create-agentic-workspace 0.4.1 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-agentic-workspace",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "The pre-session bootstrap wizard for an Agentic Foundry workspace: declares (never grants) the permission floor, absorbs foundry-bootstrap.sh's out-of-session identity wiring, and scaffolds a seven-file schema-valid workspace. Zero dependencies, no lifecycle scripts, no telemetry.",
   "license": "MIT",
   "type": "module",
@@ -34,7 +34,7 @@
     "marketplace_name": "agentic-foundry",
     "marketplace_repo": "lukasrepublic/agentic-foundry",
     "plugin_name": "foundry",
-    "plugin_version": "1.4.1",
+    "plugin_version": "1.5.0",
     "pins_researched": "2026-08-02"
   }
 }

package/permission-floor.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "plugin_root_glob": "~/.claude/plugins/cache/*/foundry/*",
-  "generated_for_plugin_version": "1.4.1",
+  "generated_for_plugin_version": "1.5.0",
   "entries": [
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry-acceptance-contract-validate.py:*)",
@@ -263,6 +263,11 @@
       "tier": "ask",
       "rationale": "ceremony: --create arrives after other args, not prefix-keyable, so the whole script is ask"
     },
+    {
+      "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_command_deck.py:*)",
+      "tier": "allow",
+      "rationale": "read-only programme resolution + ready-set/idle/wake derivation; writes nothing (asserted byte-level over a whole fixture tree by AC-CDW-6) and issues no merge, dispatch, or authorization. NOT write-free means side-effect-free: via foundry_release it runs read-only git plumbing (log/rev-parse) in a repo dir, and it exec_module's the in-tree wave planner. Manifest-named spec_ref/contract_ref are confinement-checked BEFORE any derivation. NOT covered: the dir git runs in comes from the contract's own target_repo via _resolve_repo, whose unrecognized-key fallback can leave the corpus - pre-existing shipped behaviour, reached only through an already-confined, authorized contract"
+    },
     {
       "rule": "Bash(~/.claude/plugins/cache/*/foundry/*/scripts/foundry_release.py accept:*)",
       "tier": "ask",

package/src/run.mjs

@@ -168,19 +168,15 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
 
     print(renderPreview({ plan, machineScopeWrites, map }));
 
-    // Drift is classified HERE — before the write phase and before the dry-run return — not after
-    // applyPlan where the advisory report used to compute it. Two things depend on the move: the
-    // reconcile must know what it would add in order to decide whether to write at all, and
-    // --dry-run must be able to report those rules, which it never could before because it returned
-    // above the only classifyDrift call in the file.
-    const { effective, unreadable } = readEffectiveRules(physicalRoot);
+    // Resolved HERE — before the write phase and before the dry-run return — because the reconcile
+    // below must know what it would add in order to decide whether to write at all, and --dry-run
+    // must be able to report those rules. That requirement is carried by the TRACKED classification
+    // a few lines down; the union classification the advisory report needs is derived after the
+    // write instead, for the reason stated there.
     const pluginRootExpansion = expandPluginRootGlob(map.plugin_root_glob, homeDir);
-    const findings = classifyDrift(map, effective, {
-      pluginRootExpansion, unreadableOrigins: unreadable, home: homeDir,
-    });
 
     // The reconcile classifies against the TRACKED settings.json alone. A floor rule carried only
-    // in the untracked settings.local.json reads as covered in the union above, so the tracked file
+    // in the untracked settings.local.json reads as covered in the union report below, so the tracked file
     // would stay incomplete while the report said converged — and the repo would then ship to every
     // other clone and to CI without it.
     let floorPlan = null;
@@ -256,6 +252,21 @@ export async function runCli(argv, { cwd, isTTY, input, output, homeDir, pkgDir
       wireIdentity({ slug, name: identity.name, email: identity.email, targetRoot: physicalRoot, homeDir });
     }
 
+    // The advisory report describes the state the operator is LEFT in, so it is classified from the
+    // files as they now stand — AFTER applyPlan and after any reconcile write. Classifying it up
+    // front instead makes it name rules that exist by the time it prints: on the reconcile path
+    // that is every rule just added, so the run reported `added allow=42, ask=16` and then listed
+    // all 58 as absent, which reads as the write having silently failed. The create path had the
+    // same defect whenever it wrote settings.json itself. Deriving it here cannot contradict the
+    // write above it, at the cost of re-reading two small files on the write path.
+    //
+    // This is only the UNION (settings.json + settings.local.json) report. The reconcile's own
+    // classification stays above the write and over the tracked file alone — consent has to be
+    // informed by what WILL be written, which is a different question from what remains after.
+    const { effective, unreadable } = readEffectiveRules(physicalRoot);
+    const findings = classifyDrift(map, effective, {
+      pluginRootExpansion, unreadableOrigins: unreadable, home: homeDir,
+    });
     if (findings.length > 0) {
       print('');
       print(`Permission-floor report (advisory, ${findings.length} finding(s)):`);