arcane-cli 0.33.0 → 0.33.2

package/dist/assets/.arcane/governance/portable-bootstrap.md

@@ -54,7 +54,7 @@ Paste this entire file into any AI client (Claude web, ChatGPT, etc.) to give it
 - **Framework-managed standards:** `.arcane/governance/`. Spells reference this single installed layer; **do not create a duplicate root `governance/` tree. Enforcement: explicitly advisory prose (ARC-023) — no check scans a repo for a duplicate root-level `governance/` directory.**
 - **Project-owned orientation and continuity:** `README.md`, `project.md`, `TODO.md`, `DECISIONS.md`, `ai-context/`, and `journal/`. Arcane creates missing files once and preserves existing content.
 - **Project/domain documents:** use explicit descriptive paths such as `docs/`, `security/`, `infrastructure/`, or a configured business root. These add project context alongside framework standards.
-- **Overrides are not yet supported:** editing a managed `.arcane/governance/` standard can be replaced by `arcane update`. Additive project documents are safe; **overriding a shipped standard requires the open customization/override model. Enforcement: explicitly advisory prose (ARC-023) — that model is still an open backlog item (not yet built), so nothing currently blocks a direct edit; `arcane update` will just overwrite it silently on the next run.**
+- **Overrides survive `arcane update`:** editing a managed `.arcane/governance/` standard no longer risks silent loss. Additive project documents were always safe; a hand-edit to a shipped standard now is too. **Enforcement: executable check (ARC-038, shipped BC-31)** — `spell update` compares each file's on-disk content against its recorded hash at install time: unchanged, it refreshes normally; edited, it fetches the exact previously-installed published version as a three-way merge base against your edit and the new vendor content, auto-merging non-overlapping changes and leaving standard conflict markers only on genuine collisions. If the prior published version can't be fetched, your edit is left untouched with a warning rather than replaced.
 
 ## Research Reports
 

package/dist/assets/.github/instructions/agent-output.instructions.md

@@ -61,8 +61,8 @@ stale number is invisible until someone tries.
 - **Spell prompts and instructions this framework ships**
   (`.github/prompts/*.prompt.md`, `.github/instructions/*.md`): **plain text only —
   cite the bare ID, no link at all** (`ARC-035`, not `[ARC-035](...)`). A full
-  canonical URL is *also* unsafe here, not just a same-repo link: it bakes
-  `github.com/codemagicianhq/arcane` — this project's own org and repo name — into
+  canonical URL is *also* unsafe here, not just a same-repo link: it bakes a literal
+  `github.com/{GITHUB_ORG}/{REPO_NAME}` — this project's own org and repo name — into
   content the org-token portability gate (`scripts/org-token-lint.ts`, D2 in
   `spell-authoring-standards.md`) exists specifically to keep out of distributed
   spells. **Confirmed live 2026-08-31 (BC-06):** the build's `Org-token lint` failed
@@ -90,8 +90,8 @@ missing one. The first fix replaced it with a same-repo wiki-link to this repo's
 `DECISIONS.md` — itself the exact cross-repo defect this section warns about
 (`DECISIONS.md` doesn't ship). The second fix replaced that with a full canonical
 URL, which held up locally but failed the build's org-token portability gate: a
-`github.com/codemagicianhq/arcane` URL bakes this project's own org into a file the
-gate treats as distributed content (see Doc-ID Link Format above). Settled on the
+literal `github.com/{GITHUB_ORG}/{REPO_NAME}` URL bakes this project's own org into a
+file the gate treats as distributed content (see Doc-ID Link Format above). Settled on the
 bare ID — the gate's own documented safe form.
 
 When completing a PR via `az repos pr update`, do **not** pass `--squash true`. The correct command:

package/dist/index.js

@@ -2287,6 +2287,29 @@ async function isHookInstalled(cwd, hookName, body) {
 async function isHookEnforced(cwd) {
   return isHookInstalled(cwd, "pre-push", PRE_PUSH_HOOK_BODY);
 }
+var CLOSED_PR_WARNING_HOOK_BODY = `#!/bin/sh
+# Installed by Arcane (ARC-035 decision 4): warns when the branch being
+# pushed already has a closed or merged PR, instead of accepting the push
+# into a void with no signal at all. Never blocks -- pushing to a branch
+# behind a closed PR is sometimes intentional.
+remote_url="$2"
+case "$remote_url" in
+  *github.com*) ;;
+  *) exit 0 ;;
+esac
+command -v gh >/dev/null 2>&1 || exit 0
+branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null) || exit 0
+state=$(gh pr view "$branch" --json state --jq .state 2>/dev/null) || exit 0
+case "$state" in
+  CLOSED|MERGED)
+    echo "arcane: WARNING -- the PR for branch '$branch' is already $state. Pushing anyway (not blocked)." >&2
+    ;;
+esac
+exit 0
+`;
+async function installClosedPrWarningHook(cwd) {
+  return installHook(cwd, "pre-push", CLOSED_PR_WARNING_HOOK_BODY);
+}
 async function defaultHooks(cwd) {
   let hooksDir;
   try {
@@ -2980,6 +3003,15 @@ async function runInit(options, targetDir, assetsDir, packageVersion) {
       );
     }
   }
+  if (push_policy !== "blocked") {
+    try {
+      const hook = await installClosedPrWarningHook(targetDir);
+      if (hook.status === "installed") {
+        printInfo("Installed a pre-push hook that warns when the current branch's PR is already closed or merged.");
+      }
+    } catch {
+    }
+  }
   try {
     const hook = await installSecretsPrecommitHook(targetDir);
     if (hook.status === "installed") {