vibe-forge 0.4.0 → 0.8.2

package/.claude/commands/worker-loop.md

@@ -1,106 +1,106 @@
----
-description: Start a persistent worker loop (Ralph-style)
-argument-hint: <agent> [--max-idle 10] | stop
----
-
-# Worker Loop Command
-
-Start a persistent worker loop for the specified agent. The worker will:
-1. Check for assigned tasks
-2. Work on tasks until complete
-3. Loop back and check for more tasks
-4. Only exit after N idle checks with no work found
-
-## Activation Modes
-
-Worker Loop can be activated in two ways:
-
-### 1. Config-based (Recommended)
-
-Enable during `forge init` or toggle anytime:
-
-```bash
-forge config worker-loop on     # Enable for all workers
-forge config worker-loop off    # Disable
-forge config worker-loop        # Check status
-```
-
-When enabled, ALL workers will automatically stay running and check for new tasks.
-
-### 2. Runtime (Per-session)
-
-Use this command for fine-grained control:
-
-```
-/worker-loop anvil              # Start Anvil in persistent loop
-/worker-loop furnace --max-idle 20  # Custom idle limit
-/worker-loop stop               # Stop the current loop
-```
-
-## Arguments
-
-- `$1` - Agent name (anvil, furnace, crucible, etc.) or "stop"
-- `--max-idle N` - Exit after N checks with no tasks (default: 10)
-
-## Implementation
-
-Based on `$ARGUMENTS`:
-
-### If first argument is "stop"
-
-Remove the worker loop state file and confirm:
-
-```bash
-rm -f "${CLAUDE_LOCAL_DIR:-$HOME/.claude}/forge-worker-loop.json"
-```
-
-Output: "Worker loop stopped."
-
-### Otherwise, start a loop
-
-1. Resolve the agent name to canonical form
-2. Create state file at `${CLAUDE_LOCAL_DIR}/forge-worker-loop.json`:
-
-```json
-{
-  "agent": "<resolved-agent>",
-  "max_idle_checks": 10,
-  "idle_count": 0,
-  "poll_interval": 5,
-  "started_at": "<ISO timestamp>"
-}
-```
-
-3. Load the agent's personality file
-4. Start working with this system prompt addition:
-
-```
-You are in PERSISTENT WORKER MODE. After completing each task:
-1. Check for more tasks assigned to you in tasks/pending/ and tasks/needs-changes/
-2. If tasks found, immediately begin working
-3. If no tasks, announce you are idle and waiting
-
-Do NOT ask permission to continue - work autonomously until no tasks remain.
-```
-
-5. The stop hook (hooks/worker-loop.js) will intercept exit attempts and:
-   - If tasks exist: feed prompt to continue working
-   - If no tasks: increment idle counter
-   - If max idle reached: allow exit
-
-## How It Works
-
-The Worker Loop uses Claude Code's **Stop Hook** feature:
-
-1. When a worker tries to exit, the hook script runs
-2. It checks for pending tasks in `tasks/pending/` and `tasks/needs-changes/`
-3. If tasks found: blocks exit and feeds a prompt to continue working
-4. If no tasks: allows exit (or waits, depending on config)
-
-## Benefits
-
-- Workers stay active and pick up new tasks automatically
-- No need to manually respawn workers
-- Tasks can be added to pending/ and workers will find them
-- Config-based mode requires zero per-session setup
-- Configurable idle timeout prevents infinite waiting
+---
+description: Start a persistent worker loop (Ralph-style)
+argument-hint: <agent> [--max-idle 10] | stop
+---
+
+# Worker Loop Command
+
+Start a persistent worker loop for the specified agent. The worker will:
+1. Check for assigned tasks
+2. Work on tasks until complete
+3. Loop back and check for more tasks
+4. Only exit after N idle checks with no work found
+
+## Activation Modes
+
+Worker Loop can be activated in two ways:
+
+### 1. Config-based (Recommended)
+
+Enable during `forge init` or toggle anytime:
+
+```bash
+forge config worker-loop on     # Enable for all workers
+forge config worker-loop off    # Disable
+forge config worker-loop        # Check status
+```
+
+When enabled, ALL workers will automatically stay running and check for new tasks.
+
+### 2. Runtime (Per-session)
+
+Use this command for fine-grained control:
+
+```
+/worker-loop anvil              # Start Anvil in persistent loop
+/worker-loop furnace --max-idle 20  # Custom idle limit
+/worker-loop stop               # Stop the current loop
+```
+
+## Arguments
+
+- `$1` - Agent name (anvil, furnace, crucible, etc.) or "stop"
+- `--max-idle N` - Exit after N checks with no tasks (default: 10)
+
+## Implementation
+
+Based on `$ARGUMENTS`:
+
+### If first argument is "stop"
+
+Remove the worker loop state file and confirm:
+
+```bash
+rm -f "${CLAUDE_LOCAL_DIR:-$HOME/.claude}/forge-worker-loop.json"
+```
+
+Output: "Worker loop stopped."
+
+### Otherwise, start a loop
+
+1. Resolve the agent name to canonical form
+2. Create state file at `${CLAUDE_LOCAL_DIR}/forge-worker-loop.json`:
+
+```json
+{
+  "agent": "<resolved-agent>",
+  "max_idle_checks": 10,
+  "idle_count": 0,
+  "poll_interval": 5,
+  "started_at": "<ISO timestamp>"
+}
+```
+
+3. Load the agent's personality file
+4. Start working with this system prompt addition:
+
+```
+You are in PERSISTENT WORKER MODE. After completing each task:
+1. Check for more tasks assigned to you in tasks/pending/ and tasks/needs-changes/
+2. If tasks found, immediately begin working
+3. If no tasks, announce you are idle and waiting
+
+Do NOT ask permission to continue - work autonomously until no tasks remain.
+```
+
+5. The stop hook (hooks/worker-loop.js) will intercept exit attempts and:
+   - If tasks exist: feed prompt to continue working
+   - If no tasks: increment idle counter
+   - If max idle reached: allow exit
+
+## How It Works
+
+The Worker Loop uses Claude Code's **Stop Hook** feature:
+
+1. When a worker tries to exit, the hook script runs
+2. It checks for pending tasks in `tasks/pending/` and `tasks/needs-changes/`
+3. If tasks found: blocks exit and feeds a prompt to continue working
+4. If no tasks: allows exit (or waits, depending on config)
+
+## Benefits
+
+- Workers stay active and pick up new tasks automatically
+- No need to manually respawn workers
+- Tasks can be added to pending/ and workers will find them
+- Config-based mode requires zero per-session setup
+- Configurable idle timeout prevents infinite waiting

package/.claude/hooks/worker-loop.js

@@ -20,7 +20,23 @@ const os = require('os');
 // State file location (runtime toggle)
 const claudeLocalDir = process.env.CLAUDE_LOCAL_DIR || path.join(os.homedir(), '.claude');
 const stateFile = path.join(claudeLocalDir, 'forge-worker-loop.json');
-const forgeRoot = process.env.FORGE_ROOT || process.cwd();
+// SEC-005: Validate FORGE_ROOT to prevent path traversal via attacker-controlled env
+const rawForgeRoot = process.env.FORGE_ROOT || process.cwd();
+const forgeRoot = validateForgeRoot(rawForgeRoot) ? rawForgeRoot : null;
+
+function validateForgeRoot(dir) {
+  try {
+    if (!dir || typeof dir !== 'string') return false;
+    // Must be an absolute path to prevent cwd-relative resolution
+    if (!path.isAbsolute(dir)) return false;
+    // Must contain tasks/ and .forge/ (or config/) to be a valid forge project
+    const hasTasksDir = fs.existsSync(path.join(dir, 'tasks'));
+    const hasForgeDir = fs.existsSync(path.join(dir, '.forge')) || fs.existsSync(path.join(dir, 'config'));
+    return hasTasksDir && hasForgeDir;
+  } catch (_) {
+    return false;
+  }
+}
 
 // Helper to safely parse JSON
 function safeJsonParse(filePath, defaultValue = {}) {
@@ -75,6 +91,12 @@ function output(result) {
 
 // Main logic
 function main() {
+  // SEC-005: Abort safely if forge root is invalid
+  if (!forgeRoot) {
+    output({ decision: 'allow' });
+    return;
+  }
+
   let loopActive = false;
   let workerAgent = '';
   let maxIdleChecks = 10;
@@ -112,8 +134,16 @@ function main() {
     return output({ decision: 'approve' });
   }
 
+  // Determine tasks directory location
+  // When running from vibe-forge repo: tasks are at ./tasks/
+  // When running from a project using vibe-forge as submodule: tasks are at ./_vibe-forge/tasks/
+  let tasksDir = path.join(forgeRoot, 'tasks');
+  if (!fs.existsSync(tasksDir)) {
+    // Fall back to submodule location
+    tasksDir = path.join(forgeRoot, '_vibe-forge', 'tasks');
+  }
+
   // Check for pending tasks
-  const tasksDir = path.join(forgeRoot, '_vibe-forge', 'tasks');
   let pendingCount = 0;
   let needsChangesCount = 0;
 
@@ -133,6 +163,9 @@ function main() {
 
   const totalTasks = pendingCount + needsChangesCount;
 
+  // Get relative task path for prompts (relative to forgeRoot)
+  const relativeTasksPath = path.relative(forgeRoot, tasksDir);
+
   if (totalTasks > 0) {
     // Tasks found! Reset idle counter and continue
     if (fs.existsSync(stateFile)) {
@@ -146,7 +179,7 @@ function main() {
     return output({
       decision: 'block',
       message: `[Forge Loop] Found ${totalTasks} pending task(s). Continuing work...`,
-      prompt: 'Check _vibe-forge/tasks/pending/ and _vibe-forge/tasks/needs-changes/ for tasks assigned to you and begin working on them immediately.'
+      prompt: `Check ${relativeTasksPath}/pending/ and ${relativeTasksPath}/needs-changes/ for tasks assigned to you and begin working on them immediately.`
     });
   }
 
@@ -173,7 +206,7 @@ function main() {
     return output({
       decision: 'block',
       message: `[Forge Loop] No tasks available. Idle check ${idleCount}/${maxIdleChecks}. Waiting...`,
-      prompt: 'No tasks currently assigned to you. Wait briefly, then check _vibe-forge/tasks/pending/ and _vibe-forge/tasks/needs-changes/ again for new work. If still no tasks, announce you are idle and ready.'
+      prompt: `No tasks currently assigned to you. Wait briefly, then check ${relativeTasksPath}/pending/ and ${relativeTasksPath}/needs-changes/ again for new work. If still no tasks, announce you are idle and ready.`
     });
   }
 

package/.claude/scripts/setup-worker-loop.sh

@@ -1,45 +1,45 @@
-#!/usr/bin/env bash
-#
-# Setup Worker Loop
-# Creates state file to enable the worker loop stop hook
-#
-
-set -euo pipefail
-
-AGENT="${1:-}"
-MAX_IDLE="${2:-10}"
-STATE_DIR="${CLAUDE_LOCAL_DIR:-$HOME/.claude}"
-STATE_FILE="$STATE_DIR/forge-worker-loop.json"
-
-if [[ "$AGENT" == "stop" ]]; then
-    if [[ -f "$STATE_FILE" ]]; then
-        rm -f "$STATE_FILE"
-        echo "Worker loop stopped."
-    else
-        echo "No active worker loop."
-    fi
-    exit 0
-fi
-
-if [[ -z "$AGENT" ]]; then
-    echo "Usage: setup-worker-loop.sh <agent> [max-idle-checks]"
-    echo "       setup-worker-loop.sh stop"
-    exit 1
-fi
-
-# Ensure state directory exists
-mkdir -p "$STATE_DIR"
-
-# Create state file
-cat > "$STATE_FILE" << EOF
-{
-  "agent": "$AGENT",
-  "max_idle_checks": $MAX_IDLE,
-  "idle_count": 0,
-  "poll_interval": 5,
-  "started_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-}
-EOF
-
-echo "Worker loop started for $AGENT (max idle: $MAX_IDLE checks)"
-echo "State file: $STATE_FILE"
+#!/usr/bin/env bash
+#
+# Setup Worker Loop
+# Creates state file to enable the worker loop stop hook
+#
+
+set -euo pipefail
+
+AGENT="${1:-}"
+MAX_IDLE="${2:-10}"
+STATE_DIR="${CLAUDE_LOCAL_DIR:-$HOME/.claude}"
+STATE_FILE="$STATE_DIR/forge-worker-loop.json"
+
+if [[ "$AGENT" == "stop" ]]; then
+    if [[ -f "$STATE_FILE" ]]; then
+        rm -f "$STATE_FILE"
+        echo "Worker loop stopped."
+    else
+        echo "No active worker loop."
+    fi
+    exit 0
+fi
+
+if [[ -z "$AGENT" ]]; then
+    echo "Usage: setup-worker-loop.sh <agent> [max-idle-checks]"
+    echo "       setup-worker-loop.sh stop"
+    exit 1
+fi
+
+# Ensure state directory exists
+mkdir -p "$STATE_DIR"
+
+# Create state file
+cat > "$STATE_FILE" << EOF
+{
+  "agent": "$AGENT",
+  "max_idle_checks": $MAX_IDLE,
+  "idle_count": 0,
+  "poll_interval": 5,
+  "started_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+}
+EOF
+
+echo "Worker loop started for $AGENT (max idle: $MAX_IDLE checks)"
+echo "State file: $STATE_FILE"

package/.claude/settings.json

@@ -0,0 +1,89 @@
+{
+  "_comment": "Project-level permissions for Vibe Forge agents. These allow agents to work without --dangerously-skip-permissions while still gating destructive operations.",
+  "permissions": {
+    "allow": [
+      "Read",
+      "Edit",
+      "Write",
+      "Glob",
+      "Grep",
+      "Bash(ls:*)",
+      "Bash(cat:*)",
+      "Bash(head:*)",
+      "Bash(tail:*)",
+      "Bash(wc:*)",
+      "Bash(mkdir:*)",
+      "Bash(cp:*)",
+      "Bash(mv:*)",
+      "Bash(node:*)",
+      "Bash(npx:*)",
+      "Bash(npm test*)",
+      "Bash(npm run*)",
+      "Bash(npm ci*)",
+      "Bash(npm install*)",
+      "Bash(npm audit*)",
+      "Bash(npm view*)",
+      "Bash(npm version*)",
+      "Bash(git status*)",
+      "Bash(git diff*)",
+      "Bash(git log*)",
+      "Bash(git branch*)",
+      "Bash(git checkout*)",
+      "Bash(git switch*)",
+      "Bash(git add*)",
+      "Bash(git commit*)",
+      "Bash(git pull*)",
+      "Bash(git push*)",
+      "Bash(git rm*)",
+      "Bash(git stash*)",
+      "Bash(git show*)",
+      "Bash(git merge*)",
+      "Bash(git rebase*)",
+      "Bash(gh pr*)",
+      "Bash(gh run*)",
+      "Bash(gh repo*)",
+      "Bash(gh workflow*)",
+      "Bash(gh secret list*)",
+      "Bash(sqlite3:*)",
+      "Bash(find:*)",
+      "Bash(grep:*)",
+      "Bash(sed:*)",
+      "Bash(awk:*)",
+      "Bash(sort:*)",
+      "Bash(echo:*)",
+      "Bash(printf:*)",
+      "Bash(date:*)",
+      "Bash(basename:*)",
+      "Bash(dirname:*)",
+      "Bash(realpath:*)",
+      "Bash(which:*)",
+      "Bash(command:*)",
+      "Bash(sleep:*)",
+      "Bash(cd:*)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node src/lib/heimdall.js"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node .claude/hooks/worker-loop.js"
+          }
+        ]
+      }
+    ]
+  }
+}

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 SpasticPalate
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 sugar-crash-studios
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.