gstack/bin/gstack-question-log

#!/usr/bin/env bash
# gstack-question-log — append an AskUserQuestion event to the project log.
#
# Usage:
#   gstack-question-log '{"skill":"ship","question_id":"ship-test-failure-triage",\
#     "question_summary":"Tests failed","options_count":3,"user_choice":"fix-now",\
#     "recommended":"fix-now","session_id":"ppid"}'
#
# v1: log-only. Consumed by /plan-tune inspection and (in v2) by the
# inferred-dimension derivation pipeline.
#
# Schema (all fields validated):
#   skill              — skill name (kebab-case)
#   question_id        — either a registered id (preferred) or ad-hoc `{skill}-{slug}`
#   question_summary   — short one-liner of what was asked (<= 200 chars)
#   category           — approval | clarification | routing | cherry-pick | feedback-loop
#                        (optional — looked up from registry if omitted)
#   door_type          — one-way | two-way
#                        (optional — looked up from registry if omitted)
#   options_count      — number of options presented (positive integer)
#   user_choice        — key user selected (free string; registry-options preferred)
#   recommended        — option key the agent recommended (optional)
#   followed_recommendation — bool (optional — computed if both present)
#   session_id         — stable session identifier
#   ts                 — ISO 8601 timestamp (auto-injected if missing)
#
# Append-only JSONL. Dedup is at read time in gstack-question-sensitivity --read-log.
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
GSTACK_HOME="${GSTACK_HOME:-$HOME/.gstack}"
mkdir -p "$GSTACK_HOME/projects/$SLUG"

INPUT="$1"

# Validate and enrich from registry.
TMPERR=$(mktemp)
trap 'rm -f "$TMPERR"' EXIT
set +e
VALIDATED=$(printf '%s' "$INPUT" | bun -e "
const path = require('path');
const raw = await Bun.stdin.text();
let j;
try { j = JSON.parse(raw); } catch { process.stderr.write('gstack-question-log: invalid JSON\n'); process.exit(1); }

// Required: skill (kebab-case)
if (!j.skill || !/^[a-z0-9-]+\$/.test(j.skill)) {
  process.stderr.write('gstack-question-log: invalid skill, must be kebab-case\n');
  process.exit(1);
}

// Required: question_id (kebab-case, <=64 chars)
if (!j.question_id || !/^[a-z0-9-]+\$/.test(j.question_id) || j.question_id.length > 64) {
  process.stderr.write('gstack-question-log: invalid question_id, must be kebab-case <=64 chars\n');
  process.exit(1);
}

// Required: question_summary (non-empty, <=200 chars, no newlines)
if (typeof j.question_summary !== 'string' || !j.question_summary.length) {
  process.stderr.write('gstack-question-log: question_summary required\n');
  process.exit(1);
}
if (j.question_summary.length > 200) {
  j.question_summary = j.question_summary.slice(0, 200);
}
if (j.question_summary.includes('\n')) {
  j.question_summary = j.question_summary.replace(/\n+/g, ' ');
}

// Injection defense on the summary — same patterns as learnings-log.
const INJECTION_PATTERNS = [
  /ignore\s+(all\s+)?previous\s+(instructions|context|rules)/i,
  /you\s+are\s+now\s+/i,
  /always\s+output\s+no\s+findings/i,
  /skip\s+(all\s+)?(security|review|checks)/i,
  /override[:\s]/i,
  /\bsystem\s*:/i,
  /\bassistant\s*:/i,
  /\buser\s*:/i,
  /do\s+not\s+(report|flag|mention)/i,
];
for (const pat of INJECTION_PATTERNS) {
  if (pat.test(j.question_summary)) {
    process.stderr.write('gstack-question-log: question_summary contains suspicious instruction-like content, rejected\n');
    process.exit(1);
  }
}

// Registry lookup for category + door_type enrichment.
// Registry file is at \$GSTACK_ROOT/scripts/question-registry.ts, but we don't import
// TypeScript at runtime here — we pass through what was provided and fill in defaults.
// The caller (the preamble resolver) is expected to pass category+door_type from
// the registry when it knows them; for ad-hoc ids both can be omitted.

const ALLOWED_CATEGORIES = ['approval', 'clarification', 'routing', 'cherry-pick', 'feedback-loop'];
if (j.category !== undefined) {
  if (!ALLOWED_CATEGORIES.includes(j.category)) {
    process.stderr.write('gstack-question-log: invalid category, must be one of: ' + ALLOWED_CATEGORIES.join(', ') + '\n');
    process.exit(1);
  }
}

const ALLOWED_DOORS = ['one-way', 'two-way'];
if (j.door_type !== undefined) {
  if (!ALLOWED_DOORS.includes(j.door_type)) {
    process.stderr.write('gstack-question-log: invalid door_type, must be one-way or two-way\n');
    process.exit(1);
  }
}

// options_count — positive integer if present
if (j.options_count !== undefined) {
  const n = Number(j.options_count);
  if (!Number.isInteger(n) || n < 1 || n > 26) {
    process.stderr.write('gstack-question-log: options_count must be integer in [1, 26]\n');
    process.exit(1);
  }
  j.options_count = n;
}

// user_choice — required; <= 64 chars; single-line; no injection patterns
if (typeof j.user_choice !== 'string' || !j.user_choice.length) {
  process.stderr.write('gstack-question-log: user_choice required\n');
  process.exit(1);
}
if (j.user_choice.length > 64) j.user_choice = j.user_choice.slice(0, 64);
j.user_choice = j.user_choice.replace(/\n+/g, ' ');

// recommended — optional, same constraints as user_choice
if (j.recommended !== undefined) {
  if (typeof j.recommended !== 'string') {
    process.stderr.write('gstack-question-log: recommended must be string\n');
    process.exit(1);
  }
  if (j.recommended.length > 64) j.recommended = j.recommended.slice(0, 64);
}

// followed_recommendation — compute if both sides present.
if (j.recommended !== undefined && j.user_choice !== undefined) {
  j.followed_recommendation = j.user_choice === j.recommended;
}

// session_id — kebab-friendly; <=64 chars
if (j.session_id !== undefined) {
  if (typeof j.session_id !== 'string') {
    process.stderr.write('gstack-question-log: session_id must be string\n');
    process.exit(1);
  }
  if (j.session_id.length > 64) j.session_id = j.session_id.slice(0, 64);
}

// Inject timestamp if not present.
if (!j.ts) j.ts = new Date().toISOString();

console.log(JSON.stringify(j));
" 2>"$TMPERR")
VALIDATE_RC=$?
set -e

if [ $VALIDATE_RC -ne 0 ] || [ -z "$VALIDATED" ]; then
  if [ -s "$TMPERR" ]; then
    cat "$TMPERR" >&2
  fi
  exit 1
fi

echo "$VALIDATED" >> "$GSTACK_HOME/projects/$SLUG/question-log.jsonl"

# NOTE: question-log.jsonl is deliberately NOT enqueued for gbrain-sync.
# Per Codex v2 review, audit/derivation data stays local alongside the
# question-preferences.json it annotates.