create-agentic-workspace 0.4.0 → 0.4.1

package/bin/create-agentic-workspace.mjs

@@ -20,7 +20,9 @@ if (rawArgv.length > 0 && !rawArgv[0].startsWith('--')) {
   argv = ['--dir', rawArgv[0], ...rawArgv.slice(1)];
 }
 
-const { exitCode, output } = await runCli(argv, {
+// runCli streams every line to `output` as it is produced (ER #95), so the returned string is a
+// transcript for callers, not something to print again here.
+const { exitCode } = await runCli(argv, {
   cwd: process.cwd(),
   isTTY: Boolean(process.stdin.isTTY),
   input: process.stdin,
@@ -29,5 +31,4 @@ const { exitCode, output } = await runCli(argv, {
   pkgDir,
 });
 
-process.stdout.write(`${output}\n`);
 process.exitCode = exitCode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.4.0",
+    "plugin_version": "1.4.1",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.4.0",
+  "generated_for_plugin_version": "1.4.1",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",

package/src/preview.mjs

@@ -35,10 +35,21 @@ export function renderPreview({ plan, machineScopeWrites, map }) {
 // previewed and nothing else; `git init` would be an un-previewed side effect, and the choice of
 // remote is genuinely the reader's. `create-vite` prints its next steps the same way, for the same
 // reason. Telling keeps the promise; doing would quietly break it.
-export const TRUST_HANDOFF_TEXT = (dir, { isGitRepo = true } = {}) => `
-The workspace has been written. The permission floor above is a declaration, not a grant: the
+// `reconciledExisting` is true when --reconcile-floor actually WROTE rules into a workspace that
+// already existed. That case inverts the sentence below, and the inversion was observed live: an
+// operator reconciled an already-trusted workspace, restarted the session, and 42 wildcarded allow
+// rules took effect with NO trust dialog at all. The dialog is the consent ceremony for a workspace
+// the platform has not yet trusted; for one it already trusts, THIS CLI'S OWN preview-and-confirm is
+// the only consent moment there will be. Saying otherwise points the operator at a review that will
+// not happen — the one claim this tool cannot afford to get wrong, since "declares, never grants" is
+// its whole posture. (bootstrap-cli R8, answered 2026-08-12.)
+export const TRUST_HANDOFF_TEXT = (dir, { isGitRepo = true, reconciledExisting = false } = {}) => `
+${reconciledExisting ? `The workspace has been written, and the permission-floor rules above were added to a workspace
+that is ALREADY TRUSTED. On that path there is no second consent ceremony: the preview and the
+confirmation you just gave were it, and the added \`allow\` rules are in effect from the next
+session onward with no dialog. Re-read the list above if you have not.` : `The workspace has been written. The permission floor above is a declaration, not a grant: the
 platform's trust dialog is the consent ceremony, and the \`allow\` rules take effect only after
-you accept it — the dialog lists them.
+you accept it — the dialog lists them.`}
 
   cd ${dir}${isGitRepo ? '' : `
   git init && git add -A && git commit -m 'workspace seed'

package/src/run.mjs

@@ -93,7 +93,20 @@ function expandPluginRootGlob(glob, homeDir) {
  * caught and turned into a refusal-shaped exit 1 (or, for a bug, exit 1 with the error message). */
 export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir }) {
   const lines = [];
-  const print = (s) => lines.push(s);
+  // ER #95 — STREAM, don't accumulate. This used to only push into `lines`, which bin printed
+  // after runCli returned, so every prompt fired against a blank screen: "Write the workspace as
+  // previewed above? [y/N]" was asked with nothing above it, and the preview — the file plan, the
+  // machine-scope writes OUTSIDE the target root, and the 62 permission rules — scrolled past
+  // afterwards. A confirmation whose subject is not yet on screen cannot be informed consent, and
+  // its mere presence claims a review that did not happen.
+  //
+  // It became load-bearing with --reconcile-floor. R8 was answered live: reconciling an
+  // already-trusted workspace fires NO trust dialog, so this prompt is the ONLY consent moment
+  // there is. `lines` is still accumulated because runCli's return contract exposes it.
+  const print = (s) => {
+    lines.push(s);
+    output.write(`${s}\n`);
+  };
 
   try {
     let parsed;
@@ -254,7 +267,12 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // on the path is the check that covers both — a directory-only test would tell a worktree user
     // to re-init a repository they already have.
     const isGitRepo = fs.existsSync(path.join(targetRoot, '.git'));
-    print(TRUST_HANDOFF_TEXT(targetRoot, { isGitRepo }));
+    print(TRUST_HANDOFF_TEXT(targetRoot, {
+      isGitRepo,
+      // only when a reconcile actually wrote — a dry run, a no-op second run, or a plain scaffold
+      // all keep the standard hand-off
+      reconciledExisting: Boolean(floorPlan && floorPlan.total > 0),
+    }));
 
     return { exitCode: exitCodeForPlan(plan), output: lines.join('\n') };
   } catch (e) {