mirror of
https://github.com/microsoft/BCQuality.git
synced 2026-10-05 14:46:55 +01:00
a3b79eedc2
Two related fixes, discovered together while debugging Wareco's duplicated "Project" scope MCP entries: 1. New custom/setup/machine/settings.json template + a merge-safe deploy step in sync-bcquality-knowledge.ps1 (section 10): auto-approves the read-only/already-protocol-gated tool calls across the three CURABIS-managed MCP servers (businesscentral's 15 static tools, al's 11 dev-loop tools, microsoft-learn's 3 docs tools) via ~/.claude/settings.json's permissions.allow -- merged into whatever already exists, never overwritten, since that file also carries a developer's personal settings. Tested against a real 298-entry settings.json: preserved every existing key/array untouched, added only the 14 genuinely-missing entries. Found and fixed two real bugs while building this: -AsHashtable doesn't exist in Windows PowerShell 5.1 (this script also runs via `powershell`, not just `pwsh`) -- switched to PSCustomObject + Add-Member. And Set-Content -Encoding utf8 writes a BOM in PS5.1 with no utf8NoBOM option -- switched to [System.IO.File]::WriteAllText with an explicit no-BOM UTF8Encoding, since the original file had no BOM and a JSON parser choking on one would have silently broken every developer's settings.json. 2. Wareco's committed .claude/settings.json still has the pre-migration Dynamic Tool Mode tool names (bc_actions_search/describe) and an enabledMcpjsonServers entry for al/businesscentral -- the latter is why the MCP servers panel shows them duplicated under "Project" scope next to the correct "User" scope registration. Added detection + confirmed-removal migration step (mirroring the existing .mcp.json migration's multi-developer coordination caveat) and Roemer station 16 to catch this on other pre-migration repos (gtt-marine likely has the same file).
283 lines
14 KiB
PowerShell
283 lines
14 KiB
PowerShell
# Refresh the MACHINE-LOCAL mirror of the Curabis BCQuality knowledge base.
|
|
#
|
|
# v2 - GIT-BASED (privat repo): al konsumtion sker via en kanal-klon i
|
|
# %USERPROFILE%\.claude\QualityHub (pinned til stable-branchen)
|
|
# Autentificering haandteres af Git Credential Manager - ingen raw-URLs,
|
|
# ingen GitHub API, ingen CDN-cache. Foerste koersel udloeser evt. et
|
|
# GCM-login i browseren; det ER onboarding-autentificeringen.
|
|
#
|
|
# Mirrors three layers into %USERPROFILE%\.claude\bcquality-knowledge:
|
|
# custom/ - Curabis org-specific rules (ALWAYS read in full each session)
|
|
# community/ - BC community patterns (loaded on relevance via INDEX.md)
|
|
# microsoft/ - platform guardrails (loaded on relevance via INDEX.md)
|
|
# ...plus INDEX.md (domain + keywords per fil) og opdaterer versionsmarkoeren.
|
|
#
|
|
# Mirroren committes ALDRIG til et projekt-repo - se BCQuality-reglen
|
|
# bcquality-knowledge-must-mirror-to-machine-not-repo. Koer periodisk:
|
|
# powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\sync-bcquality-knowledge.ps1"
|
|
#
|
|
# v24: samme script deployer OGSAA resten af de maskin-globale artefakter,
|
|
# der foer v24 blev kopieret ind i hvert repo (se BCQuality-reglen
|
|
# roster-agents-live-on-machine-not-in-repo):
|
|
# ~/.claude/curabis-agents/ - 18 "read-as-protocol-doc" roster-agenter
|
|
# ~/.claude/agents/florence.md - Florence som rigtig Claude Code-subagent
|
|
# ~/.claude/find-altool.ps1 - AL-tool-finder (cwd-walkup, ikke repo-bundet)
|
|
# MCP-servere (al, businesscentral) - registreret med `claude mcp --scope user`
|
|
# Undtagelser der IKKE roeres herfra (blive repo-lokale via curabis-standard.agent.md):
|
|
# .github/.agents/bcquality.agent.md - markoerfilen der gater al denne logik
|
|
# .github/.agents/feynman.agent.md - support-brugere har intet ~/.claude/
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
|
|
$repoUrl = 'https://github.com/Curabis/QualityHub.git'
|
|
$clone = Join-Path $env:USERPROFILE '.claude\QualityHub'
|
|
$dest = Join-Path $env:USERPROFILE '.claude\bcquality-knowledge'
|
|
$marker = Join-Path $env:USERPROFILE '.claude\.bcquality-version'
|
|
$staging = "$dest.tmp"
|
|
|
|
# --- 1. Kanal-klon: opret eller opdater (pinned til stable) ---
|
|
if (-not (Test-Path (Join-Path $clone '.git'))) {
|
|
Write-Host "Kanal-klon mangler - kloner stable fra $repoUrl ..."
|
|
git clone --branch stable --single-branch $repoUrl $clone
|
|
if ($LASTEXITCODE -ne 0) { throw "git clone fejlede - er du autentificeret (GCM), og har du adgang til repoet?" }
|
|
} else {
|
|
git -C $clone fetch origin stable --quiet
|
|
if ($LASTEXITCODE -ne 0) { throw "git fetch fejlede - tjek netvaerk/adgang." }
|
|
git -C $clone checkout -B stable origin/stable --quiet
|
|
}
|
|
$sha = (git -C $clone rev-parse HEAD).Trim()
|
|
Write-Host "Kanal-klon paa stable @ $($sha.Substring(0,7))"
|
|
|
|
# --- 2. Byg mirror fra klonens filer (ingen netvaerk herfra) ---
|
|
$layerMap = [ordered]@{
|
|
'custom\knowledge' = 'custom'
|
|
'community\knowledge' = 'community'
|
|
'microsoft\knowledge' = 'microsoft'
|
|
}
|
|
|
|
function Get-Frontmatter {
|
|
param([string]$Path)
|
|
$lines = Get-Content -Path $Path
|
|
$fm = @{}
|
|
if ($lines.Count -eq 0 -or $lines[0].Trim() -ne '---') { return $fm }
|
|
for ($i = 1; $i -lt $lines.Count; $i++) {
|
|
if ($lines[$i].Trim() -eq '---') { break }
|
|
if ($lines[$i] -match '^\s*([\w-]+):\s*(.*)$') {
|
|
$fm[$matches[1]] = $matches[2].Trim()
|
|
}
|
|
}
|
|
return $fm
|
|
}
|
|
|
|
if (Test-Path $staging) { Remove-Item -Recurse -Force $staging }
|
|
New-Item -ItemType Directory -Force $staging | Out-Null
|
|
|
|
$files = @()
|
|
foreach ($prefix in $layerMap.Keys) {
|
|
$srcDir = Join-Path $clone $prefix
|
|
if (-not (Test-Path $srcDir)) { continue }
|
|
$layer = $layerMap[$prefix]
|
|
Get-ChildItem $srcDir -Recurse -Filter *.md | ForEach-Object {
|
|
$relative = $_.FullName.Substring($srcDir.Length + 1)
|
|
$localPath = Join-Path $staging (Join-Path $layer $relative)
|
|
New-Item -ItemType Directory -Force (Split-Path $localPath) | Out-Null
|
|
Copy-Item $_.FullName $localPath
|
|
$files += [pscustomobject]@{ Layer = $layer; Relative = $relative; LocalPath = $localPath }
|
|
}
|
|
}
|
|
if ($files.Count -eq 0) { throw 'Ingen knowledge-filer fundet i kanal-klonen - afbryder.' }
|
|
|
|
# --- 3. INDEX.md (relevans-indeks for alle lag) ---
|
|
$idx = [System.Collections.Generic.List[string]]::new()
|
|
$idx.Add('# BCQuality Knowledge Index')
|
|
$idx.Add('')
|
|
$idx.Add('<!-- Generated by sync-bcquality-knowledge.ps1 - do not edit by hand. -->')
|
|
$idx.Add('')
|
|
$idx.Add('Layers: `custom` is ALWAYS read in full each session. For `community` and')
|
|
$idx.Add('`microsoft`, scan this index and read only the files whose domain/keywords')
|
|
$idx.Add('match the task at hand.')
|
|
$idx.Add('')
|
|
foreach ($layer in @('custom', 'community', 'microsoft')) {
|
|
$layerFiles = $files | Where-Object { $_.Layer -eq $layer } | Sort-Object Relative
|
|
if (-not $layerFiles) { continue }
|
|
$note = if ($layer -eq 'custom') { ' (always-on)' } else { ' (load on relevance)' }
|
|
$idx.Add("## $layer$note")
|
|
$idx.Add('')
|
|
foreach ($f in $layerFiles) {
|
|
$fm = Get-Frontmatter $f.LocalPath
|
|
$domain = if ($fm.ContainsKey('domain')) { $fm['domain'] } else { '' }
|
|
$keywords = if ($fm.ContainsKey('keywords')) { $fm['keywords'].Trim('[', ']') } else { '' }
|
|
$rel = ($f.Relative -replace '\.md$', '') -replace '\\', '/'
|
|
$idx.Add("- ``$layer/$rel`` - domain: $domain; keywords: $keywords")
|
|
}
|
|
$idx.Add('')
|
|
}
|
|
Set-Content -Path (Join-Path $staging 'INDEX.md') -Value $idx -Encoding utf8
|
|
|
|
# --- 4. Swap + markoer ---
|
|
if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
|
|
Rename-Item -Path $staging -NewName (Split-Path $dest -Leaf)
|
|
Set-Content -Path $marker -Value $sha -Encoding ascii
|
|
|
|
Write-Host ''
|
|
Write-Host "Done. $($files.Count) filer, 3 lag, stable @ $($sha.Substring(0,7))."
|
|
Write-Host "Machine-local mirror updated: $dest"
|
|
|
|
# --- 5. Roster-agenter -> ~/.claude/curabis-agents/ (v24, maskin-globalt) ---
|
|
# De 18 "read-as-protocol-doc" agenter der IKKE er bcquality.agent.md eller
|
|
# feynman.agent.md (de bliver repo-lokale, se filens header). Florence
|
|
# haandteres separat nedenfor (hun er en rigtig Claude Code-subagent).
|
|
$curabisAgentsDest = Join-Path $env:USERPROFILE '.claude\curabis-agents'
|
|
New-Item -ItemType Directory -Force $curabisAgentsDest | Out-Null
|
|
|
|
$rosterFromAgentsDir = @(
|
|
'aurelius', 'carlin', 'columbo', 'court', 'edison', 'ergasterion',
|
|
'ferencz', 'fowler', 'francis', 'hickey', 'immanuel', 'lincoln', 'm365',
|
|
'munger', 'parnas', 'roemer', 'smiley', 'weber'
|
|
) | ForEach-Object { Join-Path $clone "custom\agents\$_.agent.md" }
|
|
|
|
$rosterFromSetupTemplates = @(
|
|
'al-complexity', 'al-review', 'al-triage', 'algo-settings', 'bc-mcp'
|
|
) | ForEach-Object { Join-Path $clone "custom\setup\templates\$_.agent.md" }
|
|
|
|
$rosterCount = 0
|
|
foreach ($src in ($rosterFromAgentsDir + $rosterFromSetupTemplates)) {
|
|
if (-not (Test-Path $src)) {
|
|
Write-Warning "Roster-agent ikke fundet i klonen, springer over: $src"
|
|
continue
|
|
}
|
|
Copy-Item $src (Join-Path $curabisAgentsDest (Split-Path $src -Leaf)) -Force
|
|
$rosterCount++
|
|
}
|
|
Write-Host "Roster-agenter synkroniseret til $curabisAgentsDest - $rosterCount filer."
|
|
|
|
# --- 6. Florence -> ~/.claude/agents/florence.md (rigtig subagent, ikke curabis-agents) ---
|
|
$nativeAgentsDest = Join-Path $env:USERPROFILE '.claude\agents'
|
|
New-Item -ItemType Directory -Force $nativeAgentsDest | Out-Null
|
|
Copy-Item (Join-Path $clone 'custom\agents\florence.agent.md') (Join-Path $nativeAgentsDest 'florence.md') -Force
|
|
Write-Host "Florence-subagent opdateret: $(Join-Path $nativeAgentsDest 'florence.md')"
|
|
|
|
# --- 7. find-altool.ps1 -> ~/.claude/find-altool.ps1 (maskin-globalt, raw bytes) ---
|
|
$findAltoolDest = Join-Path $env:USERPROFILE '.claude\find-altool.ps1'
|
|
Copy-Item (Join-Path $clone 'custom\setup\machine\find-altool.ps1') $findAltoolDest -Force
|
|
Write-Host "find-altool.ps1 opdateret: $findAltoolDest"
|
|
|
|
# --- 8. MCP-servere: registrer al + businesscentral paa user scope (idempotent) ---
|
|
# claude mcp add fejler med exit 1 og "already exists" hvis serveren allerede er
|
|
# registreret - det er IKKE en fejltilstand her, kun rigtige fejl skal stoppe scriptet.
|
|
# NB: $ErrorActionPreference='Stop' goer stderr fra native kommandoer til en
|
|
# terminating exception ved 2>&1-redirect - skal skiftes til 'Continue' om
|
|
# selve kaldet, ellers naar if-tjekket nedenfor aldrig at koere.
|
|
function Ensure-UserMcpServer {
|
|
param([string]$Name, [string[]]$CommandAndArgs)
|
|
# BEMAERK: `claude mcp add --scope user $Name -- @CommandAndArgs` (splat EFTER
|
|
# et literalt '--') taber '--'-grænsen et sted i PowerShell -> commander.js,
|
|
# og flagene i $CommandAndArgs bliver fejlagtigt tolket som claude-flag ("unknown
|
|
# option '-NoProfile'"). Eneste form der virker paalideligt: ét fladt array med
|
|
# ALT (inkl. 'mcp','add',flag,navn,'--') kaldt som @allArgs i ét hug.
|
|
$allArgs = @('mcp', 'add', '--scope', 'user', $Name, '--') + $CommandAndArgs
|
|
$prevEap = $ErrorActionPreference
|
|
$ErrorActionPreference = 'Continue'
|
|
$output = & claude @allArgs 2>&1
|
|
$exitCode = $LASTEXITCODE
|
|
$ErrorActionPreference = $prevEap
|
|
if ($exitCode -ne 0) {
|
|
if ($output -match 'already exists') {
|
|
Write-Host "MCP-server '$Name' er allerede registreret paa user scope."
|
|
} else {
|
|
throw "claude mcp add fejlede for '$Name': $output"
|
|
}
|
|
} else {
|
|
Write-Host "MCP-server '$Name' registreret paa user scope."
|
|
}
|
|
}
|
|
|
|
Ensure-UserMcpServer -Name 'businesscentral' -CommandAndArgs @('node', '${USERPROFILE}\.claude\bc-mcp-bridge.js')
|
|
Ensure-UserMcpServer -Name 'al' -CommandAndArgs @(
|
|
'powershell', '-NoProfile', '-ExecutionPolicy', 'Bypass',
|
|
'-File', '${USERPROFILE}\.claude\find-altool.ps1',
|
|
'launchmcpserver', 'auto', '--transport', 'stdio'
|
|
)
|
|
|
|
# --- 9. Microsoft Learn MCP (HTTP, ingen auth) - samme adgang udviklere faar som
|
|
# Mode C support-brugere allerede har. Verificeret 2026-07-30: offentlig, ingen
|
|
# nogen creds noedvendige, stdio-mekanismen ovenfor gaelder ikke - HTTP-transport
|
|
# bruger et andet flag-sæt (--transport http, ingen '--' kommando-adskiller).
|
|
function Ensure-UserMcpHttpServer {
|
|
param([string]$Name, [string]$Url)
|
|
$prevEap = $ErrorActionPreference
|
|
$ErrorActionPreference = 'Continue'
|
|
$output = & claude mcp add --scope user --transport http $Name $Url 2>&1
|
|
$exitCode = $LASTEXITCODE
|
|
$ErrorActionPreference = $prevEap
|
|
if ($exitCode -ne 0) {
|
|
if ($output -match 'already exists') {
|
|
Write-Host "MCP-server '$Name' er allerede registreret paa user scope."
|
|
} else {
|
|
throw "claude mcp add fejlede for '$Name': $output"
|
|
}
|
|
} else {
|
|
Write-Host "MCP-server '$Name' registreret paa user scope."
|
|
}
|
|
}
|
|
|
|
Ensure-UserMcpHttpServer -Name 'microsoft-learn' -Url 'https://learn.microsoft.com/api/mcp'
|
|
|
|
# --- 10. Permissions allowlist -> ~/.claude/settings.json (MERGE, never overwrite) ---
|
|
# Unlike the other artifacts above, settings.json is not pure BCQuality content -
|
|
# it also carries a developer's personal settings (theme, model, hooks, etc).
|
|
# Only merge the permissions.allow entries from the template below into whatever
|
|
# already exists; never replace the file wholesale. Scope: the three CURABIS-
|
|
# managed MCP servers only (businesscentral, al, microsoft-learn) - all either
|
|
# read-only or already gated by Smiley's own protocol checks (red/green
|
|
# confirmation, independent review), so the tool-permission prompt is redundant
|
|
# friction here, not a real safety boundary. 2026-08-03: added after a developer
|
|
# had to click through the same MCP approval prompts repeatedly across sessions.
|
|
$settingsTemplate = Join-Path $clone 'custom\setup\machine\settings.json'
|
|
$settingsDest = Join-Path $env:USERPROFILE '.claude\settings.json'
|
|
|
|
if (Test-Path $settingsTemplate) {
|
|
# NB: -AsHashtable (ConvertFrom-Json) findes kun i PowerShell 6+. Dette script
|
|
# koeres ogsaa via `powershell` (Windows PowerShell 5.1) paa udviklermaskiner,
|
|
# saa vi bruger PSCustomObject + Add-Member i stedet - virker paa begge.
|
|
$templateAllow = (Get-Content $settingsTemplate -Raw | ConvertFrom-Json).permissions.allow
|
|
|
|
$settings = $null
|
|
if (Test-Path $settingsDest) {
|
|
$raw = Get-Content $settingsDest -Raw
|
|
if ($raw -and $raw.Trim()) {
|
|
$settings = $raw | ConvertFrom-Json
|
|
}
|
|
}
|
|
if (-not $settings) { $settings = [PSCustomObject]@{} }
|
|
|
|
if (-not (Get-Member -InputObject $settings -Name 'permissions' -MemberType NoteProperty)) {
|
|
$settings | Add-Member -MemberType NoteProperty -Name 'permissions' -Value ([PSCustomObject]@{})
|
|
}
|
|
if (-not (Get-Member -InputObject $settings.permissions -Name 'allow' -MemberType NoteProperty)) {
|
|
$settings.permissions | Add-Member -MemberType NoteProperty -Name 'allow' -Value @()
|
|
}
|
|
|
|
$existingAllow = [System.Collections.Generic.List[string]]::new()
|
|
foreach ($r in @($settings.permissions.allow)) { $existingAllow.Add([string]$r) }
|
|
|
|
$added = 0
|
|
foreach ($rule in $templateAllow) {
|
|
if ($existingAllow -notcontains $rule) {
|
|
$existingAllow.Add($rule)
|
|
$added++
|
|
}
|
|
}
|
|
$settings.permissions.allow = $existingAllow.ToArray()
|
|
|
|
# NB: Set-Content -Encoding utf8 skriver en BOM i Windows PowerShell 5.1 (ingen
|
|
# utf8NoBOM-mulighed der) - fundet under test 2026-08-03: settings.json havde
|
|
# ingen BOM originalt, og en tilfoejet BOM kan knaekke JSON-parsere der laeser
|
|
# filen. [System.IO.File]::WriteAllText med en explicit no-BOM UTF8Encoding
|
|
# virker identisk paa PS5.1 og PS7.
|
|
$json = $settings | ConvertTo-Json -Depth 20
|
|
[System.IO.File]::WriteAllText($settingsDest, $json, [System.Text.UTF8Encoding]::new($false))
|
|
Write-Host "Permissions-allowlist merged ind i $settingsDest - $added ny(e) regel(er) tilfoejet."
|
|
} else {
|
|
Write-Warning "settings.json-skabelon ikke fundet i klonen, springer over."
|
|
}
|