create-agentic-workspace 0.4.0 → 0.4.2

package/bin/create-agentic-workspace.mjs

@@ -20,7 +20,9 @@ if (rawArgv.length > 0 && !rawArgv[0].startsWith('--')) {
   argv = ['--dir', rawArgv[0], ...rawArgv.slice(1)];
 }
 
-const { exitCode, output } = await runCli(argv, {
+// runCli streams every line to `output` as it is produced (ER #95), so the returned string is a
+// transcript for callers, not something to print again here.
+const { exitCode } = await runCli(argv, {
   cwd: process.cwd(),
   isTTY: Boolean(process.stdin.isTTY),
   input: process.stdin,
@@ -29,5 +31,4 @@ const { exitCode, output } = await runCli(argv, {
   pkgDir,
 });
 
-process.stdout.write(`${output}\n`);
 process.exitCode = exitCode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.4.0",
+    "plugin_version": "1.4.2",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.4.0",
+  "generated_for_plugin_version": "1.4.2",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",

package/src/preview.mjs

@@ -35,10 +35,21 @@ export function renderPreview({ plan, machineScopeWrites, map }) {
 // previewed and nothing else; `git init` would be an un-previewed side effect, and the choice of
 // remote is genuinely the reader's. `create-vite` prints its next steps the same way, for the same
 // reason. Telling keeps the promise; doing would quietly break it.
-export const TRUST_HANDOFF_TEXT = (dir, { isGitRepo = true } = {}) => `
-The workspace has been written. The permission floor above is a declaration, not a grant: the
+// `reconciledExisting` is true when --reconcile-floor actually WROTE rules into a workspace that
+// already existed. That case inverts the sentence below, and the inversion was observed live: an
+// operator reconciled an already-trusted workspace, restarted the session, and 42 wildcarded allow
+// rules took effect with NO trust dialog at all. The dialog is the consent ceremony for a workspace
+// the platform has not yet trusted; for one it already trusts, THIS CLI'S OWN preview-and-confirm is
+// the only consent moment there will be. Saying otherwise points the operator at a review that will
+// not happen — the one claim this tool cannot afford to get wrong, since "declares, never grants" is
+// its whole posture. (bootstrap-cli R8, answered 2026-08-12.)
+export const TRUST_HANDOFF_TEXT = (dir, { isGitRepo = true, reconciledExisting = false } = {}) => `
+${reconciledExisting ? `The workspace has been written, and the permission-floor rules above were added to a workspace
+that is ALREADY TRUSTED. On that path there is no second consent ceremony: the preview and the
+confirmation you just gave were it, and the added \`allow\` rules are in effect from the next
+session onward with no dialog. Re-read the list above if you have not.` : `The workspace has been written. The permission floor above is a declaration, not a grant: the
 platform's trust dialog is the consent ceremony, and the \`allow\` rules take effect only after
-you accept it — the dialog lists them.
+you accept it — the dialog lists them.`}
 
   cd ${dir}${isGitRepo ? '' : `
   git init && git add -A && git commit -m 'workspace seed'

package/src/run.mjs

@@ -93,7 +93,20 @@ function expandPluginRootGlob(glob, homeDir) {
  * caught and turned into a refusal-shaped exit 1 (or, for a bug, exit 1 with the error message). */
 export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir }) {
   const lines = [];
-  const print = (s) => lines.push(s);
+  // ER #95 — STREAM, don't accumulate. This used to only push into `lines`, which bin printed
+  // after runCli returned, so every prompt fired against a blank screen: "Write the workspace as
+  // previewed above? [y/N]" was asked with nothing above it, and the preview — the file plan, the
+  // machine-scope writes OUTSIDE the target root, and the 62 permission rules — scrolled past
+  // afterwards. A confirmation whose subject is not yet on screen cannot be informed consent, and
+  // its mere presence claims a review that did not happen.
+  //
+  // It became load-bearing with --reconcile-floor. R8 was answered live: reconciling an
+  // already-trusted workspace fires NO trust dialog, so this prompt is the ONLY consent moment
+  // there is. `lines` is still accumulated because runCli's return contract exposes it.
+  const print = (s) => {
+    lines.push(s);
+    output.write(`${s}\n`);
+  };
 
   try {
     let parsed;
@@ -155,19 +168,15 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
 
     print(renderPreview({ plan, machineScopeWrites, map }));
 
-    // Drift is classified HERE — before the write phase and before the dry-run return — not after
-    // applyPlan where the advisory report used to compute it. Two things depend on the move: the
-    // reconcile must know what it would add in order to decide whether to write at all, and
-    // --dry-run must be able to report those rules, which it never could before because it returned
-    // above the only classifyDrift call in the file.
-    const { effective, unreadable } = readEffectiveRules(physicalRoot);
+    // Resolved HERE — before the write phase and before the dry-run return — because the reconcile
+    // below must know what it would add in order to decide whether to write at all, and --dry-run
+    // must be able to report those rules. That requirement is carried by the TRACKED classification
+    // a few lines down; the union classification the advisory report needs is derived after the
+    // write instead, for the reason stated there.
     const pluginRootExpansion = expandPluginRootGlob(map.plugin_root_glob, homeDir);
-    const findings = classifyDrift(map, effective, {
-      pluginRootExpansion, unreadableOrigins: unreadable, home: homeDir,
-    });
 
     // The reconcile classifies against the TRACKED settings.json alone. A floor rule carried only
-    // in the untracked settings.local.json reads as covered in the union above, so the tracked file
+    // in the untracked settings.local.json reads as covered in the union report below, so the tracked file
     // would stay incomplete while the report said converged — and the repo would then ship to every
     // other clone and to CI without it.
     let floorPlan = null;
@@ -243,6 +252,21 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
       wireIdentity({ slug, name: identity.name, email: identity.email, targetRoot: physicalRoot, homeDir });
     }
 
+    // The advisory report describes the state the operator is LEFT in, so it is classified from the
+    // files as they now stand — AFTER applyPlan and after any reconcile write. Classifying it up
+    // front instead makes it name rules that exist by the time it prints: on the reconcile path
+    // that is every rule just added, so the run reported `added allow=42, ask=16` and then listed
+    // all 58 as absent, which reads as the write having silently failed. The create path had the
+    // same defect whenever it wrote settings.json itself. Deriving it here cannot contradict the
+    // write above it, at the cost of re-reading two small files on the write path.
+    //
+    // This is only the UNION (settings.json + settings.local.json) report. The reconcile's own
+    // classification stays above the write and over the tracked file alone — consent has to be
+    // informed by what WILL be written, which is a different question from what remains after.
+    const { effective, unreadable } = readEffectiveRules(physicalRoot);
+    const findings = classifyDrift(map, effective, {
+      pluginRootExpansion, unreadableOrigins: unreadable, home: homeDir,
+    });
     if (findings.length > 0) {
       print('');
       print(`Permission-floor report (advisory, ${findings.length} finding(s)):`);
@@ -254,7 +278,12 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
     // on the path is the check that covers both — a directory-only test would tell a worktree user
     // to re-init a repository they already have.
     const isGitRepo = fs.existsSync(path.join(targetRoot, '.git'));
-    print(TRUST_HANDOFF_TEXT(targetRoot, { isGitRepo }));
+    print(TRUST_HANDOFF_TEXT(targetRoot, {
+      isGitRepo,
+      // only when a reconcile actually wrote — a dry run, a no-op second run, or a plain scaffold
+      // all keep the standard hand-off
+      reconciledExisting: Boolean(floorPlan && floorPlan.total > 0),
+    }));
 
     return { exitCode: exitCodeForPlan(plan), output: lines.join('\n') };
   } catch (e) {