@skyf0xx/hedgehog 5.3.2 → 5.3.3

package/bin/cli.mjs

@@ -585,9 +585,33 @@ the @latest tag matters, since a bare npx may reuse a cached older CLI.
 `);
 }
 
+// The entire Hedgehog discipline is commit-per-layer/step — every loop
+// skill's own enforcement mechanism assumes `git commit` works in this
+// directory. Checked here rather than left to surface as a failed commit
+// several planning-intake steps later, after work with nowhere to land
+// as history has already happened. Run unattended, the same as
+// ensureGlobalInstall: this binary has no stdin channel to prompt on in
+// the general case, and `init` already writes every other file without
+// confirmation.
+function ensureGitRepo() {
+  try {
+    execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+      stdio: 'ignore',
+      timeout: 5_000,
+    });
+    return;
+  } catch {
+    // Not inside a work tree — fall through to init one.
+  }
+  execFileSync('git', ['init'], { stdio: 'ignore', timeout: 5_000 });
+  console.log(dim('  (no git repository found here — ran `git init`, since every later step commits)'));
+}
+
 // `core` is the fetched core — `{ manifest, root, version }` — or null on
 // a deferred install, where planner picks one later.
 async function init({ force, core, host = DEFAULT_HOST, hostOnly = false }) {
+  ensureGitRepo();
+
   // Resolve the full list of writes up front so we can detect conflicts
   // before touching anything. A deferred install plans against `null` —
   // the shared agents/skills/build-graph payload only.
@@ -650,6 +674,16 @@ async function init({ force, core, host = DEFAULT_HOST, hostOnly = false }) {
     )}\n`,
   );
   console.log('Next steps:');
+  // This install itself just fetched globalInstall.latest to run, so the
+  // global binary is already ahead of the version this run scaffolded
+  // with. Printed as step 0 here rather than left for `status`'s passive
+  // nudge to surface later, mixed in with routine output well into the
+  // build.
+  if (globalInstall?.updated) {
+    console.log(
+      `  0. ${bold(`npx @skyf0xx/hedgehog@latest update`)} ${dim(`(picks up ${globalInstall.latest} before intake begins)`)}`,
+    );
+  }
   // A core that landed a workspace landed its root package.json with it,
   // so there are dependencies to install before the first commit.
   if (core?.manifest.workspace) {
@@ -1426,8 +1460,15 @@ async function noteAvailableUpdate() {
 // The install/update itself always runs regardless of `quiet` — silence
 // governs only whether this prints, matching `boundary --quiet`'s "exit
 // code only, nothing on either stream" contract for shell hooks.
+// Returns `{ updated, latest }` — `updated` true only when this call
+// actually installed a newer global version this run is not yet running
+// on. `init` uses that to put the update command explicitly in its own
+// "Next steps" rather than leaving it to be discovered later via
+// `status`'s passive nudge, since by the time `init` prints its own
+// output the global binary is already ahead of the version this run used
+// to scaffold the project.
 async function ensureGlobalInstall({ quiet = false } = {}) {
-  if (process.env.HEDGEHOG_NO_UPDATE_CHECK) return;
+  if (process.env.HEDGEHOG_NO_UPDATE_CHECK) return { updated: false };
   try {
     const globalRoot = execFileSync('npm', ['root', '-g'], {
       encoding: 'utf8',
@@ -1435,8 +1476,8 @@ async function ensureGlobalInstall({ quiet = false } = {}) {
     }).trim();
     const runningFromGlobal = PKG_ROOT === join(globalRoot, '@skyf0xx/hedgehog');
     const { latest, stale } = await checkBinaryStaleness(DEST_ROOT, PKG_VERSION);
-    if (runningFromGlobal && !stale) return;
-    if (!latest) return;
+    if (runningFromGlobal && !stale) return { updated: false };
+    if (!latest) return { updated: false };
 
     execFileSync('npm', ['install', '-g', `@skyf0xx/hedgehog@${latest}`], {
       stdio: 'ignore',
@@ -1451,9 +1492,11 @@ async function ensureGlobalInstall({ quiet = false } = {}) {
         )}`,
       );
     }
+    return { updated: runningFromGlobal, latest };
   } catch {
     // Advisory only — a failed check or install is never worth failing a
     // command over.
+    return { updated: false };
   }
 }
 
@@ -2877,7 +2920,7 @@ async function main() {
     console.log(PKG_VERSION);
     return;
   }
-  await ensureGlobalInstall({ quiet: args.includes('--quiet') });
+  const globalInstall = await ensureGlobalInstall({ quiet: args.includes('--quiet') });
   const cmd = args[0];
   const force = args.includes('--force') || args.includes('-f');
 
@@ -2948,7 +2991,7 @@ async function main() {
     // the first host; the rest add only what differs per host.
     const targets = hosts.length ? hosts : [DEFAULT_HOST];
     for (const [i, host] of targets.entries()) {
-      await init({ force, core, host, hostOnly: i > 0 });
+      await init({ force, core, host, hostOnly: i > 0, globalInstall });
     }
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog",
-  "version": "5.3.2",
+  "version": "5.3.3",
   "description": "Install the Hedgehog build discipline (agents + skills) into a repo, for Claude Code, Cursor, or Gemini CLI.",
   "type": "module",
   "repository": {

package/src/db/next.mjs

@@ -374,7 +374,12 @@ const HONESTY = [
 export function scopePackageRoot(glob, module) {
   const segments = glob.replace('{module}', module).split('/');
   const wildcard = segments.findIndex((s) => s.includes('*'));
-  const literal = wildcard === -1 ? segments.slice(0, -1) : segments.slice(0, wildcard);
+  // No wildcard means the glob names one literal file, not a directory
+  // tree — a single prompt/config file (e.g. `.hedgehog/dsh-smoke/{module}.md`)
+  // never holds a `package.json` of its own, so its parent directory is
+  // never a package root a generator could be first into.
+  if (wildcard === -1) return null;
+  const literal = segments.slice(0, wildcard);
   const src = literal.indexOf('src');
   const root = src === -1 ? literal : literal.slice(0, src);
   // A package root is at least `<area>/<name>`; anything shallower is the

package/src/db/verify.mjs

@@ -61,6 +61,24 @@ import { DB_PATH } from './init.mjs';
 import { withCommitLock, LOCK_PATH } from './commitLock.mjs';
 import { reapExpiredLeases, pathFingerprint } from './claim.mjs';
 import { ensureTaskColumns } from './schema.mjs';
+import { FRICTION_DIR } from './friction.mjs';
+import { OVERRIDES_DIR } from './overrides.mjs';
+import { INTENTS_DIR } from './intent.mjs';
+
+// Build-graph state directories: written by their own command
+// (`friction add`, `override add`, `intent add`/`db rebuild`), committed
+// by that command's own next step, never by a layer's verify_command. A
+// layer's own work never lands here, so a path under one of these is
+// never this task's doing regardless of when it changed relative to
+// claim time — unlike attributedToTask's fingerprint check, which only
+// excludes a path unchanged since claim and so still attributes a
+// friction note logged mid-layer (exactly what the loop skill instructs)
+// to whichever task happened to be building when it was logged.
+const BUILD_GRAPH_STATE_DIRS = [FRICTION_DIR, OVERRIDES_DIR, INTENTS_DIR];
+
+function isBuildGraphStatePath(path) {
+  return BUILD_GRAPH_STATE_DIRS.some((dir) => path === dir || path.startsWith(`${dir}/`));
+}
 
 // The build graph file and the commit lock are engine state, written
 // only by this CLI, never by an agent — both are excluded from every
@@ -69,7 +87,12 @@ import { ensureTaskColumns } from './schema.mjs';
 // check they're performing. Covers SQLite's journal/WAL/SHM sidecar
 // files too.
 function isEngineStatePath(path) {
-  return path === DB_PATH || path.startsWith(`${DB_PATH}-`) || path === LOCK_PATH;
+  return (
+    path === DB_PATH ||
+    path.startsWith(`${DB_PATH}-`) ||
+    path === LOCK_PATH ||
+    isBuildGraphStatePath(path)
+  );
 }
 
 // Runs git with an argv array and no shell, so every element of `args`

package/src/hosts/gemini/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "hedgehog",
-  "version": "5.3.2",
+  "version": "5.3.3",
   "description": "Hedgehog build discipline: ordered, tested, verified build steps.",
   "contextFileName": "GEMINI.md"
 }