specweave 1.0.31 → 1.0.33

package/plugins/specweave/hooks/config-env-separator.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-#
-# Pre-Tool-Use Hook: Config-Env Separator
-#
-# Blocks Write/Edit to src/ files that read config values from process.env
-# Configuration (domain, org, project) should come from ConfigManager (config.json)
-# Only secrets (PAT, tokens, emails) should use process.env
-#
-# Ref: ADR-0194 - Enforce Config JSON Separation
-#
-
-set -e
-
-# Only run for Write and Edit tools
-if [[ "$TOOL_NAME" != "Write" ]] && [[ "$TOOL_NAME" != "Edit" ]]; then
-  exit 0
-fi
-
-# Parse tool input
-FILE_PATH=$(echo "$TOOL_INPUT" | jq -r '.file_path // empty')
-CONTENT=$(echo "$TOOL_INPUT" | jq -r '.content // .new_string // empty')
-
-# Skip if no file path
-if [[ -z "$FILE_PATH" ]]; then
-  exit 0
-fi
-
-# Only check src/ files (not tests, plugins, etc.)
-if [[ ! "$FILE_PATH" =~ /src/ ]]; then
-  exit 0
-fi
-
-# Skip test files
-if [[ "$FILE_PATH" =~ \.test\.ts$ ]]; then
-  exit 0
-fi
-
-# Skip spec files
-if [[ "$FILE_PATH" =~ \.spec\.ts$ ]]; then
-  exit 0
-fi
-
-# Config variables that should NOT be in process.env
-CONFIG_VARS=(
-  "JIRA_DOMAIN"
-  "JIRA_BASE_URL"
-  "AZURE_DEVOPS_ORG"
-  "AZURE_DEVOPS_PROJECT"
-  "GITHUB_OWNER"
-  "GITHUB_REPO"
-  "ADO_ORG_URL"
-  "ADO_PROJECT"
-)
-
-# Check for violations
-VIOLATIONS=""
-for VAR in "${CONFIG_VARS[@]}"; do
-  if echo "$CONTENT" | grep -q "process\.env\.$VAR"; then
-    VIOLATIONS="$VIOLATIONS\n  - process.env.$VAR"
-  fi
-done
-
-# If violations found, block the operation
-if [[ -n "$VIOLATIONS" ]]; then
-  echo ""
-  echo "-------------------------------------------------------------------"
-  echo "BLOCKED: Configuration values MUST use ConfigManager, not process.env"
-  echo "-------------------------------------------------------------------"
-  echo ""
-  echo "File: $FILE_PATH"
-  echo ""
-  echo "Violations detected:"
-  echo -e "$VIOLATIONS"
-  echo ""
-  echo "CORRECT PATTERN:"
-  echo "  const config = await this.configManager.read();"
-  echo "  const domain = config.issueTracker?.domain || '';"
-  echo "  const org = config.issueTracker?.organization_ado || '';"
-  echo ""
-  echo "FORBIDDEN PATTERN:"
-  echo "  const domain = process.env.JIRA_DOMAIN;  // VIOLATION!"
-  echo "  const org = process.env.AZURE_DEVOPS_ORG;  // VIOLATION!"
-  echo ""
-  echo "Ref: ADR-0194, CLAUDE.md Configuration section"
-  echo ""
-  echo "To bypass (EMERGENCY ONLY): SPECWEAVE_SKIP_CONFIG_CHECK=1"
-  echo "-------------------------------------------------------------------"
-  echo ""
-
-  # Allow bypass for emergencies
-  if [[ "$SPECWEAVE_SKIP_CONFIG_CHECK" == "1" ]]; then
-    echo "WARNING: SPECWEAVE_SKIP_CONFIG_CHECK=1 - Bypassing config check!"
-    exit 0
-  fi
-
-  exit 1
-fi
-
-exit 0

package/plugins/specweave/hooks/github-metadata-guard.sh

@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-# github-metadata-guard.sh - Prevents redundant metadata headers in GitHub issue bodies
-# WHY: GitHub has NATIVE fields (labels, milestones) - metadata belongs there, NOT in body
-# See: .specweave/docs/internal/troubleshooting/CRITICAL-remove-metadata-header-from-github-issues.md
-
-# Activation: PreToolUse event for Write/Edit tools
-# Blocks: Any attempt to add metadata header (Feature, Status, Priority, Project) to GitHub issue body builders
-
-# Exit codes:
-# 0 = Allow operation (no metadata header detected)
-# 1 = Block operation (metadata header detected)
-
-# Only validate Write/Edit operations in GitHub plugin files
-if [[ "$TOOL_NAME" != "Write" && "$TOOL_NAME" != "Edit" ]]; then
-  exit 0
-fi
-
-# Only check GitHub issue body builder files
-if [[ ! "$file_path" =~ plugins/specweave-github/lib/.*issue.*builder\.ts$ ]]; then
-  exit 0
-fi
-
-# Get content to check (new_string for Edit, content for Write)
-content_to_check=""
-if [[ "$TOOL_NAME" == "Edit" ]]; then
-  content_to_check="$new_string"
-elif [[ "$TOOL_NAME" == "Write" ]]; then
-  content_to_check="$content"
-fi
-
-# Check for metadata header patterns (case-insensitive)
-if echo "$content_to_check" | grep -qiE '^\*\*Feature\*\*:|^\*\*Status\*\*:|^\*\*Priority\*\*:|^\*\*Project\*\*:'; then
-  echo "❌ BLOCKED: GitHub issue body MUST NOT contain metadata header!" >&2
-  echo "" >&2
-  echo "WHY: GitHub has NATIVE fields for metadata:" >&2
-  echo "  - Feature → Milestone" >&2
-  echo "  - Status → Label (status:*)" >&2
-  echo "  - Priority → Label (p1, p2, p3)" >&2
-  echo "  - Project → Label (project:*)" >&2
-  echo "" >&2
-  echo "Body should contain ONLY actual work content:" >&2
-  echo "  ✅ ## Progress" >&2
-  echo "  ✅ ## User Story" >&2
-  echo "  ✅ ## Acceptance Criteria" >&2
-  echo "  ✅ ## Tasks" >&2
-  echo "" >&2
-  echo "See: .specweave/docs/internal/troubleshooting/CRITICAL-remove-metadata-header-from-github-issues.md" >&2
-  exit 1
-fi
-
-# Check for metadata at start of body string assignments
-if echo "$content_to_check" | grep -qE 'body \+= `\*\*(Feature|Status|Priority|Project)\*\*:'; then
-  echo "❌ BLOCKED: Metadata header assignment detected in GitHub issue body builder!" >&2
-  echo "" >&2
-  echo "Detected pattern: body += \`**Feature**:\` or similar" >&2
-  echo "" >&2
-  echo "FORBIDDEN CODE:" >&2
-  echo "  body += \`**Feature**: \${featureId}\`;" >&2
-  echo "  body += \`**Status**: \${status}\`;" >&2
-  echo "  body += \`**Priority**: \${priority}\`;" >&2
-  echo "  body += \`**Project**: \${project}\`;" >&2
-  echo "" >&2
-  echo "Use labels instead:" >&2
-  echo "  labels.push(\`status:\${status}\`);" >&2
-  echo "  labels.push(priority.toLowerCase());" >&2
-  echo "  labels.push(\`project:\${project}\`);" >&2
-  echo "" >&2
-  echo "See: .specweave/docs/internal/troubleshooting/CRITICAL-remove-metadata-header-from-github-issues.md" >&2
-  exit 1
-fi
-
-# Allow operation (no metadata header detected)
-exit 0

package/plugins/specweave/hooks/lib/circuit-breaker.sh

@@ -1,381 +0,0 @@
-#!/bin/bash
-# circuit-breaker.sh - Proper Circuit Breaker Pattern for SpecWeave Hooks
-#
-# PROBLEM SOLVED:
-#   The old circuit breaker was too simple - it just counted failures and blocked everything.
-#   This implementation follows the proper circuit breaker pattern with three states:
-#   - CLOSED: Normal operation, requests flow through
-#   - OPEN: Too many failures, requests are rejected immediately (fail-fast)
-#   - HALF-OPEN: Testing if system recovered, allows limited requests
-#
-# DESIGN:
-#   - Failure threshold before opening (default: 5 failures in 60s window)
-#   - Recovery timeout before half-open (default: 30s)
-#   - Success threshold to close (default: 3 successes in half-open)
-#   - Per-hook circuit breakers (not global)
-#   - Sliding window for failure counting
-#   - Automatic state transitions
-#
-# USAGE:
-#   source circuit-breaker.sh
-#
-#   # Before executing hook:
-#   if cb_allow_request "hook-name"; then
-#     # Execute hook
-#     if hook_succeeded; then
-#       cb_record_success "hook-name"
-#     else
-#       cb_record_failure "hook-name"
-#     fi
-#   else
-#     # Circuit is open, return safe default
-#   fi
-#
-# v1.0.0 - Initial implementation (2025-12-17)
-
-set -o pipefail
-
-# === Configuration ===
-CB_STATE_DIR="${SPECWEAVE_STATE_DIR:-.specweave/state}/circuit-breakers"
-CB_FAILURE_THRESHOLD="${CB_FAILURE_THRESHOLD:-5}"       # Failures before OPEN
-CB_FAILURE_WINDOW_SEC="${CB_FAILURE_WINDOW_SEC:-60}"    # Sliding window for counting failures
-CB_RECOVERY_TIMEOUT_SEC="${CB_RECOVERY_TIMEOUT_SEC:-30}" # Time in OPEN before HALF-OPEN
-CB_SUCCESS_THRESHOLD="${CB_SUCCESS_THRESHOLD:-3}"       # Successes in HALF-OPEN to CLOSE
-CB_DEBUG="${CB_DEBUG:-0}"
-
-# States
-CB_STATE_CLOSED="CLOSED"
-CB_STATE_OPEN="OPEN"
-CB_STATE_HALF_OPEN="HALF_OPEN"
-
-# === Initialization ===
-_cb_init() {
-  mkdir -p "$CB_STATE_DIR" 2>/dev/null || true
-}
-
-# === Logging ===
-_cb_log() {
-  [[ "$CB_DEBUG" == "1" ]] && echo "[CB $(date +%H:%M:%S)] $*" >&2
-}
-
-# === State File Paths ===
-_cb_state_file() {
-  local name="$1"
-  echo "$CB_STATE_DIR/${name}.state"
-}
-
-_cb_failures_file() {
-  local name="$1"
-  echo "$CB_STATE_DIR/${name}.failures"
-}
-
-_cb_successes_file() {
-  local name="$1"
-  echo "$CB_STATE_DIR/${name}.successes"
-}
-
-# === Read/Write State ===
-_cb_read_state() {
-  local name="$1"
-  local state_file
-  state_file=$(_cb_state_file "$name")
-
-  if [[ -f "$state_file" ]]; then
-    cat "$state_file" 2>/dev/null || echo "$CB_STATE_CLOSED"
-  else
-    echo "$CB_STATE_CLOSED"
-  fi
-}
-
-_cb_write_state() {
-  local name="$1"
-  local state="$2"
-  local state_file
-  state_file=$(_cb_state_file "$name")
-
-  _cb_init
-  echo "$state" > "$state_file" 2>/dev/null || true
-  _cb_log "State transition for $name: -> $state"
-}
-
-# === Timestamp helpers ===
-_cb_now() {
-  date +%s
-}
-
-_cb_file_mtime() {
-  local file="$1"
-  if [[ "$(uname)" == "Darwin" ]]; then
-    stat -f %m "$file" 2>/dev/null || echo "0"
-  else
-    stat -c %Y "$file" 2>/dev/null || echo "0"
-  fi
-}
-
-# === Failure Tracking (Sliding Window) ===
-_cb_count_recent_failures() {
-  local name="$1"
-  local failures_file
-  failures_file=$(_cb_failures_file "$name")
-
-  [[ ! -f "$failures_file" ]] && echo "0" && return
-
-  local now
-  now=$(_cb_now)
-  local window_start=$((now - CB_FAILURE_WINDOW_SEC))
-  local count=0
-
-  # Read failure timestamps and count those within window
-  while IFS= read -r timestamp; do
-    [[ -z "$timestamp" ]] && continue
-    if [[ "$timestamp" -ge "$window_start" ]]; then
-      count=$((count + 1))
-    fi
-  done < "$failures_file"
-
-  echo "$count"
-}
-
-_cb_add_failure() {
-  local name="$1"
-  local failures_file
-  failures_file=$(_cb_failures_file "$name")
-
-  _cb_init
-  local now
-  now=$(_cb_now)
-
-  # Append timestamp
-  echo "$now" >> "$failures_file" 2>/dev/null || true
-
-  # Cleanup old entries (keep only last 100)
-  if [[ -f "$failures_file" ]]; then
-    tail -100 "$failures_file" > "${failures_file}.tmp" 2>/dev/null && \
-      mv "${failures_file}.tmp" "$failures_file" 2>/dev/null || true
-  fi
-}
-
-_cb_clear_failures() {
-  local name="$1"
-  local failures_file
-  failures_file=$(_cb_failures_file "$name")
-  rm -f "$failures_file" 2>/dev/null || true
-}
-
-# === Success Tracking (Half-Open State) ===
-_cb_count_successes() {
-  local name="$1"
-  local successes_file
-  successes_file=$(_cb_successes_file "$name")
-
-  [[ ! -f "$successes_file" ]] && echo "0" && return
-
-  wc -l < "$successes_file" 2>/dev/null | tr -d ' '
-}
-
-_cb_add_success() {
-  local name="$1"
-  local successes_file
-  successes_file=$(_cb_successes_file "$name")
-
-  _cb_init
-  echo "$(_cb_now)" >> "$successes_file" 2>/dev/null || true
-}
-
-_cb_clear_successes() {
-  local name="$1"
-  local successes_file
-  successes_file=$(_cb_successes_file "$name")
-  rm -f "$successes_file" 2>/dev/null || true
-}
-
-# === State Transitions ===
-_cb_check_should_open() {
-  local name="$1"
-  local failure_count
-  failure_count=$(_cb_count_recent_failures "$name")
-
-  if [[ "$failure_count" -ge "$CB_FAILURE_THRESHOLD" ]]; then
-    _cb_log "$name: Failure threshold reached ($failure_count >= $CB_FAILURE_THRESHOLD)"
-    return 0  # Should open
-  fi
-  return 1  # Should not open
-}
-
-_cb_check_should_half_open() {
-  local name="$1"
-  local state_file
-  state_file=$(_cb_state_file "$name")
-
-  [[ ! -f "$state_file" ]] && return 1
-
-  local state_mtime
-  state_mtime=$(_cb_file_mtime "$state_file")
-  local now
-  now=$(_cb_now)
-  local age=$((now - state_mtime))
-
-  if [[ "$age" -ge "$CB_RECOVERY_TIMEOUT_SEC" ]]; then
-    _cb_log "$name: Recovery timeout reached (${age}s >= ${CB_RECOVERY_TIMEOUT_SEC}s)"
-    return 0  # Should transition to half-open
-  fi
-  return 1
-}
-
-_cb_check_should_close() {
-  local name="$1"
-  local success_count
-  success_count=$(_cb_count_successes "$name")
-
-  if [[ "$success_count" -ge "$CB_SUCCESS_THRESHOLD" ]]; then
-    _cb_log "$name: Success threshold reached ($success_count >= $CB_SUCCESS_THRESHOLD)"
-    return 0  # Should close
-  fi
-  return 1
-}
-
-# === Public API ===
-
-# Check if request should be allowed
-# Returns 0 if allowed, 1 if circuit is open
-cb_allow_request() {
-  local name="${1:-default}"
-
-  _cb_init
-
-  local state
-  state=$(_cb_read_state "$name")
-
-  case "$state" in
-    "$CB_STATE_CLOSED")
-      _cb_log "$name: CLOSED - allowing request"
-      return 0
-      ;;
-
-    "$CB_STATE_OPEN")
-      # Check if we should transition to half-open
-      if _cb_check_should_half_open "$name"; then
-        _cb_write_state "$name" "$CB_STATE_HALF_OPEN"
-        _cb_clear_successes "$name"
-        _cb_log "$name: OPEN -> HALF_OPEN - allowing test request"
-        return 0
-      fi
-      _cb_log "$name: OPEN - rejecting request (fail-fast)"
-      return 1
-      ;;
-
-    "$CB_STATE_HALF_OPEN")
-      _cb_log "$name: HALF_OPEN - allowing test request"
-      return 0
-      ;;
-
-    *)
-      # Unknown state, default to closed
-      _cb_write_state "$name" "$CB_STATE_CLOSED"
-      return 0
-      ;;
-  esac
-}
-
-# Record successful request
-cb_record_success() {
-  local name="${1:-default}"
-
-  local state
-  state=$(_cb_read_state "$name")
-
-  case "$state" in
-    "$CB_STATE_CLOSED")
-      # Clear any old failures on success
-      # (helps prevent lingering failures from keeping count high)
-      ;;
-
-    "$CB_STATE_HALF_OPEN")
-      _cb_add_success "$name"
-      if _cb_check_should_close "$name"; then
-        _cb_write_state "$name" "$CB_STATE_CLOSED"
-        _cb_clear_failures "$name"
-        _cb_clear_successes "$name"
-        _cb_log "$name: HALF_OPEN -> CLOSED (recovered)"
-      fi
-      ;;
-  esac
-}
-
-# Record failed request
-cb_record_failure() {
-  local name="${1:-default}"
-
-  local state
-  state=$(_cb_read_state "$name")
-
-  _cb_add_failure "$name"
-
-  case "$state" in
-    "$CB_STATE_CLOSED")
-      if _cb_check_should_open "$name"; then
-        _cb_write_state "$name" "$CB_STATE_OPEN"
-        _cb_log "$name: CLOSED -> OPEN (too many failures)"
-      fi
-      ;;
-
-    "$CB_STATE_HALF_OPEN")
-      # Any failure in half-open immediately opens circuit
-      _cb_write_state "$name" "$CB_STATE_OPEN"
-      _cb_clear_successes "$name"
-      _cb_log "$name: HALF_OPEN -> OPEN (failed during recovery)"
-      ;;
-  esac
-}
-
-# Get circuit breaker status
-cb_get_status() {
-  local name="${1:-default}"
-
-  _cb_init
-
-  local state
-  state=$(_cb_read_state "$name")
-  local failures
-  failures=$(_cb_count_recent_failures "$name")
-  local successes
-  successes=$(_cb_count_successes "$name")
-
-  echo "{\"name\":\"$name\",\"state\":\"$state\",\"failures\":$failures,\"successes\":$successes,\"failure_threshold\":$CB_FAILURE_THRESHOLD,\"recovery_timeout_sec\":$CB_RECOVERY_TIMEOUT_SEC}"
-}
-
-# Force reset circuit breaker
-cb_reset() {
-  local name="${1:-default}"
-
-  _cb_write_state "$name" "$CB_STATE_CLOSED"
-  _cb_clear_failures "$name"
-  _cb_clear_successes "$name"
-  _cb_log "$name: Force reset to CLOSED"
-}
-
-# List all circuit breakers
-cb_list_all() {
-  _cb_init
-
-  local result="["
-  local first=true
-
-  for state_file in "$CB_STATE_DIR"/*.state; do
-    [[ ! -f "$state_file" ]] && continue
-
-    local name
-    name=$(basename "$state_file" .state)
-
-    if [[ "$first" == "true" ]]; then
-      first=false
-    else
-      result="$result,"
-    fi
-
-    result="$result$(cb_get_status "$name")"
-  done
-
-  result="$result]"
-  echo "$result"
-}