rhachet-roles-ehmpathy 1.9.1 → 1.11.0

package/dist/logic/roles/mechanic/.skills/init.claude.permissions.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+######################################################################
+# .what = bind mechanic permissions to Claude settings
+#
+# .why  = the mechanic role needs conservative permissions to operate
+#         safely while still being productive.
+#
+#         this script manages permissions in .claude/settings.local.json:
+#           • replaces existing allows entirely (conservative)
+#           • extends denies by appending new entries (conservative)
+#           • extends asks by appending new entries (conservative)
+#           • idempotent: safe to rerun
+#
+# .how  = uses jq to merge the permissions configuration
+#         into the existing settings structure, creating it if absent.
+#
+# guarantee:
+#   ✔ creates .claude/settings.local.json if missing
+#   ✔ preserves existing settings (hooks, other configs)
+#   ✔ replaces allow list entirely
+#   ✔ appends to deny list (no duplicates)
+#   ✔ appends to ask list (no duplicates)
+#   ✔ idempotent: safe to rerun
+#   ✔ fail-fast on errors
+######################################################################
+
+set -euo pipefail
+
+PROJECT_ROOT="$PWD"
+SETTINGS_FILE="$PROJECT_ROOT/.claude/settings.local.json"
+
+# define the permissions configuration to apply
+PERMISSIONS_CONFIG=$(cat <<'EOF'
+{
+  "permissions": {
+    "deny": [
+      "Bash(git commit:*)"
+    ],
+    "ask": [
+      "Bash(chmod:*)",
+      "Bash(pnpm install:*)",
+      "Bash(pnpm add:*)"
+    ],
+    "allow": [
+      "WebSearch",
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:www.npmjs.com)",
+      "WebFetch(domain:hub.docker.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "Bash(THOROUGH=true npm run test:*)",
+      "Bash(AWS_PROFILE=ahbode.dev npm run test:integration:*)",
+      "Bash(npm run fix:*)",
+      "Bash(AWS_PROFILE=ahbode.dev npx jest:*)",
+      "Bash(AWS_PROFILE=ahbode.dev npm run deploy:dev:*)",
+      "Bash(AWS_PROFILE=ahbode.dev STAGE=dev npm run test:acceptance:*)",
+      "Bash(npm run start:testdb:*)",
+      "Bash(cat:*)",
+      "Bash(unzip:*)",
+      "Bash(npm view:*)"
+    ]
+  }
+}
+EOF
+)
+
+# ensure .claude directory exists
+mkdir -p "$(dirname "$SETTINGS_FILE")"
+
+# initialize settings file if it doesn't exist
+if [[ ! -f "$SETTINGS_FILE" ]]; then
+  echo "{}" > "$SETTINGS_FILE"
+fi
+
+# apply permissions:
+# - replace allow entirely
+# - append to deny (unique)
+# - append to ask (unique)
+jq --argjson perms "$PERMISSIONS_CONFIG" '
+  # ensure .permissions exists
+  .permissions //= {} |
+
+  # replace allow entirely with our config
+  .permissions.allow = $perms.permissions.allow |
+
+  # append to deny (unique entries only)
+  .permissions.deny = ((.permissions.deny // []) + $perms.permissions.deny | unique) |
+
+  # append to ask (unique entries only)
+  .permissions.ask = ((.permissions.ask // []) + $perms.permissions.ask | unique)
+' "$SETTINGS_FILE" > "$SETTINGS_FILE.tmp"
+
+# check if any changes were made
+if diff -q "$SETTINGS_FILE" "$SETTINGS_FILE.tmp" >/dev/null 2>&1; then
+  rm "$SETTINGS_FILE.tmp"
+  echo "👌 mechanic permissions already configured"
+  echo "   $SETTINGS_FILE"
+  exit 0
+fi
+
+# atomic replace
+mv "$SETTINGS_FILE.tmp" "$SETTINGS_FILE"
+
+echo "🔐 mechanic permissions configured successfully!"
+echo "   $SETTINGS_FILE"
+echo ""
+echo "✨ permissions applied:"
+echo "   • allow: replaced entirely"
+echo "   • deny: extended (no duplicates)"
+echo "   • ask: extended (no duplicates)"

package/dist/logic/roles/mechanic/.skills/init.claude.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+######################################################################
+# .what = initialize Claude settings for mechanic role
+#
+# .why  = mechanic needs both hooks and permissions configured to
+#         operate effectively. this script dispatches to both:
+#           • init.claude.hooks.sh - binds SessionStart hook
+#           • init.claude.permissions.sh - configures permissions
+#
+#         single entry point for full Claude configuration.
+#
+# .how  = runs both init scripts in sequence from the same directory.
+#
+# guarantee:
+#   ✔ runs both hooks and permissions initialization
+#   ✔ fail-fast on any error
+#   ✔ idempotent: safe to rerun
+######################################################################
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+echo "🔧 init claude config for mechanic role..."
+echo ""
+
+# initialize hooks
+"$SCRIPT_DIR/init.claude.hooks.sh"
+echo ""
+
+# initialize permissions
+"$SCRIPT_DIR/init.claude.permissions.sh"
+echo ""
+
+echo "👌 claude config ready"

package/dist/logic/roles/mechanic/.skills/run.test.sh

@@ -226,8 +226,14 @@ fi
 echo "> $TEST_COMMAND" | tee -a "$LOG_FILE"
 echo "" | tee -a "$LOG_FILE"
 
-eval "$TEST_COMMAND" 2>&1 | tee -a "$LOG_FILE"
-TEST_EXIT_CODE=${PIPESTATUS[0]}
+# For unit tests, strip color codes from log file while preserving them in terminal output
+if [[ "$TEST_TYPE" == "unit" ]]; then
+  eval "$TEST_COMMAND" 2>&1 | tee >(sed 's/\x1B\[[0-9;]*[JKmsu]//g' >> "$LOG_FILE")
+  TEST_EXIT_CODE=${PIPESTATUS[0]}
+else
+  eval "$TEST_COMMAND" 2>&1 | tee -a "$LOG_FILE"
+  TEST_EXIT_CODE=${PIPESTATUS[0]}
+fi
 
 echo "" | tee -a "$LOG_FILE"
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "rhachet-roles-ehmpathy",
   "author": "ehmpathy",
   "description": "empathetic software construction roles and skills, via rhachet",
-  "version": "1.9.1",
+  "version": "1.11.0",
   "repository": "ehmpathy/rhachet-roles-ehmpathy",
   "homepage": "https://github.com/ehmpathy/rhachet-roles-ehmpathy",
   "keywords": [
@@ -26,7 +26,7 @@
     "fix:lint": "eslint -c ./.eslintrc.js src/**/*.ts --fix",
     "build:clean": "rm dist/ -rf",
     "build:compile": "tsc -p ./tsconfig.build.json",
-    "build:complete": "rsync -a --prune-empty-dirs --include='*/' --exclude='**/.route/**' --exclude='**/.scratch/**' --include='**/*.template.md' --include='**/.briefs/**/*.md' --include='**/.briefs/*.md' --include='**/.skills/**/*.sh' --include='**/.skills/*.sh' --exclude='*' src/ dist/",
+    "build:complete": "rsync -a --prune-empty-dirs --include='*/' --exclude='**/.route/**' --exclude='**/.scratch/**' --exclude='**/.behavior/**' --include='**/*.template.md' --include='**/.briefs/**/*.md' --include='**/.briefs/*.md' --include='**/.skills/**/*.sh' --include='**/.skills/*.sh' --exclude='*' src/ dist/",
     "build": "npm run build:clean && npm run build:compile && npm run build:complete",
     "test:commits": "LAST_TAG=$(git describe --tags --abbrev=0 @^ 2> /dev/null || git rev-list --max-parents=0 HEAD) && npx commitlint --from $LAST_TAG --to HEAD --verbose",
     "test:types": "tsc -p ./tsconfig.build.json --noEmit",