moai-adk 0.9.1__py3-none-any.whl → 0.11.0__py3-none-any.whl

moai_adk/core/project/phase_executor.py

@@ -312,8 +312,12 @@ class PhaseExecutor:
                 cwd=project_path,
                 check=True,
                 capture_output=True,
+                timeout=30,  # Default timeout for git operations
             )
             # Intentionally avoid printing to keep progress output clean
+        except subprocess.TimeoutExpired:
+            # Timeout is non-fatal
+            pass
         except subprocess.CalledProcessError:
             # Only log on error; failures are non-fatal
             pass

moai_adk/core/tags/ci_validator.py

@@ -16,6 +16,8 @@ import os
 from typing import Any, Dict, List, Optional
 
 import requests
+from requests.adapters import HTTPAdapter
+from urllib3.util import Retry
 
 from .pre_commit_validator import (
     PreCommitValidator,
@@ -87,16 +89,44 @@ class CIValidator(PreCommitValidator):
             'Accept': 'application/vnd.github.v3+json'
         }
 
+        # Create session with retry strategy
+        session = requests.Session()
+        retry = Retry(
+            total=3,
+            backoff_factor=0.5,
+            status_forcelist=[500, 502, 503, 504],
+            allowed_methods=["GET"]
+        )
+        adapter = HTTPAdapter(max_retries=retry)
+        session.mount("https://", adapter)
+
         try:
-            response = requests.get(url, headers=headers, timeout=10)
+            # Dual timeout: (connect_timeout, read_timeout)
+            response = session.get(
+                url,
+                headers=headers,
+                timeout=(5, 10)
+            )
             response.raise_for_status()
 
             files_data = response.json()
             return [file_info['filename'] for file_info in files_data]
 
-        except Exception:
-            # Return empty list on any error (network, auth, etc.)
+        except requests.exceptions.Timeout:
+            # Network timeout - return empty list gracefully
+            return []
+        except requests.exceptions.HTTPError as e:
+            # HTTP error (4xx, 5xx)
+            if e.response.status_code == 404:
+                # PR not found
+                return []
+            # Other HTTP errors: log but continue
+            return []
+        except requests.exceptions.RequestException:
+            # Network/connection errors
             return []
+        finally:
+            session.close()
 
     def validate_pr_changes(
         self,

moai_adk/core/template_engine.py

@@ -31,13 +31,17 @@ class TemplateEngine:
     - File-based and string-based template rendering
     """
 
-    def __init__(self, strict_undefined: bool = False):
+    def __init__(self, strict_undefined: bool = True):
         """
         Initialize the template engine.
 
         Args:
-            strict_undefined: If True, raise error on undefined variables.
+            strict_undefined: If True, raise error on undefined variables (default: True).
                              If False, render undefined variables as empty strings.
+
+        Note:
+            Changed to strict_undefined=True (v0.10.2+) for safer template rendering.
+            Variables must be explicitly provided to avoid silent template failures.
         """
         self.strict_undefined = strict_undefined
         self.undefined_behavior = StrictUndefined if strict_undefined else None

moai_adk/templates/.git-hooks/pre-push

@@ -0,0 +1,143 @@
+#!/bin/bash
+
+# MoAI-ADK GitFlow Main Branch Control Hook
+# Purpose: Enforce GitFlow in team mode, advisory in personal mode
+# Enforces: Strict team workflow, flexible personal development
+#
+# This hook runs before any git push operation:
+# Team Mode:   Blocks direct main/master push (non-develop), requires confirmation for develop→main
+# Personal Mode: Advisory warnings, allows flexibility
+#
+# Exit codes:
+# 0 - Push allowed
+# 1 - Push blocked (team mode violation or user declined)
+
+# Check team mode from .moai/config.json
+is_team_mode() {
+    if [ -f ".moai/config.json" ]; then
+        # Check if mode is "team"
+        grep -q '"mode".*:.*"team"' ".moai/config.json" 2>/dev/null
+        return $?
+    fi
+    return 1
+}
+
+# Colors for output
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+TEAM_MODE=false
+is_team_mode && TEAM_MODE=true
+
+# Read from stdin (git sends remote, local ref info)
+# Format: <local ref> <local oid> <remote ref> <remote oid>
+while read local_ref local_oid remote_ref remote_oid; do
+    # Extract the remote branch name from the reference
+    # remote_ref format: refs/heads/main
+    remote_branch=$(echo "$remote_ref" | sed 's|refs/heads/||')
+    local_branch=$(echo "$local_ref" | sed 's|refs/heads/||')
+
+    # Check if attempting to push to main branch
+    if [ "$remote_branch" = "main" ] || [ "$remote_branch" = "master" ]; then
+        # Get the current branch to determine if this is the develop branch
+        current_branch=$(git rev-parse --abbrev-ref HEAD)
+
+        # TEAM MODE ENFORCEMENT
+        if [ "$TEAM_MODE" = true ]; then
+            # Block non-develop, non-release branches from pushing to main
+            if [ "$local_branch" != "develop" ] && [ "${local_branch#release/}" = "$local_branch" ]; then
+                echo ""
+                echo -e "${RED}❌ BLOCKED: Non-standard GitFlow in TEAM MODE${NC}"
+                echo ""
+                echo -e "${BLUE}Current branch: ${local_branch}${NC}"
+                echo -e "${BLUE}Target branch: ${remote_branch}${NC}"
+                echo ""
+                echo "🚀 Correct GitFlow workflow for TEAM MODE:"
+                echo "  1. Work on feature/SPEC-{ID} branch (created from develop)"
+                echo "  2. Push to feature/SPEC-{ID} and create PR to develop"
+                echo "  3. Code review & merge into develop"
+                echo "  4. When develop is stable, create PR from develop to main"
+                echo "  5. Release manager merges develop → main with tag"
+                echo ""
+                echo -e "${RED}⚠️  Push to ${remote_branch} blocked in team mode${NC}"
+                echo ""
+                exit 1
+            fi
+
+            # For develop → main or release/* → main, ask for confirmation
+            if [ "$local_branch" = "develop" ] || [ "${local_branch#release/}" != "$local_branch" ]; then
+                echo ""
+                echo -e "${YELLOW}⚠️  TEAM MODE: Pushing ${local_branch} → ${remote_branch}${NC}"
+                echo ""
+                echo "📋 Summary:"
+                echo "  • Source branch: ${local_branch}"
+                echo "  • Target branch: ${remote_branch}"
+                echo "  • Mode: TEAM MODE (strict enforcement)"
+                echo ""
+                read -p "❓ Are you sure you want to push ${local_branch} to ${remote_branch}? (y/n) " -n 1 -r
+                echo ""
+                if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+                    echo -e "${RED}✓ Push cancelled by user${NC}"
+                    exit 1
+                fi
+            fi
+        fi
+
+        # PERSONAL MODE: Advisory warnings (allow all pushes)
+        if [ "$TEAM_MODE" = false ]; then
+            # Advisory: recommend develop -> main workflow
+            if [ "$local_branch" != "develop" ] && [ "${local_branch#release/}" = "$local_branch" ]; then
+                echo ""
+                echo -e "${YELLOW}⚠️  ADVISORY: Non-standard GitFlow detected${NC}"
+                echo ""
+                echo -e "${BLUE}Current branch: ${local_branch}${NC}"
+                echo -e "${BLUE}Target branch: ${remote_branch}${NC}"
+                echo ""
+                echo "Recommended GitFlow workflow:"
+                echo "  1. Work on feature/SPEC-{ID} branch (created from develop)"
+                echo "  2. Push to feature/SPEC-{ID} and create PR to develop"
+                echo "  3. Merge into develop after code review"
+                echo "  4. When develop is stable, create PR from develop to main"
+                echo "  5. Release manager merges develop -> main with tag"
+                echo ""
+                echo -e "${GREEN}✓ Push will proceed (personal mode - flexibility enabled)${NC}"
+                echo ""
+            fi
+
+            # Check for delete operation
+            if [ "$local_oid" = "0000000000000000000000000000000000000000" ]; then
+                echo ""
+                echo -e "${RED}⚠️  WARNING: Attempting to delete main branch${NC}"
+                echo ""
+                echo -e "${YELLOW}This operation is highly discouraged.${NC}"
+                echo -e "${GREEN}✓ Push will proceed (personal mode - flexibility enabled)${NC}"
+                echo ""
+            fi
+
+            # Check for force push attempts to main
+            if [ "$remote_branch" = "main" ] || [ "$remote_branch" = "master" ]; then
+                # Check if remote_oid exists (non-zero means we're trying to update existing ref)
+                if [ "$remote_oid" != "0000000000000000000000000000000000000000" ]; then
+                    # Verify this is a fast-forward merge (no force push)
+                    if ! git merge-base --is-ancestor "$remote_oid" "$local_oid" 2>/dev/null; then
+                        echo ""
+                        echo -e "${YELLOW}⚠️  ADVISORY: Force-push to main branch detected${NC}"
+                        echo ""
+                        echo "Recommended approach:"
+                        echo "  - Use GitHub PR with proper code review"
+                        echo "  - Ensure changes are merged via fast-forward"
+                        echo ""
+                        echo -e "${GREEN}✓ Push will proceed (personal mode - flexibility enabled)${NC}"
+                        echo ""
+                    fi
+                fi
+            fi
+        fi
+    fi
+done
+
+# All checks passed (or advisory warnings shown)
+exit 0

moai_adk/templates/.github/workflows/moai-gitflow.yml

@@ -13,6 +13,11 @@ jobs:
   moai-pipeline:
     name: "{{PROJECT_NAME}} Pipeline"
     runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,7 +27,7 @@ jobs:
         if: ${{ hashFiles('requirements.txt') != '' || hashFiles('pyproject.toml') != '' || hashFiles('setup.py') != '' }}
         uses: actions/setup-python@v5
         with:
-          python-version: "3.13"
+          python-version: ${{ matrix.python-version }}
 
       - name: Setup Node.js
         if: ${{ hashFiles('package.json') != '' }}

moai_adk/templates/.github/workflows/release.yml

@@ -10,14 +10,18 @@ jobs:
     name: 📦 Deploy to PyPI
     runs-on: ubuntu-latest
 
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
     steps:
       - name: 📥 Checkout code
         uses: actions/checkout@v4
 
-      - name: 🐍 Setup Python 3.13
+      - name: 🐍 Setup Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
-          python-version: "3.13"
+          python-version: ${{ matrix.python-version }}
 
       - name: 📦 Install uv
         uses: astral-sh/setup-uv@v2

moai_adk/templates/.github/workflows/tag-validation.yml

@@ -10,33 +10,82 @@ on:
     branches: [main, develop, "feature/**"]
 
 jobs:
+  detect-language:
+    name: 🔍 Detect Project Language
+    runs-on: ubuntu-latest
+    outputs:
+      language: ${{ steps.detect.outputs.language }}
+      is-python: ${{ steps.detect.outputs.is-python }}
+      is-javascript: ${{ steps.detect.outputs.is-javascript }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Detect language
+        id: detect
+        run: |
+          if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ]; then
+            echo "language=python" >> $GITHUB_OUTPUT
+            echo "is-python=true" >> $GITHUB_OUTPUT
+            echo "is-javascript=false" >> $GITHUB_OUTPUT
+          elif [ -f "package.json" ]; then
+            echo "language=javascript" >> $GITHUB_OUTPUT
+            echo "is-python=false" >> $GITHUB_OUTPUT
+            echo "is-javascript=true" >> $GITHUB_OUTPUT
+          else
+            echo "language=unknown" >> $GITHUB_OUTPUT
+            echo "is-python=false" >> $GITHUB_OUTPUT
+            echo "is-javascript=false" >> $GITHUB_OUTPUT
+          fi
+
   validate-tags:
     name: 🏷️ Validate TAG Annotations
     runs-on: ubuntu-latest
+    needs: detect-language
 
     # Skip validation on draft PRs (allow WIP)
     if: github.event.pull_request.draft == false || github.event_name == 'push'
 
+    permissions:
+      contents: read
+      pull-requests: write
+
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+        node-version: ["18", "20"]
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0  # Fetch all history for comprehensive validation
 
-      - name: Setup Python
+      - name: Setup Python (if Python project)
+        if: needs.detect-language.outputs.is-python == 'true'
         uses: actions/setup-python@v5
         with:
-          python-version: '3.13'
+          python-version: ${{ matrix.python-version }}
 
-      - name: Install uv
-        uses: astral-sh/setup-uv@v5
+      - name: Setup Node.js (if JavaScript project)
+        if: needs.detect-language.outputs.is-javascript == 'true'
+        uses: actions/setup-node@v4
         with:
-          version: "latest"
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies (Python)
+        if: needs.detect-language.outputs.is-python == 'true'
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install requests
 
-      - name: Install dependencies
+      - name: Install dependencies (JavaScript)
+        if: needs.detect-language.outputs.is-javascript == 'true'
         run: |
-          uv pip install --system -e .
-          uv pip install --system requests
+          npm ci
+          npm install requests 2>/dev/null || true
 
       - name: Get PR number
         id: pr