create-agentic-workspace 0.17.0 → 0.17.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.17.0",
+    "plugin_version": "1.17.1",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.17.0",
+  "generated_for_plugin_version": "1.17.1",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",

package/src/amendmentsBackfill.mjs

@@ -14,6 +14,7 @@
 // never written), atomic writes, and a plan/apply split so `--dry-run` prints the same row.
 import fs from 'node:fs';
 import path from 'node:path';
+import { confinedJoin } from './util.mjs';
 
 export const NORMATIVE_CLOSE = '<!-- /normative -->';
 export const AMENDMENTS_HEADING = '## Amendments';
@@ -22,7 +23,10 @@ export const AMENDMENTS_HEADING = '## Amendments';
  * "...\n\n" gets the heading directly. Header columns are `foundry-amend.py`'s own row shape. */
 export const AMENDMENTS_BLOCK = `${AMENDMENTS_HEADING}\n\n| date | what changed | why reality required it | auth_seq |\n|---|---|---|---|\n`;
 
-const SPEC_BASENAME_RE = /^feat-.*\.md$/;
+// ER #223 (v1.17.1): EVERY `*.md` under specs/, not only `feat-*.md` — foundry-amend.py has no
+// filename rule (it classifies by the normative region), and an adopter's delivery atoms are named
+// `spec-*.md`. A README or template without a normative region lands in `skipped`, never written.
+const SPEC_BASENAME_RE = /\.md$/;
 const CODE_FENCE_RE = /```[\s\S]*?```/g;
 
 /** The verdict `foundry-amend.py`'s amendments_section_ok gives: `present` when a `## Amendments`
@@ -42,15 +46,19 @@ export function classifySpec(text) {
   return 'absent';
 }
 
-/** Every regular `feat-*.md` under `<root>/specs`, depth-first, with symlinked FILES reported
+/** Every regular `*.md` under `<root>/specs` (any basename — ER #223), depth-first, with symlinked FILES reported
  * separately (never followed, never written — AC-AMB-2) and symlinked DIRECTORIES not descended
  * (the same confinement instinct as the scaffold's confinedJoin: nothing outside the workspace
  * root is ever touched). Absent `specs/` yields an empty walk, not an error. */
 export function walkSpecs(physicalRoot) {
-  const specsRoot = path.join(physicalRoot, 'specs');
   const files = [];
   const symlinks = [];
-  if (!fs.existsSync(specsRoot)) return { files, symlinks };
+  // v1.17.1 security review Risk 1: the ROOT is confined like every entry under it — a `specs`
+  // that is itself a symlink (or resolves outside the workspace) is never descended, never written.
+  const specsRoot = confinedJoin(physicalRoot, 'specs');
+  if (!specsRoot) return { files, symlinks };
+  const rootStat = fs.lstatSync(specsRoot, { throwIfNoEntry: false });
+  if (!rootStat || rootStat.isSymbolicLink() || !rootStat.isDirectory()) return { files, symlinks };
   const stack = [specsRoot];
   while (stack.length > 0) {
     const dir = stack.pop();
@@ -120,8 +128,19 @@ export function applyAmendmentsBackfill(plan) {
     }
     if (classifySpec(text) !== 'absent') continue;
     const tmp = `${abs}.amendments-backfill.tmp`;
-    fs.writeFileSync(tmp, text + appendBytesFor(text), 'utf-8');
-    fs.renameSync(tmp, abs);
+    // v1.17.1 security review Risk 2: `wx` refuses to write through a planted sibling — a symlink
+    // or a leftover file at the temp path means this spec is skipped, never written elsewhere.
+    try {
+      fs.writeFileSync(tmp, text + appendBytesFor(text), { encoding: 'utf-8', flag: 'wx' });
+    } catch {
+      continue;
+    }
+    try {
+      fs.renameSync(tmp, abs);
+    } catch {
+      fs.rmSync(tmp, { force: true });
+      continue;
+    }
     written += 1;
   }
   plan.applied = true;

package/src/update.mjs

@@ -16,7 +16,7 @@ import {
 } from './floorReconcile.mjs';
 import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from './gitignoreReconcile.mjs';
 import { planAmendmentsBackfill, applyAmendmentsBackfill, renderAmendmentsRow } from './amendmentsBackfill.mjs';
-import { buildUpgradeReport, writeUpgradeReport, NEXT_LINE } from './upgradeReport.mjs';
+import { buildUpgradeReport, writeUpgradeReport, installedVersionBefore, NEXT_LINE } from './upgradeReport.mjs';
 import { planStatuslineWiring, applyStatuslineWiring, renderStatuslineRows, statuslineChanged } from './statuslineWiring.mjs';
 import {
   ALLOWED_CLAUDE_SUBCOMMANDS, resolveClaudeOnPath, runClaude,
@@ -124,6 +124,8 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
 
     const registry = readInstalledPluginsRegistry(configDir);
     const isInstalled = isInstalledInScopeFactory(registry, pluginKey, cwd);
+    // ER #222: the report's `from` is what THIS workspace had installed, read before any mutation.
+    const installedBefore = installedVersionBefore(registry, pluginKey, cwd);
 
     const migrations = [];
     const indeterminateInstalledness = [];
@@ -336,7 +338,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // completed run (overwritten — a report, not a managed file; `.foundry/*` is gitignored), and
     // named in the LAST line so the operator's next step is never a guess.
     const report = buildUpgradeReport({
-      beforeEntry, afterEntry, toPluginVersion: pins.plugin_version, phases, filePlan, amendmentsPlan,
+      installedBefore, afterEntry, toPluginVersion: pins.plugin_version, phases, filePlan, amendmentsPlan,
     });
     const reportPath = writeUpgradeReport(physicalRoot, report);
     print('');

package/src/upgradeReport.mjs

@@ -11,6 +11,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { confinedJoin } from './util.mjs';
+import { scopeRecordsFor } from './pluginRefresh.mjs';
 
 export const REPORT_REL = '.foundry/upgrade-report.json';
 export const REPORT_SCHEMA_VERSION = 1;
@@ -24,19 +25,22 @@ export function versionOrNull(v) {
   return typeof v === 'string' && v.length <= 64 && VERSION_RE.test(v) ? v : null;
 }
 
-/** Pure: assemble the report object. `beforeEntry`/`afterEntry` are the marketplace manifest's
- * plugin entries around the refresh (either may be null); `filePlan` is the managed-file plan;
+/** Pure: assemble the report object. `installedBefore` is this workspace's installed version from
+ * `installedVersionBefore` (or null); `afterEntry` is the marketplace manifest's plugin entry after
+ * the refresh (or null); `filePlan` is the managed-file plan;
  * `amendmentsPlan` is the applied backfill plan (or null); `phases` is what renderSummary got. */
 export function buildUpgradeReport({
-  beforeEntry, afterEntry, toPluginVersion, phases, filePlan, amendmentsPlan, now = new Date(),
+  installedBefore = null, afterEntry, toPluginVersion, phases, filePlan, amendmentsPlan, now = new Date(),
 }) {
   const seedRow = (filePlan || []).find((f) => f.seed);
   return {
     schema_version: REPORT_SCHEMA_VERSION,
     ran_at: now.toISOString(),
-    // null when no manifest was readable before the refresh (a first install) — the skill then
-    // lists only the current version's CHANGELOG section (AC-PUS-1, Out of scope).
-    from_plugin_version: beforeEntry ? versionOrNull(beforeEntry.version) : null,
+    // ER #222 (v1.17.1): THIS workspace's installed version from installed_plugins.json, captured
+    // before any mutation — never the marketplace clone's advertised version, which is per machine
+    // and already moved by the time Phase 1 reads it. null (no record, unreadable registry, a
+    // first install) makes the skill list only the current version's CHANGELOG section.
+    from_plugin_version: versionOrNull(installedBefore),
     to_plugin_version: (afterEntry && versionOrNull(afterEntry.version)) || versionOrNull(toPluginVersion),
     phases: (phases || []).map((p) => ({ name: p.name, verdict: p.verdict, ...(p.reason ? { reason: p.reason } : {}) })),
     amendments: amendmentsPlan
@@ -47,6 +51,18 @@ export function buildUpgradeReport({
   };
 }
 
+/** The version THIS workspace had installed before the run (ER #222): the project-scope record
+ * whose `projectPath` is `cwd`, else the user-scope record (no `projectPath`), else null. Reads the
+ * registry object `readInstalledPluginsRegistry` returns; `ok: false` is null, never a guess. */
+export function installedVersionBefore(registry, pluginKey, cwd) {
+  if (!registry || !registry.ok) return null;
+  const records = scopeRecordsFor(registry.doc, pluginKey).filter((r) => r && typeof r === 'object');
+  const project = records.find((r) => r.projectPath && path.resolve(String(r.projectPath)) === path.resolve(cwd));
+  const user = records.find((r) => !r.projectPath);
+  const hit = project || user;
+  return hit ? versionOrNull(hit.version) : null;
+}
+
 /** Write the report under the workspace root, creating `.foundry/` if needed. Overwrites.
  * Confined the way every other Phase-4 writer is (PR #218 security review, Risk 4): the target is
  * joined through `confinedJoin`, a `.foundry` that is a symlink or a leaf that is not a regular