@fugood/bricks-project 2.25.0-beta.41 → 2.25.0-beta.43

package/tools/postinstall.ts

@@ -69,8 +69,15 @@ const projectMcpServer = {
   args: [`${cwd}/node_modules/@fugood/bricks-ctor/tools/mcp-server.ts`],
 }
 
+// Codex cancels MCP tool calls it cannot prompt approval for (e.g. `codex exec`),
+// so the project-local server's tools must be pre-approved in its config entry.
+const codexProjectMcpServer = {
+  ...projectMcpServer,
+  default_tools_approval_mode: 'approve',
+}
+
 type CodexMcpConfig = {
-  mcp_servers: Record<string, typeof projectMcpServer>
+  mcp_servers: Record<string, typeof codexProjectMcpServer | typeof projectMcpServer>
 }
 
 // Claude Code and AGENTS.md projects both use the shared project .mcp.json file.
@@ -196,11 +203,81 @@ if (hasClaudeCode || hasAgentsMd) {
   await setupSkills()
 }
 
+type ClaudeSettings = {
+  autoMode?: {
+    environment?: string[]
+    allow?: string[]
+    soft_deny?: string[]
+    hard_deny?: string[]
+  }
+  [key: string]: unknown
+}
+
+// Trusted infrastructure for auto mode's classifier. `$defaults` keeps the
+// built-in environment (the working repo and its git remotes); the extra
+// entries stop routine syncs to the BRICKS backend from being treated as
+// external exfiltration. See https://code.claude.com/docs/en/auto-mode-config
+const autoModeEnvironment = [
+  '$defaults',
+  'Organization: BRICKS (bricks.tools). Primary use: building BRICKS apps/modules with the bricks CLI and the local bricks-ctor MCP server.',
+  'Trusted internal domains: all *.bricks.tools services — api.bricks.tools (project GraphQL API), bank.bricks.tools (config & asset Bank API), cdn.bricks.tools (asset CDN), plus the control/display/activity services. This project syncs its config and assets to these endpoints.',
+]
+
+// `.claude/settings.local.json` is per-developer local config; keep it untracked.
+const ensureSettingsLocalGitignored = async () => {
+  const gitignorePath = path.join(cwd, '.gitignore')
+  const entry = '.claude/settings.local.json'
+  const coveredBy = new Set([entry, '.claude', '.claude/', '.claude/*', '*.local.json'])
+
+  let content = ''
+  if (await exists(gitignorePath)) {
+    content = await readFile(gitignorePath, 'utf-8')
+    if (content.split('\n').some((line) => coveredBy.has(line.trim()))) return
+  }
+
+  const separator = content.length === 0 ? '' : content.endsWith('\n') ? '\n' : '\n\n'
+  await writeFile(gitignorePath, `${content}${separator}# Claude Code local settings\n${entry}\n`)
+  console.log(`Added ${entry} to .gitignore`)
+}
+
+// Pre-configure auto mode once, on initial setup. We only seed the classifier's
+// trusted infrastructure — not `permissions.defaultMode: 'auto'`, which Claude
+// Code ignores from project/local settings (a repo can't grant itself auto mode;
+// it only takes effect from ~/.claude/settings.json). An existing autoMode block
+// is left untouched so reinstalls never clobber a developer's customizations.
+const setupClaudeAutoMode = async () => {
+  const settingsPath = path.join(cwd, '.claude', 'settings.local.json')
+
+  let settings: ClaudeSettings = {}
+  if (await exists(settingsPath)) {
+    try {
+      settings = JSON.parse(await readFile(settingsPath, 'utf-8'))
+    } catch {
+      console.warn(`Skipping auto mode setup; ${settingsPath} is not valid JSON`)
+      return
+    }
+    if (settings.autoMode) return
+  }
+
+  settings.autoMode = { environment: autoModeEnvironment }
+
+  await mkdir(path.dirname(settingsPath), { recursive: true })
+  await writeFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`)
+  console.log(`Set up auto mode in ${settingsPath}`)
+
+  await ensureSettingsLocalGitignored()
+}
+
+if (hasClaudeCode) {
+  // Pre-configure auto mode's trusted infrastructure for Claude Code projects.
+  await setupClaudeAutoMode()
+}
+
 if (hasAgentsMd) {
   // Codex stores its project-local MCP config in .codex/config.toml.
   const defaultCodexMcpConfig = {
     mcp_servers: {
-      'bricks-ctor': projectMcpServer,
+      'bricks-ctor': codexProjectMcpServer,
     },
   }
 
@@ -212,7 +289,7 @@ if (hasAgentsMd) {
         const parsed = TOML.parse(configStr) as Partial<CodexMcpConfig>
         if (!parsed?.mcp_servers) throw new Error('mcp_servers is not defined')
         mcpConfig = { mcp_servers: parsed.mcp_servers }
-        mcpConfig.mcp_servers['bricks-ctor'] = projectMcpServer
+        mcpConfig.mcp_servers['bricks-ctor'] = codexProjectMcpServer
         delete mcpConfig.mcp_servers['bricks-project']
       } catch {
         mcpConfig = defaultCodexMcpConfig

package/utils/data.ts

@@ -7,14 +7,12 @@ export const linkData: (dataGetter: () => Data) => DataLink = (dataGetter) => ({
   data: dataGetter,
 })
 
-const idOpts = {
-  snapshotMode: process.env.BRICKS_SNAPSHOT_MODE === '1',
-}
-
 export const createCanvasIdRef: (canvasGetter: () => Canvas) => Data<string> = (canvasGetter) => {
   const data: Data<string> = {
     __typename: 'Data',
-    id: makeId('data', idOpts),
+    // Stable by default (utils/id.ts) so recompiling unchanged source yields an
+    // identical config; the legacy snapshotMode opt-out made this id churn per compile.
+    id: makeId('data'),
     type: 'string',
     routing: 'read-only',
     kind: {