@nurix/etna 0.19.77 → 0.19.78

package/data/harness-index.json

@@ -1,5 +1,5 @@
 {
-    "fingerprint": "f747b8cde1b8",
+    "fingerprint": "728af89f1e8e",
     "harnesses": {
         "code": {
             "plugin": "code",

package/data/harnesses/code/harness.json

@@ -1,7 +1,7 @@
 {
   "harness": "code",
   "name": "code",
-  "version": "3.10.3",
+  "version": "3.10.4",
   "files": [
     ".prettierignore",
     ".prettierrc.json",
@@ -15,5 +15,5 @@
     "docs/memory/main.md",
     ".mcp.json"
   ],
-  "digest": "950e458df1d7"
+  "digest": "4b1ec8d430ab"
 }

package/data/harnesses/code/hooks/approved-packages.md

@@ -7,6 +7,8 @@ Read by the PreToolUse install gate (`compliance.mjs`) — an off-table install
 | `react` | ^19.2.3 | UI components | — |
 | `vite` | ^8.0.0 | Build tool, dev server | `webpack`, CRA |
 | `tailwindcss` | ^4.1.18 | Styling | `styled-components` |
+| `@nurix/components` | ^0.15.12 | The UI component library — import by subpath | `npx shadcn add`, a `components.json` scaffold |
+| `@tailwindcss/vite` | ^4.1.18 | Tailwind v4 Vite plugin | `postcss`, `tailwind.config.js` |
 | `@vitejs/plugin-react-swc` | ^4.2.2 | JSX compilation | `@vitejs/plugin-react` |
 | `react-router-dom` | ^7.11.0 | Routing | — |
 | `@reduxjs/toolkit` | ^2.11.2 | State management | `zustand`, `jotai` |

package/data/harnesses/code/hooks/compliance.mjs

@@ -277,11 +277,21 @@ function packageGate(projectDir, command, sessionId) {
   if (!m) return null;
   const approved = approvedPackages(projectDir);
   if (approved.size === 0) return null; // no rules file installed — nothing to enforce
-  const args = (m[1] || "")
-    .split(/\s+/)
-    .filter((a) => a && !a.startsWith("-") && PKG_SPEC.test(a));
+  const raw = m[1] || "";
+  // Test packages install at `latest`, outside the table's pin set (.claude/rules/testing.md).
+  // Two dev-only installs are a decision already taken rather than a new one: a companion in an
+  // approved scope (`@testing-library/react` is approved, so `-D @testing-library/user-event` is
+  // not a fresh choice), and `@types/*`, which is the typing of a package already decided. Scoped
+  // and dev only — an unscoped or runtime install is still judged against the table.
+  const isDev = /(?:^|\s)(?:-D|--save-dev|--dev)(?:\s|$)/.test(raw);
+  const approvedScopes = new Set(
+    [...approved].filter((n) => n.startsWith("@")).map((n) => n.split("/")[0])
+  );
+  approvedScopes.add("@types");
+  const args = raw.split(/\s+/).filter((a) => a && !a.startsWith("-") && PKG_SPEC.test(a));
   for (const arg of args) {
     const pkg = arg.startsWith("@") ? arg.split("@").slice(0, 2).join("@") : arg.split("@")[0];
+    if (isDev && pkg.startsWith("@") && approvedScopes.has(pkg.split("/")[0])) continue;
     if (!approved.has(pkg)) {
       return deny(
         projectDir,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@nurix/etna",
-    "version": "0.19.77",
+    "version": "0.19.78",
     "description": "Bootstrap a project with a Nurix harness — copies the harness's CLAUDE.md, skills, agents, rules, and hooks directly into the project from a bundled payload (no marketplace fetch, no network).",
     "type": "module",
     "bin": {
@@ -42,5 +42,5 @@
         "agent",
         "plugin"
     ],
-    "etnaFingerprint": "f747b8cde1b8"
+    "etnaFingerprint": "728af89f1e8e"
 }