memstack-skill-loader 4.8.0__tar.gz → 4.10.0__tar.gz

{memstack_skill_loader-4.8.0/src/memstack_skill_loader.egg-info → memstack_skill_loader-4.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memstack-skill-loader
-Version: 4.8.0
+Version: 4.10.0
 Summary: MCP server that vector-indexes MemStack Pro skills for on-demand loading
 Requires-Python: >=3.10
 Requires-Dist: mcp>=1.0.0

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/README.md

@@ -1,6 +1,6 @@
 # MemStack™ Skill Loader
 
-**129 skills for Claude Code:** 85 free + 44 Pro exclusive. Vector-indexed so CC loads only the skill it needs, saving your context window.
+**130 skills for Claude Code:** 86 free + 44 Pro exclusive. Vector-indexed so CC loads only the skill it needs, saving your context window.
 
 ## Quick Start (5 minutes)
 
@@ -11,7 +11,7 @@ MemStack installs in two parts: the **skills** (via the Claude Code plugin marke
 /plugin marketplace add cwinvestments/memstack
 /plugin install memstack@cwinvestments-memstack
 ```
-Run both commands. This unlocks the 85 free skills right away.
+Run both commands. This unlocks the 86 free skills right away.
 
 > **SSH error?** ("Host key verification failed" on a fresh server that's never used GitHub over SSH.)
 > **Default fix · (in terminal)** — rewrite GitHub to HTTPS, then retry Step 1:
@@ -53,7 +53,7 @@ If this doesn't match Step 2's interpreter, the server won't launch (you'll see
 ```
 activate_license(key="your-key", email="you@example.com")
 ```
-Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 44 Pro skills (85 free + 44 Pro = 129 total). Then type `list skills` to verify.
+Use `key="free"` for the free tier, or your Pro key from [memstack.pro](https://memstack.pro) to unlock all 44 Pro skills (86 free + 44 Pro = 130 total). Then type `list skills` to verify.
 
 > To override the skills path, set `MEMSTACK_SKILLS_DIR=/path/to/your/memstack/skills`.
 
@@ -86,7 +86,7 @@ sudo apt install python3-pip
 
 ## How It Works
 
-MCP server that vector-indexes all 129 MemStack™ skills so Claude Code can call `find_skill("deploy to Railway")` and load **only** the relevant skill on demand, instead of all skills consuming context window.
+MCP server that vector-indexes all 130 MemStack™ skills so Claude Code can call `find_skill("deploy to Railway")` and load **only** the relevant skill on demand, instead of all skills consuming context window.
 
 - **No Anthropic API key required:** skill search and indexing run locally — the only outbound network call is license validation, which contacts the MemStack license server on session start ([Data and privacy](#data-and-privacy))
 - **Pro skills auto-detected:** set your license key and they appear automatically

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "memstack-skill-loader"
-version = "4.8.0"
+version = "4.10.0"
 description = "MCP server that vector-indexes MemStack Pro skills for on-demand loading"
 requires-python = ">=3.10"
 dependencies = [

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/src/memstack_skill_loader/__init__.py

@@ -1,3 +1,3 @@
 """MemStack Skill Loader — MCP server for semantic skill search."""
 
-__version__ = "4.8.0"
+__version__ = "4.10.0"

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/src/memstack_skill_loader/agent_runner.py

@@ -1026,7 +1026,8 @@ def _invoke_agent(name: str, prompt: str, working_dir: str, log_path: Optional[P
                    model: str = "", disallowed_tools: Optional[list[str]] = None,
                    session: Optional["Session"] = None,
                    display_name: str = "",
-                   execution_mode: str = "subscription") -> tuple[str, int, int, int]:
+                   execution_mode: str = "subscription",
+                   extra_settings: Optional[str] = None) -> tuple[str, int, int, int]:
     """Run a single claude interactive streaming invocation and return the output."""
     claude_bin = shutil.which("claude")
     if not claude_bin:
@@ -1040,6 +1041,10 @@ def _invoke_agent(name: str, prompt: str, working_dir: str, log_path: Optional[P
     if disallowed_tools:
         patterns = ",".join(f"mcp__{srv}__*" for srv in disallowed_tools)
         cmd.extend(["--disallowedTools", patterns])
+    if extra_settings:
+        # Inline --settings JSON (e.g. Builder git-deny PreToolUse hook). Only
+        # passed by Builder call sites; Manager/Reviewer never provide this.
+        cmd.extend(["--settings", extra_settings])
 
     if log_path:
         log_path.parent.mkdir(parents=True, exist_ok=True)
@@ -1385,10 +1390,53 @@ def _parse_subtasks(text: str) -> list[tuple[str, str]]:
     return []
 
 
+def _build_builder_hook_settings() -> str:
+    """Inline --settings JSON that registers the Builder git-deny PreToolUse hook.
+
+    The hook script ships inside this package (hooks/deny_git.py). Its absolute
+    path MUST use forward slashes: backslashes get stripped when the settings
+    command string is executed on Windows, which mangles the path and breaks
+    the hook (see smoke test)."""
+    hook_script = os.path.join(os.path.dirname(__file__), "hooks", "deny_git.py").replace("\\", "/")
+    return json.dumps({
+        "hooks": {"PreToolUse": [{"matcher": "Bash",
+            "hooks": [{"type": "command", "command": f"python {hook_script}"}]}]}
+    })
+
+
+def _git_head(working_dir: str) -> Optional[str]:
+    """Return the current HEAD commit SHA, or None if it can't be read."""
+    try:
+        r = subprocess.run(
+            ["git", "rev-parse", "HEAD"],
+            cwd=working_dir, capture_output=True, text=True, timeout=30,
+        )
+        return r.stdout.strip() if r.returncode == 0 else None
+    except Exception:
+        return None
+
+
+def _git_reset_soft(working_dir: str, ref: str) -> bool:
+    """Best-effort `git reset --soft <ref>` to move HEAD back without touching
+    the working tree. Used to undo a Builder commit so the orchestrator remains
+    the single committer. Returns True on success."""
+    try:
+        r = subprocess.run(
+            ["git", "reset", "--soft", ref],
+            cwd=working_dir, capture_output=True, text=True, timeout=30,
+        )
+        return r.returncode == 0
+    except Exception:
+        return False
+
+
 def _orchestrate(session: Session) -> None:
     """Run the Manager → Builder → Reviewer loop."""
     session._start_monotonic = time.monotonic()
     session_log_dir = STATE_DIR / "sessions" / session.session_id
+    # Builder-only git-deny hook (Layer 1). Built once, passed to Builder
+    # _invoke_agent calls via extra_settings; never to Manager/Reviewer.
+    builder_hook_settings = _build_builder_hook_settings()
 
     try:
         # Load execution modes and custom display names for this run
@@ -1512,6 +1560,9 @@ def _orchestrate(session: Session) -> None:
                     )
                     if session.user_name:
                         builder_prompt = f"The user's name is {session.user_name}.\n\n" + builder_prompt
+                    # Layer 2 backstop: snapshot HEAD before the Builder runs so
+                    # we can detect any git activity that slips past the hook.
+                    pre_head = _git_head(session.working_dir)
                     try:
                         if agent_modes["builder"] == "subscription":
                             builder_output, b_in, b_out, b_ctx = _invoke_agent(
@@ -1524,6 +1575,7 @@ def _orchestrate(session: Session) -> None:
                                 session=session,
                                 display_name=display_names["builder"],
                                 execution_mode=agent_modes["builder"],
+                                extra_settings=builder_hook_settings,
                             )
                         else:
                             builder_output, b_in, b_out = _invoke_api_agent(
@@ -1565,6 +1617,24 @@ def _orchestrate(session: Session) -> None:
                     if session.status == "stopped":
                         break
 
+                    # Layer 2 backstop: if the Builder moved HEAD (commit, reset,
+                    # checkout, etc.) it violated the no-git policy. Soft-undo and
+                    # fail the subtask rather than trusting its work.
+                    post_head = _git_head(session.working_dir)
+                    if pre_head and post_head and post_head != pre_head:
+                        undone = _git_reset_soft(session.working_dir, pre_head)
+                        reason = (
+                            f"Builder ran git and moved HEAD (pre={pre_head[:8]} "
+                            f"post={post_head[:8]}) - blocked by policy"
+                            + ("; HEAD soft-reset to pre-state" if undone else "")
+                        )
+                        print(f"[agent-runner] POLICY VIOLATION: {reason}", file=sys.stderr)
+                        session.add_message("system", "all", f"Subtask {idx} of {len(subtasks)} failed: {title} - {reason}")
+                        subtasks_failed += 1
+                        subtask_results.append(f"Subtask {idx}: FAILED - {title} ({reason})")
+                        session._save_state()
+                        break
+
                     if not builder_output or len(builder_output.strip()) < 20:
                         try:
                             diff_result = subprocess.run(
@@ -1784,6 +1854,9 @@ def _orchestrate(session: Session) -> None:
             )
             if session.user_name:
                 builder_prompt = f"The user's name is {session.user_name}.\n\n" + builder_prompt
+            # Layer 2 backstop: snapshot HEAD before the Builder runs so we can
+            # detect any git activity that slips past the hook.
+            pre_head = _git_head(session.working_dir)
             try:
                 if agent_modes["builder"] == "subscription":
                     builder_output, b_in, b_out, b_ctx = _invoke_agent(
@@ -1796,6 +1869,7 @@ def _orchestrate(session: Session) -> None:
                         session=session,
                         display_name=display_names["builder"],
                         execution_mode=agent_modes["builder"],
+                        extra_settings=builder_hook_settings,
                     )
                 else:
                     builder_output, b_in, b_out = _invoke_api_agent(
@@ -1836,6 +1910,25 @@ def _orchestrate(session: Session) -> None:
                 session._save_state()
                 return
 
+            # Layer 2 backstop: if the Builder moved HEAD (commit, reset,
+            # checkout, etc.) it violated the no-git policy. Soft-undo and fail
+            # the task rather than trusting its work.
+            post_head = _git_head(session.working_dir)
+            if pre_head and post_head and post_head != pre_head:
+                undone = _git_reset_soft(session.working_dir, pre_head)
+                reason = (
+                    f"Builder ran git and moved HEAD (pre={pre_head[:8]} "
+                    f"post={post_head[:8]}) - blocked by policy"
+                    + ("; HEAD soft-reset to pre-state" if undone else "")
+                )
+                print(f"[agent-runner] POLICY VIOLATION: {reason}", file=sys.stderr)
+                session.agents["builder"]["status"] = "crashed"
+                session.status = "error"
+                session.result = reason
+                session.add_message("system", "all", f"Task failed: {reason}")
+                session._save_state()
+                return
+
             if not builder_output or len(builder_output.strip()) < 20:
                 try:
                     diff_result = subprocess.run(

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/src/memstack_skill_loader/categories.py

@@ -31,6 +31,7 @@ CATEGORY_MAP = {
     "performance-audit": "Development", "refactor-planner": "Development", "test-writer": "Development",
     "changelog-generator": "Development", "mentor": "Development", "webapp-testing": "Development",
     # Core
+    "goal": "Core",
     "compress": "Core", "diary": "Core", "echo": "Core", "grimoire": "Core",
     "sight": "Core", "token-optimization": "Core",
     # Marketing

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/src/memstack_skill_loader/dashboard.html

@@ -1319,6 +1319,10 @@
       <svg viewBox="0 0 24 24"><path d="M21 6h-2v9H6v2c0 .55.45 1 1 1h11l4 4V7c0-.55-.45-1-1-1zm-4 6V3c0-.55-.45-1-1-1H3c-.55 0-1 .45-1 1v14l4-4h10c.55 0 1-.45 1-1z"/></svg>
       Agent Monitor
     </a>
+    <a class="nav-item" data-page="referrals">
+      <svg viewBox="0 0 24 24"><path d="M18 16.08c-.76 0-1.44.3-1.96.77L8.91 12.7c.05-.23.09-.46.09-.7s-.04-.47-.09-.7l7.05-4.11c.54.5 1.25.81 2.04.81 1.66 0 3-1.34 3-3s-1.34-3-3-3-3 1.34-3 3c0 .24.04.47.09.7L8.04 9.81C7.5 9.31 6.79 9 6 9c-1.66 0-3 1.34-3 3s1.34 3 3 3c.79 0 1.5-.31 2.04-.81l7.12 4.16c-.05.21-.08.43-.08.65 0 1.61 1.31 2.92 2.92 2.92s2.92-1.31 2.92-2.92-1.31-2.92-2.92-2.92z"/></svg>
+      Referrals
+    </a>
     <a class="nav-item" data-page="settings">
       <svg viewBox="0 0 24 24"><path d="M19.14 12.94c.04-.3.06-.61.06-.94 0-.32-.02-.64-.07-.94l2.03-1.58a.49.49 0 00.12-.61l-1.92-3.32a.49.49 0 00-.59-.22l-2.39.96c-.5-.38-1.03-.7-1.62-.94l-.36-2.54a.484.484 0 00-.48-.41h-3.84c-.24 0-.43.17-.47.41l-.36 2.54c-.59.24-1.13.57-1.62.94l-2.39-.96c-.22-.08-.47 0-.59.22L2.74 8.87c-.12.21-.08.47.12.61l2.03 1.58c-.05.3-.07.62-.07.94s.02.64.07.94l-2.03 1.58a.49.49 0 00-.12.61l1.92 3.32c.12.22.37.29.59.22l2.39-.96c.5.38 1.03.7 1.62.94l.36 2.54c.05.24.24.41.48.41h3.84c.24 0 .44-.17.47-.41l.36-2.54c.59-.24 1.13-.56 1.62-.94l2.39.96c.22.08.47 0 .59-.22l1.92-3.32c.12-.22.07-.47-.12-.61l-2.01-1.58zM12 15.6c-1.98 0-3.6-1.62-3.6-3.6s1.62-3.6 3.6-3.6 3.6 1.62 3.6 3.6-1.62 3.6-3.6 3.6z"/></svg>
       Settings
@@ -1894,6 +1898,16 @@
 </div>
 
 <!-- ═══════ Settings (Placeholder) ═══════ -->
+<div id="page-referrals" class="page">
+  <div class="page-header">
+    <h2>Referral Program</h2>
+    <p class="meta">Stats update when this page loads &middot; <a href="#" id="referrals-refresh" onclick="loadReferrals();return false;">Refresh</a></p>
+  </div>
+  <div id="referrals-content">
+    <span class="empty-state">Loading&hellip;</span>
+  </div>
+</div>
+
 <div id="page-settings" class="page">
   <div class="page-header">
     <h2>Settings</h2>
@@ -2222,6 +2236,118 @@ overlay.addEventListener('click', () => {
   overlay.classList.remove('open');
 });
 
+/* ════════════════════════════════════════════
+   Referrals
+   ════════════════════════════════════════════ */
+async function loadReferrals() {
+  const el = document.getElementById('referrals-content');
+  if (!el) return;
+  el.innerHTML = '<span class="empty-state">Loading&hellip;</span>';
+  let data;
+  try {
+    const res = await fetch('/api/referrals', { headers: AUTH_GET });
+    data = await res.json();
+  } catch (e) {
+    data = { state: 'error' };
+  }
+  el.innerHTML = renderReferrals(data);
+}
+
+function referralNotice(msg, linkText, linkHref) {
+  let h = '<div class="panel" style="text-align:center;padding:2rem 1rem">';
+  h += '<p style="color:#c9d1d9;margin-bottom:' + (linkText ? '1rem' : '0') + '">' + escapeHtml(msg) + '</p>';
+  if (linkText && linkHref) {
+    h += '<a href="' + linkHref + '" target="_blank" rel="noopener" class="copy-git-output-btn" style="text-decoration:none;display:inline-block">' + escapeHtml(linkText) + '</a>';
+  }
+  h += '</div>';
+  return h;
+}
+
+function referralBadge(status) {
+  const map = {
+    pending:   ['#8b949e', '#161b22'],
+    signed_up: ['#58a6ff', 'rgba(88,166,255,0.1)'],
+    converted: ['#3fb950', 'rgba(63,185,80,0.1)'],
+    paid_out:  ['#bc8cff', 'rgba(188,140,255,0.1)'],
+  };
+  const c = map[status] || map.pending;
+  const label = (status || '').replace('_', ' ');
+  return '<span style="display:inline-block;padding:0.1rem 0.5rem;border-radius:10px;font-size:0.75rem;color:' + c[0] + ';background:' + c[1] + ';border:1px solid ' + c[0] + '33">' + escapeHtml(label) + '</span>';
+}
+
+function renderReferrals(d) {
+  const state = d && d.state;
+  if (state === 'pro_required') {
+    return referralNotice('Referral stats are available for MemStack Pro users.', 'Get MemStack Pro', 'https://memstack.pro');
+  }
+  if (state === 'not_linked') {
+    return referralNotice('Link your license key to your account at memstack.pro/dashboard to see your referral stats here.', 'Link my license', 'https://memstack.pro/dashboard');
+  }
+  if (state !== 'ok') {
+    return referralNotice("Couldn't reach memstack.pro right now. Stats will load when you're back online.", '', '');
+  }
+  const link = d.referral_link || '';
+  const tier = d.tier || {};
+  const cards = [
+    ['Clicks', fmt(d.clicks)],
+    ['Referrals', fmt(d.total_referrals)],
+    ['Signups', fmt(d.signups)],
+    ['Conversions', fmt(d.conversions)],
+    ['Total Earnings', '$' + Number(d.total_earnings || 0).toFixed(2)],
+    ['Tier', tier.name ? (escapeHtml(tier.name) + ' (' + tier.percent + '%)') : '&mdash;'],
+  ];
+  const colors = ['#58a6ff', '#3fb950', '#d29922', '#bc8cff', '#39d353', '#ff7b72'];
+  let html = '';
+  html += '<div class="panel" style="margin-bottom:1rem">';
+  html += '<h3>Your referral link</h3>';
+  html += '<div style="display:flex;gap:0.5rem;align-items:center;flex-wrap:wrap">';
+  html += '<input id="referral-link-input" readonly value="' + escapeHtml(link) + '" style="flex:1;min-width:240px;background:#0d1117;border:1px solid #30363d;border-radius:6px;padding:0.5rem 0.75rem;color:#c9d1d9;font-family:monospace;font-size:0.85rem">';
+  html += '<button class="copy-git-output-btn" onclick="copyReferralLink()" title="Copy to clipboard">Copy</button>';
+  html += '</div></div>';
+  html += '<div class="stats-grid">';
+  cards.forEach((c, i) => {
+    html += '<div class="card"><div class="value" style="color:' + colors[i] + '">' + c[1] + '</div><div class="label">' + c[0] + '</div></div>';
+  });
+  html += '</div>';
+  const recent = d.recent || [];
+  html += '<div class="panel" style="margin-top:1rem"><h3>Recent Referrals</h3>';
+  if (!recent.length) {
+    html += '<span class="empty-state">No referrals yet. Share your link to get started!</span>';
+  } else {
+    html += '<table style="width:100%;border-collapse:collapse;font-size:0.85rem">';
+    html += '<thead><tr style="text-align:left;color:#8b949e"><th style="padding:0.4rem 0.5rem">Email</th><th style="padding:0.4rem 0.5rem">Status</th><th style="padding:0.4rem 0.5rem">Amount</th><th style="padding:0.4rem 0.5rem">Date</th></tr></thead><tbody>';
+    recent.forEach((r) => {
+      const amt = r.commission_amount != null ? ('$' + Number(r.commission_amount).toFixed(2)) : '&mdash;';
+      const dt = r.created_at ? new Date(r.created_at).toLocaleDateString() : '&mdash;';
+      html += '<tr style="border-top:1px solid #21262d">';
+      html += '<td style="padding:0.4rem 0.5rem;color:#c9d1d9">' + escapeHtml(r.referred_email_masked || '') + '</td>';
+      html += '<td style="padding:0.4rem 0.5rem">' + referralBadge(r.status) + '</td>';
+      html += '<td style="padding:0.4rem 0.5rem;color:#8b949e">' + amt + '</td>';
+      html += '<td style="padding:0.4rem 0.5rem;color:#8b949e">' + dt + '</td>';
+      html += '</tr>';
+    });
+    html += '</tbody></table>';
+  }
+  html += '</div>';
+  return html;
+}
+
+async function copyReferralLink() {
+  const el = document.getElementById('referral-link-input');
+  if (!el) return;
+  try {
+    await navigator.clipboard.writeText(el.value);
+    const btn = document.querySelector('#page-referrals .copy-git-output-btn');
+    if (btn) {
+      const orig = btn.textContent;
+      btn.textContent = 'Copied!';
+      btn.style.color = '#3fb950';
+      btn.style.borderColor = '#3fb950';
+      setTimeout(() => { btn.textContent = orig; btn.style.color = ''; btn.style.borderColor = ''; }, 2000);
+    }
+  } catch (e) { /* ignore */ }
+}
+
 document.querySelectorAll('.nav-item').forEach(item => {
   item.addEventListener('click', () => {
     const page = item.dataset.page;
@@ -2238,6 +2364,7 @@ document.querySelectorAll('.nav-item').forEach(item => {
     if (page === 'agent-monitor') loadAgentMonitor();
     if (page === 'memory-browser') loadMemoryBrowser();
     if (page === 'burn-report') loadBurnReport();
+    if (page === 'referrals') loadReferrals();
     if (page === 'settings') loadSettings();
     if (page !== 'agent-monitor') stopAgentRefresh();
   });

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/src/memstack_skill_loader/dashboard.py

@@ -9,6 +9,7 @@ import shutil
 import sys
 import threading
 import time
+import urllib.error
 import urllib.request
 import webbrowser
 from datetime import datetime, timezone
@@ -543,6 +544,53 @@ def _collect_browser_entries(project: str | None = None) -> list[dict]:
     return entries
 
 
+# Live referral-stats endpoint on the pro-site. Overridable for testing.
+REFERRALS_URL = os.environ.get(
+    "MEMSTACK_REFERRALS_URL", "https://memstack.pro/api/referrals/me"
+)
+
+
+def _get_referral_stats() -> bytes:
+    """Proxy the local license key to the pro-site referral-stats endpoint.
+
+    The license key is read server-side (never exposed to browser JS) and POSTed
+    to REFERRALS_URL. Returns a JSON body with a top-level "state" so the page can
+    render each outcome distinctly:
+
+      - "pro_required": no local license key (free user) — NO network call made
+      - "ok":           stats present (endpoint payload merged in)
+      - "not_linked":   key isn't linked to a Pro account on the site (404)
+      - "error":        timeout / network / unexpected — never breaks the dashboard
+
+    Fail-soft everywhere: any failure resolves to "error", 5s timeout.
+    """
+    from .license import get_license_key
+
+    key = get_license_key()
+    if not key:
+        return json.dumps({"state": "pro_required"}).encode()
+
+    try:
+        payload = json.dumps({"license_key": key}).encode()
+        req = urllib.request.Request(
+            REFERRALS_URL,
+            data=payload,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            data = json.loads(resp.read().decode("utf-8"))
+        data["state"] = "ok"
+        return json.dumps(data).encode()
+    except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return json.dumps({"state": "not_linked"}).encode()
+        return json.dumps({"state": "error"}).encode()
+    except Exception:
+        # Timeout, connection refused, DNS failure, bad JSON — all fail soft.
+        return json.dumps({"state": "error"}).encode()
+
+
 class _DashboardServer(HTTPServer):
     allow_reuse_address = False
 
@@ -868,6 +916,8 @@ class _Handler(BaseHTTPRequestHandler):
             }
             body = json.dumps(data).encode()
             self._respond(200, "application/json", body)
+        elif self.path == "/api/referrals":
+            self._respond(200, "application/json", _get_referral_stats())
         elif self.path == "/api/license-status":
             from .license import LICENSE_FILE, DISK_CACHE_FILE
             result = {"has_license": False, "key_masked": None, "valid": False, "plan": None, "checked_at": None, "cache_age_days": None}

memstack_skill_loader-4.10.0/src/memstack_skill_loader/goal.py

@@ -0,0 +1,118 @@
+# MemStack Goal CLI - thin `python -m memstack_skill_loader.goal` wrapper over goal_engine
+"""Command-line front door to the goal engine (see goal_engine.py).
+
+This module reimplements NOTHING: every subcommand delegates to the engine's
+existing functions. It exists so the /goal skill and the Architect stage can
+shell out to a stable interface and, critically, gate on an EXIT CODE:
+
+    template  -> print the blank five-field scaffold                 (exit 0)
+    validate  -> parse + validate a drafted goal; print problems.
+                 exit 0 when the goal is valid (warnings allowed),
+                 exit 2 when it has errors (missing TASK/OUTCOME/
+                 VERIFICATION). This exit code is the enforcement point.
+    format    -> parse + re-emit the clean labeled template          (exit 0)
+
+Input for validate/format resolves in this order: --text, else --file, else
+STDIN — so a caller can pipe a goal in or pass it as an argument.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from .goal_engine import (
+    format_goal,
+    goal_is_valid,
+    goal_template,
+    parse_goal,
+    validate_goal,
+)
+
+# Exit code returned by `validate` when the goal has hard errors. Callers
+# (skill, Architect) branch on this to refuse an unverifiable goal.
+EXIT_INVALID = 2
+
+
+def read_input(args: argparse.Namespace) -> str:
+    """Resolve the goal text from --text, else --file, else STDIN.
+
+    Returns the raw text unparsed. An empty result is left to the engine's
+    validator to report (it will surface the missing required fields).
+    """
+    if args.text is not None:
+        return args.text
+    if args.file is not None:
+        with open(args.file, "r", encoding="utf-8") as fh:
+            return fh.read()
+    return sys.stdin.read()
+
+
+def _add_input_args(parser: argparse.ArgumentParser) -> None:
+    """Attach the shared --text / --file options to a subparser."""
+    parser.add_argument(
+        "--text", default=None,
+        help="Goal text passed directly on the command line.",
+    )
+    parser.add_argument(
+        "--file", default=None,
+        help="Path to a file containing the drafted goal.",
+    )
+
+
+def cmd_template(_args: argparse.Namespace) -> int:
+    """Print the blank five-field template."""
+    print(goal_template())
+    return 0
+
+
+def cmd_validate(args: argparse.Namespace) -> int:
+    """Validate a drafted goal; print problems, return 0 (valid) or EXIT_INVALID.
+
+    Problems are printed one per line in the engine's order (errors first, then
+    ``WARNING:`` lines). Warnings do not affect the exit code.
+    """
+    goal = parse_goal(read_input(args))
+    for problem in validate_goal(goal):
+        print(problem)
+    return 0 if goal_is_valid(goal) else EXIT_INVALID
+
+
+def cmd_format(args: argparse.Namespace) -> int:
+    """Parse a goal and re-emit it via the engine's clean template."""
+    goal = parse_goal(read_input(args))
+    print(format_goal(goal))
+    return 0
+
+
+def main() -> None:
+    """CLI entry point. Dispatches to a subcommand and exits with its code."""
+    parser = argparse.ArgumentParser(
+        prog="python -m memstack_skill_loader.goal",
+        description="Structure and validate a task as a goal with a required, "
+                    "checkable VERIFICATION criterion.",
+    )
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    p_template = sub.add_parser("template", help="Print the blank five-field template.")
+    p_template.set_defaults(func=cmd_template)
+
+    p_validate = sub.add_parser(
+        "validate",
+        help="Validate a drafted goal (stdin/--file/--text). Exit 2 on errors.",
+    )
+    _add_input_args(p_validate)
+    p_validate.set_defaults(func=cmd_validate)
+
+    p_format = sub.add_parser(
+        "format", help="Re-emit a drafted goal (stdin/--file/--text) as the clean template.",
+    )
+    _add_input_args(p_format)
+    p_format.set_defaults(func=cmd_format)
+
+    args = parser.parse_args()
+    sys.exit(args.func(args))
+
+
+if __name__ == "__main__":
+    main()

memstack_skill_loader-4.10.0/src/memstack_skill_loader/goal_engine.py

@@ -0,0 +1,326 @@
+# MemStack Goal Engine - structures a task into five fields with a required, checkable VERIFICATION criterion
+"""Goal-structuring engine shared by the /goal skill and the Architect stage.
+
+A "goal" is a task decomposed into five fields:
+
+    TASK          what to do
+    WHY           why it matters / who it's for          (optional)
+    OUTCOME       the exact finished result / definition of done
+    CONSTRAINTS   what must or must not be done           (optional, list)
+    VERIFICATION  how to prove the OUTCOME is complete    (REQUIRED)
+
+VERIFICATION is the load-bearing field and the whole reason this module exists.
+The dominant failure mode this engine is built to prevent is a goal that reads
+as "done" without a concrete, checkable way to prove it: an agent (or a person)
+declares success against a vague target and ships something unverified. A goal
+without a specific verification criterion is treated as invalid here — not a
+style nit, but a hard rule enforced by ``validate_goal``. A verification that
+exists but only says "it works" / "tests pass" is flagged as a warning so the
+author is nudged toward a concrete, observable check.
+
+Pure standard library. No project imports, no external dependencies.
+
+Validation contract (see ``validate_goal``): the returned list mixes two
+severities distinguished by prefix —
+  * ERRORS  — plain messages (e.g. "TASK is required"). A goal with any error
+              is invalid and must not proceed.
+  * WARNINGS — messages prefixed with the literal ``"WARNING: "``. Advisory
+              only; a goal with warnings but no errors is still valid.
+Use ``goal_has_errors`` / ``goal_is_valid`` to branch without string-matching.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+# The five recognized field labels, in canonical display order. Parsing is
+# case-insensitive and whitespace-tolerant; this ordering drives format output.
+_LABELS = ("TASK", "WHY", "OUTCOME", "CONSTRAINTS", "VERIFICATION")
+
+# Matches a label line like "OUTCOME: ...", tolerating leading whitespace and
+# any casing. Group 1 = the (upper-cased) label, group 2 = the inline value.
+_LABEL_RE = re.compile(
+    r"^\s*(" + "|".join(_LABELS) + r")\s*:\s*(.*)$",
+    re.IGNORECASE,
+)
+
+# Marker prepended to advisory messages so callers can separate them from
+# hard errors without re-deriving the rules.
+_WARNING_PREFIX = "WARNING: "
+
+# A verification shorter than this (after normalization) is assumed too terse
+# to name a concrete, checkable criterion.
+_VAGUE_MIN_LEN = 15
+
+# Vacuous verification phrasings that may exceed the length floor yet still
+# assert nothing observable. Compared against the normalized (lower-cased,
+# punctuation-stripped, whitespace-collapsed) verification text.
+_VAGUE_PHRASES = frozenset({
+    "it works",
+    "works",
+    "it is done",
+    "its done",
+    "done",
+    "finished",
+    "complete",
+    "completed",
+    "tests pass",
+    "all tests pass",
+    "the tests pass",
+    "passes",
+    "it passes",
+    "ok",
+    "looks good",
+    "lgtm",
+    "works as expected",
+    "it works as expected",
+})
+
+
+@dataclass
+class Goal:
+    """A task structured into five fields.
+
+    ``task``, ``outcome`` and ``verification`` carry the meaning; ``why`` and
+    ``constraints`` are optional context. Only ``task`` is a positional
+    requirement of the dataclass — the required-ness of ``outcome`` and
+    ``verification`` is a *validation* rule (see ``validate_goal``), not a
+    construction rule, so partial goals can be built and then reported on.
+    """
+
+    task: str
+    why: str = ""
+    outcome: str = ""
+    constraints: list[str] = field(default_factory=list)
+    verification: str = ""
+
+
+def _normalize(text: str) -> str:
+    """Lower-case, strip surrounding punctuation, and collapse inner whitespace.
+
+    Used to compare a verification string against ``_VAGUE_PHRASES`` so that
+    "It works." and "  it   works  " both reduce to "it works".
+    """
+    lowered = text.strip().lower()
+    lowered = re.sub(r"\s+", " ", lowered)
+    return lowered.strip(" \t\r\n.!?,;:-*")
+
+
+def _split_constraints(raw_lines: list[str]) -> list[str]:
+    """Turn accumulated CONSTRAINTS text into a clean list.
+
+    Splits on both newlines and commas, strips common bullet markers
+    ("-", "*", "•") and surrounding whitespace, and drops empties.
+    """
+    items: list[str] = []
+    for line in raw_lines:
+        for part in re.split(r"[,\n]", line):
+            cleaned = part.strip().lstrip("-*• \t").strip()
+            if cleaned:
+                items.append(cleaned)
+    return items
+
+
+def parse_goal(text: str) -> Goal:
+    """Parse labeled ``LABEL: value`` text into a :class:`Goal`.
+
+    Recognizes the five labels (TASK, WHY, OUTCOME, CONSTRAINTS, VERIFICATION)
+    case-insensitively and with tolerant whitespace. A field's value may span
+    multiple lines: everything after a label line, up to the next label line,
+    belongs to that field. Scalar fields are whitespace-joined; CONSTRAINTS is
+    split into a list (see :func:`_split_constraints`).
+
+    Missing fields become empty (``""`` or ``[]``). Parsing never raises for
+    missing required fields — that is reported by :func:`validate_goal`.
+    """
+    # Accumulate raw text lines per field as we walk the input.
+    buckets: dict[str, list[str]] = {label: [] for label in _LABELS}
+    current: str | None = None
+
+    for line in text.splitlines():
+        match = _LABEL_RE.match(line)
+        if match:
+            current = match.group(1).upper()
+            inline = match.group(2).strip()
+            if inline:
+                buckets[current].append(inline)
+        elif current is not None:
+            # Continuation line for the field currently being read.
+            stripped = line.strip()
+            if stripped:
+                buckets[current].append(stripped)
+
+    def scalar(label: str) -> str:
+        return " ".join(buckets[label]).strip()
+
+    return Goal(
+        task=scalar("TASK"),
+        why=scalar("WHY"),
+        outcome=scalar("OUTCOME"),
+        constraints=_split_constraints(buckets["CONSTRAINTS"]),
+        verification=scalar("VERIFICATION"),
+    )
+
+
+def _verification_is_vague(verification: str) -> bool:
+    """True when a non-empty verification names no concrete, checkable criterion.
+
+    Two triggers: it is shorter than ``_VAGUE_MIN_LEN`` after normalization, or
+    it matches one of the known vacuous phrasings in ``_VAGUE_PHRASES``.
+    """
+    normalized = _normalize(verification)
+    if not normalized:
+        return False  # empty is an ERROR case, handled by validate_goal
+    if len(normalized) < _VAGUE_MIN_LEN:
+        return True
+    return normalized in _VAGUE_PHRASES
+
+
+def validate_goal(goal: Goal) -> list[str]:
+    """Return a list of problems with *goal*; an empty list means fully valid.
+
+    Errors (plain messages — presence of any makes the goal invalid):
+      * "TASK is required"
+      * "OUTCOME is required (define what done looks like)"
+      * "VERIFICATION is required (state how you'll prove it's complete)"
+
+    Warnings (prefixed with ``"WARNING: "`` — advisory, do not invalidate):
+      * a present-but-vacuous VERIFICATION.
+
+    Errors are listed before warnings. Use :func:`goal_has_errors` to test
+    validity without inspecting the prefix yourself.
+    """
+    errors: list[str] = []
+    warnings: list[str] = []
+
+    if not goal.task.strip():
+        errors.append("TASK is required")
+    if not goal.outcome.strip():
+        errors.append("OUTCOME is required (define what done looks like)")
+    if not goal.verification.strip():
+        errors.append(
+            "VERIFICATION is required (state how you'll prove it's complete)"
+        )
+    elif _verification_is_vague(goal.verification):
+        warnings.append(
+            _WARNING_PREFIX
+            + "VERIFICATION is vague - state a concrete, checkable criterion"
+        )
+
+    return errors + warnings
+
+
+def goal_has_errors(problems: list[str]) -> bool:
+    """True if *problems* (from :func:`validate_goal`) contains any hard error.
+
+    A hard error is any message NOT prefixed with ``"WARNING: "``.
+    """
+    return any(not p.startswith(_WARNING_PREFIX) for p in problems)
+
+
+def goal_is_valid(goal: Goal) -> bool:
+    """Convenience: True when *goal* has no hard errors (warnings are allowed)."""
+    return not goal_has_errors(validate_goal(goal))
+
+
+def format_goal(goal: Goal) -> str:
+    """Render *goal* back into the clean labeled template for display/output.
+
+    Optional empty fields (WHY, CONSTRAINTS) are still emitted as labels so the
+    output shape is stable and copy-editable. Constraints render as a bulleted
+    list; a single constraint renders inline.
+    """
+    lines = [f"TASK: {goal.task}".rstrip()]
+    lines.append(f"WHY: {goal.why}".rstrip())
+    lines.append(f"OUTCOME: {goal.outcome}".rstrip())
+
+    if not goal.constraints:
+        lines.append("CONSTRAINTS:")
+    elif len(goal.constraints) == 1:
+        lines.append(f"CONSTRAINTS: {goal.constraints[0]}")
+    else:
+        lines.append("CONSTRAINTS:")
+        lines.extend(f"  - {item}" for item in goal.constraints)
+
+    lines.append(f"VERIFICATION: {goal.verification}".rstrip())
+    return "\n".join(lines)
+
+
+def goal_template() -> str:
+    """Return the empty five-field template with a one-line hint per label.
+
+    Handed to a user (or the Architect) starting from scratch, so every field —
+    especially VERIFICATION — comes with a prompt for what belongs there.
+    """
+    return (
+        "TASK: (what to do)\n"
+        "WHY: (why it matters / who it's for - optional)\n"
+        "OUTCOME: (the exact finished result - what 'done' looks like)\n"
+        "CONSTRAINTS: (what must or must not be done - optional, one per line)\n"
+        "VERIFICATION: (how you'll prove the outcome is complete - "
+        "a concrete, checkable criterion)"
+    )
+
+
+if __name__ == "__main__":
+    # Small self-test exercising the four cases: valid, missing-verification
+    # (error), vague-verification (warning), and template output.
+    print("=" * 64)
+    print("CASE 1 — complete valid goal")
+    print("=" * 64)
+    valid = parse_goal(
+        """
+        TASK: Add a --json flag to the report command
+        WHY: CI needs machine-readable output for the dashboard
+        OUTCOME: `report --json` prints a valid JSON object to stdout and exits 0
+        CONSTRAINTS: no new dependencies
+        must not change the default human output
+        VERIFICATION: run `report --json | python -m json.tool` and confirm it
+        parses and contains the "total" key
+        """
+    )
+    print(format_goal(valid))
+    problems = validate_goal(valid)
+    print("\nproblems:", problems)
+    print("has_errors:", goal_has_errors(problems), "| is_valid:", goal_is_valid(valid))
+    print("constraints parsed:", valid.constraints)
+    assert problems == [], "expected no problems for a complete goal"
+    assert goal_is_valid(valid)
+    assert valid.constraints == ["no new dependencies", "must not change the default human output"]
+
+    print("\n" + "=" * 64)
+    print("CASE 2 — missing VERIFICATION (error)")
+    print("=" * 64)
+    missing = parse_goal(
+        "TASK: Refactor the parser\n"
+        "OUTCOME: parser split into tokenizer and builder modules"
+    )
+    problems = validate_goal(missing)
+    print("problems:", problems)
+    print("has_errors:", goal_has_errors(problems), "| is_valid:", goal_is_valid(missing))
+    assert goal_has_errors(problems), "missing verification must be an error"
+    assert any("VERIFICATION is required" in p for p in problems)
+    assert not goal_is_valid(missing)
+
+    print("\n" + "=" * 64)
+    print("CASE 3 — vague VERIFICATION (warning, still valid)")
+    print("=" * 64)
+    vague = parse_goal(
+        "TASK: Fix the login bug\n"
+        "OUTCOME: users can log in again\n"
+        "VERIFICATION: it works"
+    )
+    problems = validate_goal(vague)
+    print("problems:", problems)
+    print("has_errors:", goal_has_errors(problems), "| is_valid:", goal_is_valid(vague))
+    assert not goal_has_errors(problems), "vague verification is a warning, not an error"
+    assert any(p.startswith("WARNING: ") for p in problems)
+    assert goal_is_valid(vague), "a goal with only warnings is still valid"
+
+    print("\n" + "=" * 64)
+    print("CASE 4 — empty template")
+    print("=" * 64)
+    print(goal_template())
+
+    print("\nAll self-test assertions passed.")

memstack_skill_loader-4.10.0/src/memstack_skill_loader/hooks/__init__.py

@@ -0,0 +1,5 @@
+"""Hook scripts injected into agent subprocesses (e.g. Builder git-guard).
+
+Kept as a subpackage so the scripts ship inside the installed wheel and can be
+resolved at runtime via os.path.dirname(__file__).
+"""

memstack_skill_loader-4.10.0/src/memstack_skill_loader/hooks/deny_git.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python
+"""PreToolUse hook: denies any Bash git invocation. Injected only into the
+Builder agent subprocess via --settings, so the Builder cannot run git
+(commit, push, reset, checkout, etc.). Fail-closed: on any error, deny."""
+import sys, json, re
+
+try:
+    data = json.load(sys.stdin)
+    cmd = data.get("tool_input", {}).get("command", "")
+except Exception:
+    # Fail closed: if we can't parse, deny to be safe.
+    print("BLOCKED: Builder git-guard could not parse tool input; denying.", file=sys.stderr)
+    sys.exit(2)
+
+# Match git as a command token in any form: git, /usr/bin/git, sh -c "git",
+# env VAR=x git, chained "&& git", "; git", "| git", GIT_DIR=... git, etc.
+if re.search(r"(^|[\s;&|/])git(\s|$)", cmd) or re.search(r"\bgit\b", cmd):
+    print("BLOCKED: Builder may not run git. Git operations are performed by the orchestrator, not the Builder.", file=sys.stderr)
+    sys.exit(2)
+
+sys.exit(0)

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0/src/memstack_skill_loader.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: memstack-skill-loader
-Version: 4.8.0
+Version: 4.10.0
 Summary: MCP server that vector-indexes MemStack Pro skills for on-demand loading
 Requires-Python: >=3.10
 Requires-Dist: mcp>=1.0.0

{memstack_skill_loader-4.8.0 → memstack_skill_loader-4.10.0}/src/memstack_skill_loader.egg-info/SOURCES.txt

@@ -9,6 +9,8 @@ src/memstack_skill_loader/compression.py
 src/memstack_skill_loader/config.py
 src/memstack_skill_loader/dashboard.html
 src/memstack_skill_loader/dashboard.py
+src/memstack_skill_loader/goal.py
+src/memstack_skill_loader/goal_engine.py
 src/memstack_skill_loader/indexer.py
 src/memstack_skill_loader/license.py
 src/memstack_skill_loader/memory_db.py
@@ -24,6 +26,8 @@ src/memstack_skill_loader.egg-info/dependency_links.txt
 src/memstack_skill_loader.egg-info/entry_points.txt
 src/memstack_skill_loader.egg-info/requires.txt
 src/memstack_skill_loader.egg-info/top_level.txt
+src/memstack_skill_loader/hooks/__init__.py
+src/memstack_skill_loader/hooks/deny_git.py
 src/memstack_skill_loader/proxy/__init__.py
 src/memstack_skill_loader/proxy/_diag.py
 src/memstack_skill_loader/proxy/body_parser.py