wogiflow 1.0.47 → 1.0.49

package/.workflow/bridges/claude-bridge.js

@@ -59,12 +59,21 @@ class ClaudeBridge extends BaseBridge {
 
   /**
    * Generate CLAUDE.md from Handlebars-like template
-   * Supports: {{variable}}, {{config.path}}, {{#if}}, {{#each}}, {{/if}}, {{/each}}
+   * Supports: {{variable}}, {{config.path}}, {{#if}}, {{#each}}, {{/if}}, {{/each}}, {{> partial}}
    */
   generateFromTemplate(templatePath, config) {
-    const template = fs.readFileSync(templatePath, 'utf-8');
+    let template;
+    try {
+      template = fs.readFileSync(templatePath, 'utf-8');
+    } catch (err) {
+      this.log(`Warning: Could not read template ${templatePath}: ${err.message}`);
+      return this.generateDefaultClaudeMd(config);
+    }
     let content = template;
 
+    // Process {{> partial}} includes first (before other processing)
+    content = this.processPartials(content);
+
     // Process {{#if config.path.to.value}}...{{/if}} blocks
     // Non-greedy match to handle nested conditions
     content = this.processConditionals(content, config);
@@ -340,24 +349,47 @@ Last synced: ${new Date().toISOString()}
   }
 
   /**
-   * Generate settings.local.json with wildcard permissions
-   * Claude Code 2.1.0+ supports wildcards like Bash(npm *)
+   * Generate settings.local.json with permissions
+   * NOTE: Requires Claude Code 2.1.7+ which fixed wildcard matching of shell operators.
+   * See security-patterns.md rule #6 for details.
    */
   generateSettings(config) {
     const projectDir = this.projectDir;
 
-    // Base wildcard permissions - covers most common use cases
+    // Permission rules - balancing security with workflow convenience
+    // Wildcards are safe in 2.1.7+ (shell operators rejected)
     const wildcardPermissions = [
-      // Package managers
-      'Bash(npm *)',
+      // Package managers - specific safe operations
+      'Bash(npm install *)',
+      'Bash(npm run *)',
+      'Bash(npm test *)',
+      'Bash(npm exec *)',
+      'Bash(npm ci)',
+      'Bash(npm audit *)',
+      'Bash(npm outdated *)',
+      'Bash(npm ls *)',
+      'Bash(npm version *)',
       'Bash(npx *)',
-      'Bash(yarn *)',
-      'Bash(pnpm *)',
-      'Bash(pip *)',
-      'Bash(python *)',
-      'Bash(python3 *)',
-
-      // Git operations
+      'Bash(yarn install *)',
+      'Bash(yarn add *)',
+      'Bash(yarn remove *)',
+      'Bash(yarn run *)',
+      'Bash(yarn test *)',
+      'Bash(yarn build *)',
+      'Bash(yarn dev *)',
+      'Bash(pnpm install *)',
+      'Bash(pnpm add *)',
+      'Bash(pnpm remove *)',
+      'Bash(pnpm run *)',
+      'Bash(pnpm test *)',
+      'Bash(pnpm build *)',
+      'Bash(pnpm dev *)',
+      'Bash(pip install *)',
+      'Bash(pip list *)',
+      'Bash(python -m *)',
+      'Bash(python3 -m *)',
+
+      // Git operations - all safe read/write operations
       'Bash(git status)',
       'Bash(git status *)',
       'Bash(git diff *)',
@@ -386,18 +418,14 @@ Last synced: ${new Date().toISOString()}
       'Bash(./scripts/flow *)',
       'Bash(./scripts/flow)',
 
-      // Common utilities
+      // Safe read-only utilities
       'Bash(ls *)',
       'Bash(tree *)',
-      'Bash(cat *)',
-      'Bash(head *)',
-      'Bash(tail *)',
       'Bash(wc *)',
-      'Bash(grep *)',
-      'Bash(find *)',
       'Bash(chmod +x *)',  // Only make executable, not arbitrary permissions
-      'Bash(node *)',
-      'Bash(bash *)',
+      'Bash(node --check *)',
+      'Bash(node --version)',
+      'Bash(bash -n *)',  // Syntax check only
       'Bash(open *)',
       'Bash(test *)',
 

package/.workflow/bridges/codex-bridge.js

@@ -0,0 +1,466 @@
+#!/usr/bin/env node
+
+/**
+ * Wogi Flow - Codex CLI Bridge
+ *
+ * Generates AGENTS.md and .codex/config.toml from WogiFlow configuration.
+ * Provides soft parity with Claude Code/Gemini CLI - same rules, same memory,
+ * but enforcement is advisory (Codex lacks pre-operation hooks).
+ */
+
+const fs = require('fs');
+const path = require('path');
+const BaseBridge = require('./base-bridge');
+
+// Try to load Handlebars, fall back to inline templates if not available
+let Handlebars;
+try {
+  Handlebars = require('handlebars');
+} catch {
+  Handlebars = null;
+}
+
+// ============================================================
+// Codex Bridge Class
+// ============================================================
+
+class CodexBridge extends BaseBridge {
+  constructor(options = {}) {
+    super('codex', options);
+  }
+
+  // ==================== Abstract Method Implementations ====================
+
+  getCliFolder() {
+    return '.codex';
+  }
+
+  getRulesFileName() {
+    return 'AGENTS.md';
+  }
+
+  getSkillsPath() {
+    return path.join('.codex', 'skills');
+  }
+
+  getRulesPath() {
+    return path.join('.codex', 'rules');
+  }
+
+  /**
+   * Register template partials with Handlebars
+   */
+  registerPartials() {
+    if (!Handlebars) return;
+
+    const partialsDir = path.join(this.projectDir, this.workflowDir, 'templates', 'partials');
+    if (!fs.existsSync(partialsDir)) return;
+
+    try {
+      const partialFiles = fs.readdirSync(partialsDir).filter(f => f.endsWith('.hbs'));
+      for (const file of partialFiles) {
+        const partialName = path.basename(file, '.hbs');
+        const partialContent = fs.readFileSync(path.join(partialsDir, file), 'utf-8');
+        Handlebars.registerPartial(partialName, partialContent);
+        this.log(`Registered partial: ${partialName}`);
+      }
+    } catch (err) {
+      this.log(`Warning: Could not register partials: ${err.message}`);
+    }
+  }
+
+  /**
+   * Generate AGENTS.md content
+   */
+  generateRulesContent(config) {
+    const context = this.buildContext(config);
+
+    // Try to use Handlebars template with proper error handling
+    if (Handlebars) {
+      // Register partials before compiling
+      this.registerPartials();
+
+      try {
+        const templatePath = path.join(this.projectDir, this.workflowDir, 'templates', 'agents-md.hbs');
+        if (fs.existsSync(templatePath)) {
+          const templateSource = fs.readFileSync(templatePath, 'utf-8');
+          const template = Handlebars.compile(templateSource);
+          return template(context);
+        }
+      } catch (err) {
+        // Template failed - fall through to inline generation
+        this.log(`Template generation failed, using fallback: ${err.message}`);
+      }
+    }
+
+    // Fallback to inline generation (includes partial content directly)
+    return this.generateAgentsMdFallback(context);
+  }
+
+  /**
+   * Codex-specific setup: generate config.toml
+   */
+  async setupCliSpecific(config) {
+    // Generate config.toml
+    const configTomlPath = path.join(this.projectDir, this.getCliFolder(), 'config.toml');
+    const configTomlContent = this.generateConfigToml(config);
+    fs.writeFileSync(configTomlPath, configTomlContent);
+    this.log('Generated .codex/config.toml');
+
+    // Convert Claude skills to Codex format
+    this.convertAndSyncSkills();
+  }
+
+  // ==================== Codex-Specific Methods ====================
+
+  /**
+   * Build template context
+   */
+  buildContext(config) {
+    // Load decisions.md for coding rules
+    const decisionsPath = path.join(this.projectDir, this.workflowDir, 'state', 'decisions.md');
+    let decisions = '';
+    try {
+      decisions = fs.readFileSync(decisionsPath, 'utf-8');
+    } catch (err) {
+      // File may not exist or be unreadable - continue with empty decisions
+      if (err.code !== 'ENOENT') {
+        this.log(`Failed to read decisions.md: ${err.message}`);
+      }
+    }
+
+    // Get installed skills
+    const skills = config.skills?.installed || [];
+
+    return {
+      projectName: path.basename(this.projectDir),
+      projectRoot: this.projectDir,
+      timestamp: new Date().toISOString(),
+      config,
+      decisions,
+      skills,
+      enforcement: config.enforcement || {},
+      research: config.research || {},
+      qualityGates: config.qualityGates || {},
+      commits: config.commits || {}
+    };
+  }
+
+  /**
+   * Fallback AGENTS.md generation (no Handlebars)
+   */
+  generateAgentsMdFallback(context) {
+    const lines = [];
+
+    lines.push('# WogiFlow Project Instructions');
+    lines.push('');
+    lines.push(`> Generated by WogiFlow Codex Bridge - ${context.timestamp}`);
+    lines.push('');
+    lines.push('## Core Principles');
+    lines.push('');
+    lines.push('1. **State files are memory** - Read `.workflow/state/` first');
+    lines.push('2. **Config drives behavior** - Follow `.workflow/config.json` rules');
+    lines.push('3. **Log every change** - Append to `request-log.md`');
+    lines.push('4. **Reuse components** - Check `app-map.md` before creating');
+    lines.push('5. **Learn from feedback** - Update instructions when corrected');
+    lines.push('');
+
+    // Task Gating
+    if (context.enforcement?.strictMode) {
+      lines.push('## Task Gating (MANDATORY)');
+      lines.push('');
+      lines.push('**STOP. Before ANY implementation:**');
+      lines.push('1. Check `.workflow/state/ready.json` for existing tasks');
+      lines.push('2. If no task exists, create one with `/wogi-story`');
+      lines.push('3. Start with `/wogi-start TASK-XXX`');
+      lines.push('');
+    }
+
+    // Research Protocol
+    if (context.research?.enabled) {
+      lines.push('## Research Protocol');
+      lines.push('');
+      lines.push('For capability/feasibility/existence questions:');
+      lines.push('1. Search local files thoroughly (Glob, Grep)');
+      lines.push('2. Web search for current documentation');
+      lines.push('3. List assumptions and verify each');
+      lines.push('4. Cite sources for all claims');
+      lines.push('5. State confidence level (HIGH/MEDIUM/LOW)');
+      lines.push('');
+      lines.push('**FORBIDDEN:** Claiming "X doesn\'t exist" without exhaustive search.');
+      lines.push('');
+    }
+
+    // Essential Commands
+    lines.push('## Essential Commands');
+    lines.push('');
+    lines.push('| Command | Purpose |');
+    lines.push('|---------|---------|');
+    lines.push('| `/wogi-ready` | Show available tasks |');
+    lines.push('| `/wogi-start TASK-X` | Start task with context |');
+    lines.push('| `/wogi-story "title"` | Create story with AC |');
+    lines.push('| `/wogi-status` | Project overview |');
+    lines.push('| `/wogi-research "q"` | Research before answering |');
+    lines.push('');
+
+    // Request Logging
+    lines.push('## Request Logging');
+    lines.push('');
+    lines.push('After EVERY request that changes files:');
+    lines.push('```markdown');
+    lines.push('### R-[XXX] | [YYYY-MM-DD HH:MM]');
+    lines.push('**Type**: new | fix | change | refactor');
+    lines.push('**Tags**: #screen:[name] #component:[name]');
+    lines.push('**Request**: "[what user asked]"');
+    lines.push('**Result**: [what was done]');
+    lines.push('**Files**: [files changed]');
+    lines.push('```');
+    lines.push('');
+
+    // Component Reuse
+    lines.push('## Component Reuse');
+    lines.push('');
+    lines.push('**Before creating ANY component:**');
+    lines.push('1. Check `app-map.md`');
+    lines.push('2. Search codebase for existing');
+    lines.push('3. Priority: Use existing → Add variant → Extend → Create new');
+    lines.push('');
+
+    // File Locations
+    lines.push('## File Locations');
+    lines.push('');
+    lines.push('| What | Where |');
+    lines.push('|------|-------|');
+    lines.push('| Config | `.workflow/config.json` |');
+    lines.push('| Tasks | `.workflow/state/ready.json` |');
+    lines.push('| Logs | `.workflow/state/request-log.md` |');
+    lines.push('| Components | `.workflow/state/app-map.md` |');
+    lines.push('| Rules | `.workflow/state/decisions.md` |');
+    lines.push('');
+
+    lines.push('---');
+    lines.push('');
+    lines.push('*Note: Enforcement is advisory. Codex lacks pre-operation hooks.*');
+
+    return lines.join('\n');
+  }
+
+  /**
+   * Generate .codex/config.toml content
+   */
+  generateConfigToml(config) {
+    const context = this.buildContext(config);
+
+    // Try to use Handlebars template with proper error handling
+    if (Handlebars) {
+      try {
+        const templatePath = path.join(this.projectDir, this.workflowDir, 'templates', 'codex-config.hbs');
+        if (fs.existsSync(templatePath)) {
+          const templateSource = fs.readFileSync(templatePath, 'utf-8');
+          const template = Handlebars.compile(templateSource);
+          return template(context);
+        }
+      } catch (err) {
+        // Template failed - fall through to inline generation
+        this.log(`Config template failed, using fallback: ${err.message}`);
+      }
+    }
+
+    // Fallback to inline generation
+    return this.generateConfigTomlFallback(context);
+  }
+
+  /**
+   * Fallback config.toml generation
+   */
+  generateConfigTomlFallback(context) {
+    const lines = [];
+
+    lines.push('# WogiFlow Codex Configuration');
+    lines.push(`# Generated: ${context.timestamp}`);
+    lines.push('');
+
+    // Approvals - safer default
+    lines.push('[approvals]');
+    lines.push('mode = "on-request"');
+    lines.push('');
+
+    // MCP Servers
+    lines.push('[mcp_servers.wogiflow_memory]');
+    lines.push('command = "node"');
+    lines.push(`args = ["mcp-memory-server/index.js"]`);
+    lines.push(`cwd = "${context.projectRoot}"`);
+    lines.push('');
+
+    // Features
+    lines.push('[features]');
+    lines.push('child_agents_md = true');
+    lines.push('');
+
+    // Fallback filenames
+    lines.push('project_doc_fallback_filenames = ["CLAUDE.md", "GEMINI.md"]');
+    lines.push('');
+
+    return lines.join('\n');
+  }
+
+  /**
+   * Convert Claude skills to Codex SKILL.md format
+   */
+  convertAndSyncSkills() {
+    const claudeSkillsDir = path.join(this.projectDir, '.claude', 'skills');
+    const codexSkillsDir = path.join(this.projectDir, this.getSkillsPath());
+
+    if (!fs.existsSync(claudeSkillsDir)) {
+      this.log('No Claude skills to convert');
+      return;
+    }
+
+    // Ensure Codex skills directory exists with explicit permissions
+    if (!fs.existsSync(codexSkillsDir)) {
+      fs.mkdirSync(codexSkillsDir, { recursive: true, mode: 0o755 });
+    }
+
+    let skillDirs;
+    try {
+      skillDirs = fs.readdirSync(claudeSkillsDir, { withFileTypes: true })
+        .filter(d => d.isDirectory())
+        .map(d => d.name);
+    } catch (err) {
+      this.log(`Failed to read skills directory: ${err.message}`);
+      return;
+    }
+
+    let converted = 0;
+    let skipped = 0;
+
+    for (const skillName of skillDirs) {
+      try {
+        // SECURITY: Validate skillName to prevent path traversal
+        // path.basename() removes any directory components (../, etc.)
+        const safeSkillName = path.basename(skillName);
+        if (safeSkillName !== skillName) {
+          this.log(`Skipping suspicious skill name: ${skillName}`);
+          skipped++;
+          continue;
+        }
+
+        // Additional validation: only alphanumeric, dash, underscore
+        if (!/^[a-zA-Z0-9_-]+$/.test(safeSkillName)) {
+          this.log(`Skipping skill with invalid characters: ${skillName}`);
+          skipped++;
+          continue;
+        }
+
+        const claudeSkillMd = path.join(claudeSkillsDir, safeSkillName, 'skill.md');
+
+        if (fs.existsSync(claudeSkillMd)) {
+          const content = fs.readFileSync(claudeSkillMd, 'utf-8');
+          const codexContent = this.convertSkillToCodex(safeSkillName, content);
+
+          // Create Codex skill directory with explicit permissions
+          const codexSkillDir = path.join(codexSkillsDir, safeSkillName);
+          if (!fs.existsSync(codexSkillDir)) {
+            fs.mkdirSync(codexSkillDir, { recursive: true, mode: 0o755 });
+          }
+
+          // Write SKILL.md (Codex format)
+          fs.writeFileSync(path.join(codexSkillDir, 'SKILL.md'), codexContent);
+          this.log(`Converted skill: ${safeSkillName}`);
+          converted++;
+        }
+      } catch (err) {
+        // Log error but continue with other skills
+        this.log(`Failed to convert skill ${skillName}: ${err.message}`);
+        skipped++;
+      }
+    }
+
+    if (converted > 0 || skipped > 0) {
+      this.log(`Skill sync complete: ${converted} converted, ${skipped} skipped`);
+    }
+  }
+
+  /**
+   * Convert a Claude skill.md to Codex SKILL.md format
+   */
+  convertSkillToCodex(skillName, claudeContent) {
+    const lines = [];
+
+    // Parse Claude frontmatter if present
+    let description = `WogiFlow ${skillName} skill`;
+    let body = claudeContent;
+
+    const frontmatterMatch = claudeContent.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+    if (frontmatterMatch) {
+      const frontmatter = frontmatterMatch[1];
+      body = frontmatterMatch[2].trim();
+
+      const descMatch = frontmatter.match(/description:\s*["']?([^"'\n]+)["']?/);
+      if (descMatch) {
+        description = descMatch[1];
+      }
+    }
+
+    // Generate Codex SKILL.md format
+    lines.push('---');
+    lines.push(`name: ${skillName}`);
+    lines.push(`description: ${description}`);
+    lines.push('metadata:');
+    lines.push(`  short-description: ${description.slice(0, 50)}`);
+    lines.push(`  source: wogi-flow`);
+    lines.push('---');
+    lines.push('');
+    lines.push(body);
+
+    return lines.join('\n');
+  }
+}
+
+// ============================================================
+// Module Exports
+// ============================================================
+
+module.exports = CodexBridge;
+
+// CLI interface if run directly
+if (require.main === module) {
+  const args = process.argv.slice(2);
+  const command = args[0];
+
+  const bridge = new CodexBridge({ verbose: true });
+
+  switch (command) {
+    case 'sync':
+      bridge.sync().then(results => {
+        console.log('');
+        console.log('Codex Bridge Sync Results:');
+        console.log(`  Success: ${results.success}`);
+        console.log(`  Duration: ${results.duration}ms`);
+        console.log(`  Synced: ${results.synced.join(', ')}`);
+        if (results.errors.length > 0) {
+          console.log(`  Errors: ${results.errors.map(e => e.error).join(', ')}`);
+        }
+      });
+      break;
+
+    case 'status':
+      const agentsMdExists = fs.existsSync(path.join(process.cwd(), 'AGENTS.md'));
+      const configTomlExists = fs.existsSync(path.join(process.cwd(), '.codex', 'config.toml'));
+
+      console.log('Codex Bridge Status:');
+      console.log(`  AGENTS.md: ${agentsMdExists ? '✓ exists' : '✗ missing'}`);
+      console.log(`  .codex/config.toml: ${configTomlExists ? '✓ exists' : '✗ missing'}`);
+      break;
+
+    default:
+      console.log('WogiFlow Codex Bridge');
+      console.log('');
+      console.log('Commands:');
+      console.log('  sync     Sync WogiFlow config to Codex format');
+      console.log('  status   Check current Codex configuration');
+      console.log('');
+      console.log('Usage:');
+      console.log('  node .workflow/bridges/codex-bridge.js sync');
+  }
+}