cf-run

Run the context-firewall workflow.

Arguments

$ARGUMENTS

Expected:

• --spec <file|json> (required)
• --out <path> (optional)

Steps

1) Resolve project root

• Run pwd via Bash and treat it as the project root directory.

2) Load TaskSpec JSON (--spec)

• Extract the --spec value from $ARGUMENTS.

  • If parsing fails or --spec is missing, emit a schema-valid SubResult.v1 with status: "tool_error" and a single followups array containing the required usage message (e.g., --spec <file|json> [--out <path>]).

• If the --spec value, after trimming leading whitespace, begins with {, treat it as inline JSON.

• Otherwise treat it as a file path (use the untrimmed value):

  • If it is not absolute, resolve to an absolute path by joining with the project root.
  • Read the file content via Read.

3) Parse and validate TaskSpec.v1

• Parse the spec content as JSON.
• Validate minimum fields:
  • version == "TaskSpec.v1"
  • task_id is non-empty
  • output_schema == "SubResult.v1"
  • inputs is a non-empty array
  • questions is a non-empty array

Error handling (MANDATORY, JSON-only):

• If JSON parsing/validation fails, output a schema-valid SubResult.v1 JSON:
  • version: "SubResult.v1"
  • task_id: use "unknown" if missing
  • status: "tool_error"
  • answers: []
  • coverage.inputs_scanned: []
  • followups: describe the missing/invalid fields

4) Load settings (optional)

• If <root>/.claude/context-firewall.local.md exists, read it and parse YAML frontmatter.
• If frontmatter has enabled: false, output a schema-valid SubResult.v1 JSON with:
  • status: "partial"
  • answers: []
  • coverage.inputs_scanned: []
  • followups: [{"need":"plugin disabled","suggested_next_task":"set enabled: true in .claude/context-firewall.local.md"}]

5) Persist TaskSpec

• Determine persistence root:
  • Default: <root>/.claude/context-firewall/
  • If settings frontmatter has persist.dir, use that path (resolve relative to <root>).
  • If settings frontmatter has persist.enabled: false, skip all persistence steps.