@gatebolt/cli 0.6.0 → 0.7.0

package/README.md

@@ -56,10 +56,11 @@ gatebolt init
 ```
 
 It **links** the repository (writing a committable `.gatebolt`, exactly like `gatebolt link`),
-**wires** your agent's declare → observe hooks — for Claude Code, appended to
-`.claude/settings.local.json` — and installs a **pre-push backstop** at `.git/hooks/pre-push`
-that reconciles an open declaration before a push. It reuses a saved profile (it never signs you
-in), and is safe to re-run — it never duplicates hooks.
+**wires** your agent's declare → observe hooks — for Claude Code, merged into the committable
+`.claude/settings.json` so enforcement travels to every clone and worktree — and installs a
+**pre-push backstop** at `.git/hooks/pre-push` that reconciles an open declaration before a push.
+It reuses a saved profile (it never signs you in), and is safe to re-run — it never duplicates
+hooks.
 
 | Flag               | Description                                                                                                         |
 | ------------------ | ------------------------------------------------------------------------------------------------------------------- |

package/dist/agents/claude-code.js

@@ -2,9 +2,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { isRecord } from "../json.js";
 const CLAUDE_DIR = ".claude";
-const SETTINGS_FILE = "settings.local.json";
-const GITIGNORE_FILE = ".gitignore";
-const GITIGNORE_ENTRY = `${CLAUDE_DIR}/${SETTINGS_FILE}`;
+const SETTINGS_FILE = "settings.json";
 const PRE_TOOL_USE = "PreToolUse";
 const STOP = "Stop";
 const EDIT_TOOLS_MATCHER = "Edit|Write|NotebookEdit";
@@ -59,13 +57,6 @@ export function mergeSettings(existing, opts) {
     }
     return { settings, changed };
 }
-export function withGitignoreEntry(existing, entry) {
-    const present = existing.split("\n").some((line) => line.trim() === entry);
-    if (present)
-        return null;
-    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
-    return `${existing}${prefix}${entry}\n`;
-}
 function plainObject(value, label) {
     if (value === undefined)
         return {};
@@ -116,11 +107,9 @@ async function wireClaudeCode(root, opts) {
         await mkdir(join(root, CLAUDE_DIR), { recursive: true });
         await writeFile(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf8");
     }
-    const gitignoreChanged = await ensureGitignore(root);
     return {
         settingsPath,
         settingsChanged: changed,
-        gitignoreChanged,
         enforce: effectiveEnforce(settings),
     };
 }
@@ -147,24 +136,6 @@ async function readSettings(path) {
     }
     return data;
 }
-async function ensureGitignore(root) {
-    const path = join(root, GITIGNORE_FILE);
-    const updated = withGitignoreEntry(await readTextOrEmpty(path), GITIGNORE_ENTRY);
-    if (updated === null)
-        return false;
-    await writeFile(path, updated, "utf8");
-    return true;
-}
-async function readTextOrEmpty(path) {
-    try {
-        return await readFile(path, "utf8");
-    }
-    catch (error) {
-        if (isNotFound(error))
-            return "";
-        throw error;
-    }
-}
 function safeParse(raw) {
     try {
         return JSON.parse(raw);

package/dist/commands/init.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { claudeCodeAdapter } from "../agents/claude-code.js";
 import { repoIdentityFromName, resolveConnection } from "../config.js";
-import { hooksPath, repoContext } from "../git.js";
+import { hooksPath, isPathIgnored, isUncommitted, repoContext, } from "../git.js";
 import { isRecord } from "../json.js";
 import { pinRepoProfile, profileLoader, readRepoLink } from "../profiles.js";
 import { deriveIdentity, linkRepository } from "./link.js";
@@ -15,10 +15,10 @@ const PRE_PUSH_FILE = "pre-push";
 const PRE_PUSH_MARKER = "GateBolt pre-push backstop";
 const HOOK_MODE = 0o755;
 const ID_PREFIX_LEN = 8;
-const GITIGNORE_ENTRY = ".claude/settings.local.json";
 const NO_REMOTE = "GateBolt cannot derive this repository's identity from its `origin` remote. Re-run with --name <a-name-for-this-repo>.";
 const NO_KEY = "No GateBolt key found. Run `gatebolt login` (or `gatebolt configure`) first, then re-run `gatebolt init`.";
-const EPHEMERAL_CLI = "GateBolt is running from a temporary npx/dlx cache, so the hooks would break when the package manager prunes it. Install it durably first — `npm i -g @gatebolt/cli`, or add it as a project dependency so `gatebolt` is on PATH — then re-run `gatebolt init`. To link only, pass --no-hooks --no-pre-push.";
+const EPHEMERAL_CLI = "GateBolt is running from a temporary npx/dlx cache, so the hooks would break when the package manager prunes it. Install it durably so `gatebolt` is on PATH on every machine — `npm i -g @gatebolt/cli` — then re-run `gatebolt init`. To link only, pass --no-hooks --no-pre-push.";
+const NOT_ON_PATH = "GateBolt isn't on your PATH, so a committed hook command would only name a path that exists on this machine. Install it durably so `gatebolt` is on PATH on every machine — `npm i -g @gatebolt/cli` — then re-run `gatebolt init`. To link only, pass --no-hooks --no-pre-push.";
 export async function runInit(argv) {
     const { values } = parseArgs({
         args: argv,
@@ -47,6 +47,7 @@ export async function runInit(argv) {
     const prePush = values["no-pre-push"]
         ? null
         : await installPrePush(command, Boolean(values.force));
+    const settingsState = await settingsGitState(wired[0]?.result.settingsPath);
     process.stdout.write(summary({
         root: repo.root,
         link,
@@ -54,6 +55,7 @@ export async function runInit(argv) {
         prePush,
         enforce: wired[0]?.result.enforce ?? enforce ?? "lenient",
         noHooks: Boolean(values["no-hooks"]),
+        ...settingsState,
     }));
 }
 export function parseEnforce(value) {
@@ -94,14 +96,25 @@ async function ensureLink(connection, root, name) {
         created: result.created,
     };
 }
+async function settingsGitState(settingsPath) {
+    if (!settingsPath) {
+        return { settingsIgnored: false, settingsUncommitted: false };
+    }
+    const settingsIgnored = await isPathIgnored(settingsPath);
+    const settingsUncommitted = settingsIgnored
+        ? false
+        : await isUncommitted(settingsPath);
+    return { settingsIgnored, settingsUncommitted };
+}
 function resolveCommand(root) {
     const cli = fileURLToPath(new URL("../index.js", import.meta.url));
     if (isEphemeralPath(cli)) {
         throw new Error(EPHEMERAL_CLI);
     }
-    if (onDurablePath("gatebolt", root))
-        return "gatebolt";
-    return `${quote(process.execPath)} ${quote(cli)}`;
+    if (!onDurablePath("gatebolt", root)) {
+        throw new Error(NOT_ON_PATH);
+    }
+    return "gatebolt";
 }
 // npx/dlx run from throwaway caches that get pruned, breaking any hook wired
 // here: npm marks them with an `_npx` segment, pnpm with `dlx`, yarn with `xfs-…`.
@@ -122,9 +135,6 @@ function isInsideRoot(dir, root) {
     const rel = relative(root, dir);
     return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
 }
-function quote(value) {
-    return /\s/.test(value) ? `"${value}"` : value;
-}
 async function wireAgents(root, command, enforce) {
     const wired = [];
     for (const adapter of ADAPTERS) {
@@ -175,6 +185,12 @@ function summary(parts) {
         "",
         enforceLine(parts.enforce),
     ];
+    if (!parts.noHooks && parts.settingsIgnored) {
+        lines.push("Warning: .claude/settings.json is gitignored, so committing it won't work — enforcement won't travel to other clones or worktrees until you remove the ignore rule and commit it.");
+    }
+    else if (!parts.noHooks && parts.settingsUncommitted) {
+        lines.push("Commit .claude/settings.json so every worktree, clone, and machine enforces this policy.");
+    }
     if (!parts.link.existed) {
         lines.push("Commit .gatebolt so every clone and CI job resolves the same repository.");
     }
@@ -194,9 +210,6 @@ function hookLines(root, wired, noHooks) {
     for (const { displayName, result } of wired) {
         const verb = result.settingsChanged ? "wired" : "already wired";
         lines.push(`${displayName}: ${verb} → ${relative(root, result.settingsPath)}`);
-        if (result.gitignoreChanged) {
-            lines.push(`  ignored ${GITIGNORE_ENTRY} in .gitignore`);
-        }
     }
     return lines;
 }

package/dist/git.js

@@ -34,6 +34,21 @@ export async function hooksPath() {
     const output = await git(["rev-parse", "--git-path", "hooks"]);
     return resolve(output.trim());
 }
+export async function isPathIgnored(path) {
+    try {
+        await git(["check-ignore", "--quiet", path]);
+        return true;
+    }
+    catch (error) {
+        if (gitExitedNonZero(error))
+            return false;
+        throw gitFailure(error);
+    }
+}
+export async function isUncommitted(path) {
+    const output = await git(["status", "--porcelain", "--", path]);
+    return output.trim() !== "";
+}
 export async function remoteOriginUrl() {
     try {
         const output = await git(["remote", "get-url", "origin"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatebolt/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Declare-then-observe agent client for GateBolt — records the files an AI agent intends to touch, then reconciles the actual git diff.",
   "keywords": [
     "gatebolt",