'VERSION'))) {
+      configDir = localConfigDir;
+    }
+
+    // Fire background update check
+    checkForUpdates(configDir);
+
+    // Build state context
+    const stateContext = getStateContext();
+
+    const output = {
+      hookSpecificOutput: {
+        hookEventName: 'SessionStart',
+        additionalContext: stateContext
+      }
+    };
+
+    process.stdout.write(JSON.stringify(output));
+  } catch (e) {
+    process.exit(0);
+  }
+});

package/hooks/learnship-statusline.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env node
+// learnship-hook-version: 2.2.0
+// learnship Statusline — shows model, project state, directory, and context usage
+// Installed by learnship for Claude Code and Gemini CLI.
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+// --- Project state reader ---
+
+function readProjectState(dir) {
+  const home = os.homedir();
+  let current = dir;
+  for (let i = 0; i < 10; i++) {
+    const candidate = path.join(current, '.planning', 'STATE.md');
+    if (fs.existsSync(candidate)) {
+      try {
+        return parseStateMd(fs.readFileSync(candidate, 'utf8'));
+      } catch (e) {
+        return null;
+      }
+    }
+    const parent = path.dirname(current);
+    if (parent === current || current === home) break;
+    current = parent;
+  }
+  return null;
+}
+
+function parseStateMd(content) {
+  const state = {};
+  const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+  if (fmMatch) {
+    for (const line of fmMatch[1].split('\n')) {
+      const m = line.match(/^(\w+):\s*(.+)/);
+      if (!m) continue;
+      const [, key, val] = m;
+      const v = val.trim().replace(/^["']|["']$/g, '');
+      if (key === 'status') state.status = v === 'null' ? null : v;
+      if (key === 'milestone') state.milestone = v === 'null' ? null : v;
+      if (key === 'milestone_name') state.milestoneName = v === 'null' ? null : v;
+    }
+  }
+  const phaseMatch = content.match(/^Phase:\s*(\d+)\s+of\s+(\d+)(?:\s+\(([^)]+)\))?/m);
+  if (phaseMatch) {
+    state.phaseNum = phaseMatch[1];
+    state.phaseTotal = phaseMatch[2];
+    state.phaseName = phaseMatch[3] || null;
+  }
+  if (!state.status) {
+    const bodyStatus = content.match(/^Status:\s*(.+)/m);
+    if (bodyStatus) {
+      const raw = bodyStatus[1].trim().toLowerCase();
+      if (raw.includes('ready to plan') || raw.includes('planning')) state.status = 'planning';
+      else if (raw.includes('execut')) state.status = 'executing';
+      else if (raw.includes('complet') || raw.includes('archived')) state.status = 'complete';
+    }
+  }
+  return state;
+}
+
+function formatProjectState(s) {
+  const parts = [];
+  if (s.milestone || s.milestoneName) {
+    const ver = s.milestone || '';
+    const name = (s.milestoneName && s.milestoneName !== 'milestone') ? s.milestoneName : '';
+    const ms = [ver, name].filter(Boolean).join(' ');
+    if (ms) parts.push(ms);
+  }
+  if (s.status) parts.push(s.status);
+  if (s.phaseNum && s.phaseTotal) {
+    const phase = s.phaseName
+      ? `${s.phaseName} (${s.phaseNum}/${s.phaseTotal})`
+      : `ph ${s.phaseNum}/${s.phaseTotal}`;
+    parts.push(phase);
+  }
+  return parts.join(' \u00b7 ');
+}
+
+// --- Main ---
+
+function runStatusline() {
+  let input = '';
+  const stdinTimeout = setTimeout(() => process.exit(0), 3000);
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', chunk => input += chunk);
+  process.stdin.on('end', () => {
+    clearTimeout(stdinTimeout);
+    try {
+      const data = JSON.parse(input);
+      const model = data.model?.display_name || 'Claude';
+      const dir = data.workspace?.current_dir || process.cwd();
+      const session = data.session_id || '';
+      const remaining = data.context_window?.remaining_percentage;
+
+      // Context window display (shows USED percentage scaled to usable context)
+      const AUTO_COMPACT_BUFFER_PCT = 16.5;
+      let ctx = '';
+      if (remaining != null) {
+        const usableRemaining = Math.max(0, ((remaining - AUTO_COMPACT_BUFFER_PCT) / (100 - AUTO_COMPACT_BUFFER_PCT)) * 100);
+        const used = Math.max(0, Math.min(100, Math.round(100 - usableRemaining)));
+
+        // Write bridge file for context-monitor hook
+        const sessionSafe = session && !/[/\\]|\.\./.test(session);
+        if (sessionSafe) {
+          try {
+            const bridgePath = path.join(os.tmpdir(), `learnship-ctx-${session}.json`);
+            const bridgeData = JSON.stringify({
+              session_id: session,
+              remaining_percentage: remaining,
+              used_pct: used,
+              timestamp: Math.floor(Date.now() / 1000)
+            });
+            fs.writeFileSync(bridgePath, bridgeData);
+          } catch (e) {
+            // Silent fail — bridge is best-effort
+          }
+        }
+
+        const filled = Math.floor(used / 10);
+        const bar = '\u2588'.repeat(filled) + '\u2591'.repeat(10 - filled);
+        if (used < 50) {
+          ctx = ` \x1b[32m${bar} ${used}%\x1b[0m`;
+        } else if (used < 65) {
+          ctx = ` \x1b[33m${bar} ${used}%\x1b[0m`;
+        } else if (used < 80) {
+          ctx = ` \x1b[38;5;208m${bar} ${used}%\x1b[0m`;
+        } else {
+          ctx = ` \x1b[5;31m\ud83d\udc80 ${bar} ${used}%\x1b[0m`;
+        }
+      }
+
+      // Current task from todos
+      let task = '';
+      const homeDir = os.homedir();
+      const claudeDir = process.env.CLAUDE_CONFIG_DIR || path.join(homeDir, '.claude');
+      const todosDir = path.join(claudeDir, 'todos');
+      if (session && fs.existsSync(todosDir)) {
+        try {
+          const files = fs.readdirSync(todosDir)
+            .filter(f => f.startsWith(session) && f.includes('-agent-') && f.endsWith('.json'))
+            .map(f => ({ name: f, mtime: fs.statSync(path.join(todosDir, f)).mtime }))
+            .sort((a, b) => b.mtime - a.mtime);
+          if (files.length > 0) {
+            try {
+              const todos = JSON.parse(fs.readFileSync(path.join(todosDir, files[0].name), 'utf8'));
+              const inProgress = todos.find(t => t.status === 'in_progress');
+              if (inProgress) task = inProgress.activeForm || '';
+            } catch (e) {}
+          }
+        } catch (e) {}
+      }
+
+      // Project state (milestone · status · phase)
+      const stateStr = task ? '' : formatProjectState(readProjectState(dir) || {});
+
+      // Output
+      const dirname = path.basename(dir);
+      const middle = task
+        ? `\x1b[1m${task}\x1b[0m`
+        : stateStr
+          ? `\x1b[2m${stateStr}\x1b[0m`
+          : null;
+
+      if (middle) {
+        process.stdout.write(`\x1b[2m${model}\x1b[0m \u2502 ${middle} \u2502 \x1b[2m${dirname}\x1b[0m${ctx}`);
+      } else {
+        process.stdout.write(`\x1b[2m${model}\x1b[0m \u2502 \x1b[2m${dirname}\x1b[0m${ctx}`);
+      }
+    } catch (e) {
+      // Silent fail
+    }
+  });
+}
+
+module.exports = { readProjectState, parseStateMd, formatProjectState };
+
+if (require.main === module) runStatusline();

package/learnship/contexts/dev.md

@@ -0,0 +1,21 @@
+# Dev Context Profile
+
+Agent output guidance for dev mode. Loaded when `context: dev` is set in config.json.
+
+## Output Style
+
+- Concise, action-oriented responses
+- Lead with the code change or command, follow with brief rationale
+- Skip preamble — assume the developer has full context
+- Use inline code references (`file:line`) over prose descriptions
+
+## Focus Areas
+
+- Working code that compiles and passes tests
+- Minimal diff — change only what is necessary
+- Flag side effects or breaking changes immediately
+- Surface the next actionable step at the end of every response
+
+## Verbosity
+
+Low. One-liner explanations unless the change is non-obvious. Omit background theory, alternative approaches, and caveats that do not affect the current task.

package/learnship/contexts/research.md

@@ -0,0 +1,22 @@
+# Research Context Profile
+
+Agent output guidance for research mode. Loaded when `context: research` is set in config.json.
+
+## Output Style
+
+- Verbose, exploratory responses that surface trade-offs and alternatives
+- Present multiple approaches with pros and cons before recommending one
+- Include links, references, and citations where available
+- Use structured headings and bullet lists for scan-ability
+
+## Focus Areas
+
+- Breadth of options — enumerate before narrowing
+- Prior art and ecosystem conventions
+- Risks, edge cases, and failure modes
+- Dependencies and compatibility implications
+- Long-term maintainability of each approach
+
+## Verbosity
+
+High. Explain reasoning, show evidence, and document assumptions. Include background context even if the developer likely knows it — research artifacts are read by future contributors who may not.

package/learnship/contexts/review.md

@@ -0,0 +1,22 @@
+# Review Context Profile
+
+Agent output guidance for review mode. Loaded when `context: review` is set in config.json.
+
+## Output Style
+
+- Critical, detail-focused responses that prioritize correctness
+- Organize findings by severity: blocking, important, nit
+- Reference specific lines and files for every finding
+- State what is correct as well as what needs change — confirm the good parts
+
+## Focus Areas
+
+- Correctness — logic errors, off-by-ones, missing edge cases
+- Security — input validation, injection vectors, secret exposure
+- Performance — unnecessary allocations, O(n^2) patterns, missing caching
+- Style and consistency — naming, formatting, import order
+- Test coverage — untested branches, missing assertions, flaky patterns
+
+## Verbosity
+
+Medium. Be thorough on findings but terse in explanation. Each issue should be one to three sentences: what is wrong, why it matters, and how to fix it.

package/learnship/templates/research-project/ARCHITECTURE.md

@@ -0,0 +1,140 @@
+# Architecture Research Template
+
+Template for `.planning/research/ARCHITECTURE.md` — system structure patterns for the project domain.
+
+<template>
+
+```markdown
+# Architecture Research
+
+**Domain:** [domain type]
+**Researched:** [date]
+**Confidence:** [HIGH/MEDIUM/LOW]
+
+## Component Boundaries
+
+### System Overview
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                        [Layer Name]                          │
+├─────────────────────────────────────────────────────────────┤
+│  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐        │
+│  │ [Comp]  │  │ [Comp]  │  │ [Comp]  │  │ [Comp]  │        │
+│  └────┬────┘  └────┬────┘  └────┬────┘  └────┬────┘        │
+│       │            │            │            │              │
+├───────┴────────────┴────────────┴────────────┴──────────────┤
+│                        [Layer Name]                          │
+├─────────────────────────────────────────────────────────────┤
+│  ┌─────────────────────────────────────────────────────┐    │
+│  │                    [Component]                       │    │
+│  └─────────────────────────────────────────────────────┘    │
+├─────────────────────────────────────────────────────────────┤
+│                        [Layer Name]                          │
+│  ┌──────────┐  ┌──────────┐  ┌──────────┐                   │
+│  │ [Store]  │  │ [Store]  │  │ [Store]  │                   │
+│  └──────────┘  └──────────┘  └──────────┘                   │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Component Responsibilities
+
+| Component | Responsibility | Typical Implementation |
+|-----------|----------------|------------------------|
+| [name] | [what it owns] | [how it's usually built] |
+| [name] | [what it owns] | [how it's usually built] |
+| [name] | [what it owns] | [how it's usually built] |
+
+## Data Flow
+
+### Primary Data Flow
+
+```
+[Source] → [Transform/Process] → [Destination]
+   ↓
+[Side Effect / Event]
+   ↓
+[Consumer]
+```
+
+### Data Flow Description
+
+| Flow | Source | Destination | Format | Notes |
+|------|--------|-------------|--------|-------|
+| [name] | [where data originates] | [where it goes] | [JSON/binary/stream] | [important details] |
+| [name] | [where data originates] | [where it goes] | [JSON/binary/stream] | [important details] |
+
+## Build Order
+
+Suggested implementation sequence based on dependencies:
+
+| Order | Component | Dependencies | Rationale |
+|-------|-----------|--------------|-----------|
+| 1 | [component] | None | [why first — usually data layer or core abstractions] |
+| 2 | [component] | [depends on #1] | [why this order] |
+| 3 | [component] | [depends on #1, #2] | [why this order] |
+| 4 | [component] | [depends on #2, #3] | [why this order] |
+
+## Integration Points
+
+### External Integrations
+
+| Integration | Type | Protocol | Auth | Notes |
+|------------|------|----------|------|-------|
+| [service] | [API/SDK/webhook] | [REST/gRPC/WS] | [key/OAuth/none] | [rate limits, gotchas] |
+
+### Internal Boundaries
+
+| Boundary | Left Side | Right Side | Contract |
+|----------|-----------|------------|----------|
+| [name] | [module A] | [module B] | [interface/API shape] |
+
+## Recommended Project Structure
+
+```
+src/
+├── [folder]/           # [purpose]
+│   ├── [subfolder]/    # [purpose]
+│   └── [file].ts       # [purpose]
+├── [folder]/           # [purpose]
+│   ├── [subfolder]/    # [purpose]
+│   └── [file].ts       # [purpose]
+├── [folder]/           # [purpose]
+└── [folder]/           # [purpose]
+```
+
+---
+*Architecture research for: [domain]*
+*Researched: [date]*
+```
+
+</template>
+
+<guidelines>
+
+**Component Boundaries:**
+- Use ASCII diagrams for system overview — they render in any terminal or editor
+- Each component should have a single clear responsibility
+- If a component does two things, it should probably be two components
+
+**Data Flow:**
+- Show the primary happy path first, then edge cases
+- Note data format at each boundary (JSON, binary, stream)
+- Identify where data transforms happen — these are common bug sources
+
+**Build Order:**
+- This directly feeds into roadmap phase ordering
+- Always start with the data layer or core abstractions
+- UI comes last (it depends on everything below it)
+
+**Integration Points:**
+- Note rate limits, auth requirements, and known gotchas
+- External integrations are the most common source of runtime failures
+- Define internal boundaries as interfaces/contracts — this enables parallel work
+
+**Project Structure:**
+- Follow domain conventions (e.g., Next.js app/ router, Django apps/)
+- Group by feature, not by type, for most projects
+- Keep the structure flat enough to navigate but deep enough to organize
+
+</guidelines>