@compr/opscontext-mcp 2.5.2 → 2.5.3

package/dist/cli.js

@@ -226,6 +226,52 @@ function generateMcpJson() {
 // ---------------------------------------------------------------------------
 // Template for pre-commit hook (CE doc freshness + secret scanner)
 // ---------------------------------------------------------------------------
+/**
+ * 🔒 LOCKED [SKIPPING-A-HOOK-MUST-NAME-WHAT-IS-UNENFORCED] — 2026-08-20
+ * ⛔ NEVER print a bare "already exists, skipping" for a hook slot. NEVER overwrite or
+ *    append to a foreign hook either.
+ * WHY: `init` refuses to clobber an existing hook, which is right, but it said so with one
+ *      grey line among a column of green ticks. The user reads "init done" and believes the
+ *      policy gates are live; in that repo they were never installed and enforce nothing.
+ *      This is exactly §E1 arriving through a different door: there, the rule existed and no
+ *      hook called it; here, a hook exists and does not call the rule. Both produce a gate
+ *      that is present in every document and absent at runtime, and neither produces an error.
+ *      A real instance is on this machine: invocme-odoo-connector has a hand-written
+ *      pre-commit, so `init` skipped it, and none of that repo's CE gates have ever run.
+ *      Appending instead is not the fix, and is how that repo ended up with a whole secret
+ *      scanner sitting unreachable behind an earlier `exit 0`.
+ * FIX: on skip, read the existing hook. If it does not invoke the CE CLI, say which gates are
+ *      therefore unenforced and print the one line that wires them in. Silence here reads as
+ *      success.
+ */
+function existingHookInvokesCE(path) {
+    try {
+        const body = readFileSync(path, "utf-8");
+        return /\b(contextengine|opscontext)\b/.test(body);
+    }
+    catch {
+        // Unreadable is not proof of absence; say nothing rather than claim a verdict.
+        return true;
+    }
+}
+function warnSkippedHook(path, slot) {
+    if (existingHookInvokesCE(path))
+        return;
+    const gates = {
+        "pre-commit": "secret-scan, doc-coverage, rule-parity",
+        "commit-msg": "commit-message-required",
+        "post-commit": "audit trail of the push",
+    };
+    const wire = {
+        "pre-commit": 'contextengine hook secret-scan && contextengine hook doc-coverage && contextengine hook rule-parity',
+        "commit-msg": 'contextengine hook commit-message-required "$1"',
+        "post-commit": "contextengine end-session",
+    };
+    console.log(`     ⚠️  that hook never calls ContextEngine, so these enforce NOTHING here:`);
+    console.log(`        ${gates[slot]}`);
+    console.log(`        Wire them by adding this line to ${path}:`);
+    console.log(`          ${wire[slot]}`);
+}
 function generatePreCommitHook() {
     const lines = [];
     lines.push("#!/bin/zsh");
@@ -508,7 +554,8 @@ async function runInit() {
             const postCommitDest = join(hooksDir, "post-commit");
             const commitMsgDest = join(hooksDir, "commit-msg");
             if (existsSync(preCommitDest)) {
-                console.log("  ⏭  .git/hooks/pre-commit already exists — skipping");
+                console.log("  ⏭  .git/hooks/pre-commit already exists — skipping (never overwritten)");
+                warnSkippedHook(preCommitDest, "pre-commit");
                 skipped++;
             }
             else {
@@ -523,7 +570,8 @@ async function runInit() {
             // [COMMIT-MSG-HOOK-MUST-BE-INSTALLED] — without this, every
             // commit_message_required rule is silently unenforced.
             if (existsSync(commitMsgDest)) {
-                console.log("  ⏭  .git/hooks/commit-msg already exists — skipping");
+                console.log("  ⏭  .git/hooks/commit-msg already exists — skipping (never overwritten)");
+                warnSkippedHook(commitMsgDest, "commit-msg");
                 skipped++;
             }
             else {
@@ -536,7 +584,8 @@ async function runInit() {
                 }
             }
             if (existsSync(postCommitDest)) {
-                console.log("  ⏭  .git/hooks/post-commit already exists — skipping");
+                console.log("  ⏭  .git/hooks/post-commit already exists — skipping (never overwritten)");
+                warnSkippedHook(postCommitDest, "post-commit");
                 skipped++;
             }
             else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@compr/opscontext-mcp",
-  "version": "2.5.2",
+  "version": "2.5.3",
   "description": "OpsContext for AI Agents — read-only fleet visibility (PM2/nginx/Docker/git/cron) + tamper-evident audit log + policy-as-code hooks. The ops + compliance layer Claude Code can't grow natively.",
   "type": "module",
   "main": "dist/index.js",