vibecoding-devtools 1.0.1 → 1.1.0

package/README.md

@@ -10,12 +10,12 @@ instalados das fontes oficiais.
 ## Instalação
 
 ```bash
-npx vibecoding-devtools@1.0.1 install    # instala pelo painel
-npx vibecoding-devtools@1.0.1 update     # reutiliza as escolhas salvas
-npx vibecoding-devtools@1.0.1 uninstall  # remove só o que o kit instalou
+npx vibecoding-devtools@1.1.0 install    # instala pelo painel
+npx vibecoding-devtools@1.1.0 update     # reutiliza as escolhas salvas
+npx vibecoding-devtools@1.1.0 uninstall  # remove só o que o kit instalou
 ```
 
-Alternativa pelo GitHub: `npx github:Or4cu1o/vibecoding-devtools#v1.0.1 install` (aceita os mesmos comandos).
+Alternativa pelo GitHub: `npx github:Or4cu1o/vibecoding-devtools#v1.1.0 install` (aceita os mesmos comandos).
 
 Requer Node 22+ e git. O instalador detecta Claude Code, Codex e Antigravity, mostra o plano e só grava depois da
 confirmação. Use `--dry-run` para apenas conferir o plano. Detalhes no [guia do instalador](docs/installer.md).
@@ -28,7 +28,8 @@ confirmação. Use `--dry-run` para apenas conferir o plano. Detalhes no [guia d
 | [`skills/`](skills/) | triagem de risco, revisão de segurança e operação do Maestri |
 | [`templates/`](templates/) | `AGENTS.md` e `CLAUDE.md` para projetos, e `.coderabbit.yaml` |
 | [Hooks](hooks/README.md) | `secret-scan`, `maestri-protocol` e `full-suite` implementados |
-| [`docs/`](docs/) | instalação, compatibilidade e justificativas das regras |
+| [`team/`](team/README.md) | equipe de 13 agentes para o Maestri (roles, notas, partitura `vibecoding-devtools`), instalada com `npx vibecoding-devtools team` |
+| [`docs/`](docs/) | instalação, compatibilidade, Maestri em máquina remota e justificativas das regras |
 
 O `secret-scan` verifica segredos com gitleaks antes de commits. O `maestri-protocol` valida mensagens e exige o pacote
 Maestri. O `full-suite` aplica um bloqueio contornável a suítes completas em repositórios com CI; para uma execução

package/hooks/maestri-protocol.mjs

@@ -6,9 +6,10 @@ const reason = 'Maestri message must use a valid protocol header or end with the
 export function validMessage(message) {
   const text = message.replace(/\r\n/g, '\n');
   if (text.startsWith('~')) return header.test(text.split('\n')[0]);
-  // Match the skill footer at the end, including its report-back instruction.
-  const footer = text.match(/(?:^|\n)ref: ([^\n]+)\nWhen done, load the maestri-protocol skill and report back with:\nmaestri ask "([^"\n]+)" "~ ([^|\n]+?) \| STATUS \| ([^|\n]+?) \| one-line summary"\nSTATUS is one of DONE, PENDING, BLOCKED, ERROR, ACK\. Details go on the following lines\.\s*$/);
-  return Boolean(footer && footer[1] === footer[4]);
+  // Match the skill footer at the end, including its report-back instruction. Its quotes may be double or single,
+  // each pair matching, so a prompt already wrapped in double quotes can carry the footer unescaped.
+  const footer = text.match(/(?:^|\n)ref: ([^\n]+)\nWhen done, load the maestri-protocol skill and report back with:\nmaestri ask (["'])((?:(?!\2)[^\n])+)\2 (["'])~ ([^|\n]+?) \| STATUS \| ([^|\n]+?) \| one-line summary\4\nSTATUS is one of DONE, PENDING, BLOCKED, ERROR, ACK\. Details go on the following lines\.\s*$/);
+  return Boolean(footer && footer[1] === footer[6]);
 }
 
 function messages(words) {

package/installer/cli.mjs

@@ -10,9 +10,12 @@ import { readState, hashContent } from './state.mjs';
 import { parseFlags, choicesFromFlags, panel, confirmExecution, Cancellation } from './panel.mjs';
 import * as thirdPartyApi from './third-party.mjs';
 import { jsonMergeSituation } from './json-merge.mjs';
+import { envListSituation } from './env-list.mjs';
 import { CODEX_HOOK_APPROVAL } from './hooks.mjs';
+import { teamMain } from './team.mjs';
 
 export const HELP = `Usage: vibecoding-devtools [install|update|detect|uninstall] [flags]
+       vibecoding-devtools team [--roles-only] [--update-roles] [--dry-run]   (Maestri team; see team --help)
 Default command: install. Without a TTY: use --yes to apply or --dry-run to preview.
 Update reuses saved install choices; explicit flags override them. Run install first if no choices are saved.
 Update removes unchanged kit-owned items absent from the new plan; edited and third-party items are retained.
@@ -76,6 +79,10 @@ export function summarizePlan(plan, { home, force = false } = {}) {
       const previous = state.items.find((i) => i.type === action.type && i.destination === action.destination);
       return { ...action, situation: jsonMergeSituation(current, action, previous) };
     }
+    if (action.type === 'env-list') {
+      const previous = state.items.find((i) => i.type === action.type && i.destination === action.destination);
+      return { ...action, situation: envListSituation(current, action, previous) };
+    }
     let desired;
     if (action.type === 'block') {
       const text = current?.toString('utf8') ?? '';
@@ -148,6 +155,7 @@ export async function main(argv = process.argv.slice(2), options = {}) {
     isTTY = Boolean(process.stdin.isTTY && process.stdout.isTTY), out = console.log, err = console.error,
     detect = detectAll, choose = panel, confirm = confirmExecution, prepareThirdParty: prepare, thirdParty = thirdPartyApi,
     planBuilder = buildPlan, apply = execute, remove = uninstall } = options;
+  if (argv[0] === 'team') return teamMain(argv.slice(1), { kit, out, err, home });
   let flags;
   let warnings = [];
   let errorCode = 2;

package/installer/codex-maestri.rules

@@ -0,0 +1,13 @@
+# vibecoding-devtools: Maestri commands Codex agents run outside the sandbox without a human prompt.
+# Installed globally as ~/.codex/rules/vibecoding-devtools-maestri.rules when the Maestri pack is selected.
+prefix_rule(pattern = ["maestri", "ask"], decision = "allow")
+prefix_rule(pattern = ["maestri", "check"], decision = "allow")
+prefix_rule(pattern = ["maestri", "list"], decision = "allow")
+prefix_rule(pattern = ["maestri", "recall"], decision = "allow")
+prefix_rule(pattern = ["maestri", "floor", "status"], decision = "allow")
+prefix_rule(pattern = ["maestri", "note", "read"], decision = "allow")
+prefix_rule(pattern = ["maestri", "note", "edit"], decision = "allow")
+prefix_rule(pattern = ["maestri", "portal"], decision = "allow")
+prefix_rule(pattern = ["maestri", "portal", "close"], decision = "forbidden")
+prefix_rule(pattern = ["maestri", "note", "delete"], decision = "forbidden")
+prefix_rule(pattern = ["maestri", "dismiss"], decision = "forbidden")

package/installer/env-list.mjs

@@ -0,0 +1,70 @@
+// Kit values inside one comma-separated string of a JSON settings file's `env` object, such as
+// GATEGUARD_EXEMPT_GLOBS in ~/.claude/settings.json. The rest of the file stays byte for byte; the value keeps the
+// user's entries and spacing (the string is written back with JSON escaping, so escapes such as \u002f decode).
+import { isUtf8 } from 'node:buffer';
+import { append, parse, property, removeChild } from './json-merge.mjs';
+
+function validate(action) {
+  if (typeof action.key !== 'string' || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(action.key) || !Array.isArray(action.values)
+    || !action.values.length || action.values.some((v) => typeof v !== 'string' || !v.trim() || v.includes(','))) {
+    throw new Error('Invalid env list action');
+  }
+}
+
+function locate(text, key) {
+  const root = parse(text);
+  const env = property(root, 'env');
+  if (env && env.node.kind !== 'object') throw new Error('env must be a JSON object');
+  const entry = env && property(env.node, key);
+  if (entry && typeof entry.node.value !== 'string') throw new Error(`env.${key} must be a string`);
+  return { root, env, entry };
+}
+
+// `record` is the state item of an earlier install: its values, the ones the user already had (`preexisting`, never
+// removed) and the containers the kit created. Install adds the missing values and drops values an earlier kit
+// version added and this one no longer lists; remove drops the kit's values.
+export function envListMerge(current, action, record = null, { remove = false } = {}) {
+  validate(action);
+  if (current !== null && !isUtf8(current)) throw new Error('Settings file is not valid UTF-8');
+  const text = current === null ? '{}\n' : current.toString('utf8');
+  const { root, env, entry } = locate(text, action.key);
+  // Raw segments keep the user's spacing; values compare trimmed.
+  const parts = entry ? entry.node.value.split(',') : [];
+  const list = parts.map((v) => v.trim()).filter(Boolean);
+  // A value the user had before the kit first listed it stays theirs, including values a later kit version adds.
+  const preexisting = [...new Set([...(record?.preexisting ?? []),
+    ...action.values.filter((v) => list.includes(v) && !(record?.values ?? []).includes(v))])];
+  const createdPaths = record?.createdPaths ?? [...(entry ? [] : [['env', action.key]]), ...(env ? [] : [['env']])];
+  const wanted = remove ? [] : action.values;
+  const dropped = new Set([...(record?.values ?? []), ...(remove ? action.values : [])]
+    .filter((v) => !preexisting.includes(v) && !wanted.includes(v)));
+  const added = wanted.filter((v) => !list.includes(v));
+  const result = { preexisting, createdPaths };
+  if (!added.length && !list.some((v) => dropped.has(v))) return { ...result, same: true, content: current };
+
+  const kept = parts.filter((v) => !dropped.has(v.trim()));
+  const next = [...(kept.some((v) => v.trim()) ? kept : []), ...added];
+  const created = (keys) => createdPaths.some((p) => p.join('\0') === keys.join('\0'));
+  const joined = next.join(',');
+  let out;
+  if (next.length && entry) out = text.slice(0, entry.node.start) + JSON.stringify(joined) + text.slice(entry.node.end);
+  else if (next.length) {
+    out = env ? append(text, env.node, action.key, joined) : append(text, root, 'env', { [action.key]: joined });
+  } else if (created(['env', action.key])) {
+    out = removeChild(text, env.node, entry);
+    const rest = parse(out);
+    const after = property(rest, 'env');
+    if (created(['env']) && !after.node.children.length) out = removeChild(out, rest, after);
+  } else out = text.slice(0, entry.node.start) + '""' + text.slice(entry.node.end);
+  return { ...result, same: false, content: Buffer.from(out) };
+}
+
+// Same bytes with another value list in the state is an update: the state must stop owning values the kit dropped.
+export const envListStale = (record, action) => JSON.stringify(record?.values) !== JSON.stringify(action.values);
+
+export function envListSituation(current, action, previous) {
+  try {
+    if (envListMerge(current, action, previous).same && !(previous && envListStale(previous, action))) return 'same';
+    return previous ? 'update' : 'new';
+  } catch { return 'conflict'; }
+}