wavework 0.0.0-stage → 0.1.1

package/templates/scripts/red-green-check.sh

@@ -0,0 +1,287 @@
+#!/usr/bin/env bash
+# Runs a child's new/changed tests against the pre-change code and classifies every test:
+#   RED          failed on old code (good: the test proves something)
+#   RED-COMPILE  old code does not compile / import against the test (accepted)
+#   GREEN-ON-OLD passed on old code (suspicious: the test may prove nothing)
+#   UNCHANGED    passed on old code, but the child did not touch this test (ignore)
+#   SKIP <area>: unsupported   the area's test layout is not understood (see below); judge its tests from the diff
+# Usage: red-green-check.sh <worktree> [<base-ref>]   (base-ref defaults to HEAD)
+# Exit: 0 no GREEN-ON-OLD (or no changed tests), 1 any GREEN-ON-OLD, 2 tool/setup error.
+# Writes only into a throwaway detached worktree in a temp dir (removed on exit). Tests in a changed file that
+# were not themselves changed are classified too: judge those by the diff.
+#
+# Areas come from the checks of .claude/wavework.json (generated by `wavework init`/`update`, do not edit):
+# one line 'name|kind|dir'. Understood kinds:
+#   maven   *Test.java / *Tests.java / *IT.java under <dir>/src/test, run with ./mvnw (or mvn) test -Dtest=...
+#   vitest  *.test.ts / *.test.tsx / *.test.js / *.test.jsx under <dir>, run with pnpm (pnpm-lock.yaml) or npm (package-lock.json)
+# Any other area is `unsupported`: its tests are not run and the script prints SKIP.
+# Needs bash, git and node. Testing seam: RED_GREEN_AREAS (same line format, one per line) replaces the table.
+set -o pipefail
+
+AREAS=(
+  {{redGreenAreas}}
+)
+if [[ -n "${RED_GREEN_AREAS:-}" ]]; then
+  AREAS=()
+  while IFS= read -r line; do [[ -n "$line" ]] && AREAS+=("$line"); done <<< "$RED_GREEN_AREAS"
+fi
+
+die() { echo "red-green-check: $*" >&2; exit 2; }
+
+[[ $# -ge 1 && $# -le 2 ]] || die "usage: $0 <worktree> [<base-ref>]"
+WT="$(cd "$1" 2>/dev/null && pwd)" || die "worktree not found: $1"
+BASE="${2:-HEAD}"
+git -C "$WT" rev-parse --git-dir >/dev/null 2>&1 || die "not a git worktree: $WT"
+git -C "$WT" rev-parse --verify --quiet "$BASE^{commit}" >/dev/null || die "unknown base ref: $BASE"
+command -v node >/dev/null || die "node is required"
+
+TMP="$(mktemp -d)" || die "cannot create temp dir"
+OLD="$TMP/old"
+cleanup() {
+  git -C "$WT" worktree remove --force "$OLD" >/dev/null 2>&1 || true
+  git -C "$WT" worktree prune >/dev/null 2>&1 || true
+  rm -rf "$TMP"
+}
+trap cleanup EXIT
+
+# Per area i: $TMP/test.i (changed test files), $TMP/support.i (changed helpers), $TMP/seen.i (any changed file).
+AREA_NAME=() AREA_KIND=() AREA_DIR=()
+for i in "${!AREAS[@]}"; do
+  IFS="|" read -r "AREA_NAME[$i]" "AREA_KIND[$i]" "AREA_DIR[$i]" <<< "${AREAS[$i]}"
+  : > "$TMP/test.$i"; : > "$TMP/support.$i"; : > "$TMP/seen.$i"
+done
+
+# Area of a path: the one with the longest matching dir ("." matches everything). Prints the index or nothing.
+area_of() {
+  local f="$1" best="" bestlen=-1 i d
+  for i in "${!AREA_DIR[@]}"; do
+    d="${AREA_DIR[$i]}"
+    if [[ "$d" == "." ]]; then
+      [[ 0 -gt $bestlen ]] && { best=$i; bestlen=0; }
+    elif [[ "$f" == "$d"/* && ${#d} -gt $bestlen ]]; then
+      best=$i; bestlen=${#d}
+    fi
+  done
+  echo "$best"
+}
+
+# Changed files (added/copied/modified/renamed, tracked + untracked), NUL separated so names with spaces work.
+while IFS= read -r -d '' f; do
+  i="$(area_of "$f")"
+  [[ -n "$i" ]] || continue
+  rel="$f"; [[ "${AREA_DIR[$i]}" == "." ]] || rel="${f#"${AREA_DIR[$i]}"/}"
+  echo "$f" >> "$TMP/seen.$i"
+  case "${AREA_KIND[$i]}" in
+    maven)
+      case "$rel" in
+        src/test/*.java) case "$rel" in *Test.java|*Tests.java|*IT.java) echo "$f" >> "$TMP/test.$i" ;; *) echo "$f" >> "$TMP/support.$i" ;; esac ;;
+        src/test/*) echo "$f" >> "$TMP/support.$i" ;;
+      esac ;;
+    vitest)
+      case "$rel" in
+        *.test.ts|*.test.tsx|*.test.js|*.test.jsx) echo "$f" >> "$TMP/test.$i" ;;
+        src/test/*) echo "$f" >> "$TMP/support.$i" ;;
+      esac ;;
+  esac
+done < <(
+  { git -C "$WT" diff --name-only -z --diff-filter=ACMR "$BASE" --; git -C "$WT" ls-files -z --others --exclude-standard; } | sort -zu
+)
+
+ANY=0
+for i in "${!AREA_NAME[@]}"; do
+  if [[ "${AREA_KIND[$i]}" != maven && "${AREA_KIND[$i]}" != vitest ]]; then
+    [[ -s "$TMP/seen.$i" ]] && echo "SKIP ${AREA_NAME[$i]}: unsupported (no test discovery for this area; judge its tests from the diff)"
+  elif [[ -s "$TMP/test.$i" ]]; then
+    ANY=1
+  fi
+done
+if [[ $ANY -eq 0 ]]; then
+  echo "no tests changed"
+  exit 0
+fi
+
+git -C "$WT" worktree add --detach "$OLD" "$BASE" >/dev/null 2>&1 || die "cannot create worktree at $BASE"
+
+for i in "${!AREA_NAME[@]}"; do
+  while IFS= read -r f; do
+    mkdir -p "$OLD/$(dirname "$f")" && cp -p "$WT/$f" "$OLD/$f" || die "cannot copy $f"
+  done < <(cat "$TMP/test.$i" "$TMP/support.$i")
+done
+
+RESULTS="$TMP/results.tsv"   # status<TAB>path<TAB>title<TAB>display
+: > "$RESULTS"
+
+# Results parsers (node, no dependencies). Argument: results file, area name, then the inputs.
+parse_surefire() {
+  node - "$@" <<'JS'
+const fs = require('fs');
+const [results, area, ...files] = process.argv.slice(2);
+const decode = (v) => v
+  .replace(/&#x([0-9a-fA-F]+);/g, (m, h) => String.fromCodePoint(parseInt(h, 16)))
+  .replace(/&#(\d+);/g, (m, d) => String.fromCodePoint(Number(d)))
+  .replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+const attr = (head, k) => {
+  const m = head.match(new RegExp('\\s' + k + '="([^"]*)"'));
+  return m ? decode(m[1]) : '';
+};
+let out = '';
+for (const file of files) {
+  const xml = fs.readFileSync(file, 'utf8');
+  for (let part of xml.split(/<testcase\b/).slice(1)) {
+    part = part.split('</testsuite>')[0];
+    const head = part.slice(0, part.indexOf('>'));
+    // match result elements only outside CDATA and system-out/system-err (a test may print "<failure>")
+    const body = part.replace(/<!\[CDATA\[[\s\S]*?\]\]>/g, '').replace(/<system-(out|err)\b[\s\S]*?<\/system-\1>/g, '');
+    if (/<skipped\b/.test(body)) continue;
+    const bad = /<(failure|error)\b/.test(body);
+    const classname = attr(head, 'classname');
+    const name = attr(head, 'name');
+    const cls = classname.split('$')[0].split('.').pop();
+    out += [bad ? 'RED' : 'GREEN-ON-OLD', cls + '.java', name.split('(')[0], area + ' ' + classname + '.' + name].join('\t') + '\n';
+  }
+}
+fs.appendFileSync(results, out);
+JS
+}
+
+parse_vitest() {
+  node - "$@" <<'JS'
+const fs = require('fs');
+const [results, area, dir, json, ...rels] = process.argv.slice(2);
+const prefix = dir === '.' ? '' : dir + '/';
+let out = '';
+for (const suite of JSON.parse(fs.readFileSync(json, 'utf8')).testResults || []) {
+  const name = suite.name || '?';
+  const rel = rels.find((r) => name === r || name.endsWith('/' + r)) || name;
+  const tests = suite.assertionResults || [];
+  if (tests.length === 0) {
+    if (suite.status === 'failed') out += ['RED-COMPILE', prefix + rel, '', area + ' ' + rel + ' (suite failed to load on old code)'].join('\t') + '\n';
+    continue;
+  }
+  for (const t of tests) {
+    if (['pending', 'skipped', 'todo'].includes(t.status)) continue;
+    out += [t.status === 'failed' ? 'RED' : 'GREEN-ON-OLD', prefix + rel, t.title || '', area + ' ' + rel + ' > ' + (t.fullName || '?')].join('\t') + '\n';
+  }
+}
+fs.appendFileSync(results, out);
+JS
+}
+
+run_maven() {   # index
+  local i="$1" dir="${AREA_DIR[$1]}" classes=() f
+  while IFS= read -r f; do f="${f##*/}"; classes+=("${f%.java}"); done < "$TMP/test.$i"
+  local list; list="$(IFS=,; echo "${classes[*]}")"
+  local log="$TMP/maven.$i.log" mvn_cmd=(mvn)
+  [[ -x "$OLD/$dir/mvnw" ]] && mvn_cmd=(./mvnw)
+  ( cd "$OLD/$dir" && "${mvn_cmd[@]}" test "-Dtest=$list" -Dsurefire.failIfNoSpecifiedTests=false ) >"$log" 2>&1
+  local rc=$?
+  local reports=( "$OLD/$dir"/target/surefire-reports/TEST-*.xml )
+  if [[ -e "${reports[0]}" ]]; then
+    parse_surefire "$RESULTS" "${AREA_NAME[$i]}" "${reports[@]}" || return 2
+    return 0
+  fi
+  if grep -q "COMPILATION ERROR" "$log"; then
+    local c
+    for c in "${classes[@]}"; do printf 'RED-COMPILE\t%s.java\t\t%s %s (old code does not compile)\n' "$c" "${AREA_NAME[$i]}" "$c" >> "$RESULTS"; done
+    return 0
+  fi
+  echo "${AREA_NAME[$i]}: run produced no reports (exit $rc); tail of output:" >&2
+  tail -n 30 "$log" >&2
+  return 2
+}
+
+run_vitest() {   # index
+  local i="$1" dir="${AREA_DIR[$1]}" rel=() f prefix=""
+  [[ "$dir" == "." ]] || prefix="$dir/"
+  while IFS= read -r f; do rel+=("${f#"$prefix"}"); done < "$TMP/test.$i"
+  local log="$TMP/vitest.$i.log" json="$TMP/vitest.$i.json" install runner
+  if [[ -f "$OLD/$dir/pnpm-lock.yaml" ]]; then
+    install=(pnpm install --frozen-lockfile --prefer-offline); runner=(pnpm vitest)
+  elif [[ -f "$OLD/$dir/package-lock.json" ]]; then
+    install=(npm ci); runner=(npx vitest)
+  else
+    echo "SKIP ${AREA_NAME[$i]}: unsupported (no pnpm-lock.yaml or package-lock.json in $dir; judge its tests from the diff)"
+    return 0
+  fi
+  ( cd "$OLD/$dir" && "${install[@]}" ) >"$log" 2>&1 || { echo "${AREA_NAME[$i]}: install failed; tail:" >&2; tail -n 30 "$log" >&2; return 2; }
+  ( cd "$OLD/$dir" && "${runner[@]}" run "${rel[@]}" --reporter=json "--outputFile=$json" ) >>"$log" 2>&1
+  if [[ ! -s "$json" ]]; then
+    echo "${AREA_NAME[$i]}: vitest produced no JSON report; tail:" >&2; tail -n 30 "$log" >&2; return 2
+  fi
+  parse_vitest "$RESULTS" "${AREA_NAME[$i]}" "$dir" "$json" "${rel[@]}" || return 2
+  return 0
+}
+
+STATUS=0
+for i in "${!AREA_NAME[@]}"; do
+  [[ -s "$TMP/test.$i" ]] || continue
+  case "${AREA_KIND[$i]}" in
+    maven) run_maven "$i" || STATUS=2 ;;
+    vitest) run_vitest "$i" || STATUS=2 ;;
+  esac
+done
+[[ $STATUS -eq 2 ]] && die "could not run the tests on the old code (not a pass)"
+
+cat "$TMP"/test.* > "$TMP/testfiles"
+echo "red-green-check: base=$BASE"
+# A GREEN test only counts as GREEN-ON-OLD when the child touched it (changed lines per file from git; every
+# line of an untracked or new file); untouched tests in a changed file show as UNCHANGED.
+node - "$WT" "$BASE" "$RESULTS" "$TMP/testfiles" <<'JS'
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const [wt, base, results, testfiles] = process.argv.slice(2);
+const git = (...args) => spawnSync('git', ['-C', wt, ...args], { encoding: 'utf8' });
+const touched = new Map();
+for (const f of fs.readFileSync(testfiles, 'utf8').split('\n').filter(Boolean)) {
+  const lines = new Set();
+  if (git('ls-files', '--error-unmatch', '--', f).status === 0 && git('cat-file', '-e', base + ':' + f).status === 0) {
+    for (const l of git('diff', '-U0', base, '--', f).stdout.split('\n')) {
+      const m = l.match(/^@@ -\S+ \+(\d+)(?:,(\d+))? @@/);
+      if (!m) continue;
+      const a = Number(m[1]);
+      const n = m[2] === undefined ? 1 : Number(m[2]);
+      for (let i = a; i < a + n; i++) lines.add(i);
+    }
+  } else {
+    const count = fs.readFileSync(path.join(wt, f), 'utf8').split('\n').length;
+    for (let i = 1; i <= count; i++) lines.add(i);
+  }
+  touched.set(f, lines);
+}
+const starts = /^\s*(@Test|@ParameterizedTest|@RepeatedTest|it\(|it\.each|test\(|it\.skip|test\.each)/;
+function segmentTouched(file, title) {
+  const key = [...touched.keys()].find((k) => k === file || k.endsWith('/' + file));
+  if (!title || key === undefined) return true;
+  let lines;
+  try { lines = fs.readFileSync(path.join(wt, key), 'utf8').split('\n'); } catch (e) { return true; }
+  const idx = [];
+  lines.forEach((l, i) => { if (starts.test(l)) idx.push(i + 1); });
+  idx.push(lines.length + 1);
+  for (let k = 0; k + 1 < idx.length; k++) {
+    const a = idx[k];
+    const b = idx[k + 1];
+    if (lines.slice(a - 1, b - 1).some((l) => l.includes(title))) {
+      return [...touched.get(key)].some((n) => n >= a && n < b);
+    }
+  }
+  return true;   // title not found: stay conservative
+}
+const rows = [];
+let green = 0;
+for (const l of fs.readFileSync(results, 'utf8').split('\n').filter(Boolean)) {
+  const [status, file, title, disp] = l.split('\t');
+  let st = status;
+  if (st === 'GREEN-ON-OLD') {
+    if (!segmentTouched(file, title)) st = 'UNCHANGED';
+    else green++;
+  }
+  rows.push([st, disp]);
+}
+const order = { 'GREEN-ON-OLD': 0, 'RED-COMPILE': 1, 'RED': 2, 'UNCHANGED': 3 };
+rows.sort((x, y) => order[x[0]] - order[y[0]] || (x[1] < y[1] ? -1 : x[1] > y[1] ? 1 : 0));
+for (const [st, disp] of rows) console.log(st.padEnd(13) + ' ' + disp);
+console.log('RESULT: ' + (green ? 'GREEN-ON-OLD tests found (suspicious)' : 'all changed tests are red on old code'));
+process.exit(green ? 1 : 0);
+JS
+exit $?

package/templates/scripts/red-green-check.test.sh

@@ -0,0 +1,151 @@
+#!/usr/bin/env bash
+# Shell test for red-green-check.sh with a throwaway git repo and stubbed mvnw/pnpm.
+# Needs only bash, git and node: no Maven, pnpm, Docker, database or network. It sets its own area table
+# (RED_GREEN_AREAS), so it tests the generic parts: argument parsing, test discovery, RED / GREEN-ON-OLD /
+# RED-COMPILE classification and the SKIP of unsupported areas. Usage: .claude/scripts/red-green-check.test.sh
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT="$HERE/red-green-check.sh"
+TMP="$(mktemp -d)"
+export RED_GREEN_AREAS="backend|maven|backend
+frontend|vitest|frontend
+svc|unsupported|svc"
+trap 'rm -rf "$TMP"' EXIT
+FAILS=0
+check() { # description, condition result (0 = ok)
+  if [[ "$2" -eq 0 ]]; then echo "ok   - $1"; else echo "FAIL - $1"; FAILS=$((FAILS + 1)); fi
+}
+
+# Stub mvnw: a test class "*RedTest" fails unless backend/src/main/feature.txt exists, "*GreenTest" always passes.
+# BREAK file -> compilation error; FAIL_TOOL file -> exit 1 with no report.
+make_repo() {
+  local r="$1"
+  mkdir -p "$r/backend/src/main" "$r/backend/src/test/java/x" "$r/frontend/src" "$r/svc" "$r/bin"
+  echo lock > "$r/frontend/pnpm-lock.yaml"
+  cat > "$r/backend/mvnw" <<'STUB'
+#!/usr/bin/env bash
+root="$(cd "$(dirname "$0")/.." && pwd)"
+[[ -e "$root/backend/src/main/FAIL_TOOL" ]] && { echo "Docker not running"; exit 1; }
+[[ -e "$root/backend/src/main/BREAK" ]] && { echo "[ERROR] COMPILATION ERROR :"; exit 1; }
+for a in "$@"; do [[ "$a" == -Dtest=* ]] && list="${a#-Dtest=}"; done
+mkdir -p "$root/backend/target/surefire-reports"
+echo '<testsuite>' > "$root/backend/target/surefire-reports/TEST-all.xml"
+IFS=, read -ra cls <<< "$list"
+for c in "${cls[@]}"; do
+  if [[ "$c" == *NoiseTest ]]; then
+    # realistic surefire output: properties block, passing test with entities in its name, noise in system-out/err
+    echo "<properties><property name=\"x\" value=\"<error>\"/></properties>"
+    echo "<testcase classname=\"x.$c\" name=\"it&apos;s &#233; &#x41;\" time=\"0.1\"><system-out><![CDATA[<failure> noise <error>]]></system-out><system-err>&lt;skipped&gt; <failure></system-err></testcase>"
+  elif [[ "$c" == *RedTest && ! -e "$root/backend/src/main/feature.txt" ]]; then
+    echo "<testcase classname=\"x.$c\" name=\"works\"><failure message=\"boom\"/></testcase>"
+  else
+    echo "<testcase classname=\"x.$c\" name=\"works\"/>"
+  fi
+done >> "$root/backend/target/surefire-reports/TEST-all.xml"
+echo '</testsuite>' >> "$root/backend/target/surefire-reports/TEST-all.xml"
+STUB
+  chmod +x "$r/backend/mvnw"
+  # pnpm stub (put on PATH): install is a no-op; vitest writes JSON, failing "red space.test.ts" when feature.txt is absent.
+  cat > "$r/bin/pnpm" <<'STUB'
+#!/usr/bin/env bash
+[[ "$1" == install ]] && exit 0
+out=""; files=()
+for a in "$@"; do
+  case "$a" in --outputFile=*) out="${a#--outputFile=}" ;; vitest|run|--reporter=json) ;; *) files+=("$a") ;; esac
+done
+root="$(cd ../ && pwd)"
+printf '{"testResults":[' > "$out"; sep=""
+for f in "${files[@]}"; do
+  st=passed
+  [[ "$f" == *red* && ! -e "$root/backend/src/main/feature.txt" ]] && st=failed
+  printf '%s{"name":"%s/frontend/%s","assertionResults":[{"fullName":"does it","status":"%s"}]}' "$sep" "$root" "$f" "$st" >> "$out"; sep=","
+done
+printf ']}' >> "$out"
+STUB
+  chmod +x "$r/bin/pnpm"
+  ( cd "$r" && git init -q && git config user.email t@t && git config user.name t \
+    && echo base > README && git add -A -f && git commit -qm base )
+}
+
+run() { ( cd "$1" && PATH="$1/bin:$PATH" "$SCRIPT" "$1" "${@:2}" ) ; }
+
+# 1. failing on old code -> RED, exit 0 (backend + frontend, file name with spaces)
+R1="$TMP/r1"; make_repo "$R1"
+echo 'class T {}' > "$R1/backend/src/test/java/x/FooRedTest.java"
+echo 'x' > "$R1/frontend/src/red space.test.ts"
+touch "$R1/backend/src/main/feature.txt"   # the "implementation", present only in the working tree
+set +e; OUT="$(run "$R1" 2>&1)"; RC=$?; set -e
+check "red tests exit 0" $([[ $RC -eq 0 ]]; echo $?)
+check "backend RED reported" $([[ "$OUT" == *"RED "*"backend x.FooRedTest.works"* ]]; echo $?)
+check "frontend RED with spaces in name" $([[ "$OUT" == *"RED "*"red space.test.ts"* ]]; echo $?)
+
+# 2. passing on old code -> GREEN-ON-OLD, exit 1
+R2="$TMP/r2"; make_repo "$R2"
+echo 'class T {}' > "$R2/backend/src/test/java/x/BarGreenTest.java"
+set +e; OUT="$(run "$R2" 2>&1)"; RC=$?; set -e
+check "green-on-old exits 1" $([[ $RC -eq 1 ]]; echo $?)
+check "GREEN-ON-OLD reported" $([[ "$OUT" == *"GREEN-ON-OLD"*"BarGreenTest"* ]]; echo $?)
+
+# 3. old code does not compile -> RED-COMPILE, exit 0 (BREAK is committed in base)
+R3="$TMP/r3"; make_repo "$R3"
+touch "$R3/backend/src/main/BREAK"; ( cd "$R3" && git add -f -A && git commit -qm brk )
+echo 'class T {}' > "$R3/backend/src/test/java/x/NewGreenTest.java"
+set +e; OUT="$(run "$R3" 2>&1)"; RC=$?; set -e
+check "red-compile exits 0" $([[ $RC -eq 0 ]]; echo $?)
+check "RED-COMPILE reported" $([[ "$OUT" == *"RED-COMPILE"* ]]; echo $?)
+
+# 4. no changed tests -> exit 0
+R4="$TMP/r4"; make_repo "$R4"; echo change >> "$R4/README"
+set +e; OUT="$(run "$R4" 2>&1)"; RC=$?; set -e
+check "no tests changed exits 0" $([[ $RC -eq 0 && "$OUT" == *"no tests changed"* ]]; echo $?)
+
+# 5. tool failure -> exit 2
+R5="$TMP/r5"; make_repo "$R5"
+touch "$R5/backend/src/main/FAIL_TOOL"; ( cd "$R5" && git add -f -A && git commit -qm tool )
+echo 'class T {}' > "$R5/backend/src/test/java/x/AnyGreenTest.java"
+set +e; OUT="$(run "$R5" 2>&1)"; RC=$?; set -e
+check "tool failure exits 2" $([[ $RC -eq 2 ]]; echo $?)
+
+# 6. worktree untouched and temp worktree removed
+BEFORE="$(git -C "$R2" status --porcelain)"
+set +e; run "$R2" >/dev/null 2>&1; set -e
+check "git status unchanged" $([[ "$BEFORE" == "$(git -C "$R2" status --porcelain)" ]]; echo $?)
+check "no leftover worktrees" $([[ "$(git -C "$R2" worktree list | wc -l | tr -d ' ')" == 1 ]]; echo $?)
+
+# 7. frontend test that passes on old code -> GREEN-ON-OLD, exit 1 (stub passes anything not named *red*)
+R7="$TMP/r7"; make_repo "$R7"
+echo 'x' > "$R7/frontend/src/ok.test.ts"
+set +e; OUT="$(run "$R7" 2>&1)"; RC=$?; set -e
+check "frontend green-on-old exits 1" $([[ $RC -eq 1 && "$OUT" == *"GREEN-ON-OLD"*"frontend src/ok.test.ts"* ]]; echo $?)
+
+# 8. changed files of an unsupported area are skipped with a clear message, not run and not a failure
+R8="$TMP/r8"; make_repo "$R8"
+echo 'def test_x(): pass' > "$R8/svc/test_x.py"
+set +e; OUT="$(run "$R8" 2>&1)"; RC=$?; set -e
+check "unsupported area: SKIP, exit 0" $([[ $RC -eq 0 && "$OUT" == *"SKIP svc: unsupported"* && "$OUT" == *"no tests changed"* ]]; echo $?)
+
+# 9. a supported area alongside an unsupported one: tests run, SKIP is still reported
+R9="$TMP/r9"; make_repo "$R9"
+echo 'def test_x(): pass' > "$R9/svc/test_x.py"
+echo 'class T {}' > "$R9/backend/src/test/java/x/BazGreenTest.java"
+set +e; OUT="$(run "$R9" 2>&1)"; RC=$?; set -e
+check "mixed areas: SKIP plus GREEN-ON-OLD" $([[ $RC -eq 1 && "$OUT" == *"SKIP svc"* && "$OUT" == *"GREEN-ON-OLD"*"BazGreenTest"* ]]; echo $?)
+
+# 10. helper files (not tests) alone do not count as changed tests
+R10="$TMP/r10"; make_repo "$R10"
+echo 'class H {}' > "$R10/backend/src/test/java/x/Helper.java"
+set +e; OUT="$(run "$R10" 2>&1)"; RC=$?; set -e
+check "support file only: no tests changed" $([[ $RC -eq 0 && "$OUT" == *"no tests changed"* ]]; echo $?)
+
+# 10b. noise in <system-out>/CDATA and entities in names: passing test stays GREEN-ON-OLD, name is decoded
+R10B="$TMP/r10b"; make_repo "$R10B"
+echo 'class T {}' > "$R10B/backend/src/test/java/x/QuietNoiseTest.java"
+set +e; OUT="$(run "$R10B" 2>&1)"; RC=$?; set -e
+check "system-out noise is not a failure" $([[ $RC -eq 1 && "$OUT" == *"GREEN-ON-OLD"*"it's é A"* && "$OUT" != *"RED "* ]]; echo $?)
+
+# 11. argument errors exit 2
+set +e; "$SCRIPT" >/dev/null 2>&1; RC1=$?; "$SCRIPT" "$R4" no-such-ref >/dev/null 2>&1; RC2=$?; "$SCRIPT" "$TMP/missing" >/dev/null 2>&1; RC3=$?; set -e
+check "usage, unknown ref and missing worktree exit 2" $([[ $RC1 -eq 2 && $RC2 -eq 2 && $RC3 -eq 2 ]]; echo $?)
+
+[[ $FAILS -eq 0 ]] && echo "all passed" || { echo "$FAILS failed"; exit 1; }

package/templates/settings/hooks.json

@@ -0,0 +1,31 @@
+{
+  "hooks": {},
+  "features": {
+    "dashboard": {
+      "hooks": {
+        "SessionStart": [
+          {
+            "hooks": [
+              {
+                "type": "command",
+                "command": "node \"$CLAUDE_PROJECT_DIR/.claude/wavework/dashboard/hooks/session-start.mjs\"",
+                "timeout": 5
+              }
+            ]
+          }
+        ],
+        "SubagentStop": [
+          {
+            "hooks": [
+              {
+                "type": "command",
+                "command": "node \"$CLAUDE_PROJECT_DIR/.claude/wavework/dashboard/hooks/subagent-stop.mjs\"",
+                "timeout": 10
+              }
+            ]
+          }
+        ]
+      }
+    }
+  }
+}

package/templates/skills/next-task/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: next-task
+description: Implement a whole beads epic end to end. Takes an epic ID, creates a branch, prepares dependencies, plans the work, works in its own git worktree, hands each child task to an implementer sub-agent (tests first, implementation, e2e, focused test runs), records out-of-scope findings as beads, then closes the beads, updates docs, pushes to {{baseBranch}} and removes the worktree and branch. Use when the user says "next-task <epic-id>" or asks to implement an epic.
+---
+
+# next-task
+
+Orchestrates one epic from branch to push. You coordinate; the implementer sub-agents write the code. **Model check first:** before any other step or tool call, check the session model. If it isn't {{orchestrationModelName}} (Model Policy in CLAUDE.md), stop, say so and suggest `/model {{models.orchestration}}`. Don't create branches or claim beads first.
+
+**Input:** an epic ID, optionally with the flag `--watch-ci` (`$ARGUMENTS`). Remove the flag, then take the rest as the epic ID. If the ID is missing, or `bd show <id>` says it isn't an epic, stop and ask for one, whatever flags were passed. A whole-branch review always runs before the push (step 7). Never pick an epic yourself.
+
+**By invoking this skill the user authorizes** for this epic: creating and deleting its branch and worktree, committing, pushing the branch to `{{baseBranch}}` (fast-forward only) and filing `finding` beads (under the standing findings epics, see `next-task-findings`). Nothing else: never force-push, never rewrite pushed history{{#if noAttribution}}, never add attribution lines (see CLAUDE.md){{/if}}.
+
+## Steps
+
+Each step lives in its own skill under `.claude/skills/`. Read that skill's `SKILL.md` and follow it. Stop and report to the user whenever a step says to stop. Don't skip ahead.
+
+{{#if dashboard}}
+**Recording:** `Record:` lines call `node .claude/wavework/dashboard/record.mjs <event> --run <RUN> ...` from `<WT>` (record from `<WT>` while it exists; record the end of the run before the worktree is removed). `<RUN>` = the branch name with `/` replaced by `.` (e.g. `epic.shipr-1hxo-pipeline-dashboard`). Fire-and-forget: it always exits 0, never wait on or react to it. Fields: `.claude/wavework/dashboard/README.md`.
+
+Record: every stop in steps 1–7 (failed bead check or deps, failed plan, failed verification after the retry, review round 3 still failing, blocked child): `run-end --status blocked`.
+
+{{/if}}
+1. **Branch:** `next-task-branch` with prefix `epic`. Creates `{{epicBranch}}` from `origin/{{baseBranch}}` in its own worktree `<WT>`. Every later step, including yours, runs only in `<WT>` (`cd <WT> && ...`, absolute paths under it); never switch branches in the main checkout.
+   {{#if dashboard}}
+   Record: `run-start --kind next-task --units <epic-id> --branch <branch> --worktree <WT>` (under `next-task-batch` add `--parent <BATCH-RUN>`).
+   {{/if}}
+2. **Check beads:** `next-task-plan`, part 1. Validates the epic and its children.
+   {{#if dashboard}}
+   Record: `step-start --step plan`.
+   {{/if}}
+3. **Dependencies:** `next-task-deps`. Installs packages and applies safe updates as their own commit.
+   {{#if dashboard}}
+   Record: `step-start --step deps` before, `step-end --step deps` after.
+   {{/if}}
+4. **Plan implementation:** `next-task-plan`, part 2. Orders the children into waves, with the model and file set for each.
+   {{#if dashboard}}
+   Record: `step-end --step plan`.
+   {{/if}}
+5. **Hand off to sub-agents:** for each wave, start one implementer per child. Use {{implementerAgentsOr}} according to the child's `model:` label. Children in the same wave run in parallel; waves run one after another. Give each agent the prompt template from `next-task-plan`, with the worktree path.{{#if dashboard}} Record: `step-start --step wave --wave <n>` per wave and `step-end --step wave --wave <n>` when it is done; `child-start --bead <child> --model <{{implementerModelPipe}}> --wave <n>` when starting a child.{{/if}} Each sub-agent then follows `next-task-implement`:
+   1. write tests (`next-task-write-tests`)
+   2. implement (`next-task-code`)
+   3. e2e tests (`next-task-e2e`)
+   4. run the focused checks of its area (`next-task-test`)
+   5. report back as finished, with out-of-scope findings
+6. **After each sub-agent reports:** verify the result yourself before accepting it:
+   - `cd <WT> && git branch --show-current` still shows the epic branch, and the changed files are in `<WT>`, not in the main checkout
+   - re-run `next-task-test` for its area
+   - the report has a **Red before green** section (failing test name + assertion line, or an explicit allowed exception); if missing, treat it as a review must-fix and send it back to the implementer
+   - **Red-green check:** after re-running `next-task-test` and before the review, run `.claude/scripts/red-green-check.sh <WT>` (it runs the child's new/changed tests against the pre-change code in a throwaway worktree; tests that need external services need them running). Exit 0 = ok, 1 = some test is `GREEN-ON-OLD`, 2 = tool/setup error (fix the cause and rerun; never treat as a pass). Pass its output to the reviewer. Skip only for a stated exception (pure refactor/docs/config), where it prints "no tests changed" anyway
+   - check the diff against the acceptance criteria and the CLAUDE.md rules (architecture, security{{#if uiSkill}}, and `{{uiSkill.name}}` for UI under {{uiPaths}}{{/if}})
+   - **Review:** run `next-task-review` (fresh read-only reviewer sub-agent). Must-fix findings go back to the same implementer (SendMessage), then re-verify and review again; at most 3 review rounds per child. Out-of-scope findings go to `next-task-findings`. If round 3 still has must-fix findings, stop that child uncommitted and hand off to the user with the open findings
+   - after a review PASS, commit only that child's files: `git commit -m "<child title> (<child-id>)"`
+   - **Findings:** run `next-task-findings` for the agent's reported findings and whatever your own review of the diff turned up outside the child's scope
+   {{#if dashboard}}
+   - Record: `child-end --bead <child> --result <committed|blocked> --redBeforeGreen <yes|exception>` after the commit, the BLOCKED handling or a review round 3 that still fails; `finding --bead <finding-id>` per filed finding
+   {{/if}}
+
+   If **verification** fails or is incomplete (not review findings, which follow the review loop above), send the agent the concrete findings once (SendMessage). If it still isn't right, stop and report.
+
+   **If the agent reports BLOCKED** (retry cap in `next-task-implement`): `bd update <child> --status blocked --append-notes "<reason + failing output tail>"`. Leave its changes uncommitted, keep worktree and branch, and don't start any child that depends on it, directly or transitively. Continue the independent children. Don't start the next wave until every child in the current wave is committed or blocked.
+7. **When all sub-agents are finished:** if any child is blocked, don't run `next-task-finish`: stop and report the blocked children, skipped dependents and the worktree path. Rerunning `/next-task <epic-id>` resumes in that worktree (`next-task-branch`), picks up blocked and open children, and finishes then.{{#if dashboard}} Record the stop with `run-end --status blocked`.{{/if}} Otherwise `next-task-finish` (it includes the branch review). Rebase onto `origin/{{baseBranch}}`, final full test run, remaining findings, close the beads, write the documentation, push to `{{baseBranch}}`, then remove the worktree and branch.
+8. **Watch CI (optional):** only after step 7 has pushed `{{baseBranch}}` successfully.
+   - With `--watch-ci`: run the `watch-ci` skill for `{{baseBranch}}` (branch argument `{{baseBranch}}`) right away.
+   - Without it: ask once with AskUserQuestion, "Skip" as the first and default option, and "Watch CI" second. On "Skip", don't watch.
+   - A CI failure never reopens beads, reverts or re-merges anything. Report it; `watch-ci` then offers its bug bead. Don't fix or re-run anything here.
+
+## Report
+
+At the end, keep it short:
+- the epic and each child with its commit hash
+- the test results
+- anything deferred, and the `finding` beads filed (ID, priority, title)
+- the push result
+- the CI result from `watch-ci` (run conclusions and URLs), or "CI not watched"
+
+If the run stopped early, say which step stopped it, why, and what state the branch and the worktree (path) are in.

package/templates/skills/next-task-batch/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: next-task-batch
+description: Implement several beads epics in one run. Orders them by their dependencies, then runs the full /next-task pipeline for each epic one after another (each in its own worktree, each pushed to {{baseBranch}} before the next starts), and watches CI once at the end. Use when the user says "next-task-batch <epic-id> <epic-id> ..." or asks to implement multiple epics.
+---
+
+# next-task-batch
+
+A loop over `next-task`. **Model check first:** before any other step or tool call, check the session model. If it isn't {{orchestrationModelName}} (Model Policy in CLAUDE.md), stop, say so and suggest `/model {{models.orchestration}}`. Don't create branches or claim beads first.
+
+**Input:** two or more epic IDs, optionally with the flag `--watch-ci` (`$ARGUMENTS`). Every epic's `next-task` run includes the whole-branch review before its push; an epic whose review leaves must-fix findings stops as in step 4. If any ID is missing or not an epic (`bd show`), stop and ask before starting anything; point to `/next-task-beads` for non-epic beads. Never add epics yourself.
+
+**By invoking this skill the user authorizes** for each listed epic what `next-task` authorizes for one. Nothing more.
+
+## Steps
+
+1. **Check all epics up front:** run `next-task-plan` part 1 for every epic before starting the first one, so a broken bead late in the batch is found now. If any fails, stop and report all failures together.
+2. **Order:** epics run **sequentially**, one finished and pushed before the next starts. That way each epic branches from a `{{baseBranch}}` that already contains the earlier ones, and conflicts can't pile up. Keep the user's order, except move an epic after any other listed epic it depends on (`bd dep list`, including dependencies of its children on the other epic's children). A dependency on an open epic that is not in the batch: that epic is skipped (see 4). Show the final order before starting.
+3. **Run each epic:** follow `next-task` steps 1–7 for it (own worktree via `next-task-branch`, the **Red before green** check and the `next-task-review` loop after each child with its 3-round cap, findings, `next-task-finish`). Don't watch CI per epic.
+   {{#if dashboard}}
+   Record: `<BATCH-RUN>` = `batch.<first epic id in the final order>`. Right after `next-task-branch` creates the first epic's worktree, from that `<WT>`: `node .claude/wavework/dashboard/record.mjs run-start --run <BATCH-RUN> --kind batch --units <epic ids>` (no `--worktree`, so a cwd lookup never matches the batch run). Each epic's `run-start` adds `--parent <BATCH-RUN>`; its `run-end` for the batch is in `next-task-finish`.
+   {{/if}}
+4. **When an epic stops** (failed gate, blocked child, review still failing after 3 rounds, open must-fix findings of the branch review, conflict, unclear bead, rejected push): leave its branch and worktree as they are, mark it stopped, and also skip every later epic that depends on it. Continue with the independent ones. Never retry or resolve a stopped epic yourself.
+5. **Watch CI once** after the last epic, only if at least one was pushed: with `--watch-ci` run `watch-ci` for `{{baseBranch}}`; without it ask once with AskUserQuestion ("Skip" first and default, "Watch CI" second).
+
+## Report
+
+A table: epic, status (pushed / stopped / skipped), children with commit hashes, findings filed. Then the test results per epic, for stopped ones the step, reason and worktree path, and the CI result or "CI not watched".

package/templates/skills/next-task-beads/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: next-task-beads
+description: Implement one or more individual beads (tasks, bugs, chores, findings — not epics) end to end, like /next-task but without an epic. Creates a worktree branch, plans waves, hands each bead to an implementer sub-agent, records findings, closes the beads, pushes to {{baseBranch}}. Use when the user says "next-task-beads <id> [<id> ...]" or asks to implement specific beads.
+---
+
+# next-task-beads
+
+Same pipeline as `next-task`, for a hand-picked set of beads instead of an epic's children. **Model check first:** before any other step or tool call, check the session model. If it isn't {{orchestrationModelName}} (Model Policy in CLAUDE.md), stop, say so and suggest `/model {{models.orchestration}}`. Don't create branches or claim beads first.
+
+**Input:** one or more bead IDs, optionally with the flag `--watch-ci` (`$ARGUMENTS`; the whole-branch review before the push always runs, against the beads' descriptions and criteria). If none is given, stop and ask; never pick beads yourself. If an ID is an epic, stop and point to `/next-task` (or `/next-task-batch` for several epics).
+
+**By invoking this skill the user authorizes** for these beads: creating and deleting one branch and worktree, committing, pushing it to `{{baseBranch}}` (fast-forward only) and filing `finding` beads. Nothing else: never force-push, never rewrite pushed history{{#if noAttribution}}, never add attribution lines{{/if}}.
+
+## Steps
+
+Follow `next-task` steps 1–8, with these differences:
+
+{{#if dashboard}}
+Record: the `run-start` uses `--kind beads --units <bead ids>`.
+{{/if}}
+1. **Branch:** `next-task-branch` with prefix `task`, unit ID = the first bead ID, title = that bead's title (one bead) or a short summary of the set. E.g. `{{taskBranchExample}}`.
+2. **Check beads:** `next-task-plan` part 1 with the given beads as the work set. Beads without a `model:` label fail the check: stop and suggest `/text-to-task` or adding the label. (Findings filed by `next-task-findings` already carry one. To run a whole group of them, use `/next-task <findings-epic>`.) Dependencies between the given beads order the waves; an open blocker outside the set stops the run.
+3. **Dependencies, plan, hand-off, verify, findings:** exactly as in `next-task` steps 3–6, including the **Red before green** check (a report without it is a must-fix) and the **Red-green check** script run (`.claude/scripts/red-green-check.sh <WT>` after re-running `next-task-test`, before the review; its output goes to the reviewer) and the `next-task-review` loop after each bead (max 3 rounds, then stop that bead and hand off) and the BLOCKED handling (blocked bead: status `blocked`, notes, worktree kept, dependents skipped, no finish; rerunning resumes in the worktree). Commit each bead as `<bead title> (<bead-id>)`.
+4. **Finish:** `next-task-finish` as a bead run (no epic to close; docs commit `Document <short summary> (<ids>)`).
+5. **Watch CI:** as `next-task` step 8.
+
+## Report
+
+As in `next-task`: each bead with its commit hash, test results, findings filed, push result, CI result. If stopped early: which step, why, branch and worktree state.

package/templates/skills/next-task-branch/SKILL.md

@@ -0,0 +1,19 @@
+---
+name: next-task-branch
+description: Step 1 of /next-task, /next-task-beads and /next-task-batch. Creates the working branch in its own git worktree from the latest origin/{{baseBranch}}, so parallel sessions and sub-agents never share a checkout. Normally invoked by those skills, not directly.
+---
+
+# next-task-branch
+
+**Input:** a unit ID (the epic ID, or for `/next-task-beads` the first bead ID), a branch prefix (`epic` or `task`) and a title for the slug.
+
+A branch belongs to a checkout, not to an agent. Every run therefore gets its **own worktree**; the main checkout is never switched, so other sessions working there are not disturbed and nothing lands on the wrong branch.
+
+1. **Find the main repo:** `MAIN=$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")`. The worktree path is `WT={{worktreeExpr}}`, e.g. `{{worktreeExample}}`.
+2. **Fetch {{baseBranch}}:** `git -C "$MAIN" fetch origin {{baseBranch}}`. Never base the branch on the current branch, `HEAD` or the local `{{baseBranch}}`.
+3. **Create branch and worktree in one step:** `git -C "$MAIN" worktree add -b {{branchExpr}} "$WT" origin/{{baseBranch}}`. The slug is 2–5 lowercase words from the title joined by hyphens, e.g. `epic/shipr-yy7-project-skeleton`.
+   - **Resume:** if `WT` already exists (`git worktree list`) and has a `{{branchGlob}}` branch checked out, reuse it instead of failing: skip steps 2–3, don't touch its commits or uncommitted changes, and report "resumed" with `git status --short` and `git log --oneline origin/{{baseBranch}}..HEAD`. A blocked bead's work is still there.
+   - If the path or branch exists in any other way (other branch in the path, branch without worktree), ask the user whether to resume or start fresh. Starting fresh deletes the old worktree and branch, so confirm first, and never remove a worktree with uncommitted changes.
+   - Uncommitted changes in the main checkout are not your concern: they stay there and are not carried over.
+4. **From now on, work only in `$WT`.** Start every Bash command with `cd <WT> &&` and use absolute paths under `<WT>` for Read/Edit/Write. Never run `git switch`/`checkout` anywhere.
+5. Report the branch name, the worktree path and the `origin/{{baseBranch}}` commit it starts from (`git -C "$MAIN" rev-parse --short origin/{{baseBranch}}`).