@sous-io/sous 0.2.34 → 0.2.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sous-io/sous",
-  "version": "0.2.34",
+  "version": "0.2.35",
   "description": "Compiles AI coding agent configuration (CLAUDE.md, skills, memories) from LiquidJS templates",
   "type": "module",
   "license": "Apache-2.0",

package/recipes/core/sous-skills/sous.recipe.yaml

@@ -11,7 +11,7 @@ formatVersion: 1
 
 namespace: core
 name: sous-skills
-version: 0.2.34
+version: 0.2.35
 
 description: >-
   The skills that teach an agent what sous is and how it works: which files sous

package/src/lib/repos/git-clone.ts

@@ -16,6 +16,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { ConfigError } from "../errors.js";
+import { LF_CHECKOUT_OPTIONS } from "./store/hash.js";
 
 /** What one git invocation produced. */
 export type GitResult = {
@@ -211,15 +212,20 @@ export function cloneRepo(
   const depth = options.depth ?? 1;
   const runner = options.runner ?? runGit;
 
+  // A linked checkout is hashed when its recipes are released or compiled, so
+  // it keeps the committed bytes whatever this machine's line-ending settings are.
   if (depth > 0) {
-    const shallow = runner(["clone", "--depth", String(depth), "--", url, destDir], {});
+    const shallow = runner(
+      ["clone", ...LF_CHECKOUT_OPTIONS, "--depth", String(depth), "--", url, destDir],
+      {}
+    );
     if (shallow.status === 0) return { depth, fellBackToFullClone: false };
     // git leaves the destination behind on some failures; clear it so the retry
     // is not refused by its own leftovers.
     fs.rmSync(destDir, { recursive: true, force: true });
   }
 
-  runGitOrThrow(["clone", "--", url, destDir], {
+  runGitOrThrow(["clone", ...LF_CHECKOUT_OPTIONS, "--", url, destDir], {
     runner: options.runner,
     what: `Cloning ${url}`,
   });

package/src/lib/repos/providers/git.ts

@@ -14,6 +14,7 @@ import { spawn } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { ConfigError } from "../../errors.js";
+import { LF_CHECKOUT_OPTIONS } from "../store/hash.js";
 
 /** What a finished subprocess reports back. */
 export type CommandResult = {
@@ -174,6 +175,9 @@ export async function fetchSubtree(options: {
         "1",
         "--filter=blob:none",
         "--sparse",
+        // The fetched subtree is hashed against its pin, so its bytes must be the
+        // committed ones whatever this machine's line-ending settings are.
+        ...LF_CHECKOUT_OPTIONS,
         "--branch",
         tag,
         // Everything after this is a path or a URL, never an option, whatever it

package/src/lib/repos/store/hash.ts

@@ -35,6 +35,23 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { STORE_ENTRY_FILENAME } from "../formats/common.js";
 
+/**
+ * `git clone` options that check files out exactly as they were committed.
+ *
+ * A content hash is over raw bytes, and Git for Windows installs with
+ * `core.autocrlf=true` by default, which rewrites every text file to CRLF on
+ * checkout. A recipe published with LF then hashed differently on such a
+ * machine and failed its own pin. `--config` also writes these into the
+ * clone's own `.git/config`, so later checkouts in a linked working copy keep
+ * the same bytes.
+ */
+export const LF_CHECKOUT_OPTIONS = [
+  "--config",
+  "core.autocrlf=false",
+  "--config",
+  "core.eol=lf",
+] as const;
+
 /** Directory name never included in a content hash. */
 const GIT_DIR_NAME = ".git";