@polderlabs/bizar 10.7.0 → 10.7.1

package/bizar-dash/skills/publishing/SKILL.md

@@ -46,7 +46,8 @@ Highlights:
 - bullet 2
 - bullet 3
 
-Co-authored-by: Odin <noreply@polderlabs.dev>"
+Tests: <N> pass / 0 fail across <M> runners.
+tsc: clean. build: <main> KB + <mobile> KB."
 
 # Tag
 git tag -a vX.Y.Z -m "vX.Y.Z — short title"

package/cli/provision.mjs

@@ -490,6 +490,34 @@ export async function syncHookFiles({ dryRun = false } = {}) {
   return { ok: true, message: 'hook scripts installed', copied: readdirSync(dest).length, skipped: 0 };
 }
 
+// ─── git hooks ──────────────────────────────────────────────────────────────
+//
+// Install the repo-local git hooks (.git/hooks/commit-msg, pre-commit, pre-push)
+// from scripts/git-hooks/. Runs only when invoked from inside a git repo, so
+// the npm-install path (which doesn't have a .git/) is a no-op.
+export function installGitHooks({ dryRun = false } = {}) {
+  if (!existsSync(REPO_ROOT) || !existsSync(join(REPO_ROOT, '.git'))) {
+    return { ok: true, message: 'no git repo — skipping git hook install', installed: [] };
+  }
+  if (dryRun) return { ok: true, message: '[dry-run] would install git hooks from scripts/git-hooks/', installed: [] };
+
+  const src = join(REPO_ROOT, 'scripts', 'git-hooks');
+  const dest = join(REPO_ROOT, '.git', 'hooks');
+  if (!existsSync(src)) return { ok: true, message: `no git hooks source at ${src}`, installed: [] };
+  ensureDir(dest);
+  const installed = [];
+  for (const name of readdirSync(src)) {
+    const fp = join(src, name);
+    const st = statSync(fp);
+    if (!st.isFile()) continue;
+    const dst = join(dest, name);
+    copyFileSync(fp, dst);
+    try { chmodSync(dst, 0o755); } catch { /* ignore */ }
+    installed.push(name);
+  }
+  return { ok: true, message: `${installed.length} git hook(s) installed`, installed };
+}
+
 // ─── settings.json ──────────────────────────────────────────────────────────
 
 export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
@@ -697,6 +725,7 @@ export async function runProvision(opts = {}) {
   await runStep('Syncing commands',   () => syncCommandFiles({ dryRun, force }));
   await runStep('Syncing rules',      () => syncRulesFiles({ dryRun, force }));
   await runStep('Syncing hooks',      () => syncHookFiles({ dryRun, force }));
+  await runStep('Installing git hooks', () => installGitHooks({ dryRun }));
   await runStep('Building SDK',       () => buildSdk({ dryRun }));
   await runStep('Building plugin',    () => buildPlugin({ dryRun }));
   await runStep('Building dashboard', () => buildDash({ dryRun }));

package/install.sh

@@ -32,6 +32,13 @@ EOF
     Darwin) macos;;
     *) err "Unsupported OS — use install.ps1 on Windows"; exit 1;;
   esac
+  # Auto-install the repo-local git hooks (pre-commit, pre-push, commit-msg).
+  # The commit-msg hook strips Claude/agent co-author trailers from commits
+  # so the human author identity is the only one on every Bizar commit.
+  if [ "${DRY:-0}" -eq 0 ] && [ -f "$(dirname "$0")/scripts/install-hooks.sh" ]; then
+    note "Installing git hooks (commit-msg + pre-commit + pre-push)..."
+    bash "$(dirname "$0")/scripts/install-hooks.sh" || warn "git hook install failed — run ./scripts/install-hooks.sh manually"
+  fi
   local a=(--mode=install)
   [ "$ni" -eq 1 ] && a+=(--yes)
   [ "${DRY:-0}" -eq 1 ] && a+=(--dry-run)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "10.7.0",
+  "version": "10.7.1",
   "description": "90s-office multi-agent system for Claude Code — 14 agents across 4 cost tiers with cost-aware routing, plans, and a configurable agent harness. Ships as a single npm package with the dashboard server, Claude Code MCP server, and typed SDK.",
   "type": "module",
   "bin": {

package/scripts/git-hooks/__tests__/commit-msg.test.mjs

@@ -0,0 +1,61 @@
+/**
+ * scripts/git-hooks/__tests__/commit-msg.test.mjs
+ *
+ * Tests the commit-msg hook that strips Claude/agent co-author trailers.
+ * Runs the bash hook against synthetic commit messages and asserts the
+ * post-rewrite contents.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const HOOK = resolve(__dirname, '..', 'commit-msg');
+
+function runHook(input) {
+  const dir = mkdtempSync(join(tmpdir(), 'bizar-hook-'));
+  const msgFile = join(dir, 'msg');
+  writeFileSync(msgFile, input);
+  execFileSync('bash', [HOOK, msgFile], { stdio: 'pipe' });
+  return readFileSync(msgFile, 'utf8');
+}
+
+test('strips Claude Co-Authored-By trailer', () => {
+  const out = runHook('feat: test\n\nCo-Authored-By: Claude <noreply@anthropic.com>\n');
+  assert.doesNotMatch(out, /Claude <noreply@anthropic\.com>/);
+  assert.match(out, /feat: test/);
+});
+
+test('strips lowercase co-authored-by trailer (case-insensitive header)', () => {
+  const out = runHook('feat: test\n\nco-authored-by: claude <noreply@anthropic.com>\n');
+  assert.doesNotMatch(out, /claude <noreply@anthropic\.com>/);
+});
+
+test('strips agent-themed polderlabs.dev trailers', () => {
+  const out = runHook('feat: test\n\nCo-authored-by: Odin <noreply@polderlabs.dev>\nCo-authored-by: Thor <noreply@polderlabs.dev>\n');
+  assert.doesNotMatch(out, /Odin <noreply@polderlabs\.dev>/);
+  assert.doesNotMatch(out, /Thor <noreply@polderlabs\.dev>/);
+});
+
+test('preserves human co-author trailers', () => {
+  const out = runHook('feat: test\n\nCo-Authored-By: Real Human <real@example.com>\n');
+  assert.match(out, /Real Human <real@example\.com>/);
+});
+
+test('preserves embedded Claude mentions in commit body', () => {
+  const out = runHook('feat: test\n\nDiscussed Claude <noreply@anthropic.com> inline.\n\nSigned-off-by: Berk <berk@berkderooij.nl>\n');
+  assert.match(out, /Discussed Claude <noreply@anthropic\.com> inline\./);
+  assert.match(out, /Signed-off-by: Berk <berk@berkderooij\.nl>/);
+});
+
+test('collapses blank lines left by trailer removal', () => {
+  const input = 'feat: x\n\nbody line\n\n\nCo-Authored-By: Claude <noreply@anthropic.com>\n';
+  const out = runHook(input);
+  // No triple-newlines, no trailing Claude line
+  assert.doesNotMatch(out, /\n\n\n/);
+  assert.doesNotMatch(out, /Claude/);
+});

package/scripts/git-hooks/commit-msg

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Strip Claude/agent co-author trailers that don't belong on Bizar commits.
+#
+# Why: Claude Code's CLI appends "Co-Authored-By: Claude <noreply@anthropic.com>"
+# by default; older Bizar release docs also templated Norse/office-agent
+# personas as co-authors. This repo's commits should only carry the human
+# author identity. Any matching trailers get removed before the commit lands.
+#
+# To bypass in an emergency: git commit --no-verify
+set -euo pipefail
+
+msg_file="$1"
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+
+# Remove the two known offender trailers (case-insensitive on the header).
+# Also strip any Co-authored-by: line whose email ends in @anthropic.com
+# or @polderlabs.dev — defense-in-depth against future variations.
+sed -E \
+  -e '/^[Cc]o-[Aa]uthored-[Bb]y:[[:space:]]*Claude <noreply@anthropic\.com>[[:space:]]*$/d' \
+  -e '/^[Cc]o-[Aa]uthored-[Bb]y:[[:space:]]*[^<]*<(noreply@anthropic\.com|noreply@polderlabs\.dev)>$/d' \
+  "$msg_file" > "$tmp"
+
+# Collapse runs of blank lines that may result from trailer removal.
+awk 'BEGIN { blank=0; seen=0 } {
+  if ($0 == "") { blank++ }
+  else {
+    if (blank > 0 && seen) print "";
+    blank=0; print; seen=1
+  }
+}' "$tmp" > "${tmp}.2"
+mv "${tmp}.2" "$tmp"
+
+if ! cmp -s "$msg_file" "$tmp"; then
+  echo "commit-msg: stripped Claude/agent co-author trailers" >&2
+fi
+
+mv "$tmp" "$msg_file"

package/scripts/install-hooks.sh

@@ -18,6 +18,9 @@ chmod +x "$GIT_HOOKS_DIR/pre-commit"
 cp "$HOOKS_DIR/pre-push" "$GIT_HOOKS_DIR/pre-push"
 chmod +x "$GIT_HOOKS_DIR/pre-push"
 
+cp "$HOOKS_DIR/commit-msg" "$GIT_HOOKS_DIR/commit-msg"
+chmod +x "$GIT_HOOKS_DIR/commit-msg"
+
 echo "✓ Installed pre-commit hook"
 echo "  The hook scans staged changes for likely secrets (Bearer tokens, API keys, etc.)"
 echo "  It also blocks commits touching .bizar/ or config/cline.json (per-machine state)"
@@ -27,3 +30,9 @@ echo "✓ Installed pre-push hook"
 echo "  Blocks pushes whose commit range includes .bizar/ or config/cline.json changes"
 echo "  Defense-in-depth: catches bypasses of pre-commit via --no-verify"
 echo "  To bypass in an emergency: git push --no-verify"
+echo ""
+echo "✓ Installed commit-msg hook"
+echo "  Strips Co-Authored-By: Claude <noreply@anthropic.com> (and agent-themed"
+echo "  noreply@polderlabs.dev trailers) from commit messages — this repo's"
+echo "  commits should only carry the human author identity."
+echo "  To bypass in an emergency: git commit --no-verify"