create-anpunkit 2.0.0 → 2.0.3

package/bin/cli.js

@@ -16,10 +16,56 @@ if (!fs.existsSync(SETUP)) {
   process.exit(1);
 }
 
+// --- locate a REAL bash on Windows (never the System32 WSL relay).
+// In PowerShell, bare `bash` resolves to C:\Windows\System32\bash.exe, which
+// relays into WSL and fails with "execvpe(/bin/bash) failed" when no distro
+// is installed. We must find Git Bash explicitly.
+function findBash() {
+  if (process.platform !== 'win32') return 'bash';
+  const candidates = [];
+  if (process.env.ANPUNKIT_BASH) candidates.push(process.env.ANPUNKIT_BASH);
+  // Derive from git on PATH: <Git>\cmd\git.exe or <Git>\mingw64\bin\git.exe -> <Git>\bin\bash.exe
+  try {
+    const r = spawnSync('where', ['git'], { encoding: 'utf8' });
+    if (r.status === 0) {
+      for (const line of r.stdout.split(/\r?\n/).map(s => s.trim()).filter(Boolean)) {
+        const d1 = path.resolve(path.dirname(line), '..');
+        const d2 = path.resolve(d1, '..');
+        candidates.push(path.join(d1, 'bin', 'bash.exe'), path.join(d2, 'bin', 'bash.exe'));
+      }
+    }
+  } catch (_) { /* where.exe missing — fall through */ }
+  // Standard Git for Windows install locations
+  for (const base of [
+    process.env.ProgramFiles,
+    process.env['ProgramFiles(x86)'],
+    process.env.LocalAppData ? path.join(process.env.LocalAppData, 'Programs') : null
+  ]) {
+    if (base) candidates.push(path.join(base, 'Git', 'bin', 'bash.exe'));
+  }
+  for (const c of candidates) {
+    if (c && !/system32/i.test(c) && fs.existsSync(c)) return c;
+  }
+  return null;
+}
+
+const bash = findBash();
+if (!bash) {
+  console.error('create-anpunkit: could not find Git Bash.');
+  console.error('The Windows `bash` on PATH is the WSL relay (System32), which is not usable here.');
+  console.error('Fix one of:');
+  console.error('  1. Install Git for Windows (includes Git Bash): https://git-scm.com/download/win');
+  console.error('  2. Run `npx create-anpunkit` from a Git Bash terminal instead of PowerShell.');
+  console.error('  3. Set ANPUNKIT_BASH to the full path of a bash.exe.');
+  process.exit(1);
+}
+
 // Pass through recognised flags only; setup.sh validates the rest.
 const passthrough = ['--kb-path', '--kb-remote', '--no-kb', '--force', '--dry-run'];
 const argv = process.argv.slice(2);
-const args = ['--src', TEMPLATE];
+// Git Bash is happiest with forward slashes; Windows APIs accept them too.
+const fwd = p => p.split(path.sep).join('/');
+const args = ['--src', fwd(TEMPLATE)];
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
   if (passthrough.includes(a)) {
@@ -31,11 +77,10 @@ for (let i = 0; i < argv.length; i++) {
   }
 }
 
-const bash = process.platform === 'win32' ? 'bash' : 'bash'; // Git Bash / WSL on Windows
-console.log(`create-anpunkit -> running setup.sh (src: ${TEMPLATE})`);
-const r = spawnSync(bash, [SETUP, ...args], { stdio: 'inherit', cwd: process.cwd() });
+console.log(`create-anpunkit -> running setup.sh (bash: ${bash})`);
+const r = spawnSync(bash, [fwd(SETUP), ...args], { stdio: 'inherit', cwd: process.cwd() });
 if (r.error) {
-  console.error('create-anpunkit: could not run bash. Install Git Bash (Windows) or ensure bash is on PATH.');
+  console.error(`create-anpunkit: failed to run ${bash}: ${r.error.message}`);
   process.exit(1);
 }
 process.exit(r.status === null ? 1 : r.status);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-anpunkit",
-  "version": "2.0.0",
+  "version": "2.0.3",
   "description": "Scaffold the anpunkit AI-coding workflow (Claude Code + Cursor) into a project. Upgrade-safe, non-destructive.",
   "bin": {
     "create-anpunkit": "bin/cli.js"

package/template/.claude/anpunkit-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.0",
+  "version": "2.0.3",
   "files": [
     {
       "path": "AGENTS.md",
@@ -11,7 +11,7 @@
     },
     {
       "path": "README.md",
-      "sha256": "56a76a3fefacbf5ffc37d5b1f43748a628e0e4a8142ce2d6058957f8a22781a0"
+      "sha256": "0335a0cecb86b57d01e63f564206cdf6d189ac873fce5c69d0f5081facfec964"
     },
     {
       "path": ".gitattributes",
@@ -19,7 +19,7 @@
     },
     {
       "path": "setup.sh",
-      "sha256": "6e833255c4aeb5f7824db3fe332535f8f0816a0cbf79a0f8f16ee07b606753cf"
+      "sha256": "85c4aab58c83bf7b62344bbc04b94a4b49f90df0840b5e20660546b540889d6e"
     },
     {
       "path": ".claude/agents/debugger.md",
@@ -55,7 +55,7 @@
     },
     {
       "path": ".claude/hooks/cursor-session-start.sh",
-      "sha256": "504aa12b63508c6926cda28da14fa8951234d49d4b4318da83eecd6f115402e3"
+      "sha256": "e08bcd14fbcfe1831b64e7d8f181b57b02c561cd8d0de6eb16fe06db259be6af"
     },
     {
       "path": ".claude/hooks/pre-compact.sh",
@@ -231,11 +231,11 @@
     },
     {
       "path": "create-anpunkit/package.json",
-      "sha256": "a0cdb99a170ef7f4dc9f0aecc85e8d4c8fde3038d2b176366b17078deee09d09"
+      "sha256": "4b16cdfd4d9a22379147338664530fd7ce7f0e7566bf63d097f7b8f8f76dcdd8"
     },
     {
       "path": "create-anpunkit/bin/cli.js",
-      "sha256": "3c12a18a3831c40ddb3633072a26e5f8be28954fe8d058388d7220d13cf4568e"
+      "sha256": "129dae04923b6d380d3ca4601b5dcd2baa6ad4c51c827dddae3e43ea6a9c50e2"
     },
     {
       "path": "create-anpunkit/build.sh",

package/template/.claude/hooks/cursor-session-start.sh

@@ -5,10 +5,13 @@
 # session-start.sh body (single copy — anti-drift) and wraps its output in the
 # JSON envelope Cursor requires. Cursor sets CLAUDE_PROJECT_DIR (compat alias),
 # so the shared script needs no changes.
+# Uses node for JSON (the kit assumes Node; python3 is a fallback only).
 # Verified against cursor.com/docs/hooks (sessionStart output schema), 2026-06.
 set -euo pipefail
 HERE="$(cd "$(dirname "$0")" && pwd)"
 OUT="$(bash "$HERE/session-start.sh" 2>/dev/null || true)"
-python3 -c 'import json,sys; print(json.dumps({"additional_context": sys.stdin.read()}))' <<EOF_CTX
-$OUT
-EOF_CTX
+if command -v node >/dev/null 2>&1; then
+  printf '%s' "$OUT" | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>console.log(JSON.stringify({additional_context:d})))'
+else
+  printf '%s' "$OUT" | python3 -c 'import json,sys; print(json.dumps({"additional_context": sys.stdin.read()}))'
+fi

package/template/README.md

@@ -26,7 +26,7 @@ npx create-anpunkit            # non-destructive: never clobbers your files
 /overview                      # bootstrap the project (includes Phase 0 infra)
 ```
 Useful flags: `--dry-run` (print the plan, write nothing), `--force` (overwrite
-user-modified kit files), `--kb-path <dir>` / `--kb-remote <url>` / `--no-kb`.
+user-modified kit files), `--kb-path <dir>` (your pre-cloned KB repo; remote auto-recorded from its origin) / `--no-kb`.
 
 Upgrading an existing anpunkit project? Re-run `npx create-anpunkit`. It refreshes
 kit-owned files, preserves anything you modified as `<file>.anpunkit-new`, merges
@@ -157,14 +157,20 @@ re-discovering the same Azure/Databricks gotchas project after project.
 **Setup (one-time per machine):**
 
 ```bash
-# 1. Create a GitHub repo: anpunkit-kb (empty)
-# 2. Clone it somewhere permanent on your machine
-git clone git@github.com:your-username/anpunkit-kb.git ~/anpunkit-kb
+# 1. Create a GitHub repo: anpunkit-kb (empty is fine)
+# 2. Clone it yourself, somewhere permanent — you own the git auth
+git clone git@github.com:<you>/anpunkit-kb.git ~/anpunkit-kb
 
-# 3. During setup.sh, provide the path when prompted
-bash setup.sh
+# 3. Point anpunkit at it
+npx create-anpunkit --kb-path ~/anpunkit-kb
+# (or paste the path at the interactive prompt)
 ```
 
+That's the last manual git you'll run against the KB. From then on the
+**session-start hook pulls** each session and **`/store-wisdom` commits and
+pushes** (always with your approval). The remote URL is recorded automatically
+from the clone's `origin`; `--kb-remote <url>` overrides it if needed.
+
 **Usage:**
 
 ```

package/template/docs/DESIGN_LOG.md

@@ -17,6 +17,27 @@
 
 Newest first. One entry per architectural change. Appended by `/log-decision`.
 
+- **(v2.0.2)** — KB setup stays PATH-FIRST: the user clones the KB repo
+  themselves (`git clone ... ~/anpunkit-kb`) and passes `--kb-path` (or the
+  interactive prompt). New: the remote URL is auto-recorded from the clone's
+  `origin`, so `--kb-remote` is optional metadata. After setup, no manual git:
+  the session-start hook pulls; `/store-wisdom` commits and pushes (human-gated).
+  REJECTED: URL-first setup where anpunkit runs `git clone` itself — it was built
+  and tested, then dropped: it entangles a fresh install with the user's GitHub
+  authentication (SSH keys / gh auth), and a clone failure mid-setup is a worse
+  failure mode than asking a developer to run one clone command they already
+  understand. Setup records state; it does not acquire credentials.
+
+- **(v2.0.1)** — Windows portability fix for the npx installer. (1) `cli.js` no
+  longer trusts bare `bash` on win32: PowerShell resolves it to the System32 WSL
+  relay, which fails with `execvpe(/bin/bash)` when no distro is installed. The
+  bin now locates Git Bash explicitly (ANPUNKIT_BASH override -> derive from
+  `where git` -> standard install paths), refuses System32, and fails loudly with
+  install guidance. (2) `setup.sh` and `cursor-session-start.sh` no longer depend
+  on `python3` (absent or a Store stub on many Windows machines): all JSON and
+  checksum work now uses Node, which the kit already requires. Paths passed into
+  Git Bash are normalized to forward slashes.
+
 - **(v2.0)** — Major release. Project name: **anpunkit**; distributed
   as `npx create-anpunkit`. Five locked features: (1) **TDD-first** via a SCAFFOLD
   step (implementer writes stubs only; test-author writes the suite blind against

package/template/setup.sh

@@ -39,7 +39,7 @@ act() { if [ "$DRY" = 1 ]; then say "  [dry-run] $*"; else say "  $*"; fi; }
 sha() {
   if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d' ' -f1
   elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d' ' -f1
-  else python3 -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],'rb').read()).hexdigest())" "$1"; fi
+  else node -e "console.log(require('crypto').createHash('sha256').update(require('fs').readFileSync(process.argv[1])).digest('hex'))" "$1"; fi
 }
 
 say "anpunkit setup — dest: $DEST  src: $SRC  $([ "$DRY" = 1 ] && echo '(DRY-RUN)')"
@@ -47,12 +47,12 @@ say "anpunkit setup — dest: $DEST  src: $SRC  $([ "$DRY" = 1 ] && echo '(DRY-R
 MAN_SRC="$SRC/.claude/anpunkit-manifest.json"
 MAN_DEST="$DEST/.claude/anpunkit-manifest.json"
 [ -f "$MAN_SRC" ] || { echo "FATAL: missing $MAN_SRC (corrupt kit)"; exit 1; }
-NEW_VER=$(python3 -c "import json;print(json.load(open('$MAN_SRC'))['version'])")
+NEW_VER=$(node -e "console.log(JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).version)" "$MAN_SRC")
 
 # ---- determine mode from installed manifest
 MODE="fresh"
 if [ -f "$MAN_DEST" ]; then
-  OLD_VER=$(python3 -c "import json;print(json.load(open('$MAN_DEST')).get('version',''))" 2>/dev/null || echo "")
+  OLD_VER=$(node -e "try{console.log(JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).version||'')}catch(e){console.log('')}" "$MAN_DEST" 2>/dev/null || echo "")
   if   [ "$OLD_VER" = "$NEW_VER" ]; then MODE="repair"
   elif [ -z "$OLD_VER" ]; then MODE="upgrade"
   else
@@ -82,19 +82,23 @@ install_kit_file() {
     mkdir -p "$(dirname "$d")"; cp -p "$s" "$d"; return 0
   fi
   # present — compare against the INSTALLED manifest's recorded checksum
-  local recorded; recorded=$(python3 - "$MAN_DEST" "$rel" <<'PY' 2>/dev/null || true
-import json,sys
-try:
-    m=json.load(open(sys.argv[1]))
-    print(next((f["sha256"] for f in m["files"] if f["path"]==sys.argv[2]),""))
-except Exception: print("")
-PY
+  local recorded; recorded=$(node - "$MAN_DEST" "$rel" <<'NODE' 2>/dev/null || true
+const fs=require('fs');
+try{
+  const m=JSON.parse(fs.readFileSync(process.argv[2],'utf8'));
+  const f=(m.files||[]).find(f=>f.path===process.argv[3]);
+  console.log(f?f.sha256:'');
+}catch(e){console.log('');}
+NODE
 )
   local cur; cur=$(sha "$d")
-  if [ "$cur" = "$recorded" ] || [ -z "$recorded" ] && [ "$SRC" = "." ]; then
-    # unmodified since last install (or clone flow with file already in place) -> refresh
-    if [ "$cur" = "$(sha "$s")" ]; then act "ok       $rel (identical)"; else
-      backup_one "$d"; act "refresh  $rel"; [ "$DRY" = 1 ] || cp -p "$s" "$d"; fi
+  local new; new=$(sha "$s")
+  # already identical to the new version -> nothing to do (regardless of manifest)
+  if [ "$cur" = "$new" ]; then act "ok       $rel (identical)"; return 0; fi
+  # NOTE: bash gives || and && EQUAL precedence (left-assoc) — group explicitly.
+  if [ "$cur" = "$recorded" ] || { [ -z "$recorded" ] && [ "$SRC" = "." ]; }; then
+    # unmodified since last install (or clone flow) -> refresh to the new version
+    backup_one "$d"; act "refresh  $rel"; [ "$DRY" = 1 ] || cp -p "$s" "$d"
   else
     # user-modified kit file
     if [ "$FORCE" = 1 ]; then backup_one "$d"; act "force    $rel (overwritten)"; [ "$DRY" = 1 ] || cp -p "$s" "$d"
@@ -104,7 +108,7 @@ PY
 
 say ""; say "[1/6] kit-owned files (taxonomy):"
 if [ "$SRC" != "." ]; then
-  while IFS= read -r rel; do install_kit_file "$rel"; done < <(python3 -c "import json;[print(f['path']) for f in json.load(open('$MAN_SRC'))['files']]")
+  while IFS= read -r rel; do install_kit_file "$rel"; done < <(node -e "JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).files.forEach(f=>console.log(f.path))" "$MAN_SRC")
 else
   say "  clone flow (src=.) — kit files already in place; verifying + generating only."
 fi
@@ -131,44 +135,41 @@ say ""; say "[3/6] wire hooks (idempotent merge):"
 merge_settings() {
   [ "$DRY" = 1 ] && { act "merge    .claude/settings.json + .cursor/hooks.json"; return 0; }
   backup_one "$DEST/.claude/settings.json"; backup_one "$DEST/.cursor/hooks.json"
-  python3 - "$DEST" <<'PY'
-import json,os,sys
-dest=sys.argv[1]
-def load(p,default):
-    try: return json.load(open(p))
-    except Exception: return default
-# Claude settings.json
-sp=os.path.join(dest,".claude/settings.json")
-s=load(sp,{})
-s.setdefault("$schema","https://json.schemastore.org/claude-code-settings.json")
-hooks=s.setdefault("hooks",{})
-def ensure(event,matcher,cmd):
-    arr=hooks.setdefault(event,[])
-    for blk in arr:
-        for h in blk.get("hooks",[]):
-            if h.get("command")==cmd: return
-    blk={"hooks":[{"type":"command","command":cmd}]}
-    if matcher: blk={"matcher":matcher,**blk}
-    arr.append(blk)
-ensure("SessionStart","startup|clear|compact","bash .claude/hooks/session-start.sh")
-ensure("PreCompact","auto|manual","bash .claude/hooks/pre-compact.sh")
-ensure("SubagentStop","","bash .claude/hooks/subagent-stop.sh")
-os.makedirs(os.path.dirname(sp),exist_ok=True)
-json.dump(s,open(sp,"w"),indent=2); open(sp,"a").write("\n")
-# Cursor hooks.json
-cp=os.path.join(dest,".cursor/hooks.json")
-c=load(cp,{"version":1,"hooks":{}})
-ch=c.setdefault("hooks",{})
-def cursor_ensure(event,cmd):
-    arr=ch.setdefault(event,[])
-    if not any(h.get("command")==cmd for h in arr): arr.append({"command":cmd})
-cursor_ensure("sessionStart","bash .claude/hooks/cursor-session-start.sh")
-cursor_ensure("preCompact","bash .claude/hooks/pre-compact.sh")
-cursor_ensure("subagentStop","bash .claude/hooks/subagent-stop.sh")
-os.makedirs(os.path.dirname(cp),exist_ok=True)
-json.dump(c,open(cp,"w"),indent=2); open(cp,"a").write("\n")
-print("  merged .claude/settings.json + .cursor/hooks.json")
-PY
+  node - "$DEST" <<'NODE'
+const fs=require('fs'),path=require('path');
+const dest=process.argv[2];
+const load=(p,d)=>{try{return JSON.parse(fs.readFileSync(p,'utf8'))}catch(e){return d}};
+const save=(p,o)=>{fs.mkdirSync(path.dirname(p),{recursive:true});fs.writeFileSync(p,JSON.stringify(o,null,2)+"\n")};
+// Claude settings.json
+const sp=path.join(dest,'.claude/settings.json');
+const s=load(sp,{});
+if(!s.$schema)s.$schema='https://json.schemastore.org/claude-code-settings.json';
+s.hooks=s.hooks||{};
+const ensure=(event,matcher,cmd)=>{
+  const arr=s.hooks[event]=s.hooks[event]||[];
+  for(const blk of arr)for(const h of (blk.hooks||[]))if(h.command===cmd)return;
+  const blk={hooks:[{type:'command',command:cmd}]};
+  if(matcher)blk.matcher=matcher;
+  arr.push(blk);
+};
+ensure('SessionStart','startup|clear|compact','bash .claude/hooks/session-start.sh');
+ensure('PreCompact','auto|manual','bash .claude/hooks/pre-compact.sh');
+ensure('SubagentStop','','bash .claude/hooks/subagent-stop.sh');
+save(sp,s);
+// Cursor hooks.json
+const cp=path.join(dest,'.cursor/hooks.json');
+const c=load(cp,{version:1,hooks:{}});
+c.hooks=c.hooks||{};
+const cursorEnsure=(event,cmd)=>{
+  const arr=c.hooks[event]=c.hooks[event]||[];
+  if(!arr.some(h=>h.command===cmd))arr.push({command:cmd});
+};
+cursorEnsure('sessionStart','bash .claude/hooks/cursor-session-start.sh');
+cursorEnsure('preCompact','bash .claude/hooks/pre-compact.sh');
+cursorEnsure('subagentStop','bash .claude/hooks/subagent-stop.sh');
+save(cp,c);
+console.log('  merged .claude/settings.json + .cursor/hooks.json');
+NODE
 }
 merge_settings
 
@@ -206,23 +207,41 @@ say ""; say "[6/6] shared KB:"
 configure_kb() {
   local cfg="$DEST/.claude/kb-config.json"
   if [ "$NO_KB" = 1 ]; then say "  --no-kb: skipping KB."; return 0; fi
-  if [ -z "$KB_PATH" ] && [ -z "$KB_REMOTE" ]; then
+
+  # Path-first by design: YOU clone the KB repo (you own the git auth);
+  # anpunkit only records where it lives. After that, the session-start hook
+  # pulls and /store-wisdom commits+pushes (human-gated) — no manual git needed.
+  if [ -z "$KB_PATH" ]; then
     if [ -t 0 ]; then
-      printf "  Local path to cloned anpunkit-kb repo (blank to skip): "; read -r KB_PATH || true
-      [ -z "$KB_PATH" ] && { say "  skipped KB (no path given)."; return 0; }
+      printf "  Local path to your cloned anpunkit-kb repo (blank to skip): "
+      read -r KB_PATH || true
+      [ -z "$KB_PATH" ] && { say "  skipped KB."; return 0; }
     else
-      say "  no KB flags + no TTY -> skipping KB (re-run with --kb-path / --kb-remote)."; return 0
+      say "  no KB flags + no TTY -> skipping KB (re-run with --kb-path <dir>)."; return 0
     fi
   fi
-  if [ -n "$KB_PATH" ] && [ ! -d "$KB_PATH" ]; then
-    echo "  ! KB path '$KB_PATH' not a directory. Clone your anpunkit-kb repo first."; return 0; fi
+  if [ ! -d "$KB_PATH" ]; then
+    echo "  ! KB path '$KB_PATH' is not a directory. Clone your KB repo first, e.g.:"
+    echo "      git clone git@github.com:<you>/anpunkit-kb.git ~/anpunkit-kb"
+    echo "    then re-run with --kb-path ~/anpunkit-kb"
+    return 0
+  fi
+
+  # remote is metadata: explicit --kb-remote wins, else read the clone's origin
+  if [ -z "$KB_REMOTE" ] && [ -d "$KB_PATH/.git" ]; then
+    KB_REMOTE=$(git -C "$KB_PATH" remote get-url origin 2>/dev/null || echo "")
+  fi
   if [ -n "$KB_REMOTE" ]; then
-    git ls-remote "$KB_REMOTE" >/dev/null 2>&1 || say "  ! warning: cannot reach KB remote '$KB_REMOTE' (configuring anyway)."; fi
-  [ "$DRY" = 1 ] && { act "write .claude/kb-config.json"; return 0; }
+    git ls-remote "$KB_REMOTE" >/dev/null 2>&1 \
+      || say "  ! warning: cannot reach KB remote '$KB_REMOTE' right now (recording anyway; pull/push will need it)."
+  fi
+
+  [ "$DRY" = 1 ] && { act "write .claude/kb-config.json (path: $KB_PATH)"; return 0; }
   mkdir -p "$DEST/.claude"
-  python3 -c "import json;json.dump({'path':'$KB_PATH','remote':'$KB_REMOTE'},open('$cfg','w'),indent=2)"
-  say "  wrote .claude/kb-config.json"
+  node -e "require('fs').writeFileSync(process.argv[1],JSON.stringify({path:process.argv[2],remote:process.argv[3]},null,2)+'\n')" "$cfg" "$KB_PATH" "$KB_REMOTE"
+  say "  wrote .claude/kb-config.json (path: $KB_PATH${KB_REMOTE:+, remote: $KB_REMOTE})"
 }
+
 configure_kb
 
 # ---- finalize: stamp the installed manifest (copy the new one)