@windyroad/itil 0.35.8 → 0.35.9-preview.396

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -484,5 +484,5 @@
484
484
  }
485
485
  },
486
486
  "name": "wr-itil",
487
- "version": "0.35.8"
487
+ "version": "0.35.9"
488
488
  }
@@ -102,9 +102,15 @@ TRAPPED_SLUG=$(detect_changeset_required 2>/dev/null) && exit 0
102
102
 
103
103
  # Trap detected — emit deny with terse recovery.
104
104
  # Voice-tone budget per ADR-045 deny-band ≤300 bytes total. Names the
105
- # plugin slug, the literal recovery command (`bun run changeset`), the
106
- # BYPASS env var escape, and the P141 cite.
107
- REASON="BLOCKED: P141 changeset discipline. packages/${TRAPPED_SLUG}/ source needs .changeset/*.md. Recovery: bun run changeset. Bypass: BYPASS_CHANGESET_GATE=1."
105
+ # plugin slug, the literal in-flight recovery command (`bun run
106
+ # changeset` staging ANY changeset satisfies the gate), and the P141
107
+ # cite. P173: the deny no longer advertises BYPASS_CHANGESET_GATE=1 as an
108
+ # in-flight escape — that env var only takes effect when set in Claude
109
+ # Code's process env BEFORE the session started; a mid-session Bash
110
+ # export/inline assignment never reaches the hook process. The deny
111
+ # states the bypass is pre-session-only so maintainers stop wasting a
112
+ # turn trying it mid-session (the original P173 cost).
113
+ REASON="BLOCKED: P141 changeset discipline. packages/${TRAPPED_SLUG}/ source needs .changeset/*.md. Recovery: bun run changeset. Env bypass is pre-session only."
108
114
 
109
115
  cat <<EOF
110
116
  {
@@ -101,6 +101,19 @@ run_bash_hook() {
101
101
  [ "${#output}" -lt 300 ]
102
102
  }
103
103
 
104
+ # P173: the deny must NOT advertise the env bypass as an in-flight escape.
105
+ # BYPASS_CHANGESET_GATE only takes effect when set in Claude Code's process
106
+ # env before the session started; a mid-session Bash `export`/inline assignment
107
+ # never reaches the hook. The deny clarifies the bypass is pre-session.
108
+ @test "P173 deny message clarifies the env bypass is pre-session (not a mid-session action)" {
109
+ echo "skill body" > packages/itil/skills/foo/SKILL.md
110
+ git add packages/itil/skills/foo/SKILL.md
111
+ run run_bash_hook "git commit -m 'feat'"
112
+ [ "$status" -eq 0 ]
113
+ [[ "$output" == *"\"permissionDecision\": \"deny\""* ]]
114
+ [[ "$output" == *"pre-session"* ]]
115
+ }
116
+
104
117
  # --- Allow paths: each non-trap shape must NOT deny ---
105
118
 
106
119
  @test "allow: staged packages/<plugin>/ source WITH a staged changeset allows the commit" {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@windyroad/itil",
3
- "version": "0.35.8",
3
+ "version": "0.35.9-preview.396",
4
4
  "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
5
5
  "bin": {
6
6
  "windyroad-itil": "./bin/install.mjs"