create-agentic-workspace 0.17.1 → 0.17.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.17.1",
+    "plugin_version": "1.17.3",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.17.1",
+  "generated_for_plugin_version": "1.17.3",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",

package/src/floorReconcile.mjs

@@ -213,6 +213,45 @@ export function parseFloorRootShape(rule, pluginRootGlob) {
   return { name: m[1], sub: m[2] ?? null };
 }
 
+/** The floor's root-glob shape with every `*` segment of the glob allowed to be a CONCRETE
+ * segment instead (`cache/agentic-foundry/foundry/1.9.1/scripts/<name>[ <sub>]:*`) — the shape an
+ * init before installer-unpinning (v1.7.0) wrote, with the marketplace directory and the plugin
+ * version spelled out. hotfix-v1.17.3: such rows are stale by construction (the floor has written
+ * only version-wildcarded rows since; the wildcard row the reconcile adds in the same pass covers
+ * the script), and because they never matched the exact-shape regex above, nothing ever retired
+ * them — an adopter carried `1.9.1` allow rows across eight releases. `*` in the glob becomes
+ * `([^/]+)`; a row whose captured segments are ALL literal `*` is the exact shape (handled above),
+ * so this parser reports `pinned: true` only when at least one segment is concrete. */
+function floorPinnedShapeRe(pluginRootGlob) {
+  // PR #233 security review Risk 2: every `*` but the last (the marketplace directory) may be a
+  // plain name (no dots — so `..` and an operator's partial glob like `1.*` never qualify) or the
+  // literal `*`; the LAST `*` (the plugin version) may be a semver-shaped segment or `*`. A rule
+  // from a foreign marketplace still matches by shape (the name is not the floor's to know here),
+  // but only for the tiers and conditions planRetirements allows.
+  const stars = (pluginRootGlob.match(/\*/g) || []).length;
+  let seen = 0;
+  const src = escapeLiteral(pluginRootGlob).replace(/\\\*/g, () => {
+    seen += 1;
+    return seen === stars ? '(\\*|\\d+\\.\\d+\\.\\d+[A-Za-z0-9.+-]*)' : '(\\*|[A-Za-z0-9_-]+)';
+  });
+  return new RegExp(`^Bash\\(${src}/scripts/(${ROOT_SHAPE_NAME_RE})(?: (.+))?:\\*\\)$`);
+}
+
+/** Parse `rule` as a version-/marketplace-PINNED variant of the floor's own row shape. Returns
+ * `{ name, sub, pinned: true }` when at least one glob segment is concrete in the row, `null` for
+ * the exact wildcard shape (parseFloorRootShape's business) and for every other shape. Exported for
+ * the fixture tests. */
+export function parseFloorPinnedShape(rule, pluginRootGlob) {
+  if (typeof pluginRootGlob !== 'string' || pluginRootGlob === '') return null;
+  const stars = (pluginRootGlob.match(/\*/g) || []).length;
+  if (stars === 0) return null;
+  const m = floorPinnedShapeRe(pluginRootGlob).exec(rule);
+  if (!m) return null;
+  const segs = m.slice(1, 1 + stars);
+  if (segs.every((x) => x === '*')) return null;
+  return { name: m[1 + stars], sub: m[2 + stars] ?? null, pinned: true };
+}
+
 /** A collision-free key for the `(name, sub)` pair — `JSON.stringify` of a 2-tuple rather than a
  * string concatenation with a hand-picked separator, which a `sub` containing that exact separator
  * (an unlikely but not-impossible flag value) could otherwise fold into a DIFFERENT pair's key. */
@@ -241,13 +280,34 @@ function shippedRootNames(map) {
  * `{ retirements: { allow: [...], ask: [...] }, total }`. */
 export function planRetirements({ settingsObj, map }) {
   const shipped = shippedRootNames(map);
+  const shippedAsk = new Set();
+  for (const e of map.entries) {
+    if (e.tier !== 'ask') continue;
+    const parsed = parseFloorRootShape(e.rule, map.plugin_root_glob);
+    if (parsed) shippedAsk.add(rootNameKey(parsed));
+  }
   const retirements = { allow: [], ask: [] };
   const perms = (settingsObj && settingsObj.permissions) || {};
   for (const tier of ['allow', 'ask']) {
     for (const rule of perms[tier] || []) {
       const parsed = parseFloorRootShape(rule, map.plugin_root_glob);
-      if (!parsed) continue; // not the floor's own shape at all -> never touched (AC-FRR-2)
-      if (!shipped.has(rootNameKey(parsed))) retirements[tier].push(rule);
+      if (parsed) {
+        if (!shipped.has(rootNameKey(parsed))) retirements[tier].push(rule);
+        continue;
+      }
+      // hotfix-v1.17.3: a version-/marketplace-pinned variant of the floor's own shape. An `allow`
+      // row is retired whether or not the script still ships — the wildcard row covers a shipped
+      // script (added in this same pass when absent), and a pinned row for a gone script is exactly
+      // the ER #199 class. An `ask` row is retired ONLY when the shipped map declares the same
+      // (name, sub) at `ask`, so the wildcard `ask` row replaces it (PR #233 security review Risk 1:
+      // `ask` beats `allow`, so dropping an ask row under a broader allow would turn a prompt into a
+      // silent grant — a widening this pass must never perform).
+      const pinned = parseFloorPinnedShape(rule, map.plugin_root_glob);
+      if (pinned) {
+        if (tier === 'allow') retirements[tier].push(rule);
+        else if (shippedAsk.has(rootNameKey(pinned))) retirements[tier].push(rule);
+      }
+      // any other shape -> never touched (AC-FRR-2)
     }
   }
   const total = retirements.allow.length + retirements.ask.length;

package/src/permissionFloor.mjs

@@ -4,6 +4,7 @@
 // (AC-BCL-8). `covers()` agrees with tests/test_permission_floor_map.py::_subsumes on the shared
 // 8-row table by construction (same prefix-subsumption rule).
 import fs from 'node:fs';
+import { SELF_GUARD_DENY } from './selfGuardDeny.mjs';
 import os from 'node:os';
 
 /** The one map schema_version this build understands. A map declaring anything else is refused
@@ -214,6 +215,10 @@ export function buildSettings(map, pins) {
   for (const e of map.entries) {
     byTier[e.tier].push(e.rule);
   }
+  // hotfix-v1.17.3: the policy file's own self-guard pair rides with the floor on the create path
+  // (the scaffold seeds .foundry/permissions.yaml in the same run), so a fresh workspace is in-sync
+  // instead of `policy drift (2)` until someone runs the compiler.
+  for (const r of SELF_GUARD_DENY) if (!byTier.deny.includes(r)) byTier.deny.push(r);
   // THE PINNED LITERAL — SUPERSEDED (feat-foundry-installer-unpinning, AC-IUP-3). This block used
   // to read (AC-BCL-4(b), contract v1.2 — PR #61 security review Block 1), verbatim:
   //

package/src/run.mjs

@@ -20,6 +20,7 @@ import {
 import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from './gitignoreReconcile.mjs';
 import { planAmendmentsBackfill, applyAmendmentsBackfill, renderAmendmentsRow } from './amendmentsBackfill.mjs';
 import { planStatuslineWiring, applyStatuslineWiring, renderStatuslineRows } from './statuslineWiring.mjs';
+import { policyPresent, missingSelfGuardDeny, applySelfGuardDeny, renderSelfGuardRow, selfGuardShapeOk } from './selfGuardDeny.mjs';
 
 export { DECLARED_PATH_SET };
 
@@ -253,8 +254,18 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // permission floor unattended; --yes must be given EXPLICITLY. This sits above applyPlan
     // deliberately — a "refused" verdict printed after the scaffold write had already landed reads
     // as "nothing happened", which is the one thing it must not mean.
+    // hotfix-v1.17.3 (PR #233 review Risk 4): the self-guard pair is previewed here and counts as
+    // floor work, so a piped run cannot write it without an explicit --yes and --dry-run names it.
+    let selfGuardPreview = { missing: [], shapeOk: true };
+    if (answers.reconcileFloor && floorTarget && floorTarget.present && policyPresent(physicalRoot)) {
+      const cur0 = readTarget(floorTarget.path);
+      selfGuardPreview = { missing: missingSelfGuardDeny(cur0), shapeOk: selfGuardShapeOk(cur0) };
+      const prow = renderSelfGuardRow(physicalRoot, selfGuardPreview.missing.length, { shapeOk: selfGuardPreview.shapeOk, applied: false });
+      if (prow) print(prow);
+    }
     const floorHasWork = Boolean(floorPlan)
-      && (floorPlan.total > 0 || (floorRetirementPlan && floorRetirementPlan.total > 0));
+      && (floorPlan.total > 0 || (floorRetirementPlan && floorRetirementPlan.total > 0)
+          || selfGuardPreview.missing.length > 0);
     if (floorHasWork && !isTTY && answers.yes !== true) {
       throw new RefusalError(
         'refusing --reconcile-floor without a terminal: pass --yes explicitly to confirm the write',
@@ -297,6 +308,17 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
         applied: true, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
       })) print(line);
     }
+    // hotfix-v1.17.3 (ER #232): under --reconcile-floor (the one opt-in that permits a narrow
+    // settings write on --existing), converge the policy file's self-guard deny pair, fresh from
+    // disk after the floor write, whenever a policy file exists.
+    if (answers.reconcileFloor && floorTarget && floorTarget.present && policyPresent(physicalRoot)) {
+      const cur = readTarget(floorTarget.path);
+      const shapeOk = selfGuardShapeOk(cur);
+      const missing = missingSelfGuardDeny(cur);
+      if (shapeOk && missing.length > 0) writeTargetAtomically(floorTarget.path, applySelfGuardDeny(cur));
+      const row = renderSelfGuardRow(physicalRoot, missing.length, { shapeOk });
+      if (row) print(row);
+    }
     // AFTER the floor write above: that write serialises a settings object read before this
     // point, so wiring the statusLine keys first would have been overwritten by it. The wiring
     // re-reads settings.json itself and adds only the absent keys (AC-SLW-2).

package/src/selfGuardDeny.mjs

@@ -0,0 +1,75 @@
+// selfGuardDeny.mjs — the two framework-owned deny rules that protect the operator's policy file
+// (hotfix-v1.17.3, ER #232): `Edit(.foundry/permissions.yaml)` and `Write(.foundry/permissions.yaml)`.
+//
+// They are what `scripts/foundry-permissions-compile.py --write` derives for a policy with ZERO grants
+// (its SELF_GUARD pair) — no operator judgement is in them, so every writer that seeds or keeps the
+// policy file converges them too, and a fresh seed is in-sync instead of `policy drift (2)` until
+// someone remembers the compiler. Grants stay the compiler's (operator-run) business.
+//
+// Discipline: add-if-absent onto `permissions.deny`, never reorder or remove anything, never touch
+// another key; a settings object without a `permissions` block gains one with only `deny`.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const POLICY_REL = '.foundry/permissions.yaml';
+export const SELF_GUARD_DENY = Object.freeze([
+  `Edit(${POLICY_REL})`,
+  `Write(${POLICY_REL})`,
+]);
+
+const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/** `true` when `settingsObj.permissions` is absent or a plain object whose `deny`, if present, is an
+ * array — the only shapes this module will write into. Anything else is refused rather than
+ * guessed (PR #233 security review Risk 3: a string `deny` would otherwise be spread into
+ * characters and written back). */
+export function selfGuardShapeOk(settingsObj) {
+  if (!isPlainObject(settingsObj)) return false;
+  const perms = settingsObj.permissions;
+  if (perms === undefined) return true;
+  if (!isPlainObject(perms)) return false;
+  return perms.deny === undefined || Array.isArray(perms.deny);
+}
+
+/** Which of the two rules `settingsObj` still lacks. Pure. Returns [] for a shape this module will
+ * not write into (see selfGuardShapeOk) — the caller reports that separately. */
+export function missingSelfGuardDeny(settingsObj) {
+  if (!selfGuardShapeOk(settingsObj)) return [];
+  const deny = (settingsObj.permissions && settingsObj.permissions.deny) || [];
+  return SELF_GUARD_DENY.filter((r) => !deny.includes(r));
+}
+
+/** A NEW settings object with the missing rules appended to `permissions.deny`. Pure; returns the
+ * input unchanged for a shape it will not write into. */
+export function applySelfGuardDeny(settingsObj) {
+  if (!selfGuardShapeOk(settingsObj)) return settingsObj;
+  const missing = missingSelfGuardDeny(settingsObj);
+  if (missing.length === 0) return settingsObj;
+  const next = { ...settingsObj };
+  next.permissions = { ...(next.permissions || {}) };
+  next.permissions.deny = [...(next.permissions.deny || []), ...missing];
+  return next;
+}
+
+/** `true` when the policy file exists as a regular file under `physicalRoot` (seeded or kept) — the
+ * rules guard a file, so they are written only when there is one. Never follows a symlink. */
+export function policyPresent(physicalRoot) {
+  try {
+    return fs.lstatSync(path.join(physicalRoot, POLICY_REL)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/** The one row every writer prints: `[permissions] self-guard deny rules added (N)` or
+ * `already present`. `null` when there is no policy file to guard (nothing to say). */
+export function renderSelfGuardRow(physicalRoot, addedCount, { shapeOk = true, applied = true } = {}) {
+  if (!policyPresent(physicalRoot)) return null;
+  if (!shapeOk) return '  [permissions] settings.permissions is not the shape expected (object with an array deny) — self-guard deny rules NOT written';
+  if (addedCount > 0) {
+    return applied
+      ? `  [permissions] self-guard deny rules added (${addedCount}): Edit/Write on ${POLICY_REL}`
+      : `  [permissions] would add self-guard deny rules (${addedCount}): Edit/Write on ${POLICY_REL}`;
+  }
+  return '  [permissions] self-guard deny rules already present';
+}

package/src/update.mjs

@@ -16,8 +16,9 @@ import {
 } from './floorReconcile.mjs';
 import { reconcileGitignorePlan, applyGitignorePlan, renderGitignoreRow } from './gitignoreReconcile.mjs';
 import { planAmendmentsBackfill, applyAmendmentsBackfill, renderAmendmentsRow } from './amendmentsBackfill.mjs';
-import { buildUpgradeReport, writeUpgradeReport, installedVersionBefore, NEXT_LINE } from './upgradeReport.mjs';
+import { buildUpgradeReport, writeUpgradeReport, installedVersionBefore, versionOrNull, NEXT_LINE } from './upgradeReport.mjs';
 import { planStatuslineWiring, applyStatuslineWiring, renderStatuslineRows, statuslineChanged } from './statuslineWiring.mjs';
+import { policyPresent, missingSelfGuardDeny, applySelfGuardDeny, renderSelfGuardRow, selfGuardShapeOk } from './selfGuardDeny.mjs';
 import {
   ALLOWED_CLAUDE_SUBCOMMANDS, resolveClaudeOnPath, runClaude,
   defaultScopes, snapshotScopes, classifyMigration, migrationActions, migrateScope,
@@ -72,7 +73,7 @@ function isInstalledInScopeFactory(registry, pluginKey, cwd) {
 /** Run the update command end to end. Never throws — every failure path is caught and turned into
  * a refusal-shaped exit 1 (or, for a bug, exit 1 with the error message), matching run.mjs's own
  * contract. */
-export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output, spawnEnv = process.env }) {
+export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output, spawnEnv = process.env, updaterVersion = null }) {
   const lines = [];
   const print = (s) => {
     lines.push(s);
@@ -103,7 +104,11 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
       return { exitCode: 0, output: lines.join('\n') };
     }
 
-    const pins = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf-8')).foundry;
+    const corePkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf-8'));
+    const pins = corePkg.foundry;
+    // ER #228: say WHICH updater this is, first, every run — a stale npx-cached updater looked
+    // exactly like a broken backfill until the report and the log carried the version.
+    print(`update-agentic-workspace ${versionOrNull(updaterVersion) || 'unknown'} (core create-agentic-workspace ${versionOrNull(corePkg.version) || 'unknown'}, built for plugin ${versionOrNull(pins.plugin_version) || 'unknown'})`);
     const marketplaceName = pins.marketplace_name;
     const marketplaceRepo = pins.marketplace_repo;
     const pluginKey = `${pins.plugin_name}@${pins.marketplace_name}`;
@@ -207,6 +212,13 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
       if (previewRetirementPlan && previewRetirementPlan.total > 0) {
         previewLines.push(`  [permission-floor] would retire allow=${previewRetirementPlan.retirements.allow.length}, ask=${previewRetirementPlan.retirements.ask.length}`);
       }
+      // hotfix-v1.17.3 (PR #233 review Risk 4): the self-guard pair is previewed like the floor.
+      if (policyPresent(physicalRoot) || filePlan.some((f) => f.seed && f.action === 'create')) {
+        const cur0 = readTarget(floorTarget.path);
+        const prow = renderSelfGuardRow(physicalRoot, missingSelfGuardDeny(cur0).length, { shapeOk: selfGuardShapeOk(cur0), applied: false });
+        if (prow) previewLines.push(prow);
+        else previewLines.push('  [permissions] would add self-guard deny rules (2): Edit/Write on .foundry/permissions.yaml (with the seed)');
+      }
     } else {
       previewLines.push('  [permission-floor] .claude/settings.json absent — left to the create path');
     }
@@ -289,6 +301,17 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
           applied: true, retirementPlan: floorRetirementPlan, mapEntryCount: map.entries.length,
         })) print(line);
       }
+      // hotfix-v1.17.3 (ER #232): the policy file's self-guard deny pair is framework-owned — converge
+      // it here, fresh from disk after the floor write, whenever a policy file exists (seeded above or
+      // kept). Grants stay the compiler's (operator-run) business.
+      if (policyPresent(physicalRoot)) {
+        const cur = readTarget(freshFloorTarget.path);
+        const shapeOk = selfGuardShapeOk(cur);
+        const missing = missingSelfGuardDeny(cur);
+        if (shapeOk && missing.length > 0) writeTargetAtomically(freshFloorTarget.path, applySelfGuardDeny(cur));
+        const row = renderSelfGuardRow(physicalRoot, missing.length, { shapeOk });
+        if (row) print(row);
+      }
     }
     // Recomputed FRESH from disk, same reasoning as floorPlan just above: never apply a plan
     // captured before Phases 1-3 ran, even though `.gitignore` is not itself a migration target.
@@ -339,6 +362,7 @@ export async function runUpdate(argv, { cwd, configDir, homeDir, pkgDir, output,
     // named in the LAST line so the operator's next step is never a guess.
     const report = buildUpgradeReport({
       installedBefore, afterEntry, toPluginVersion: pins.plugin_version, phases, filePlan, amendmentsPlan,
+      updaterVersion, coreVersion: corePkg.version, updaterPluginVersion: pins.plugin_version,
     });
     const reportPath = writeUpgradeReport(physicalRoot, report);
     print('');

package/src/upgradeReport.mjs

@@ -31,6 +31,7 @@ export function versionOrNull(v) {
  * `amendmentsPlan` is the applied backfill plan (or null); `phases` is what renderSummary got. */
 export function buildUpgradeReport({
   installedBefore = null, afterEntry, toPluginVersion, phases, filePlan, amendmentsPlan, now = new Date(),
+  updaterVersion = null, coreVersion = null, updaterPluginVersion = null,
 }) {
   const seedRow = (filePlan || []).find((f) => f.seed);
   return {
@@ -42,10 +43,18 @@ export function buildUpgradeReport({
     // first install) makes the skill list only the current version's CHANGELOG section.
     from_plugin_version: versionOrNull(installedBefore),
     to_plugin_version: (afterEntry && versionOrNull(afterEntry.version)) || versionOrNull(toPluginVersion),
+    // ER #228 (v1.17.2): WHICH updater ran. A stale npx-cached updater was indistinguishable from a
+    // broken walk; the skill refuses a report whose updater was built for another plugin version.
+    updater_version: versionOrNull(updaterVersion),
+    core_version: versionOrNull(coreVersion),
+    updater_plugin_version: versionOrNull(updaterPluginVersion),
     phases: (phases || []).map((p) => ({ name: p.name, verdict: p.verdict, ...(p.reason ? { reason: p.reason } : {}) })),
+    // `total` is the walk's denominator (ER #228): backfilled + present + skipped == total, so a
+    // walk that never opened a file cannot read as a clean pass.
     amendments: amendmentsPlan
-      ? { backfilled: amendmentsPlan.written ?? 0, present: amendmentsPlan.present, skipped: amendmentsPlan.skipped }
-      : { backfilled: 0, present: 0, skipped: 0 },
+      ? { backfilled: amendmentsPlan.written ?? 0, present: amendmentsPlan.present, skipped: amendmentsPlan.skipped,
+          total: amendmentsPlan.total ?? ((amendmentsPlan.written ?? 0) + amendmentsPlan.present + amendmentsPlan.skipped) }
+      : { backfilled: 0, present: 0, skipped: 0, total: 0 },
     permissions_policy: seedRow ? (seedRow.action === 'create' ? 'created' : 'kept') : 'absent',
     drifted: (filePlan || []).filter((f) => f.action === 'drifted').map((f) => f.relPath),
   };