baldart 3.28.0 → 3.28.1

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to BALDART will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.28.1] - 2026-05-28
+
+Patch su tre drift segnalati dal curator dopo v3.28.0 install in `mayo`:
+(1) `--yes` non si propaga da `update --reset` al child `baldart add`,
+(2) errore "Configuring alias is not permitted without enabling allowUnsafeAlias" stampato come install-failed mentre l'install era OK,
+(3) due template `ui-guidelines.template.md` + `brand-guidelines.md` lasciati untracked senza istruzioni chiare all'utente. Tutti e tre cosmetici/UX, nessuno affecta la correctness del framework installato — ma confondono l'utente durante il post-install.
+
+### Fixed — `baldart add` honors `--yes` from parent caller
+
+- **[src/commands/add.js](src/commands/add.js)** + **[src/commands/update.js:237](src/commands/update.js)**: `add(repo, options)` ora legge `options.yes` e auto-conferma i prompt non-distruttivi (`Install framework?`, `Configure git aliases?`, `Configure project context now?`). Il prompt distruttivo `Remove and reinstall?` resta interattivo anche con `--yes` (safety). `update --reset` ora invoca correttamente `addCmd(undefined, { yes: true })` — prima passava `{ yes: true }` come **primo argomento** (cioè `repo`), facendo `options` undefined e ogni prompt scattava.
+
+### Fixed — Git alias config failure non più mascherato da install-failure
+
+- **[src/commands/add.js](src/commands/add.js)**: la configurazione degli alias `fw-version`/`fw-update`/`fw-push` passa da `git.git.addConfig()` (simple-git, che rifiuta i bang-alias senza `allowUnsafeAlias`) a `spawnSync('git', ['config', key, value])` diretto. Il bypass del check simple-git è esplicito qui: l'utente sta opt-in agli alias durante l'install. Failure isolato per alias (non bubble-up al catch globale), reported come WARNING se non-zero count, install continua. Il messaggio "✗ Installation failed: Configuring alias is not permitted…" non appare più.
+
+### Fixed — Template editable post-install: istruzioni chiare
+
+- **[src/commands/add.js](src/commands/add.js)** NEXT STEPS box: i due template `docs/references/ui-guidelines.template.md` e `docs/references/brand-guidelines.md`, copiati incondizionatamente durante `copyCustomizableFiles()`, ora sono elencati esplicitamente con cosa farne (rename / edit / delete) e con il punto chiave: "Commit them to track your project's design language, or add them to .gitignore if you don't need them." Evita la confusione del curator durante v3.28.0 install ("non chiari se debbano essere scelti/scartati dall'utente o committati. Non c'è prompt che lo chieda").
+
 ## [3.28.0] - 2026-05-28
 
 Tre additions indipendenti accumulate nel working tree e pronte per il rilascio: convenzione testuale per le dipendenze MCP, supporto `.zip` per il mockup intake del PRD, e nuovo hook `capture-detect` come parte del proactive mode dello skill `/capture` (registrazione opt-in, non auto-attivata). Tre temi distinti ma raggruppati in un'unica release di accumulo perché tutti additive e zero-schema-change.

package/VERSION

@@ -1 +1 @@
-3.28.0
+3.28.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baldart",
-  "version": "3.28.0",
+  "version": "3.28.1",
   "description": "Claude Agent Framework - Reusable framework for coordinating AI agents and humans in software projects",
   "bin": {
     "baldart": "./bin/baldart.js"

package/src/commands/add.js

@@ -7,6 +7,13 @@ const Hooks = require('../utils/hooks');
 async function add(repo, options) {
   const git = new GitUtils();
   const symlinks = new SymlinkUtils();
+  // Non-interactive flag honored on non-destructive prompts only. The
+  // "Remove and reinstall?" prompt (line 40) stays interactive even with
+  // --yes — that path requires explicit user intent, not flag inheritance.
+  // Callers that have already established intent (e.g. `update --reset`)
+  // rm -rf `.framework/` themselves, so `git.frameworkExists()` is false
+  // here and the destructive prompt is never reached.
+  const nonInteractive = options && options.yes === true;
 
   try {
     // Step 1: Verify environment
@@ -70,7 +77,9 @@ async function add(repo, options) {
       'Templates copied for customization'
     ]);
 
-    const proceed = await UI.confirm('Install framework?', true);
+    const proceed = nonInteractive
+      ? true
+      : await UI.confirm('Install framework?', true);
     if (!proceed) {
       UI.info('Installation cancelled');
       process.exit(0);
@@ -157,13 +166,39 @@ async function add(repo, options) {
     // Configure Git aliases
     UI.section('Configuring Git Aliases');
 
-    const configureAliases = await UI.confirm('Configure git aliases (fw-version, fw-update, fw-push)?', true);
+    const configureAliases = nonInteractive
+      ? true
+      : await UI.confirm('Configure git aliases (fw-version, fw-update, fw-push)?', true);
 
     if (configureAliases) {
-      await git.git.addConfig('alias.fw-version', '!cat .framework/VERSION');
-      await git.git.addConfig('alias.fw-update', '!npx github:antbald/BALDART update');
-      await git.git.addConfig('alias.fw-push', '!npx github:antbald/BALDART push');
-      UI.success('Git aliases configured');
+      // simple-git >=3.21 rejects shell-command aliases (prefix `!`) unless
+      // `allowUnsafeAlias` is set in its constructor — and even that is
+      // version-gated. Spawning `git config` directly bypasses the safety
+      // check (which is a simple-git policy, not a git policy: the user is
+      // explicitly opting in to these aliases here). Any failure here is
+      // cosmetic (the framework is fully installed without aliases), so we
+      // warn and continue instead of bubbling up to the global catch — that
+      // surfaced as "✗ Installation failed: Configuring alias is not
+      // permitted without enabling allowUnsafeAlias" while the install was
+      // actually fine.
+      const { spawnSync } = require('child_process');
+      const aliases = [
+        ['alias.fw-version', '!cat .framework/VERSION'],
+        ['alias.fw-update', '!npx baldart update'],
+        ['alias.fw-push', '!npx baldart push'],
+      ];
+      let aliasFailures = 0;
+      for (const [key, value] of aliases) {
+        const r = spawnSync('git', ['config', key, value], { stdio: 'pipe' });
+        if (r.status !== 0) {
+          aliasFailures += 1;
+        }
+      }
+      if (aliasFailures === 0) {
+        UI.success('Git aliases configured');
+      } else {
+        UI.warning(`${aliasFailures}/${aliases.length} git alias(es) could not be configured (non-blocking — install continues).`);
+      }
     }
 
     // BALDART hooks (multi-hook registry since v3.18.0)
@@ -201,10 +236,12 @@ async function add(repo, options) {
     // Skills now resolve project-specific facts from baldart.config.yml
     // instead of hard-coding paths. Configure prompts for these on install.
     UI.newline();
-    const runConfigure = await UI.confirm(
-      'Configure project context now (paths, identity, stack, feature flags)?',
-      true
-    );
+    const runConfigure = nonInteractive
+      ? true
+      : await UI.confirm(
+          'Configure project context now (paths, identity, stack, feature flags)?',
+          true
+        );
     if (runConfigure) {
       try {
         const configureCmd = require('./configure');
@@ -226,9 +263,13 @@ async function add(repo, options) {
       '   • Rename to lint-before-commit.sh',
       '   • Make executable: chmod +x .claude/hooks/lint-before-commit.sh',
       '',
-      '2. Customize UI guidelines:',
-      '   • Edit docs/references/ui-guidelines.template.md',
-      '   • Define colors, typography, spacing',
+      '2. Two editable templates landed at docs/references/ (untracked):',
+      '   • ui-guidelines.template.md  — UI design language template.',
+      '     Edit and rename to ui-guidelines.md if you adopt it.',
+      '   • brand-guidelines.md        — Brand voice & visual identity.',
+      '     Edit to taste, or delete if your project does not need one.',
+      '   These are starting points. Commit them to track your project\'s',
+      '   design language, or add them to .gitignore if you don\'t need them.',
       '',
       '3. Create backlog cards:',
       '   • Copy templates/feature-card.template.yml',

package/src/commands/update.js

@@ -234,7 +234,12 @@ async function runReset(git, options, autoYes) {
   UI.newline();
   UI.info('Re-installing framework via `baldart add`…');
   const addCmd = require('./add');
-  await addCmd({ yes: true });
+  // `add(repo, options)` — first arg is the repo URL (undefined → use default
+  // from package.json). Pre-v3.28.1 we incorrectly passed `{ yes: true }` as
+  // the first arg, so `options` was undefined and every interactive prompt
+  // ("Install framework?", "Configure git aliases?", …) fired despite the
+  // parent `update --reset --yes --i-know` having already established intent.
+  await addCmd(undefined, { yes: true });
 
   // Post-restore sanity check — confirm nothing user-owned got clobbered.
   const stillPresent = {