@gatebolt/cli 0.5.0 → 0.7.0

package/README.md

@@ -56,10 +56,11 @@ gatebolt init
 ```
 
 It **links** the repository (writing a committable `.gatebolt`, exactly like `gatebolt link`),
-**wires** your agent's declare → observe hooks — for Claude Code, appended to
-`.claude/settings.local.json` — and installs a **pre-push backstop** at `.git/hooks/pre-push`
-that reconciles an open declaration before a push. It reuses a saved profile (it never signs you
-in), and is safe to re-run — it never duplicates hooks.
+**wires** your agent's declare → observe hooks — for Claude Code, merged into the committable
+`.claude/settings.json` so enforcement travels to every clone and worktree — and installs a
+**pre-push backstop** at `.git/hooks/pre-push` that reconciles an open declaration before a push.
+It reuses a saved profile (it never signs you in), and is safe to re-run — it never duplicates
+hooks.
 
 | Flag               | Description                                                                                                         |
 | ------------------ | ------------------------------------------------------------------------------------------------------------------- |

package/dist/agents/claude-code.js

@@ -2,9 +2,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { isRecord } from "../json.js";
 const CLAUDE_DIR = ".claude";
-const SETTINGS_FILE = "settings.local.json";
-const GITIGNORE_FILE = ".gitignore";
-const GITIGNORE_ENTRY = `${CLAUDE_DIR}/${SETTINGS_FILE}`;
+const SETTINGS_FILE = "settings.json";
 const PRE_TOOL_USE = "PreToolUse";
 const STOP = "Stop";
 const EDIT_TOOLS_MATCHER = "Edit|Write|NotebookEdit";
@@ -59,13 +57,6 @@ export function mergeSettings(existing, opts) {
     }
     return { settings, changed };
 }
-export function withGitignoreEntry(existing, entry) {
-    const present = existing.split("\n").some((line) => line.trim() === entry);
-    if (present)
-        return null;
-    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    return `${existing}${prefix}${entry}\n`;
-}
 function plainObject(value, label) {
     if (value === undefined)
         return {};
@@ -116,11 +107,9 @@ async function wireClaudeCode(root, opts) {
         await mkdir(join(root, CLAUDE_DIR), { recursive: true });
         await writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
     }
-    const gitignoreChanged = await ensureGitignore(root);
     return {
         settingsPath,
         settingsChanged: changed,
-        gitignoreChanged,
         enforce: effectiveEnforce(settings),
     };
 }
@@ -147,24 +136,6 @@ async function readSettings(path) {
     }
     return data;
 }
-async function ensureGitignore(root) {
-    const path = join(root, GITIGNORE_FILE);
-    const updated = withGitignoreEntry(await readTextOrEmpty(path), GITIGNORE_ENTRY);
-    if (updated === null)
-        return false;
-    await writeFile(path, updated, "utf8");
-    return true;
-}
-async function readTextOrEmpty(path) {
-    try {
-        return await readFile(path, "utf8");
-    }
-    catch (error) {
-        if (isNotFound(error))
-            return "";
-        throw error;
-    }
-}
 function safeParse(raw) {
     try {
         return JSON.parse(raw);

package/dist/commands/init.js

@@ -5,9 +5,9 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { claudeCodeAdapter } from "../agents/claude-code.js";
 import { repoIdentityFromName, resolveConnection } from "../config.js";
-import { hooksPath, repoContext } from "../git.js";
+import { hooksPath, isPathIgnored, isUncommitted, repoContext, } from "../git.js";
 import { isRecord } from "../json.js";
-import { profileLoader, readRepoLink } from "../profiles.js";
+import { pinRepoProfile, profileLoader, readRepoLink } from "../profiles.js";
 import { deriveIdentity, linkRepository } from "./link.js";
 const ADAPTERS = [claudeCodeAdapter];
 const ENFORCE_VALUES = ["lenient", "strict"];
@@ -15,10 +15,10 @@ const PRE_PUSH_FILE = "pre-push";
 const PRE_PUSH_MARKER = "GateBolt pre-push backstop";
 const HOOK_MODE = 0o755;
 const ID_PREFIX_LEN = 8;
-const GITIGNORE_ENTRY = ".claude/settings.local.json";
 const NO_REMOTE = "GateBolt cannot derive this repository's identity from its `origin` remote. Re-run with --name <a-name-for-this-repo>.";
 const NO_KEY = "No GateBolt key found. Run `gatebolt login` (or `gatebolt configure`) first, then re-run `gatebolt init`.";
-const EPHEMERAL_CLI = "GateBolt is running from a temporary npx/dlx cache, so the hooks would break when the package manager prunes it. Install it durably first — `npm i -g @gatebolt/cli`, or add it as a project dependency so `gatebolt` is on PATH — then re-run `gatebolt init`. To link only, pass --no-hooks --no-pre-push.";
+const EPHEMERAL_CLI = "GateBolt is running from a temporary npx/dlx cache, so the hooks would break when the package manager prunes it. Install it durably so `gatebolt` is on PATH on every machine — `npm i -g @gatebolt/cli` — then re-run `gatebolt init`. To link only, pass --no-hooks --no-pre-push.";
+const NOT_ON_PATH = "GateBolt isn't on your PATH, so a committed hook command would only name a path that exists on this machine. Install it durably so `gatebolt` is on PATH on every machine — `npm i -g @gatebolt/cli` — then re-run `gatebolt init`. To link only, pass --no-hooks --no-pre-push.";
 export async function runInit(argv) {
     const { values } = parseArgs({
         args: argv,
@@ -47,6 +47,7 @@ export async function runInit(argv) {
     const prePush = values["no-pre-push"]
         ? null
         : await installPrePush(command, Boolean(values.force));
+    const settingsState = await settingsGitState(wired[0]?.result.settingsPath);
     process.stdout.write(summary({
         root: repo.root,
         link,
@@ -54,6 +55,7 @@ export async function runInit(argv) {
         prePush,
         enforce: wired[0]?.result.enforce ?? enforce ?? "lenient",
         noHooks: Boolean(values["no-hooks"]),
+        ...settingsState,
     }));
 }
 export function parseEnforce(value) {
@@ -78,6 +80,7 @@ async function connect(loadProfile) {
 async function ensureLink(connection, root, name) {
     const existing = await readRepoLink(root);
     if (existing) {
+        await pinRepoProfile(existing.repositoryId, connection.profileName);
         return { repositoryId: existing.repositoryId, existed: true };
     }
     const identity = name ? repoIdentityFromName(name) : await deriveIdentity();
@@ -93,14 +96,25 @@ async function ensureLink(connection, root, name) {
         created: result.created,
     };
 }
+async function settingsGitState(settingsPath) {
+    if (!settingsPath) {
+        return { settingsIgnored: false, settingsUncommitted: false };
+    }
+    const settingsIgnored = await isPathIgnored(settingsPath);
+    const settingsUncommitted = settingsIgnored
+        ? false
+        : await isUncommitted(settingsPath);
+    return { settingsIgnored, settingsUncommitted };
+}
 function resolveCommand(root) {
     const cli = fileURLToPath(new URL("../index.js", import.meta.url));
     if (isEphemeralPath(cli)) {
         throw new Error(EPHEMERAL_CLI);
     }
-    if (onDurablePath("gatebolt", root))
-        return "gatebolt";
-    return `${quote(process.execPath)} ${quote(cli)}`;
+    if (!onDurablePath("gatebolt", root)) {
+        throw new Error(NOT_ON_PATH);
+    }
+    return "gatebolt";
 }
 // npx/dlx run from throwaway caches that get pruned, breaking any hook wired
 // here: npm marks them with an `_npx` segment, pnpm with `dlx`, yarn with `xfs-…`.
@@ -121,9 +135,6 @@ function isInsideRoot(dir, root) {
     const rel = relative(root, dir);
     return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
 }
-function quote(value) {
-    return /\s/.test(value) ? `"${value}"` : value;
-}
 async function wireAgents(root, command, enforce) {
     const wired = [];
     for (const adapter of ADAPTERS) {
@@ -174,6 +185,12 @@ function summary(parts) {
         "",
         enforceLine(parts.enforce),
     ];
+    if (!parts.noHooks && parts.settingsIgnored) {
+        lines.push("Warning: .claude/settings.json is gitignored, so committing it won't work — enforcement won't travel to other clones or worktrees until you remove the ignore rule and commit it.");
+    }
+    else if (!parts.noHooks && parts.settingsUncommitted) {
+        lines.push("Commit .claude/settings.json so every worktree, clone, and machine enforces this policy.");
+    }
     if (!parts.link.existed) {
         lines.push("Commit .gatebolt so every clone and CI job resolves the same repository.");
     }
@@ -193,9 +210,6 @@ function hookLines(root, wired, noHooks) {
     for (const { displayName, result } of wired) {
         const verb = result.settingsChanged ? "wired" : "already wired";
         lines.push(`${displayName}: ${verb} → ${relative(root, result.settingsPath)}`);
-        if (result.gitignoreChanged) {
-            lines.push(`  ignored ${GITIGNORE_ENTRY} in .gitignore`);
-        }
     }
     return lines;
 }

package/dist/commands/link.js

@@ -2,7 +2,7 @@ import { parseArgs } from "node:util";
 import { parseRemoteUrl, repoIdentityFromName, resolveConnection, } from "../config.js";
 import { remoteOriginUrl, repoContext } from "../git.js";
 import { isRecord } from "../json.js";
-import { profileLoader, writeRepoLink } from "../profiles.js";
+import { pinRepoProfile, profileLoader, writeRepoLink } from "../profiles.js";
 import { postChange } from "../transport.js";
 export async function runLink(argv) {
     const { values } = parseArgs({
@@ -42,10 +42,8 @@ export async function linkRepository(connection, root, identity) {
     if (!isLinkResult(result)) {
         throw new Error("Unexpected response from server.");
     }
-    await writeRepoLink(root, {
-        repositoryId: result.repositoryId,
-        ...(connection.profileName ? { profile: connection.profileName } : {}),
-    });
+    await writeRepoLink(root, { repositoryId: result.repositoryId });
+    await pinRepoProfile(result.repositoryId, connection.profileName);
     return result;
 }
 function raiseNoRemote() {

package/dist/git.js

@@ -34,6 +34,21 @@ export async function hooksPath() {
     const output = await git(["rev-parse", "--git-path", "hooks"]);
     return resolve(output.trim());
 }
+export async function isPathIgnored(path) {
+    try {
+        await git(["check-ignore", "--quiet", path]);
+        return true;
+    }
+    catch (error) {
+        if (gitExitedNonZero(error))
+            return false;
+        throw gitFailure(error);
+    }
+}
+export async function isUncommitted(path) {
+    const output = await git(["status", "--porcelain", "--", path]);
+    return output.trim() !== "";
+}
 export async function remoteOriginUrl() {
     try {
         const output = await git(["remote", "get-url", "origin"]);

package/dist/profiles.js

@@ -24,8 +24,23 @@ export function parseConfig(raw) {
     if (typeof raw.default === "string") {
         config.default = raw.default;
     }
+    if (raw.repos !== undefined) {
+        const repos = parseRepos(raw.repos);
+        if (Object.keys(repos).length > 0)
+            config.repos = repos;
+    }
     return config;
 }
+function parseRepos(value) {
+    if (!isRecord(value))
+        return {};
+    const repos = {};
+    for (const [id, name] of Object.entries(value)) {
+        if (typeof name === "string")
+            repos[id] = name;
+    }
+    return repos;
+}
 function parseProfile(value) {
     if (!isRecord(value))
         return null;
@@ -52,9 +67,8 @@ export async function resolveProfile(opts) {
     const config = await loadConfig();
     if (!config)
         return null;
-    const explicit = nonEmpty(opts.name) ?? nonEmpty(process.env.GATEBOLT_PROFILE);
-    const pointer = await readLinkedProfile(opts.root);
-    const preference = configured(config, nonEmpty(opts.preferred)) ?? pointer;
+    const pin = await repoPin(config, opts.root);
+    const preference = configured(config, nonEmpty(opts.preferred)) ?? configured(config, pin);
     const name = selectProfileName(config, {
         name: opts.name,
         env: process.env.GATEBOLT_PROFILE,
@@ -65,8 +79,6 @@ export async function resolveProfile(opts) {
     const profile = config.profiles[name];
     if (profile)
         return { name, ...profile };
-    if (!explicit && name === preference)
-        return null;
     throw new Error(`Profile "${name}" is not in ${configPath()}. Run \`gatebolt configure --profile ${name}\`.`);
 }
 function configured(config, name) {
@@ -108,15 +120,25 @@ async function loadConfig() {
     }
     return config;
 }
-async function readLinkedProfile(root) {
+async function repoPin(config, root) {
     try {
         const link = await readRepoLink(root);
-        return link?.profile;
+        return link ? config.repos?.[link.repositoryId] : undefined;
     }
     catch {
+        // A malformed .gatebolt still resolves a key so `link` can repair it.
         return undefined;
     }
 }
+export async function pinRepoProfile(repositoryId, profileName) {
+    if (!profileName)
+        return;
+    const config = await readConfigForWrite();
+    if (config.repos?.[repositoryId] === profileName)
+        return;
+    config.repos = { ...config.repos, [repositoryId]: profileName };
+    await writeConfig(config);
+}
 export async function readRepoLink(root) {
     let raw;
     try {
@@ -134,11 +156,7 @@ export async function readRepoLink(root) {
         throw new Error(`${join(root, REPO_LINK_FILE)} is malformed — it should hold {"repositoryId": "<uuid>"}. ` +
             "Run `gatebolt link` from the repo root to rewrite it, then commit it.");
     }
-    const link = { repositoryId: data.repositoryId };
-    if (typeof data.profile === "string") {
-        link.profile = data.profile;
-    }
-    return link;
+    return { repositoryId: data.repositoryId };
 }
 export async function writeRepoLink(root, link) {
     const path = join(root, REPO_LINK_FILE);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatebolt/cli",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Declare-then-observe agent client for GateBolt — records the files an AI agent intends to touch, then reconciles the actual git diff.",
   "keywords": [
     "gatebolt",