soturail 0.3.3 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +71 -7
- package/dist/cli.js +4 -0
- package/dist/cli.js.map +1 -1
- package/dist/commands/agents.d.ts +2 -0
- package/dist/commands/agents.js +41 -0
- package/dist/commands/agents.js.map +1 -0
- package/dist/commands/bench.d.ts +1 -1
- package/dist/commands/bench.js +53 -4
- package/dist/commands/bench.js.map +1 -1
- package/dist/commands/context.js +11 -5
- package/dist/commands/context.js.map +1 -1
- package/dist/commands/doctor.js +7 -0
- package/dist/commands/doctor.js.map +1 -1
- package/dist/commands/hooks.d.ts +4 -2
- package/dist/commands/hooks.js +15 -10
- package/dist/commands/hooks.js.map +1 -1
- package/dist/commands/init.js +194 -4
- package/dist/commands/init.js.map +1 -1
- package/dist/commands/mcp.js +29 -2
- package/dist/commands/mcp.js.map +1 -1
- package/dist/commands/release.js +7 -3
- package/dist/commands/release.js.map +1 -1
- package/dist/commands/workflow.d.ts +2 -0
- package/dist/commands/workflow.js +58 -0
- package/dist/commands/workflow.js.map +1 -0
- package/dist/core/agent-exporter.d.ts +15 -0
- package/dist/core/agent-exporter.js +261 -0
- package/dist/core/agent-exporter.js.map +1 -0
- package/dist/core/agent-profile.d.ts +25 -0
- package/dist/core/agent-profile.js +2 -0
- package/dist/core/agent-profile.js.map +1 -0
- package/dist/core/agent-registry.d.ts +6 -0
- package/dist/core/agent-registry.js +109 -0
- package/dist/core/agent-registry.js.map +1 -0
- package/dist/core/config.d.ts +4 -0
- package/dist/core/config.js +10 -2
- package/dist/core/config.js.map +1 -1
- package/dist/core/context-pack.d.ts +3 -1
- package/dist/core/context-pack.js +23 -2
- package/dist/core/context-pack.js.map +1 -1
- package/dist/core/mcp-resources.js +9 -1
- package/dist/core/mcp-resources.js.map +1 -1
- package/dist/core/mcp-server.d.ts +4 -0
- package/dist/core/mcp-server.js +26 -0
- package/dist/core/mcp-server.js.map +1 -1
- package/dist/core/release-preflight.js +8 -0
- package/dist/core/release-preflight.js.map +1 -1
- package/dist/core/version.d.ts +1 -1
- package/dist/core/version.js +1 -1
- package/dist/core/workflow-store.d.ts +31 -0
- package/dist/core/workflow-store.js +235 -0
- package/dist/core/workflow-store.js.map +1 -0
- package/dist/core/worktree-manager.d.ts +10 -0
- package/dist/core/worktree-manager.js +55 -0
- package/dist/core/worktree-manager.js.map +1 -0
- package/docs/agents.md +46 -0
- package/docs/benchmarking.md +4 -3
- package/docs/comparisons.md +4 -2
- package/docs/context-packs.md +8 -1
- package/docs/hooks/claude.md +1 -1
- package/docs/hooks/mcp.md +1 -1
- package/docs/hooks.md +5 -2
- package/docs/mcp.md +18 -0
- package/docs/metrics.md +3 -2
- package/docs/mvp.md +1 -1
- package/docs/release-workflow.md +4 -1
- package/docs/security-model.md +6 -2
- package/docs/usage.md +21 -2
- package/docs/windows.md +43 -1
- package/docs/workflow-rail.md +48 -21
- package/examples/agents/README.md +11 -0
- package/examples/agents/antigravity.md +8 -0
- package/examples/agents/claude.md +9 -0
- package/examples/agents/codex.md +8 -0
- package/examples/agents/cursor.md +8 -0
- package/examples/agents/gemini.md +8 -0
- package/examples/workflows/README.md +13 -0
- package/examples/workflows/bugfix-workflow.md +11 -0
- package/examples/workflows/release-workflow.md +9 -0
- package/package.json +1 -1
|
@@ -0,0 +1,55 @@
|
|
|
1
|
+
import { execFile } from "node:child_process";
|
|
2
|
+
import { promises as fs } from "node:fs";
|
|
3
|
+
import path from "node:path";
|
|
4
|
+
import { promisify } from "node:util";
|
|
5
|
+
import { getWorkspacePaths, relativeToRoot } from "./config.js";
|
|
6
|
+
const execFileAsync = promisify(execFile);
|
|
7
|
+
export function safeBranchName(id) {
|
|
8
|
+
return `soturail/${id.replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase()}`;
|
|
9
|
+
}
|
|
10
|
+
export async function planWorktree(root, workflowId, dryRun = true) {
|
|
11
|
+
const paths = getWorkspacePaths(root);
|
|
12
|
+
const branch = safeBranchName(workflowId);
|
|
13
|
+
const worktreePath = path.join(paths.worktreesDir, workflowId);
|
|
14
|
+
const commands = [
|
|
15
|
+
`git worktree add -b ${branch} ${relativeToRoot(root, worktreePath)}`,
|
|
16
|
+
`git worktree remove ${relativeToRoot(root, worktreePath)}`
|
|
17
|
+
];
|
|
18
|
+
const inGit = await isInsideGit(root);
|
|
19
|
+
if (!inGit) {
|
|
20
|
+
return {
|
|
21
|
+
available: false,
|
|
22
|
+
dryRun,
|
|
23
|
+
branch,
|
|
24
|
+
worktreePath,
|
|
25
|
+
commands,
|
|
26
|
+
message: dryRun
|
|
27
|
+
? "Dry-run only; Git repository not detected, so no worktree would be created."
|
|
28
|
+
: "Git repository not detected; use non-worktree workflow state."
|
|
29
|
+
};
|
|
30
|
+
}
|
|
31
|
+
if (!dryRun) {
|
|
32
|
+
await fs.mkdir(paths.worktreesDir, { recursive: true });
|
|
33
|
+
await execFileAsync("git", ["worktree", "add", "-b", branch, worktreePath], { cwd: root, windowsHide: true });
|
|
34
|
+
}
|
|
35
|
+
return {
|
|
36
|
+
available: true,
|
|
37
|
+
dryRun,
|
|
38
|
+
branch,
|
|
39
|
+
worktreePath,
|
|
40
|
+
commands,
|
|
41
|
+
message: dryRun
|
|
42
|
+
? "Dry-run only; no worktree created, pushed, merged or deleted."
|
|
43
|
+
: "Local worktree created. SotuRail will not push, merge or delete it automatically."
|
|
44
|
+
};
|
|
45
|
+
}
|
|
46
|
+
async function isInsideGit(root) {
|
|
47
|
+
try {
|
|
48
|
+
const { stdout } = await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], { cwd: root, windowsHide: true, timeout: 3000 });
|
|
49
|
+
return stdout.trim() === "true";
|
|
50
|
+
}
|
|
51
|
+
catch {
|
|
52
|
+
return false;
|
|
53
|
+
}
|
|
54
|
+
}
|
|
55
|
+
//# sourceMappingURL=worktree-manager.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"worktree-manager.js","sourceRoot":"","sources":["../../src/core/worktree-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAW1C,MAAM,UAAU,cAAc,CAAC,EAAU;IACvC,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,UAAkB,EAAE,MAAM,GAAG,IAAI;IAChF,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG;QACf,uBAAuB,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE;QACrE,uBAAuB,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE;KAC5D,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,MAAM;YACN,MAAM;YACN,YAAY;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM;gBACb,CAAC,CAAC,6EAA6E;gBAC/E,CAAC,CAAC,+DAA+D;SACpE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,MAAM;QACN,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,OAAO,EAAE,MAAM;YACb,CAAC,CAAC,+DAA+D;YACjE,CAAC,CAAC,mFAAmF;KACxF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvI,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
|
package/docs/agents.md
ADDED
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
# Agent Integrations
|
|
2
|
+
|
|
3
|
+
SotuRail provides reviewed, project-local agent integration exports for Claude, Codex, Gemini, Cursor, Antigravity and generic agents.
|
|
4
|
+
|
|
5
|
+
```bash
|
|
6
|
+
soturail agents list
|
|
7
|
+
soturail agents doctor
|
|
8
|
+
soturail agents export --agent all
|
|
9
|
+
soturail agents install --agent claude --mode mcp --dry-run
|
|
10
|
+
soturail agents install --agent claude --mode safe-hooks --dry-run
|
|
11
|
+
soturail agents install --agent codex --mode prompt-only --dry-run
|
|
12
|
+
soturail agents install --agent cursor --mode rules --dry-run
|
|
13
|
+
soturail agents uninstall --agent claude --dry-run
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
Exports are written under `.soturail/exports/agents/<agent>/`. They are meant to be reviewed before use.
|
|
17
|
+
|
|
18
|
+
## Safe Defaults
|
|
19
|
+
|
|
20
|
+
- Install commands support `--dry-run`.
|
|
21
|
+
- Existing project files get `.soturail.bak` backups before modification.
|
|
22
|
+
- Unknown global app config locations are not modified.
|
|
23
|
+
- Antigravity support is prompt-only/context-pack unless a stable local config format is reviewed.
|
|
24
|
+
- SotuRail does not enable arbitrary shell execution through MCP.
|
|
25
|
+
|
|
26
|
+
## Doctor Guidance
|
|
27
|
+
|
|
28
|
+
In a clean project, `soturail agents doctor` points users toward the safest setup order:
|
|
29
|
+
|
|
30
|
+
```bash
|
|
31
|
+
soturail context pack --target all
|
|
32
|
+
soturail agents export --agent all
|
|
33
|
+
soturail mcp smoke
|
|
34
|
+
soturail workflow new "Implement feature"
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
If context packs or exports already exist, the doctor omits those setup steps and keeps the remaining checks visible.
|
|
38
|
+
|
|
39
|
+
## Outputs
|
|
40
|
+
|
|
41
|
+
- Claude: `CLAUDE.md`, `mcp-config.json`, `safe-hooks.md`, `context-pack.md`.
|
|
42
|
+
- Codex: `AGENTS.md`, `context-pack.md`, `prompt-only.md`.
|
|
43
|
+
- Gemini: `GEMINI.md`, `context-pack.md`, `prompt-only.md`.
|
|
44
|
+
- Cursor: `cursor-rules.md`, `context-pack.md`, `prompt-only.md`.
|
|
45
|
+
- Antigravity: `context-pack.md`, `prompt-only.md`.
|
|
46
|
+
- Generic: `context-pack.md`, `prompt-only.md`.
|
package/docs/benchmarking.md
CHANGED
|
@@ -22,14 +22,15 @@ The suite groups results as:
|
|
|
22
22
|
- cache stability;
|
|
23
23
|
- native engine availability/performance when available;
|
|
24
24
|
- skill rail validation/export;
|
|
25
|
-
- MCP resource listing/reading;
|
|
25
|
+
- MCP resource listing/reading/smoke;
|
|
26
26
|
- context pack generation;
|
|
27
|
-
- agent hook export;
|
|
27
|
+
- agent hook and agent integration export;
|
|
28
|
+
- Workflow Rail dry-run state;
|
|
28
29
|
- memory approval workflow.
|
|
29
30
|
|
|
30
31
|
Terminal reducer cases include npm install noise, npm test success, Vitest failures, TypeScript diagnostics, git diff/status noise, Docker logs, ESLint failures, Vite/Next build output, Java stack traces, Maven/Gradle failures, JSON/tool payload output, tiny-output overhead and dedupe fixtures.
|
|
31
32
|
|
|
32
|
-
Each
|
|
33
|
+
Each reducer and integration case reports:
|
|
33
34
|
|
|
34
35
|
- `raw_tokens`;
|
|
35
36
|
- `reduced_tokens`;
|
package/docs/comparisons.md
CHANGED
|
@@ -28,8 +28,10 @@ MemPalace-like memory/evidence ideas are related. SotuRail uses local JSONL memo
|
|
|
28
28
|
|
|
29
29
|
Nicole-style knowledge-to-rules workflows are related. SotuRail has `ingest` and `rules` with future hardened PDF extraction.
|
|
30
30
|
|
|
31
|
-
## Skills And Workflow Orchestration
|
|
31
|
+
## Skills, Agent Integrations And Workflow Orchestration
|
|
32
32
|
|
|
33
|
-
Agent-skills and SkillsMP-like ecosystems are related to Skill Rail exports.
|
|
33
|
+
Agent-skills and SkillsMP-like ecosystems are related to Skill Rail exports. SotuRail exports prompt/context files and MCP snippets for Claude, Codex, Gemini, Cursor, Antigravity and generic agents without claiming host-native superiority.
|
|
34
|
+
|
|
35
|
+
Compozy, Superpowers and OpenSpec-style orchestration are related to Workflow Rail. SotuRail's Workflow Rail is a local state machine with optional Git worktree isolation; it does not push, merge or delete user work automatically.
|
|
34
36
|
|
|
35
37
|
SotuRail should not be described as better than these projects unless a specific local benchmark proves a specific metric.
|
package/docs/context-packs.md
CHANGED
|
@@ -7,7 +7,9 @@ soturail context pack --target claude
|
|
|
7
7
|
soturail context pack --target codex
|
|
8
8
|
soturail context pack --target gemini
|
|
9
9
|
soturail context pack --target cursor
|
|
10
|
+
soturail context pack --target antigravity
|
|
10
11
|
soturail context pack --target generic
|
|
12
|
+
soturail context pack --target all
|
|
11
13
|
soturail context explain
|
|
12
14
|
soturail context doctor
|
|
13
15
|
```
|
|
@@ -20,6 +22,7 @@ Common generated files:
|
|
|
20
22
|
- `.soturail/context/codex-context.md`
|
|
21
23
|
- `.soturail/context/gemini-context.md`
|
|
22
24
|
- `.soturail/context/cursor-context.md`
|
|
25
|
+
- `.soturail/context/antigravity-context.md`
|
|
23
26
|
- `.soturail/context/generic-context.md`
|
|
24
27
|
|
|
25
28
|
Stable-cache order:
|
|
@@ -32,8 +35,12 @@ Stable-cache order:
|
|
|
32
35
|
6. Approved specs.
|
|
33
36
|
7. Approved memory.
|
|
34
37
|
8. Skills summary.
|
|
35
|
-
9.
|
|
38
|
+
9. Workflow summary.
|
|
39
|
+
10. MCP resource list.
|
|
40
|
+
11. Dynamic footer with timestamps, current commit, raw IDs and recent command notes.
|
|
36
41
|
|
|
37
42
|
Dynamic data never appears before stable blocks.
|
|
38
43
|
|
|
39
44
|
Review a generated pack before pasting it into an agent. Dynamic footer data can include recent command status, raw IDs or branch details.
|
|
45
|
+
|
|
46
|
+
`soturail init` scaffolds context-pack examples under `examples/context-packs/`, and v0.4 agent examples can be paired with `soturail context pack --target all` for a clean first setup.
|
package/docs/hooks/claude.md
CHANGED
package/docs/hooks/mcp.md
CHANGED
|
@@ -7,4 +7,4 @@ soturail hooks install --agent claude --mode mcp --dry-run
|
|
|
7
7
|
soturail mcp serve --transport stdio
|
|
8
8
|
```
|
|
9
9
|
|
|
10
|
-
Review generated instructions before enabling. SotuRail's MCP server exposes read-only resources and safe tools; it does not expose arbitrary shell execution
|
|
10
|
+
Review generated instructions before enabling. SotuRail's MCP server exposes read-only resources and safe tools; it does not expose arbitrary shell execution.
|
package/docs/hooks.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Agent Hooks
|
|
2
2
|
|
|
3
|
-
SotuRail hook support is cautious. Claude gets conservative safe-hooks and MCP guidance first; Codex, Gemini and
|
|
3
|
+
SotuRail hook support is cautious. Claude gets conservative safe-hooks and MCP guidance first; Codex, Gemini, Cursor and Antigravity use prompt-only fallbacks when stable native hook APIs are unavailable.
|
|
4
4
|
|
|
5
5
|
```bash
|
|
6
6
|
soturail hooks list
|
|
@@ -10,9 +10,12 @@ soturail hooks install --agent claude --mode mcp
|
|
|
10
10
|
soturail hooks install --agent codex --mode prompt-only
|
|
11
11
|
soturail hooks install --agent gemini --mode prompt-only
|
|
12
12
|
soturail hooks install --agent cursor --mode prompt-only
|
|
13
|
+
soturail hooks install --agent antigravity --mode prompt-only --dry-run
|
|
13
14
|
soturail hooks uninstall --agent claude
|
|
15
|
+
soturail hooks uninstall --agent claude --dry-run
|
|
14
16
|
soturail hooks export --agent claude
|
|
15
17
|
soturail hooks export --agent codex
|
|
18
|
+
soturail hooks export --agent antigravity
|
|
16
19
|
```
|
|
17
20
|
|
|
18
21
|
Installers create backups before modifying existing files. Dry-run prints every file that would change. If a host config location is uncertain, SotuRail generates prompt-only guidance instead of guessing.
|
|
@@ -24,6 +27,6 @@ Always review generated hooks before enabling them. SotuRail should never auto-i
|
|
|
24
27
|
`soturail hooks doctor` prints safe modes and next commands:
|
|
25
28
|
|
|
26
29
|
- Claude: `safe-hooks` and `mcp`.
|
|
27
|
-
- Codex, Gemini and
|
|
30
|
+
- Codex, Gemini, Cursor and Antigravity: `prompt-only`.
|
|
28
31
|
- Start with `--dry-run`.
|
|
29
32
|
- Export guidance with `soturail hooks export --agent claude`.
|
package/docs/mcp.md
CHANGED
|
@@ -5,6 +5,8 @@ SotuRail includes a local MCP-compatible server over stdio using JSON-RPC 2.0 st
|
|
|
5
5
|
```bash
|
|
6
6
|
soturail mcp doctor
|
|
7
7
|
soturail mcp manifest
|
|
8
|
+
soturail mcp config --agent generic
|
|
9
|
+
soturail mcp smoke
|
|
8
10
|
soturail mcp serve --transport stdio
|
|
9
11
|
```
|
|
10
12
|
|
|
@@ -58,3 +60,19 @@ Security defaults:
|
|
|
58
60
|
- no `soturail.run` MCP tool by default;
|
|
59
61
|
- raw log expansion redacts probable secrets unless `allow_raw=true`;
|
|
60
62
|
- provider cache hits are never invented.
|
|
63
|
+
|
|
64
|
+
## Host Config Helpers
|
|
65
|
+
|
|
66
|
+
`soturail mcp config --agent claude|cursor|generic` writes a reviewed stdio snippet under `.soturail/exports/mcp/<agent>/mcp-config.json`.
|
|
67
|
+
|
|
68
|
+
The snippet runs:
|
|
69
|
+
|
|
70
|
+
```bash
|
|
71
|
+
soturail mcp serve --transport stdio
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
It does not assume a global application config path. Review it before adding it to an agent host.
|
|
75
|
+
|
|
76
|
+
`soturail mcp smoke` verifies `initialize`, `resources/list`, `resources/read` and `tools/list` without starting a long-running process, and confirms `soturail.run` is not exposed by default.
|
|
77
|
+
|
|
78
|
+
`soturail init` scaffolds copyable MCP JSON-RPC examples under `examples/mcp/`.
|
package/docs/metrics.md
CHANGED
|
@@ -29,13 +29,14 @@ SotuRail metrics are local, append-only and transparent.
|
|
|
29
29
|
- real provider cache hits only if imported metadata exists.
|
|
30
30
|
- response compression reduction and preservation counts;
|
|
31
31
|
- rules ingestion and validation counts;
|
|
32
|
-
- benchmark fixture measurements
|
|
32
|
+
- benchmark fixture measurements;
|
|
33
|
+
- agent export, MCP smoke and Workflow Rail benchmark measurements.
|
|
33
34
|
|
|
34
35
|
Small command outputs can be larger after SotuRail adds raw recovery metadata. When that happens, `compression_effective` is `false` and the CLI prints the small-output warning instead of hiding the overhead.
|
|
35
36
|
|
|
36
37
|
## Token Estimation
|
|
37
38
|
|
|
38
|
-
|
|
39
|
+
SotuRail uses:
|
|
39
40
|
|
|
40
41
|
```text
|
|
41
42
|
Math.ceil(text.length / 4)
|
package/docs/mvp.md
CHANGED
package/docs/release-workflow.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Release Workflow
|
|
2
2
|
|
|
3
|
-
SotuRail releases should be repeatable and evidence-backed.
|
|
3
|
+
SotuRail releases should be repeatable and evidence-backed. Release helpers are exposed through `soturail release`.
|
|
4
4
|
|
|
5
5
|
## Check
|
|
6
6
|
|
|
@@ -19,6 +19,7 @@ The check also verifies:
|
|
|
19
19
|
- expected package files are present and forbidden generated files are absent;
|
|
20
20
|
- `CHANGELOG.md` and `RELEASE_NOTES_vX.Y.Z.md` exist for the local version;
|
|
21
21
|
- README install instructions and `LICENSE` exist.
|
|
22
|
+
- required GitHub CI and community files exist under `.github/`.
|
|
22
23
|
|
|
23
24
|
You can run only the package verification gate with:
|
|
24
25
|
|
|
@@ -30,6 +31,8 @@ This catches stale generated version files that local source checks might miss.
|
|
|
30
31
|
|
|
31
32
|
As of v0.3.3, release verification installs the packed `.tgz` into a clean temporary project and executes the CLI from `node_modules/soturail/dist/cli.js`. It does not call global `soturail`, `npx soturail` or `npm exec --package=soturail`, which avoids npm cache/global CLI false positives.
|
|
32
33
|
|
|
34
|
+
Keep using this packed-package gate before publishing. `npm exec --package=soturail@<version>` is a post-publish registry verification, not the pre-publish source of truth.
|
|
35
|
+
|
|
33
36
|
## Publish
|
|
34
37
|
|
|
35
38
|
```bash
|
package/docs/security-model.md
CHANGED
|
@@ -41,9 +41,13 @@ soturail expand <raw_id> --allow-raw --yes
|
|
|
41
41
|
|
|
42
42
|
MCP raw-log expansion also redacts probable secrets by default unless `allow_raw=true` is explicitly passed.
|
|
43
43
|
|
|
44
|
-
## MCP And
|
|
44
|
+
## MCP, Skills, Agents And Workflows
|
|
45
45
|
|
|
46
|
-
The
|
|
46
|
+
The MCP server does not expose arbitrary shell execution. Skill Rail exports are local files for human review; SotuRail does not auto-install unreviewed third-party skills.
|
|
47
|
+
|
|
48
|
+
Agent installs are dry-run-first and backup-first. Unknown global host config locations are not modified automatically.
|
|
49
|
+
|
|
50
|
+
Workflow Rail does not push, merge or delete worktrees automatically. Worktree support is local and review-oriented.
|
|
47
51
|
|
|
48
52
|
## Limitations
|
|
49
53
|
|
package/docs/usage.md
CHANGED
|
@@ -8,6 +8,8 @@ soturail init
|
|
|
8
8
|
|
|
9
9
|
Creates `.soturail/` and starter docs without overwriting existing files.
|
|
10
10
|
|
|
11
|
+
The scaffold includes docs and examples for agents, MCP, context packs, hooks, skills and workflows.
|
|
12
|
+
|
|
11
13
|
## Index
|
|
12
14
|
|
|
13
15
|
```bash
|
|
@@ -63,7 +65,7 @@ soturail native doctor
|
|
|
63
65
|
soturail bench compare-engines
|
|
64
66
|
```
|
|
65
67
|
|
|
66
|
-
##
|
|
68
|
+
## Skill, MCP And Context Workflows
|
|
67
69
|
|
|
68
70
|
```bash
|
|
69
71
|
soturail skills init demo-skill
|
|
@@ -82,6 +84,23 @@ soturail hooks install --agent claude --mode safe-hooks --dry-run
|
|
|
82
84
|
soturail release check
|
|
83
85
|
```
|
|
84
86
|
|
|
85
|
-
MCP is local stdio JSON-RPC style transport and does not expose arbitrary shell execution
|
|
87
|
+
MCP is local stdio JSON-RPC style transport and does not expose arbitrary shell execution.
|
|
86
88
|
|
|
87
89
|
For a first clean-folder walkthrough, see [first-real-workflow.md](first-real-workflow.md).
|
|
90
|
+
|
|
91
|
+
## Agent And Workflow Rail Commands
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
soturail agents list
|
|
95
|
+
soturail agents doctor
|
|
96
|
+
soturail agents export --agent all
|
|
97
|
+
soturail agents install --agent claude --mode mcp --dry-run
|
|
98
|
+
soturail mcp config --agent generic
|
|
99
|
+
soturail mcp smoke
|
|
100
|
+
soturail context pack --target all
|
|
101
|
+
soturail workflow new "Implement feature"
|
|
102
|
+
soturail workflow list
|
|
103
|
+
soturail workflow start <id> --worktree --dry-run
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
Agent exports are written to `.soturail/exports/agents/`. Workflow Rail stores local task state under `.soturail/workflows/`.
|
package/docs/windows.md
CHANGED
|
@@ -78,7 +78,10 @@ PowerShell examples:
|
|
|
78
78
|
```powershell
|
|
79
79
|
soturail mcp doctor
|
|
80
80
|
soturail mcp manifest
|
|
81
|
+
soturail mcp smoke
|
|
82
|
+
soturail mcp config --agent generic
|
|
81
83
|
soturail context pack --target generic
|
|
84
|
+
soturail context pack --target all
|
|
82
85
|
```
|
|
83
86
|
|
|
84
87
|
CMD examples:
|
|
@@ -86,11 +89,50 @@ CMD examples:
|
|
|
86
89
|
```bat
|
|
87
90
|
soturail mcp doctor
|
|
88
91
|
soturail mcp manifest
|
|
92
|
+
soturail mcp smoke
|
|
93
|
+
soturail mcp config --agent generic
|
|
89
94
|
soturail context pack --target generic
|
|
95
|
+
soturail context pack --target all
|
|
90
96
|
```
|
|
91
97
|
|
|
92
98
|
When testing `soturail mcp serve --transport stdio`, send one JSON object per line. See `examples\mcp\` for payloads.
|
|
93
99
|
|
|
100
|
+
## Agent And Workflow Commands
|
|
101
|
+
|
|
102
|
+
PowerShell:
|
|
103
|
+
|
|
104
|
+
```powershell
|
|
105
|
+
soturail agents doctor
|
|
106
|
+
soturail agents export --agent all
|
|
107
|
+
soturail workflow new "Try SotuRail"
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
CMD:
|
|
111
|
+
|
|
112
|
+
```bat
|
|
113
|
+
soturail agents doctor
|
|
114
|
+
soturail agents export --agent all
|
|
115
|
+
soturail workflow new "Try SotuRail"
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
Quote workflow titles and paths with spaces.
|
|
119
|
+
|
|
120
|
+
## Clean Project Flow
|
|
121
|
+
|
|
122
|
+
PowerShell and CMD:
|
|
123
|
+
|
|
124
|
+
```powershell
|
|
125
|
+
soturail init
|
|
126
|
+
soturail context pack --target all
|
|
127
|
+
soturail agents doctor
|
|
128
|
+
soturail agents export --agent all
|
|
129
|
+
soturail mcp smoke
|
|
130
|
+
soturail workflow new "Try SotuRail"
|
|
131
|
+
soturail workflow list
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
`soturail init` creates agent and workflow examples without overwriting existing files.
|
|
135
|
+
|
|
94
136
|
## Safety
|
|
95
137
|
|
|
96
138
|
SotuRail blocks destructive command shapes through `soturail run`, including `rm -rf`, `sudo`, `del /s`, downloaded script piping and automatic `git push`.
|
|
@@ -107,7 +149,7 @@ npm run release:check
|
|
|
107
149
|
|
|
108
150
|
`package.json`, `package-lock.json`, `node dist/cli.js --version`, the npm tarball name, the changelog and the release notes must all agree on the same version.
|
|
109
151
|
|
|
110
|
-
|
|
152
|
+
SotuRail also verifies the packed tarball by installing it in a temporary clean project and running the installed CLI. This helps catch stale generated version files before publish.
|
|
111
153
|
|
|
112
154
|
Use browser-based npm login when needed:
|
|
113
155
|
|
package/docs/workflow-rail.md
CHANGED
|
@@ -1,32 +1,59 @@
|
|
|
1
1
|
# Workflow Rail
|
|
2
2
|
|
|
3
|
-
Workflow Rail is
|
|
3
|
+
Workflow Rail is a local task state system for SotuRail. It stores auditable workflow artifacts under `.soturail/workflows/` and can optionally plan or create local Git worktrees.
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
```bash
|
|
6
|
+
soturail workflow new "Implement feature"
|
|
7
|
+
soturail workflow list
|
|
8
|
+
soturail workflow show <id>
|
|
9
|
+
soturail workflow plan <id>
|
|
10
|
+
soturail workflow start <id> --worktree --dry-run
|
|
11
|
+
soturail workflow status <id>
|
|
12
|
+
soturail workflow verify <id>
|
|
13
|
+
soturail workflow close <id>
|
|
14
|
+
soturail workflow cleanup --closed --dry-run
|
|
15
|
+
```
|
|
6
16
|
|
|
7
|
-
|
|
17
|
+
## State Machine
|
|
8
18
|
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
19
|
+
Workflows use explicit states:
|
|
20
|
+
|
|
21
|
+
- `draft`
|
|
22
|
+
- `planned`
|
|
23
|
+
- `active`
|
|
24
|
+
- `verifying`
|
|
25
|
+
- `ready_for_review`
|
|
26
|
+
- `closed`
|
|
27
|
+
- `blocked`
|
|
28
|
+
|
|
29
|
+
## Storage
|
|
30
|
+
|
|
31
|
+
Each workflow uses:
|
|
32
|
+
|
|
33
|
+
```txt
|
|
34
|
+
.soturail/workflows/<id>/
|
|
35
|
+
├── workflow.yml
|
|
36
|
+
├── plan.md
|
|
37
|
+
├── tasks.md
|
|
38
|
+
├── verification.md
|
|
39
|
+
└── logs/
|
|
14
40
|
```
|
|
15
41
|
|
|
16
|
-
##
|
|
42
|
+
## Worktrees
|
|
43
|
+
|
|
44
|
+
`soturail workflow start <id> --worktree --dry-run` prints a local worktree plan. If run without `--dry-run` inside a Git repository, SotuRail may create a local worktree under `.soturail/worktrees/<id>/`.
|
|
45
|
+
|
|
46
|
+
Safety rules:
|
|
47
|
+
|
|
48
|
+
- SotuRail does not push.
|
|
49
|
+
- SotuRail does not merge.
|
|
50
|
+
- SotuRail does not delete user work without explicit confirmation.
|
|
51
|
+
- Rollback instructions are printed when worktrees are planned.
|
|
17
52
|
|
|
18
|
-
|
|
19
|
-
- Validate workflow files before execution or export.
|
|
20
|
-
- Scan for prompt injection.
|
|
21
|
-
- Scan for destructive shell commands.
|
|
22
|
-
- Scan for secret exfiltration.
|
|
23
|
-
- Scan for downloaded script execution such as `curl ... | sh` and `wget ... | bash`.
|
|
24
|
-
- Require human approval before enabling generated workflows or exported skills.
|
|
53
|
+
## Verification
|
|
25
54
|
|
|
26
|
-
|
|
55
|
+
`soturail workflow verify <id>` only runs configured safe checks when they are explicit. Without configured checks, it prints a checklist instead of inventing commands.
|
|
27
56
|
|
|
28
|
-
##
|
|
57
|
+
## Cleanup
|
|
29
58
|
|
|
30
|
-
-
|
|
31
|
-
- v0.3.2: stronger reducers and deduplication.
|
|
32
|
-
- v0.4.0: real agent integrations and Workflow Rail.
|
|
59
|
+
`soturail workflow cleanup --closed --dry-run` previews closed workflow records that could be removed. It does not delete anything unless rerun with `--closed --yes` after review.
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
# Agent Examples
|
|
2
|
+
|
|
3
|
+
These examples show how to use SotuRail exports without modifying global agent configuration.
|
|
4
|
+
|
|
5
|
+
```bash
|
|
6
|
+
soturail agents doctor
|
|
7
|
+
soturail agents export --agent all
|
|
8
|
+
soturail mcp config --agent generic
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
Review generated files under `.soturail/exports/agents/` before enabling them in any agent host.
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
# Claude Example
|
|
2
|
+
|
|
3
|
+
```bash
|
|
4
|
+
soturail agents export --agent claude
|
|
5
|
+
soturail mcp config --agent claude
|
|
6
|
+
soturail hooks install --agent claude --mode safe-hooks --dry-run
|
|
7
|
+
```
|
|
8
|
+
|
|
9
|
+
Review `CLAUDE.md`, `mcp-config.json` and `safe-hooks.md` before copying anything into Claude Code settings.
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
# Workflow Examples
|
|
2
|
+
|
|
3
|
+
Workflow Rail stores local task state under `.soturail/workflows/`.
|
|
4
|
+
|
|
5
|
+
```bash
|
|
6
|
+
soturail workflow new "Fix bug"
|
|
7
|
+
soturail workflow list
|
|
8
|
+
soturail workflow plan <id>
|
|
9
|
+
soturail workflow start <id> --worktree --dry-run
|
|
10
|
+
soturail workflow verify <id>
|
|
11
|
+
```
|
|
12
|
+
|
|
13
|
+
SotuRail does not push, merge or delete worktrees automatically.
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
# Bugfix Workflow
|
|
2
|
+
|
|
3
|
+
```bash
|
|
4
|
+
soturail workflow new "Fix parser bug"
|
|
5
|
+
soturail workflow plan <id>
|
|
6
|
+
soturail context pack --target codex
|
|
7
|
+
soturail run npm test
|
|
8
|
+
soturail workflow verify <id>
|
|
9
|
+
```
|
|
10
|
+
|
|
11
|
+
Keep evidence local and include raw IDs in the final review notes when useful.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "soturail",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.1",
|
|
4
4
|
"description": "Local-first context rails for AI coding agents: reversible terminal compression, progressive repo reading, SDD workflows, hooks, benchmarks, memory and cache-friendly payloads.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|