@thebassclef/lite 1.7.0 → 1.8.0

package/README.md

@@ -35,7 +35,7 @@ See [`standards/os-support.md`](standards/os-support.md) for the full policy.
 
 ## Current release
 
-<!-- version-start -->1.7.0<!-- version-end -->
+<!-- version-start -->1.8.0<!-- version-end -->
 
 See [CHANGELOG.md](CHANGELOG.md) for release notes.
 

package/dist/index.cjs

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const version = "1.7.0";
+const version = "1.8.0";
 exports.version = version;

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export declare const version: "1.7.0";
+export declare const version: "1.8.0";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-const version = "1.7.0";
+const version = "1.8.0";
 export {
   version
 };

package/dist/lite/.claude/hooks/session-reflection.d/80-hook-heartbeat-check.sh

@@ -28,18 +28,57 @@ if [ "${SELF_MODE:-0}" = "1" ]; then
   return 0 2>/dev/null || exit 0
 fi
 
-# Fresh-install gate (#1818 Ship 3): if state/markers/hook-heartbeat/ does
-# not exist, no producer has ever called heartbeat_mark on this machine, so
-# no hook can be "stale" — a fresh install has no heartbeat history to check
-# against. Skip silently. Cold adopters see no false "never fired" banner
-# on their first skill run. The gate activates the moment a producer hook
-# fires and writes its first marker.
+# Fresh-install gate — two layers close the #1895 self-defeat class:
+#
+#   Layer 1: state/markers/hook-heartbeat/ does not exist — no producer has
+#     ever called heartbeat_mark on this machine. Skip silently. Cold
+#     adopters see no false "never fired" banner on their first skill run.
+#
+#   Layer 2: dir exists BUT the oldest marker is younger than the grace
+#     window (default 24h). The install is still bootstrapping — the FIRST
+#     producer fire creates the dir + first marker, but critical hooks that
+#     have not had their trigger event yet would show "never fired." Sam
+#     sees false-positive banner at 4-minute-old install. Cure per #1895:
+#     use oldest marker mtime as the install activation anchor. Add a
+#     wallclock grace window before "never fired" reports get treated as
+#     real defects. New markers written after the first do NOT reset the
+#     anchor (find + sort + head-1 gives the oldest).
+#
+# Override: FRESH_INSTALL_GRACE_SECONDS=0 disables the grace layer for
+# operator debugging.
+#
 # Anchor: @luminary donald-norman — a banner fires only when a real problem
-# exists. @luminary michael-nygard — fresh state is not broken state.
-if [ ! -d "state/markers/hook-heartbeat" ]; then
+# exists. Sam's user model: "I just installed this; give it time."
+# @luminary michael-nygard — fresh state is not broken state.
+# Resolve marker dir — mirror lib/hook-heartbeat.sh::_heartbeat_dir semantics
+# so tests that set HEARTBEAT_MARKER_DIR get consistent behavior.
+_HB_MARKER_DIR="${HEARTBEAT_MARKER_DIR:-state/markers/hook-heartbeat}"
+
+if [ ! -d "$_HB_MARKER_DIR" ]; then
   return 0 2>/dev/null || exit 0
 fi
 
+FRESH_INSTALL_GRACE_SECONDS="${FRESH_INSTALL_GRACE_SECONDS:-86400}"  # 24h default per #1895
+if [ "$FRESH_INSTALL_GRACE_SECONDS" -gt 0 ]; then
+  # Find oldest marker mtime — install activation anchor. Try GNU stat -c
+  # first (Linux; -f on GNU means filesystem info NOT mtime; silently returns
+  # a string that breaks arithmetic below). BSD stat -f second (macOS).
+  # Filter numeric-only output for portability safety.
+  _oldest_mtime=$(find "$_HB_MARKER_DIR" -maxdepth 1 -type f -name '*.marker' -exec stat -c %Y {} + 2>/dev/null | grep -E '^[0-9]+$' | sort -n | head -1)
+  if [ -z "$_oldest_mtime" ]; then
+    _oldest_mtime=$(find "$_HB_MARKER_DIR" -maxdepth 1 -type f -name '*.marker' -exec stat -f %m {} + 2>/dev/null | grep -E '^[0-9]+$' | sort -n | head -1)
+  fi
+  _now=$(date -u +%s)
+  # No markers yet: install has not activated any producer. Skip silently.
+  if [ -z "$_oldest_mtime" ]; then
+    return 0 2>/dev/null || exit 0
+  fi
+  # Grace window active: skip silently.
+  if [ $((_now - _oldest_mtime)) -lt "$FRESH_INSTALL_GRACE_SECONDS" ]; then
+    return 0 2>/dev/null || exit 0
+  fi
+fi
+
 # Probe bundled path first (dist/lite/ ship path per ADR-056 D3), then
 # $BASSCLEF_DIR fallback for synced adopters. Pattern matches
 # session-reflection.sh:11-17. Cures #1732 Phase A silent-fail at operator

package/dist/lite/bassclef-version.json

@@ -1,7 +1,7 @@
 {
-  "version": "v1.2.0",
-  "marker_tag": "release-2026-09-22-a26d8936",
-  "release_date": "2026-09-22T11:04:29Z",
-  "release_sha": "a26d8936",
-  "release_tag": "release-2026-09-22-a26d8936"
+  "version": "v1.3.0",
+  "marker_tag": "release-2026-09-23-8f764ed8",
+  "release_date": "2026-09-23T00:10:17Z",
+  "release_sha": "8f764ed8",
+  "release_tag": "release-2026-09-23-8f764ed8"
 }

package/dist/lite/presence/install/bassclef-sync.dispatcher.template.sh

@@ -126,6 +126,45 @@ bassclef_sync_resolve_pointer_file() {
   fi
 }
 
+# bassclef_sync_bundled_substrate_present <cwd>
+#
+# Returns 0 (yes) when .claude/hooks/, .claude/rules/, .claude/skills/ all
+# exist AND contain at least one file (recursively). Returns 1 (no) when
+# any of those conditions fails.
+#
+# Cures the npm-only cold adopter false-error class per
+# bassclef-upstream#1849. The dispatcher was designed for peer-checkout
+# OR source-config models. Neither works for anonymous adopters against
+# private repos. But the npm bundle already unpacks substrate at install
+# time. The fetch failure is not a real failure; this check catches the
+# steady state and lets the dispatcher exit silently.
+#
+# Composes with:
+#   @luminary alan-cooper — Sam persona; silent-on-success matches user model
+#   @luminary donald-norman — signifier; false-positive banner erodes real signal
+#   @luminary linus-torvalds — adopter contract; npm bundle IS the substrate
+#   @luminary michael-feathers — characterization tests over 3 install shapes
+#
+# Tests: .claude/hooks/tests/bassclef-sync-bundled-substrate-check.test.sh
+# Refs: bassclef-upstream#1849
+bassclef_sync_bundled_substrate_present() {
+  local cwd="${1:-}"
+  if [ -z "$cwd" ] || [ ! -d "$cwd" ]; then
+    return 1
+  fi
+  local _dir
+  for _dir in .claude/hooks .claude/rules .claude/skills; do
+    if [ ! -d "$cwd/$_dir" ]; then
+      return 1
+    fi
+    # Nonempty check: at least one file anywhere under the dir.
+    if [ -z "$(find "$cwd/$_dir" -mindepth 1 -maxdepth 4 -type f -print -quit 2>/dev/null)" ]; then
+      return 1
+    fi
+  done
+  return 0
+}
+
 bassclef_sync_self_heal_pointer() {
   local cwd="${1:-$CWD}"
   if [ "${SKIP_SELF_HEAL_POINTER:-0}" = "1" ]; then
@@ -713,6 +752,21 @@ if [ -f "$SIBLING_TEMPLATE" ]; then
   exit $?
 fi
 
+# === Path 1.5. Bundled-substrate recognition (per #1849) ===
+# npm-only cold adopters carry substrate in the package bundle. The
+# dispatcher was designed for peer-checkout OR source-config models; both
+# fail for anonymous adopters against private repos. Before firing the
+# fetch-strategies path, check whether the substrate is already loaded at
+# CWD. If yes, exit silently — no news is good news (Cooper).
+#
+# Override: BASSCLEF_DISPATCHER_STRICT=1 forces the Path 2 fetch even when
+# bundled substrate is present (operator debugging).
+if [ "${BASSCLEF_DISPATCHER_STRICT:-0}" != "1" ]; then
+  if bassclef_sync_bundled_substrate_present "$CWD"; then
+    exit 0
+  fi
+fi
+
 # === Path 2. Curl fallback ===
 # Uses the same resolver as auto_sync pre-check so old-name adopters
 # still get here (self-heal already fired above, but resolve for safety

package/dist/lite/standards/lite-manifest.json

@@ -1,7 +1,7 @@
 {
   "tier": "lite",
-  "manifest_version": "1.9.11",
-  "generated_at": "2026-09-22T06:14:43Z",
+  "manifest_version": "1.9.14",
+  "generated_at": "2026-09-22T23:10:32Z",
   "entries": [
     {
       "slug": "029-release-pipeline",
@@ -232,7 +232,7 @@
       "type": "hook",
       "path": ".claude/hooks/session-reflection.d/80-hook-heartbeat-check.sh",
       "tier": "lite",
-      "content_hash": "sha256:fa72927b90d4f6f57733249f41f2353f930b84c18003c53f7a15c98eb8045e45",
+      "content_hash": "sha256:0955f4045ae979d6d11102b6aa711f74c3bf2683754beb1d2587e9debcdef30c",
       "description": "Hook heartbeat check — reads standards/hook-cadence.json, calls"
     },
     {
@@ -1287,7 +1287,7 @@
       "type": "presence-template",
       "path": "presence/install/bassclef-sync.dispatcher.template.sh",
       "tier": "lite",
-      "content_hash": "sha256:b94d6f09c8539c09918f79904c4bcbd50d1e5e44481c6bf641a60810dd117298",
+      "content_hash": "sha256:0c5eb10d58174652549d403cec382fc801a3fa7f7b3e4496dbf2eb5dcfffc2ac",
       "description": "description: Retagged standard → lite per #1301 concentric rule (ADR-052 D1) —"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thebassclef/lite",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Bassclef CLI — install and upgrade bassclef in your project with two commands.",
   "keywords": [
     "bassclef",