@delorenj/pjangler 1.2.3 → 1.2.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/pjangler",
-  "version": "1.2.3",
+  "version": "1.2.6",
   "description": "Project subsystem bootstrapper CLI",
   "type": "module",
   "main": "dist/index.js",

package/templates/commonproject/copier.yml

@@ -79,8 +79,41 @@ primary_language:
   default: python
   when: false
 
-# --- Post-generation tasks ---
+# Whether to scaffold the project-scoped agent-hooks + skill fan-out layer
+# (.agents/hooks + the mise enter/leave wiring that injects into each agent CLI's
+# per-user config). Defaults true so a bare `copier copy` still gets it. pjangler
+# passes `--data agent_hooks_layer=false` when the machine already runs a GLOBAL
+# agent-hooks install (~/.agents/hooks) — so a fresh project never re-injects the
+# same hooks into shared per-user configs like ~/.codex or ~/.kimi-code.
+agent_hooks_layer:
+  type: bool
+  default: true
+  when: false
+
+# When agent_hooks_layer is false, omit the project-scoped hook tree + skill-link
+# scripts entirely (the mise.toml wiring is already gated inside the template).
+# The `.copier-noop-never-matches` sentinel keeps every pattern non-empty when the
+# layer is enabled, which copier requires.
+_exclude:
+  - "copier.yml"
+  - "~*"
+  - "*.py[co]"
+  - "__pycache__"
+  - ".git"
+  - ".DS_Store"
+  - ".svn"
+  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/hooks{% endif %}"
+  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/hooks/**{% endif %}"
+  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.agents/local.example.json{% endif %}"
+  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.mise/scripts/link-project-skills-to-clis.sh{% endif %}"
+  - "{% if agent_hooks_layer %}.copier-noop-never-matches{% else %}.mise/scripts/unlink-project-skills-from-clis.sh{% endif %}"
 
+# --- Post-generation tasks ---
+#
+# NOTE: intentionally does NOT run `mise trust`. Trusting the repo fires the mise
+# `[hooks].enter` array, which (when the agent-hooks layer is present) injects
+# into the caller's shared per-user CLI configs. Scaffolding must never mutate
+# global state as a side effect — the operator trusts/enters the repo themselves.
 _tasks:
   - "cp ~/.config/git/ignore .gitignore 2>/dev/null || echo '# Add ignores here' > .gitignore"
   # Ensure secrets + per-dev agent-hook/skill overrides are ignored (appended after the base ignore).
@@ -89,4 +122,3 @@ _tasks:
   - "ln -sf AGENTS.md GEMINI.md"
   # Stamp the repo's absolute path into .project.json (the SOT) post-render.
   - "python3 -c \"import json,os,pathlib; p=pathlib.Path('.project.json'); d=json.loads(p.read_text()); d['repo_path']=os.getcwd(); p.write_text(json.dumps(d,indent=2)+chr(10))\""
-  - "mise trust"

package/templates/commonproject/template/.agents/hooks/sync.py

@@ -71,17 +71,28 @@ def load_local() -> dict:
     Note: individual disabled HOOKS are enforced at RUNTIME by lib/hook-guard.sh
     (so even Claude's committed hooks honor them); this only needs disabled
     AGENTS, which gate install. CAF_HOOKS_SKIP_CODEX=1 is an env shortcut.
+
+    `defer_to_global` (under either `hooks` or `skills`) means "I already run
+    these hooks from a global agent system" — so the shared per-user injections
+    (codex/kimi/hermes) are suppressed and actively removed. Claude's committed
+    repo settings are harmless and left in place.
     """
     disabled_agents: set[str] = set()
+    defer_to_global = False
     p = REPO_ROOT / ".agents" / "local.json"
     if p.exists():
         try:
             data = json.loads(p.read_text() or "{}")
-            disabled_agents = set((data.get("hooks") or {}).get("disabled_agents") or [])
+            hooks_cfg = data.get("hooks") or {}
+            skills_cfg = data.get("skills") or {}
+            disabled_agents = set(hooks_cfg.get("disabled_agents") or [])
+            defer_to_global = bool(hooks_cfg.get("defer_to_global")) or bool(skills_cfg.get("defer_to_global"))
         except (json.JSONDecodeError, OSError) as exc:
             warn(f"ignoring malformed .agents/local.json: {exc}")
     if os.environ.get("CAF_HOOKS_SKIP_CODEX") == "1":
         disabled_agents.add("codex")
+    if defer_to_global:
+        disabled_agents.update({"codex", "kimi", "hermes"})
     return {"disabled_agents": disabled_agents}
 
 

package/templates/commonproject/template/.agents/local.example.json

@@ -4,7 +4,9 @@
     "$disabled_help": "Hook ids from .agents/hooks/hooks.master.json: skill-check-reminder, hindsight-recall, hindsight-retain, hindsight-session-end. Listed ids are skipped at runtime across ALL agents.",
     "disabled": [],
     "$disabled_agents_help": "Agent keys: claude, codex, kimi, hermes. Listed agents are NOT installed (codex/kimi/hermes injections are skipped/removed). Claude's hooks are committed and can't be fully removed per-dev — disable them individually via `disabled` instead.",
-    "disabled_agents": []
+    "disabled_agents": [],
+    "$defer_to_global_help": "Set true if you already run these hooks from a GLOBAL agent system (~/.agents/hooks). When true, sync.py suppresses AND removes the shared per-user injections (codex/kimi/hermes) so a project never double-injects into ~/.codex / ~/.kimi-code; Claude's committed repo settings are left in place. Implied by skills.defer_to_global. On a machine with a global install, pjangler skips scaffolding this whole layer, so you rarely need to set this by hand.",
+    "defer_to_global": false
   },
   "skills": {
     "$disabled_help": "Skill directory names under .agents/skills/. Listed skills are NOT symlinked into any agent CLI dir for you, and are pruned from your managed mirrors.",

package/templates/commonproject/template/mise.toml.jinja

@@ -16,27 +16,31 @@ enter = [
   "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh",
   "op inject -i .env.op > .env",
   "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/codegraph.sh",
+{%- if agent_hooks_layer %}
   "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-project-skills-to-clis.sh",
   "{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py --install --quiet",
+{%- endif %}
 ]
+{%- if agent_hooks_layer %}
 leave = [
   "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/unlink-project-skills-from-clis.sh",
   "{% raw %}{{config_root}}{% endraw %}/.agents/hooks/sync.py --uninstall --quiet",
 ]
+{%- endif %}
 
 [[watch_files]]
 patterns = ["AGENTS.md"]
 task = "link-agentfiles"
-
+{% if agent_hooks_layer %}
 # Re-fan-out the agent hooks whenever the single source of truth changes.
 [[watch_files]]
 patterns = [".agents/hooks/hooks.master.json"]
 task = "hooks-sync"
-
+{% endif %}
 [tasks.link-agentfiles]
 description = "Symlink all agent files to AGENTS.md"
 run = "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-agentfiles.sh"
-
+{% if agent_hooks_layer %}
 # --- Project-scoped agent hooks + skill fan-out (see .agents/hooks/README.md) ---
 
 [tasks.hooks-sync]
@@ -62,7 +66,7 @@ run = "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/unlink-project-skills-
 [tasks.skills-relink]
 description = "Re-fan the project skill set to all CLIs"
 run = "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/link-project-skills-to-clis.sh"
-
+{% endif %}
 [tasks.hindsight-setup]
 description = "Provision this dev's shared project Hindsight key from 1Password into .env (op inject)"
 run = "{% raw %}{{config_root}}{% endraw %}/.mise/scripts/hindsight-setup.sh"

package/templates/hermes-agent/template/.scripts/70-systemd.sh

@@ -32,6 +32,7 @@ Type=simple
 Environment=HERMES_HOME=$RUNTIME
 Environment=HERMES_OAUTH_FILE=$HERMES_OAUTH_FILE
 Environment=CODEX_HOME=$CODEX_HOME
+Environment=HERMES_KANBAN_DISPATCH_IN_GATEWAY=0
 EnvironmentFile=-$RUNTIME/.env
 ExecStart=$HERMES_BIN gateway run --replace
 Restart=on-failure

package/templates/hermes-agent/template/.scripts/sentinel.prompt.md.jinja

@@ -6,6 +6,13 @@ A cheap systemd heartbeat already decided this full pass is needed.
 Working repo: the git root containing this role at `agents/hermes/{{ role }}/`.
 Ticket provider: **{{ ticket_provider }}** (reached only through the adapter — see below).
 
+{% if ticket_provider == "plane" -%}
+**Plane is the authoritative repo ticket board/SOT for this PM.** Hermes local
+Kanban must NOT be an active durable task lifecycle surface. Local Kanban may
+only run as an explicitly configured ephemeral child execution queue and must
+never close/move authoritative repo tickets.
+
+{% endif -%}
 You are the **{{ target_repo }} PM**, running your continuous board-reconciliation
 pass. Act autonomously, but stay inside the project contracts. Read
 `agents/hermes/{{ role }}/SOUL.md` and the engine docs under

package/templates/hermes-agent/template/SOUL.md.jinja

@@ -55,12 +55,17 @@ read it before publishing a type you haven't published before.
 {% if role == "pm" -%}
 You are the **project manager**. You triage incoming requests from Telegram /
 Bloodbank command lanes, decompose them into discrete tasks on the
-Plane board, and route work to other agents in the fleet (e.g. the dev role
+**Plane board only**, and route work to other agents in the fleet (e.g. the dev role
 on `bloodbank.cmd.v1.agent.{{ target_repo }}-dev.task.assign`). You do not
 write application code. You do not approve merges.
 
+**Plane is the authoritative repo ticket board/SOT for this PM.** Hermes local
+Kanban must NOT be an active durable task lifecycle surface. The kanban toolset
+is removed from the PM's cli surface. Local Kanban may only run as an explicitly-configured
+ephemeral child execution queue and must never close/move authoritative repo tickets.
+
 Default execution workflow for implementation delivery: use
-`subagent-driven-development` in kanban-orchestrated codex mode
+`subagent-driven-development` in Plane-ticket-orchestrated implementation mode
 (WIP=1, spec review gate, quality review gate).
 
 Decision events you commonly emit: