@thebassclef/lite 1.9.3 → 1.9.4

package/README.md

@@ -63,7 +63,7 @@ your browser.
 
 ## Current release
 
-<!-- version-start -->1.9.3<!-- version-end -->
+<!-- version-start -->1.9.4<!-- version-end -->
 
 See [CHANGELOG.md](CHANGELOG.md) for the full changelog. Adopter-facing
 release notes live at [docs.bassclef.dev/docs/whats-new/releases](https://docs.bassclef.dev/docs/whats-new/releases).

package/dist/index.cjs

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const version = "1.9.3";
+const version = "1.9.4";
 exports.version = version;

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export declare const version: "1.9.3";
+export declare const version: "1.9.4";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-const version = "1.9.3";
+const version = "1.9.4";
 export {
   version
 };

package/dist/lite/bassclef-version.json

@@ -1,7 +1,7 @@
 {
-  "version": "v1.5.2",
-  "marker_tag": "release-2026-09-25-26328f36",
-  "release_date": "2026-09-25T17:01:41Z",
-  "release_sha": "26328f36",
-  "release_tag": "release-2026-09-25-26328f36"
+  "version": "v1.6.0",
+  "marker_tag": "release-2026-09-26-db89d305",
+  "release_date": "2026-09-26T12:19:56Z",
+  "release_sha": "db89d305",
+  "release_tag": "release-2026-09-26-db89d305"
 }

package/dist/lite/lib/bassclef-dir-resolver.sh

@@ -8,14 +8,17 @@
 # file at $HOME/.claude/hooks/, not a symlink to a checkout).
 #
 # The resolver probes four paths in order per Chain-of-Responsibility:
-#   1. Peer-checkout — $CWD/../bassclef with sentinel file present
-#   2. $HOME/bassclef — tarball adopter path with sentinel file present
-#   3. Bundled path — walk up from $HOOK_REAL_PATH with sentinel present
+#   1. Bundled path — walk up from $HOOK_REAL_PATH with sentinel present
+#      (was Check 3 pre-#1954; moved to Check 1 for #1953 shadow class cure —
+#       adopters with adjacent bassclef checkouts now get the npm install path)
+#   2. Peer-checkout — $CWD/../bassclef with sentinel file present
+#   3. $HOME/bassclef — tarball adopter path with sentinel file present
 #   4. Fallback — $CWD (adopter repo); safer than $HOME because the files
 #      fragments want ship into the repo via bassclef init
 #
 # The sentinel file is presence/install/bassclef-hook-connect.sh. Every
 # probe requires it — an empty peer dir or empty $HOME/bassclef does NOT win.
+# Nygard R1 fold — bundled probe fail-through preserves peer-checkout adopters.
 #
 # Silent contract: never crashes, never writes to stderr on the resolve path.
 # Consumers (13 fragments plus session-reflection.sh coordinator) treat the
@@ -42,17 +45,9 @@ resolve_bassclef_dir() {
   local home_dir="${HOME_OVERRIDE:-${HOME:-/nonexistent}}"
   local sentinel="presence/install/bassclef-hook-connect.sh"
 
-  # 1. Peer-checkout — sibling bassclef dir next to $CWD
-  if [ -d "$cwd/../bassclef" ] && [ -f "$cwd/../bassclef/$sentinel" ]; then
-    ( cd "$cwd/../bassclef" 2>/dev/null && pwd ) && return 0
-  fi
-
-  # 2. $HOME/bassclef — tarball adopter path
-  if [ -d "$home_dir/bassclef" ] && [ -f "$home_dir/bassclef/$sentinel" ]; then
-    printf '%s\n' "$home_dir/bassclef" && return 0
-  fi
-
-  # 3. Bundled path — walk up two levels from dispatcher
+  # 1. Bundled path — walk up two levels from dispatcher (SWAPPED to Check 1
+  #    per #1954 Layer 1a — closes #1953 shadow class where an adjacent
+  #    bassclef checkout at $CWD/../bassclef was winning over the npm install).
   if [ -n "$hook_path" ]; then
     local candidate
     candidate="$( cd "$(dirname "$hook_path")/../.." 2>/dev/null && pwd )" || candidate=""
@@ -61,6 +56,17 @@ resolve_bassclef_dir() {
     fi
   fi
 
+  # 2. Peer-checkout — sibling bassclef dir next to $CWD (Nygard R1 fold —
+  #    preserves peer-checkout adopters when bundled probe fails).
+  if [ -d "$cwd/../bassclef" ] && [ -f "$cwd/../bassclef/$sentinel" ]; then
+    ( cd "$cwd/../bassclef" 2>/dev/null && pwd ) && return 0
+  fi
+
+  # 3. $HOME/bassclef — tarball adopter path
+  if [ -d "$home_dir/bassclef" ] && [ -f "$home_dir/bassclef/$sentinel" ]; then
+    printf '%s\n' "$home_dir/bassclef" && return 0
+  fi
+
   # 4. Fallback — $CWD (adopter repo). Safer than $HOME because the files
   #    fragments want (init manifest, presence/install/*) ship into the repo.
   ( cd "$cwd" 2>/dev/null && pwd ) || printf '%s\n' "$cwd"

package/dist/lite/presence/install/bassclef-hook-connect.sh

@@ -241,13 +241,58 @@ bassclef_hook_connect_apply() {
     echo "[bassclef-hook-connect] no tier declared in .bassclef-source.json — merging all wires (grace window). Set tier: lite to filter." >&2
   fi
 
+  # === Filter-on-read (bassclef-upstream#1954) ===
+  # For each bassclef hook command, verify the target file exists at
+  # $bassclef_root/.claude/hooks/<basename>. Skip any entry whose target is
+  # missing. Log every skip to stderr. Emit warn banner over threshold.
+  # Saltzer-Schroeder R4 fold — matches both $CLAUDE_PROJECT_DIR- and
+  # $HOME-prefixed commands via basename extraction from .claude/hooks/ path.
+  # Nygard R2 mitigation — [ -f ] with symlink follow.
+  local present_re=""
+  local skip_count=0
+  local skipped_targets_file="$adopter_cwd/.bassclef-hook-connect-skipped.$$.tmp"
+  : > "$skipped_targets_file"
+  local present_basenames_file="$adopter_cwd/.bassclef-hook-connect-present.$$.tmp"
+  : > "$present_basenames_file"
+  local bhc_cmd bhc_base bhc_target
+  while IFS= read -r bhc_cmd; do
+    [ -z "$bhc_cmd" ] && continue
+    bhc_base=$(echo "$bhc_cmd" | grep -oE '\.claude/hooks/[^"'"'"'[:space:]\\]+\.sh' | head -1 | sed 's#\.claude/hooks/##')
+    if [ -z "$bhc_base" ]; then
+      continue
+    fi
+    bhc_target="$bassclef_root/.claude/hooks/$bhc_base"
+    if [ -f "$bhc_target" ] || [ -L "$bhc_target" ]; then
+      echo "$bhc_base" >> "$present_basenames_file"
+    else
+      echo "$bhc_target" >> "$skipped_targets_file"
+      skip_count=$((skip_count + 1))
+      echo "[bassclef-hook-connect] skip — target missing at $bhc_target" >&2
+    fi
+  done < <(jq -r '.hooks // {} | to_entries[] | .value[]? | .hooks[]? | .command // empty' "$bassclef_settings" 2>/dev/null)
+
+  if [ -s "$present_basenames_file" ]; then
+    present_re=$(sort -u "$present_basenames_file" | sed 's/\.sh$//' | paste -sd'|' -)
+  fi
+
+  # Warn banner over threshold. Threshold=0 disables banner but per-skip
+  # stderr above still fires.
+  local warn_threshold="${BASSCLEF_HOOK_CONNECT_SKIP_WARN:-5}"
+  if [ "$skip_count" -gt 0 ] && [ "$warn_threshold" -gt 0 ] && [ "$skip_count" -gt "$warn_threshold" ]; then
+    echo "[bassclef-hook-connect] WARN — $skip_count entries skipped (target files missing). Top 3:" >&2
+    sort -u "$skipped_targets_file" | head -3 | sed 's/^/  - /' >&2
+    echo "  Set BASSCLEF_HOOK_CONNECT_SKIP_WARN=N to change threshold, or 0 to disable banner." >&2
+  fi
+  rm -f "$present_basenames_file" "$skipped_targets_file"
+
   # Merge every hook entry from every event type. Preserves operator-owned
   # entries. Adds bassclef entries under matching (event, matcher) pairs
   # without duplicating commands. Skips Lane 3 hooks at $CLAUDE_PROJECT_DIR
   # per <consumer-repo>#1262. Filters off-tier entries when tier_re non-empty
-  # per bassclef-upstream#1946.
+  # per bassclef-upstream#1946. Filters missing-target entries when
+  # present_re non-empty per bassclef-upstream#1954.
   local merged
-  merged=$(jq --slurpfile bassclef "$bassclef_settings" --arg lane3re "$lane3_re" --arg tierre "$tier_re" '
+  merged=$(jq --slurpfile bassclef "$bassclef_settings" --arg lane3re "$lane3_re" --arg tierre "$tier_re" --arg presentre "$present_re" '
     . as $adopter
     | ($bassclef[0].hooks // {}) as $bhooks
     | .hooks //= {}
@@ -264,6 +309,15 @@ bassclef_hook_connect_apply() {
             # tier manifest set. Empty tier_re means no filter (fallback).
             ($tierre == "") or
             ((.command // "") | test("\\.claude/hooks/(" + $tierre + ")\\.sh"))
+          )) | map(select(
+            # Filter-on-read (bassclef-upstream#1954): keep only entries whose
+            # target hook file exists at $bassclef_root/.claude/hooks/<basename>.
+            # Empty present_re means no filter (fallback merge-all — matches
+            # the tier filter fallback shape). Non-.claude/hooks commands pass
+            # through (not our target class).
+            ($presentre == "") or
+            ((.command // "") | test("\\.claude/hooks/[a-zA-Z0-9._-]+\\.sh") | not) or
+            ((.command // "") | test("\\.claude/hooks/(" + $presentre + ")\\.sh"))
           ))) as $bhookslist |
           if ($bhookslist | length) == 0 then .
           elif any(.hooks[$event][]; (.matcher // "") == $bmatcher) then

package/dist/lite/standards/lite-manifest.json

@@ -1,7 +1,7 @@
 {
   "tier": "lite",
-  "manifest_version": "1.11.1",
-  "generated_at": "2026-09-25T15:57:21Z",
+  "manifest_version": "1.11.2",
+  "generated_at": "2026-09-26T11:18:11Z",
   "entries": [
     {
       "slug": "029-release-pipeline",
@@ -736,7 +736,7 @@
       "type": "lib",
       "path": "lib/bassclef-dir-resolver.sh",
       "tier": "lite",
-      "content_hash": "sha256:10d42c54a64415f7e9b4f2a6701d57ffc89cc9d59ec0fec9ddc2af3c178855a2",
+      "content_hash": "sha256:7b0f95e282983cca1edcf27083526edabc964e72cd0ef3596c7c8df915e24f92",
       "description": "bassclef-dir-resolver.sh — resolve BASSCLEF_DIR across install layouts."
     },
     {
@@ -1303,7 +1303,7 @@
       "type": "presence-template",
       "path": "presence/install/bassclef-hook-connect.sh",
       "tier": "lite",
-      "content_hash": "sha256:7ac3148028a5f2fd1ca35b84812c664d2ff10b475026f278c78c490f6b12fa21",
+      "content_hash": "sha256:a50c3ca715f4f786e2bcbbd804923711f34fe29924aa7a487808934612993ec6",
       "description": "description: Dynamic-derive hook connect — closes bassclef-upstream#625."
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thebassclef/lite",
-  "version": "1.9.3",
+  "version": "1.9.4",
   "description": "Bassclef CLI — install and upgrade bassclef in your project with two commands.",
   "keywords": [
     "bassclef",