Remote memory system

.agents/hooks/lf.ts

@@ -0,0 +1,4 @@
+import { runHook } from "./run-hook";
+
+const exitCode = runHook(["bun", "run", "lf"]);
+process.exit(exitCode);

.agents/hooks/madge.ts

@@ -0,0 +1,4 @@
+import { runHook } from "./run-hook";
+
+const exitCode = runHook(["bun", "run", "madge"]);
+process.exit(exitCode);

.agents/hooks/run-hook.ts

@@ -17,6 +17,25 @@ function writeFailure(format: HookFormat, output: string): void {
   process.stderr.write(output);
 }
 
+function writeSuccess(format: HookFormat, output: string): number {
+  if (format === "codex") return 0;
+  process.stdout.write(JSON.stringify({ output }));
+  return 0;
+}
+
+// Fails closed: a non-zero git status (not a repo, git missing, index locked)
+// reports changes so the gates still run. Only a confirmed-empty status skips.
+// --porcelain=v1 lists untracked files too, so a new file counts as a change.
+function worktreeHasChanges(): boolean {
+  const r = spawnSync("git status --porcelain=v1", {
+    encoding: "utf8",
+    shell: true,
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if ((r.status ?? -1) !== 0) return true;
+  return (r.stdout ?? "").trim().length > 0;
+}
+
 // Helper for agent hook scripts. Each hook file (lint.ts, test.ts, ...) is a
 // thin wrapper that calls runHook(["bun", "run", "<script>"]). We capture
 // stdout+stderr, return them on success in a JSON envelope (so Claude/opencode
@@ -28,6 +47,12 @@ export function runHook(args: string[], format = hookFormatFromArgs()): number {
     writeFailure(format, "run-hook: no command provided");
     return 2;
   }
+  if (!worktreeHasChanges()) {
+    return writeSuccess(
+      format,
+      "skipped: worktree clean, HEAD already gated by pre-commit and CI"
+    );
+  }
   const command = args.join(" ");
   const r = spawnSync(command, {
     encoding: "utf8",
@@ -38,11 +63,7 @@ export function runHook(args: string[], format = hookFormatFromArgs()): number {
   const output = out || "(no output)";
   const ok = (r.status ?? -1) === 0;
 
-  if (ok) {
-    if (format === "codex") return 0;
-    process.stdout.write(JSON.stringify({ output: "ok" }));
-    return 0;
-  }
+  if (ok) return writeSuccess(format, "ok");
   writeFailure(format, output);
   return 2;
 }

.agents/hooks/secretlint.ts

@@ -0,0 +1,4 @@
+import { runHook } from "./run-hook";
+
+const exitCode = runHook(["bun", "run", "secretlint"]);
+process.exit(exitCode);

.agents/scripts/check-lf.ts

@@ -0,0 +1,62 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+
+function listTrackedFilesWithEol(): string[] {
+  const r = spawnSync("git", ["ls-files", "--eol"], { encoding: "utf8" });
+  if (r.status !== 0) {
+    process.stderr.write(r.stderr || "git ls-files --eol failed\n");
+    process.exit(1);
+  }
+  return r.stdout.split("\n").filter(Boolean);
+}
+
+export function hasCarriageReturn(eolLine: string): boolean {
+  const [index, worktree] = eolLine.split(/\s+/);
+  return /crlf|mixed/.test(index) || /crlf|mixed/.test(worktree);
+}
+
+function pathFrom(eolLine: string): string {
+  return eolLine.split("\t").slice(1).join("\t");
+}
+
+// A NUL byte is git's own heuristic for binary content. Rewriting CR bytes inside
+// an image or archive would corrupt it, so those are reported and left alone.
+export function isBinary(contents: Buffer): boolean {
+  return contents.includes(0);
+}
+
+function convertToLf(path: string): boolean {
+  const contents = readFileSync(path);
+  if (isBinary(contents)) return false;
+  writeFileSync(path, contents.toString("utf8").replaceAll("\r\n", "\n"), "utf8");
+  return true;
+}
+
+function reportAndExit(offenders: string[]): never {
+  process.stderr.write(
+    `CRLF found in tracked files (LF required):\n${offenders.join("\n")}\n` +
+      `Run 'bun run lf:fix' to convert them.\n`
+  );
+  process.exit(1);
+}
+
+function fixAndExit(offenders: string[]): never {
+  const skipped = offenders.filter((path) => !convertToLf(path));
+  const converted = offenders.length - skipped.length;
+  process.stdout.write(`Converted ${converted} file(s) to LF.\n`);
+  if (skipped.length === 0) process.exit(0);
+  process.stderr.write(`Skipped binary file(s):\n${skipped.join("\n")}\n`);
+  process.exit(1);
+}
+
+if (import.meta.main) {
+  const offenders = listTrackedFilesWithEol().filter(hasCarriageReturn).map(pathFrom);
+
+  if (offenders.length === 0) {
+    process.stdout.write("All tracked files use LF line endings.\n");
+    process.exit(0);
+  }
+
+  if (process.argv.includes("--fix")) fixAndExit(offenders);
+  reportAndExit(offenders);
+}

.agents/scripts/mutate-diff.ts

@@ -0,0 +1,97 @@
+import { spawnSync } from "node:child_process";
+import { Glob } from "bun";
+import strykerConfig from "../../stryker.config.mjs";
+
+const baseRef = process.argv[2] ?? "origin/main";
+
+function mutatePatterns(): string[] {
+  const patterns = strykerConfig.mutate ?? [];
+  return patterns.filter((pattern): pattern is string => typeof pattern === "string");
+}
+
+type MutateFilter = { includes: Glob[]; excludes: Glob[] };
+
+function mutateFilter(patterns: string[]): MutateFilter {
+  const includes: Glob[] = [];
+  const excludes: Glob[] = [];
+  for (const pattern of patterns) {
+    if (pattern.startsWith("!")) {
+      excludes.push(new Glob(pattern.slice(1)));
+    } else {
+      includes.push(new Glob(pattern));
+    }
+  }
+  return { includes, excludes };
+}
+
+function isMutatable(path: string, filter: MutateFilter): boolean {
+  if (filter.excludes.some((glob) => glob.match(path))) {
+    return false;
+  }
+  return filter.includes.some((glob) => glob.match(path));
+}
+
+function diffAgainstBase(): string {
+  const r = spawnSync(
+    "git",
+    ["diff", "--unified=0", "--diff-filter=ACMR", `${baseRef}...HEAD`],
+    { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+  );
+  if (r.status !== 0) {
+    process.stderr.write(r.stderr || `git diff against ${baseRef} failed\n`);
+    process.exit(1);
+  }
+  return r.stdout;
+}
+
+function changedRanges(diff: string, filter: MutateFilter): string[] {
+  const ranges: string[] = [];
+  let current: string | null = null;
+
+  for (const line of diff.split("\n")) {
+    const fileMatch = /^\+\+\+ b\/(.+)$/.exec(line);
+    if (fileMatch) {
+      const path = fileMatch[1];
+      current = isMutatable(path, filter) ? path : null;
+      continue;
+    }
+
+    if (!current) continue;
+
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (!hunk) continue;
+
+    const start = Number(hunk[1]);
+    const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+    if (count === 0) continue;
+
+    ranges.push(`${current}:${start}-${start + count - 1}`);
+  }
+
+  return ranges;
+}
+
+function runStryker(ranges: string[]): number {
+  const r = spawnSync("bunx", ["stryker", "run", "--mutate", ranges.join(",")], {
+    stdio: "inherit",
+  });
+  return r.status ?? 1;
+}
+
+const patterns = mutatePatterns();
+const ranges = changedRanges(diffAgainstBase(), mutateFilter(patterns));
+
+process.stderr.write(
+  `Mutation gate covers ${patterns.length} glob(s): ${patterns.join(", ")}\n` +
+    `Changes outside these paths are NOT mutation-tested.\n`
+);
+
+if (ranges.length === 0) {
+  process.stderr.write(`No mutatable changes against ${baseRef} — nothing to gate.\n`);
+  process.exit(0);
+}
+
+process.stderr.write(
+  `Mutating ${ranges.length} changed range(s):\n${ranges.join("\n")}\n`
+);
+process.exit(runStryker(ranges));

.agents/skills/klint-rules/.klint-skill.json

@@ -0,0 +1,4 @@
+{
+  "version": "0.34.0",
+  "sha256": "c8c9584cee2ef21246fc0d0498e39d7a1af7b965aff875bbb8f55c608004357b"
+}