triflux 8.12.2 → 9.0.0

package/scripts/cross-review-gate.mjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+
+const SESSION_TTL_SEC = 30 * 60;
+const STATE_REL_PATH = join(".omc", "state", "cross-review.json");
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      raw += chunk;
+    });
+    process.stdin.on("end", () => resolve(raw));
+    process.stdin.on("error", () => resolve(""));
+  });
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function nowSec() {
+  return Math.floor(Date.now() / 1000);
+}
+
+function resolveBaseDir(payload) {
+  if (typeof payload?.cwd === "string" && payload.cwd.trim()) return payload.cwd;
+  if (typeof payload?.directory === "string" && payload.directory.trim()) return payload.directory;
+  return process.cwd();
+}
+
+function expectedReviewer(author) {
+  if (author === "claude") return "codex";
+  if (author === "codex") return "claude";
+  if (author === "gemini") return "claude";
+  return "";
+}
+
+function shouldTrackPath(filePath) {
+  if (typeof filePath !== "string" || !filePath.trim()) return false;
+
+  const lower = filePath.toLowerCase();
+  if (lower.startsWith(".omc/") || lower.startsWith(".claude/")) return false;
+  if (lower === "package-lock.json" || lower.endsWith("/package-lock.json")) return false;
+  if (/\.(md|lock|yml|yaml)$/i.test(lower)) return false;
+  return true;
+}
+
+function loadState(statePath) {
+  if (!existsSync(statePath)) return null;
+
+  try {
+    const state = JSON.parse(readFileSync(statePath, "utf8"));
+    const startedAt = Number(state?.session_start || 0);
+    const expired = !startedAt || nowSec() - startedAt > SESSION_TTL_SEC;
+    if (expired) {
+      try {
+        unlinkSync(statePath);
+      } catch {}
+      return null;
+    }
+    return state;
+  } catch {
+    return null;
+  }
+}
+
+function isGitCommitCommand(command) {
+  if (typeof command !== "string") return false;
+  return /\bgit\s+commit\b/i.test(command);
+}
+
+function nudge(message) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      additionalContext: message,
+    },
+  }));
+  process.exit(0);
+}
+
+function deny(message) {
+  process.stderr.write(message);
+  process.exit(2);
+}
+
+function summarizePending(entries) {
+  return entries
+    .map((item) => {
+      const reviewer = item.expectedReviewer || "cross-reviewer";
+      return `  * ${item.path} (author=${item.author}, reviewer=${reviewer})`;
+    })
+    .join("\n");
+}
+
+async function main() {
+  if (process.env.TFX_SKIP_CROSS_REVIEW === "1") {
+    process.exit(0);
+  }
+
+  const raw = await readStdin();
+  if (!raw.trim()) process.exit(0);
+
+  const payload = parseJson(raw);
+  if (!payload) process.exit(0);
+
+  const toolName = payload.tool_name || "";
+  const toolInput = payload.tool_input || {};
+
+  if (toolName !== "Bash") process.exit(0);
+  if (!isGitCommitCommand(toolInput.command || "")) process.exit(0);
+
+  // cwd 전파: tracker와 동일한 resolveBaseDir 사용
+  const baseDir = resolveBaseDir(payload);
+  const statePath = join(baseDir, STATE_REL_PATH);
+
+  const state = loadState(statePath);
+  if (!state || !state.files || typeof state.files !== "object") process.exit(0);
+
+  const pending = [];
+  const selfApproved = [];
+
+  for (const [path, info] of Object.entries(state.files)) {
+    if (!shouldTrackPath(path)) continue;
+    const meta = info && typeof info === "object" ? info : {};
+    const author = String(meta.author || "").toLowerCase();
+    const reviewer = String(meta.reviewer || "").toLowerCase();
+    const reviewed = meta.reviewed === true;
+    const requiredReviewer = expectedReviewer(author);
+
+    // tracker가 설정한 self_approved 플래그 명시적 체크
+    if (meta.self_approved === true) {
+      selfApproved.push({ path, author, reviewer: meta.reviewer || author, expectedReviewer: requiredReviewer });
+      continue;
+    }
+
+    if (reviewed && reviewer && reviewer === author) {
+      selfApproved.push({ path, author, reviewer, expectedReviewer: requiredReviewer });
+      continue;
+    }
+
+    if (reviewed && requiredReviewer && reviewer && reviewer !== requiredReviewer) {
+      selfApproved.push({ path, author, reviewer, expectedReviewer: requiredReviewer });
+      continue;
+    }
+
+    if (!reviewed) {
+      pending.push({ path, author, expectedReviewer: requiredReviewer });
+    }
+  }
+
+  if (selfApproved.length > 0) {
+    const lines = selfApproved
+      .map((item) => `  * ${item.path} (author=${item.author}, reviewer=${item.reviewer}, required=${item.expectedReviewer || "n/a"})`)
+      .join("\n");
+    deny(
+      `[cross-review] self-approve 차단: 동일/비허용 reviewer가 감지되었습니다.\n${lines}\n` +
+      "규칙: author=claude -> reviewer=codex, author=codex -> reviewer=claude",
+    );
+  }
+
+  if (pending.length > 0) {
+    nudge(
+      `[cross-review] git commit 전에 교차 검증이 필요합니다.\n${summarizePending(pending)}\n` +
+      "규칙: author=claude -> reviewer=codex, author=codex -> reviewer=claude",
+    );
+  }
+
+  process.exit(0);
+}
+
+main().catch(() => process.exit(0));

package/scripts/cross-review-tracker.mjs

@@ -0,0 +1,279 @@
+#!/usr/bin/env node
+
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative } from "node:path";
+
+const SESSION_TTL_SEC = 30 * 60;
+const STATE_REL_PATH = join(".omc", "state", "cross-review.json");
+const EXCLUDED_FILE_PATTERN = /\.(md|lock|yml|yaml)$/i;
+
+function nowSec() {
+  return Math.floor(Date.now() / 1000);
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let raw = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => {
+      raw += chunk;
+    });
+    process.stdin.on("end", () => resolve(raw));
+    process.stdin.on("error", () => resolve(""));
+  });
+}
+
+function parseJson(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function resolveBaseDir(payload) {
+  if (typeof payload?.cwd === "string" && payload.cwd.trim()) return payload.cwd;
+  if (typeof payload?.directory === "string" && payload.directory.trim()) return payload.directory;
+  return process.cwd();
+}
+
+function resolveStatePath(baseDir) {
+  return join(baseDir, STATE_REL_PATH);
+}
+
+function createEmptyState() {
+  return {
+    files: {},
+    session_start: nowSec(),
+  };
+}
+
+function loadState(statePath) {
+  if (!existsSync(statePath)) return createEmptyState();
+
+  try {
+    const parsed = JSON.parse(readFileSync(statePath, "utf8"));
+    const sessionStart = Number(parsed?.session_start || 0);
+    const expired = !sessionStart || nowSec() - sessionStart > SESSION_TTL_SEC;
+    if (expired) {
+      try {
+        unlinkSync(statePath);
+      } catch {}
+      return createEmptyState();
+    }
+
+    return {
+      files: parsed?.files && typeof parsed.files === "object" ? parsed.files : {},
+      session_start: sessionStart,
+    };
+  } catch {
+    return createEmptyState();
+  }
+}
+
+function saveState(statePath, state) {
+  mkdirSync(dirname(statePath), { recursive: true });
+  writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+}
+
+function normalizePath(filePath, baseDir) {
+  if (typeof filePath !== "string" || !filePath.trim()) return "";
+
+  const raw = filePath.trim();
+  let normalized = raw;
+
+  if (isAbsolute(raw)) {
+    const relPath = relative(baseDir, raw);
+    if (relPath.startsWith("..")) return "";
+    normalized = relPath;
+  }
+
+  return normalized.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+
+function shouldTrackPath(filePath) {
+  if (!filePath) return false;
+  const lower = filePath.toLowerCase();
+
+  if (lower.startsWith(".omc/") || lower.startsWith(".claude/")) return false;
+  if (lower === "package-lock.json" || lower.endsWith("/package-lock.json")) return false;
+  if (EXCLUDED_FILE_PATTERN.test(lower)) return false;
+  return true;
+}
+
+function extractFilePath(toolInput) {
+  if (!toolInput || typeof toolInput !== "object") return "";
+  const candidate = toolInput.file_path ?? toolInput.path ?? toolInput.filePath ?? "";
+  return typeof candidate === "string" ? candidate : "";
+}
+
+function extractCandidatePaths(payload, baseDir) {
+  const candidates = new Set();
+
+  const looksLikePath = (value) => {
+    if (typeof value !== "string") return false;
+    const trimmed = value.trim();
+    if (!trimmed || /\s/.test(trimmed)) return false;
+    if (trimmed.length > 260) return false;
+    if (!trimmed.includes(".") && !trimmed.includes("/") && !trimmed.includes("\\")) return false;
+    return /^[./\\A-Za-z0-9_-]/.test(trimmed);
+  };
+
+  const addPath = (value) => {
+    if (!looksLikePath(value)) return;
+    const normalized = normalizePath(value, baseDir);
+    if (shouldTrackPath(normalized)) candidates.add(normalized);
+  };
+
+  const scanValue = (value, depth = 0) => {
+    if (depth > 3 || value == null) return;
+    if (typeof value === "string") {
+      addPath(value);
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (const item of value) scanValue(item, depth + 1);
+      return;
+    }
+    if (typeof value !== "object") return;
+
+    for (const [key, child] of Object.entries(value)) {
+      const keyLower = key.toLowerCase();
+      if (keyLower.includes("file") || keyLower.includes("path")) {
+        scanValue(child, depth + 1);
+      }
+    }
+  };
+
+  addPath(extractFilePath(payload?.tool_input));
+
+  scanValue(payload?.tool_response);
+  scanValue(payload?.tool_output);
+  scanValue(payload?.result);
+  scanValue(payload?.output);
+
+  return [...candidates];
+}
+
+function collectStrings(value, out = [], depth = 0) {
+  if (depth > 4) return out;
+  if (typeof value === "string") {
+    out.push(value);
+    return out;
+  }
+  if (!value || typeof value !== "object") return out;
+  if (Array.isArray(value)) {
+    for (const item of value) collectStrings(item, out, depth + 1);
+    return out;
+  }
+
+  for (const key of Object.keys(value)) {
+    collectStrings(value[key], out, depth + 1);
+  }
+  return out;
+}
+
+function detectCliActor(payload) {
+  const lines = collectStrings(payload).join("\n");
+  const match = lines.match(/\bcli\s*[:=]\s*(claude|codex|gemini)\b/i);
+  return match ? match[1].toLowerCase() : "";
+}
+
+function detectAuthor(payload) {
+  const actor = detectCliActor(payload);
+  if (actor) return actor;
+  return "claude";
+}
+
+function expectedReviewer(author) {
+  if (author === "claude") return "codex";
+  if (author === "codex") return "claude";
+  if (author === "gemini") return "claude";
+  return "";
+}
+
+function applyReviewer(state, reviewer, ts) {
+  for (const [filePath, meta] of Object.entries(state.files)) {
+    if (!meta || typeof meta !== "object") continue;
+    if (!shouldTrackPath(filePath)) continue;
+
+    const author = String(meta.author || "").toLowerCase();
+    const expected = expectedReviewer(author);
+
+    if (expected && reviewer === expected) {
+      meta.reviewed = true;
+      meta.reviewer = reviewer;
+      meta.reviewed_ts = ts;
+      delete meta.self_approved;
+      continue;
+    }
+
+    if (reviewer === author) {
+      meta.reviewed = false;
+      meta.reviewer = reviewer;
+      meta.reviewed_ts = ts;
+      meta.self_approved = true;
+    }
+  }
+}
+
+async function main() {
+  if (process.env.TFX_SKIP_CROSS_REVIEW === "1") {
+    process.exit(0);
+  }
+
+  const raw = await readStdin();
+  if (!raw.trim()) {
+    process.exit(0);
+  }
+
+  const payload = parseJson(raw);
+  if (!payload) {
+    process.exit(0);
+  }
+
+  const baseDir = resolveBaseDir(payload);
+  const statePath = resolveStatePath(baseDir);
+  const state = loadState(statePath);
+  const toolName = payload.tool_name || "";
+  const ts = nowSec();
+  let changed = false;
+
+  if (toolName === "Edit" || toolName === "Write") {
+    const toolInput = payload.tool_input || {};
+    const normalizedPath = normalizePath(extractFilePath(toolInput), baseDir);
+    if (shouldTrackPath(normalizedPath)) {
+      state.files[normalizedPath] = {
+        author: detectAuthor(payload),
+        ts,
+        reviewed: false,
+      };
+      changed = true;
+    }
+  } else if (toolName === "Bash") {
+    const actor = detectCliActor(payload);
+    if (actor) {
+      const paths = extractCandidatePaths(payload, baseDir);
+      if (paths.length > 0) {
+        for (const path of paths) {
+          state.files[path] = {
+            author: actor,
+            ts,
+            reviewed: false,
+          };
+        }
+      } else {
+        applyReviewer(state, actor, ts);
+      }
+      changed = true;
+    }
+  }
+
+  if (changed) {
+    saveState(statePath, state);
+  }
+
+  process.exit(0);
+}
+
+main().catch(() => process.exit(0));

package/scripts/headless-guard.mjs

@@ -257,6 +257,44 @@ async function main() {
     }
   }
 
+  // ── Edit/Write: tfx-multi 코드 수정 게이트 ──
+  if (toolName === "Edit" || toolName === "Write") {
+    const multiState = readMultiState();
+
+    // 일반 모드(tfx-multi 비활성)에서는 기존처럼 통과
+    if (!multiState || !multiState.active) {
+      process.exit(0);
+    }
+
+    if (!multiState.dispatched) {
+      multiState.nativeWorkCalls = (multiState.nativeWorkCalls || 0) + 1;
+      writeMultiState(multiState);
+
+      if (multiState.nativeWorkCalls > GATE_THRESHOLD) {
+        deny(
+          `[headless-guard] tfx-multi gate: ${toolName} 호출 ${multiState.nativeWorkCalls}회 — headless dispatch 먼저 하세요.\n` +
+          'Bash("tfx multi --teammate-mode headless --auto-attach --dashboard --assign \'codex:프롬프트:역할\' --timeout 600")',
+        );
+      }
+
+      nudge(
+        `[headless-guard] tfx-multi 활성 (${multiState.nativeWorkCalls}/${GATE_THRESHOLD}). ` +
+        "headless dispatch 후 작업을 시작하세요.",
+      );
+    }
+
+    // H3 fix: Agent gate와 동일하게 NUDGE_THRESHOLD 기반 주기적 nudge
+    multiState.nativeWorkCallsSinceDispatch = (multiState.nativeWorkCallsSinceDispatch || 0) + 1;
+    writeMultiState(multiState);
+
+    if (multiState.nativeWorkCallsSinceDispatch >= NUDGE_THRESHOLD) {
+      multiState.nativeWorkCallsSinceDispatch = 0;
+      writeMultiState(multiState);
+      nudge("[headless-guard] nudge: headless 워커가 코드 수정 중. 직접 수정은 충돌 위험.");
+    }
+    process.exit(0); // threshold 미만이면 조용히 통과
+  }
+
   // ── Agent: A(gate) + B(nudge) + CLI 래핑 deny ──
   if (toolName === "Agent") {
     const subType = (toolInput.subagent_type || "").toLowerCase();

package/scripts/lib/env-probe.mjs

@@ -0,0 +1,130 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
+import { execSync, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const DEFAULT_STATUS_URL = "http://127.0.0.1:27888/status";
+const _sab = new Int32Array(new SharedArrayBuffer(4));
+
+const __filename = fileURLToPath(import.meta.url);
+const DEFAULT_PKG_ROOT = join(dirname(__filename), "..", "..");
+
+function sleepSync(ms) {
+  Atomics.wait(_sab, 0, 0, ms);
+}
+
+function fetchHubStatus({
+  execSyncFn = execSync,
+  statusUrl = DEFAULT_STATUS_URL,
+  timeout = 3000,
+} = {}) {
+  const response = execSyncFn(`curl -sf ${statusUrl}`, {
+    timeout,
+    encoding: "utf8",
+    windowsHide: true,
+  });
+  const data = JSON.parse(response);
+  return {
+    ok: true,
+    state: data?.hub?.state || "unknown",
+    pid: data?.pid,
+  };
+}
+
+export function checkCli(name, { execSyncFn = execSync } = {}) {
+  const command = process.platform === "win32"
+    ? `where ${name} 2>nul`
+    : `which ${name} 2>/dev/null`;
+  try {
+    const path = execSyncFn(command, {
+      encoding: "utf8",
+      timeout: 2000,
+      windowsHide: true,
+    }).trim();
+    return { ok: !!path, path };
+  } catch {
+    return { ok: false };
+  }
+}
+
+export function detectCodexPlan({
+  homeDir = homedir(),
+  existsSyncFn = existsSync,
+  readFileSyncFn = readFileSync,
+} = {}) {
+  try {
+    const authPath = join(homeDir, ".codex", "auth.json");
+    if (!existsSyncFn(authPath)) return { plan: "unknown", source: "no_auth" };
+
+    const auth = JSON.parse(readFileSyncFn(authPath, "utf8"));
+    if (auth.auth_mode !== "chatgpt") return { plan: "api", source: "api_key" };
+
+    const token = auth.tokens?.id_token || auth.tokens?.access_token;
+    if (!token) return { plan: "unknown", source: "no_token" };
+
+    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString());
+    const plan = payload?.["https://api.openai.com/auth"]?.chatgpt_plan_type || "unknown";
+    return { plan, source: "jwt" };
+  } catch {
+    return { plan: "unknown", source: "error" };
+  }
+}
+
+export function checkHub({
+  pkgRoot = DEFAULT_PKG_ROOT,
+  statusUrl = DEFAULT_STATUS_URL,
+  restart = true,
+  requestTimeoutMs = 3000,
+  pollAttempts = 8,
+  pollIntervalMs = 500,
+  execSyncFn = execSync,
+  spawnFn = spawn,
+  existsSyncFn = existsSync,
+  sleepSyncFn = sleepSync,
+} = {}) {
+  try {
+    return fetchHubStatus({
+      execSyncFn,
+      statusUrl,
+      timeout: requestTimeoutMs,
+    });
+  } catch {}
+
+  if (!restart) return { ok: false, state: "unreachable", restart: "disabled" };
+
+  const serverPath = join(pkgRoot, "hub", "server.mjs");
+  if (!existsSyncFn(serverPath)) return { ok: false, state: "unreachable", restart: "no_server" };
+
+  try {
+    const child = spawnFn(process.execPath, [serverPath], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+    child.unref();
+  } catch {
+    return { ok: false, state: "unreachable", restart: "spawn_failed" };
+  }
+
+  for (let i = 0; i < pollAttempts; i++) {
+    sleepSyncFn(pollIntervalMs);
+    try {
+      const status = fetchHubStatus({
+        execSyncFn,
+        statusUrl,
+        timeout: Math.min(requestTimeoutMs, 1000),
+      });
+      if (status.state === "healthy") {
+        return { ...status, restarted: true };
+      }
+    } catch {}
+  }
+
+  return { ok: false, state: "unreachable", restart: "timeout" };
+}
+
+export {
+  DEFAULT_PKG_ROOT,
+  DEFAULT_STATUS_URL,
+};