@polderlabs/bizar 10.7.0 → 10.7.2

package/cli/install/postinstall.test.mjs

@@ -0,0 +1,98 @@
+/**
+ * cli/install/postinstall.test.mjs
+ *
+ * Verifies the postinstall bootstrap resolves source paths via the package
+ * root, not via BIZAR_HOME (regression test for the v10.7.0 ENOENT crash:
+ * `~/.config/config/agents/mike.md → ~/.claude/agents/mike.md`).
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, readdirSync, copyFileSync, readFileSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '..', '..');
+
+// Mirror the postinstall's PACKAGE_ROOT computation.
+const PACKAGE_ROOT_FROM_HERE = join(__dirname, '..', '..');
+const SRC_AGENTS_DIR = join(PACKAGE_ROOT_FROM_HERE, '.claude', 'agents');
+const SRC_SETTINGS_FILE = join(PACKAGE_ROOT_FROM_HERE, '.claude', 'settings.json');
+
+test('PACKAGE_ROOT resolves to the repo root (not BIZAR_HOME)', () => {
+  // The bug: source paths used PATHS.bizarHome + '/../config/agents/' which
+  // climbed one level up from BIZAR_HOME — a runtime state dir. The fix
+  // resolves via import.meta.url to the actual package root.
+  assert.ok(SRC_AGENTS_DIR.endsWith('/.claude/agents'), `got ${SRC_AGENTS_DIR}`);
+  assert.ok(SRC_SETTINGS_FILE.endsWith('/.claude/settings.json'), `got ${SRC_SETTINGS_FILE}`);
+});
+
+test('.claude/agents/ directory exists in the repo (canonical agent source)', () => {
+  assert.ok(existsSync(SRC_AGENTS_DIR), `${SRC_AGENTS_DIR} must exist`);
+  const files = readdirSync(SRC_AGENTS_DIR).filter(f => f.endsWith('.md'));
+  assert.ok(files.length >= 14, `expected >=14 agents, got ${files.length}`);
+});
+
+test('every shipped agent file resolves to a real file under .claude/agents/', () => {
+  const files = readdirSync(SRC_AGENTS_DIR).filter(f => f.endsWith('.md'));
+  for (const file of files) {
+    assert.ok(existsSync(join(SRC_AGENTS_DIR, file)), `${file} must exist on disk`);
+  }
+});
+
+test('.claude/settings.json exists in the repo (settings template)', () => {
+  assert.ok(existsSync(SRC_SETTINGS_FILE), `${SRC_SETTINGS_FILE} must exist`);
+});
+
+test('copy semantics: existing files in destination are not overwritten', () => {
+  // Build a fake source tree + destination tree.
+  const work = mkdtempSync(join(tmpdir(), 'bizar-postinstall-'));
+  try {
+    const srcDir = join(work, 'src');
+    const dstDir = join(work, 'dst');
+    mkdirSync(srcDir, { recursive: true });
+    mkdirSync(dstDir, { recursive: true });
+    writeFileSync(join(srcDir, 'a.md'), '# shipped');
+    writeFileSync(join(dstDir, 'a.md'), '# user-edited');
+
+    // Mirror postinstall's loop: skip when dst exists.
+    const files = ['a.md'];
+    for (const f of files) {
+      const dst = join(dstDir, f);
+      if (!existsSync(dst)) {
+        copyFileSync(join(srcDir, f), dst);
+      }
+    }
+    const content = readFileSync(join(dstDir, 'a.md'), 'utf8');
+    assert.match(content, /user-edited/, 'existing user file must be preserved');
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+});
+
+test('copy semantics: missing files are copied from source', () => {
+  const work = mkdtempSync(join(tmpdir(), 'bizar-postinstall-'));
+  try {
+    const srcDir = join(work, 'src');
+    const dstDir = join(work, 'dst');
+    mkdirSync(srcDir, { recursive: true });
+    mkdirSync(dstDir, { recursive: true });
+    writeFileSync(join(srcDir, 'b.md'), '# shipped');
+
+    const files = ['b.md'];
+    for (const f of files) {
+      const dst = join(dstDir, f);
+      if (!existsSync(dst)) copyFileSync(join(srcDir, f), dst);
+    }
+    assert.match(readFileSync(join(dstDir, 'b.md'), 'utf8'), /shipped/);
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+});
+
+test('regression: source path does NOT include "config/agents/" (legacy deleted in F-107)', () => {
+  // F-107 deleted config/agents/. Postinstall must not reference it.
+  assert.ok(!SRC_AGENTS_DIR.includes('/config/agents/'),
+    `BUG: SRC_AGENTS_DIR must not contain /config/agents/ (legacy tree), got ${SRC_AGENTS_DIR}`);
+});

package/cli/provision.mjs

@@ -490,6 +490,34 @@ export async function syncHookFiles({ dryRun = false } = {}) {
   return { ok: true, message: 'hook scripts installed', copied: readdirSync(dest).length, skipped: 0 };
 }
 
+// ─── git hooks ──────────────────────────────────────────────────────────────
+//
+// Install the repo-local git hooks (.git/hooks/commit-msg, pre-commit, pre-push)
+// from scripts/git-hooks/. Runs only when invoked from inside a git repo, so
+// the npm-install path (which doesn't have a .git/) is a no-op.
+export function installGitHooks({ dryRun = false } = {}) {
+  if (!existsSync(REPO_ROOT) || !existsSync(join(REPO_ROOT, '.git'))) {
+    return { ok: true, message: 'no git repo — skipping git hook install', installed: [] };
+  }
+  if (dryRun) return { ok: true, message: '[dry-run] would install git hooks from scripts/git-hooks/', installed: [] };
+
+  const src = join(REPO_ROOT, 'scripts', 'git-hooks');
+  const dest = join(REPO_ROOT, '.git', 'hooks');
+  if (!existsSync(src)) return { ok: true, message: `no git hooks source at ${src}`, installed: [] };
+  ensureDir(dest);
+  const installed = [];
+  for (const name of readdirSync(src)) {
+    const fp = join(src, name);
+    const st = statSync(fp);
+    if (!st.isFile()) continue;
+    const dst = join(dest, name);
+    copyFileSync(fp, dst);
+    try { chmodSync(dst, 0o755); } catch { /* ignore */ }
+    installed.push(name);
+  }
+  return { ok: true, message: `${installed.length} git hook(s) installed`, installed };
+}
+
 // ─── settings.json ──────────────────────────────────────────────────────────
 
 export function writeClaudeSettings({ dryRun = false, force = false } = {}) {
@@ -697,6 +725,7 @@ export async function runProvision(opts = {}) {
   await runStep('Syncing commands',   () => syncCommandFiles({ dryRun, force }));
   await runStep('Syncing rules',      () => syncRulesFiles({ dryRun, force }));
   await runStep('Syncing hooks',      () => syncHookFiles({ dryRun, force }));
+  await runStep('Installing git hooks', () => installGitHooks({ dryRun }));
   await runStep('Building SDK',       () => buildSdk({ dryRun }));
   await runStep('Building plugin',    () => buildPlugin({ dryRun }));
   await runStep('Building dashboard', () => buildDash({ dryRun }));

package/install.sh

@@ -32,6 +32,13 @@ EOF
     Darwin) macos;;
     *) err "Unsupported OS — use install.ps1 on Windows"; exit 1;;
   esac
+  # Auto-install the repo-local git hooks (pre-commit, pre-push, commit-msg).
+  # The commit-msg hook strips Claude/agent co-author trailers from commits
+  # so the human author identity is the only one on every Bizar commit.
+  if [ "${DRY:-0}" -eq 0 ] && [ -f "$(dirname "$0")/scripts/install-hooks.sh" ]; then
+    note "Installing git hooks (commit-msg + pre-commit + pre-push)..."
+    bash "$(dirname "$0")/scripts/install-hooks.sh" || warn "git hook install failed — run ./scripts/install-hooks.sh manually"
+  fi
   local a=(--mode=install)
   [ "$ni" -eq 1 ] && a+=(--yes)
   [ "${DRY:-0}" -eq 1 ] && a+=(--dry-run)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polderlabs/bizar",
-  "version": "10.7.0",
+  "version": "10.7.2",
   "description": "90s-office multi-agent system for Claude Code — 14 agents across 4 cost tiers with cost-aware routing, plans, and a configurable agent harness. Ships as a single npm package with the dashboard server, Claude Code MCP server, and typed SDK.",
   "type": "module",
   "bin": {
@@ -14,7 +14,12 @@
     "templates/",
     "scripts/",
     "plugins/",
-    "install.sh"
+    "install.sh",
+    ".claude/agents/",
+    ".claude/skills/",
+    ".claude/commands/",
+    ".claude/hooks/",
+    ".claude/settings.json"
   ],
   "scripts": {
     "typecheck": "tsc --noEmit",

package/scripts/git-hooks/__tests__/commit-msg.test.mjs

@@ -0,0 +1,61 @@
+/**
+ * scripts/git-hooks/__tests__/commit-msg.test.mjs
+ *
+ * Tests the commit-msg hook that strips Claude/agent co-author trailers.
+ * Runs the bash hook against synthetic commit messages and asserts the
+ * post-rewrite contents.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const HOOK = resolve(__dirname, '..', 'commit-msg');
+
+function runHook(input) {
+  const dir = mkdtempSync(join(tmpdir(), 'bizar-hook-'));
+  const msgFile = join(dir, 'msg');
+  writeFileSync(msgFile, input);
+  execFileSync('bash', [HOOK, msgFile], { stdio: 'pipe' });
+  return readFileSync(msgFile, 'utf8');
+}
+
+test('strips Claude Co-Authored-By trailer', () => {
+  const out = runHook('feat: test\n\nCo-Authored-By: Claude <noreply@anthropic.com>\n');
+  assert.doesNotMatch(out, /Claude <noreply@anthropic\.com>/);
+  assert.match(out, /feat: test/);
+});
+
+test('strips lowercase co-authored-by trailer (case-insensitive header)', () => {
+  const out = runHook('feat: test\n\nco-authored-by: claude <noreply@anthropic.com>\n');
+  assert.doesNotMatch(out, /claude <noreply@anthropic\.com>/);
+});
+
+test('strips agent-themed polderlabs.dev trailers', () => {
+  const out = runHook('feat: test\n\nCo-authored-by: Odin <noreply@polderlabs.dev>\nCo-authored-by: Thor <noreply@polderlabs.dev>\n');
+  assert.doesNotMatch(out, /Odin <noreply@polderlabs\.dev>/);
+  assert.doesNotMatch(out, /Thor <noreply@polderlabs\.dev>/);
+});
+
+test('preserves human co-author trailers', () => {
+  const out = runHook('feat: test\n\nCo-Authored-By: Real Human <real@example.com>\n');
+  assert.match(out, /Real Human <real@example\.com>/);
+});
+
+test('preserves embedded Claude mentions in commit body', () => {
+  const out = runHook('feat: test\n\nDiscussed Claude <noreply@anthropic.com> inline.\n\nSigned-off-by: Berk <berk@berkderooij.nl>\n');
+  assert.match(out, /Discussed Claude <noreply@anthropic\.com> inline\./);
+  assert.match(out, /Signed-off-by: Berk <berk@berkderooij\.nl>/);
+});
+
+test('collapses blank lines left by trailer removal', () => {
+  const input = 'feat: x\n\nbody line\n\n\nCo-Authored-By: Claude <noreply@anthropic.com>\n';
+  const out = runHook(input);
+  // No triple-newlines, no trailing Claude line
+  assert.doesNotMatch(out, /\n\n\n/);
+  assert.doesNotMatch(out, /Claude/);
+});

package/scripts/git-hooks/commit-msg

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Strip Claude/agent co-author trailers that don't belong on Bizar commits.
+#
+# Why: Claude Code's CLI appends "Co-Authored-By: Claude <noreply@anthropic.com>"
+# by default; older Bizar release docs also templated Norse/office-agent
+# personas as co-authors. This repo's commits should only carry the human
+# author identity. Any matching trailers get removed before the commit lands.
+#
+# To bypass in an emergency: git commit --no-verify
+set -euo pipefail
+
+msg_file="$1"
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+
+# Remove the two known offender trailers (case-insensitive on the header).
+# Also strip any Co-authored-by: line whose email ends in @anthropic.com
+# or @polderlabs.dev — defense-in-depth against future variations.
+sed -E \
+  -e '/^[Cc]o-[Aa]uthored-[Bb]y:[[:space:]]*Claude <noreply@anthropic\.com>[[:space:]]*$/d' \
+  -e '/^[Cc]o-[Aa]uthored-[Bb]y:[[:space:]]*[^<]*<(noreply@anthropic\.com|noreply@polderlabs\.dev)>$/d' \
+  "$msg_file" > "$tmp"
+
+# Collapse runs of blank lines that may result from trailer removal.
+awk 'BEGIN { blank=0; seen=0 } {
+  if ($0 == "") { blank++ }
+  else {
+    if (blank > 0 && seen) print "";
+    blank=0; print; seen=1
+  }
+}' "$tmp" > "${tmp}.2"
+mv "${tmp}.2" "$tmp"
+
+if ! cmp -s "$msg_file" "$tmp"; then
+  echo "commit-msg: stripped Claude/agent co-author trailers" >&2
+fi
+
+mv "$tmp" "$msg_file"

package/scripts/install-hooks.sh

@@ -18,6 +18,9 @@ chmod +x "$GIT_HOOKS_DIR/pre-commit"
 cp "$HOOKS_DIR/pre-push" "$GIT_HOOKS_DIR/pre-push"
 chmod +x "$GIT_HOOKS_DIR/pre-push"
 
+cp "$HOOKS_DIR/commit-msg" "$GIT_HOOKS_DIR/commit-msg"
+chmod +x "$GIT_HOOKS_DIR/commit-msg"
+
 echo "✓ Installed pre-commit hook"
 echo "  The hook scans staged changes for likely secrets (Bearer tokens, API keys, etc.)"
 echo "  It also blocks commits touching .bizar/ or config/cline.json (per-machine state)"
@@ -27,3 +30,9 @@ echo "✓ Installed pre-push hook"
 echo "  Blocks pushes whose commit range includes .bizar/ or config/cline.json changes"
 echo "  Defense-in-depth: catches bypasses of pre-commit via --no-verify"
 echo "  To bypass in an emergency: git push --no-verify"
+echo ""
+echo "✓ Installed commit-msg hook"
+echo "  Strips Co-Authored-By: Claude <noreply@anthropic.com> (and agent-themed"
+echo "  noreply@polderlabs.dev trailers) from commit messages — this repo's"
+echo "  commits should only carry the human author identity."
+echo "  To bypass in an emergency: git commit --no-verify"