create-claude-cabinet 0.25.0 → 0.25.2

package/lib/cli.js

@@ -463,6 +463,7 @@ const MODULES = {
       'skills/plan/phases/verify-plan.md',
       'skills/execute/phases/verify-emit.md',
       'skills/debrief/phases/verify-coverage.md',
+      'skills/orient/phases/verify-backfill.md',
     ],
     postInstall: 'verify-setup',
   },
@@ -690,6 +691,14 @@ async function run() {
     // Explicit module selection via --modules <key1,key2,...>. Mandatory
     // modules are always included regardless of the flag value, so the
     // installer always has session-loop etc. available.
+    //
+    // On an upgrade (existing .ccrc.json present), --modules is treated
+    // ADDITIVELY: the requested keys are merged with whatever the
+    // existing installation already had enabled. Otherwise an `--modules
+    // verify` invocation on a project with 9 enabled modules would
+    // silently deregister 8 of them. Replacing the existing set on
+    // upgrade is almost never what the operator wants. (Fresh installs
+    // unchanged — there's no prior set to merge with.)
     const mandatoryKeys = Object.entries(MODULES)
       .filter(([, mod]) => mod.mandatory)
       .map(([key]) => key);
@@ -699,7 +708,17 @@ async function run() {
       console.log(`  ⚠ Unknown modules ignored: ${unknown.join(', ')}`);
       console.log(`    Known modules: ${Object.keys(MODULES).join(', ')}`);
     }
-    selectedModules = [...new Set([...mandatoryKeys, ...requested])];
+    let existingEnabled = [];
+    if (dirState === 'existing-install') {
+      const existing = readMetadata(projectDir);
+      existingEnabled = Object.entries(existing.modules || {})
+        .filter(([k, enabled]) => enabled && MODULES[k])
+        .map(([k]) => k);
+      if (existingEnabled.length > 0) {
+        console.log(`  Existing modules carried forward: ${existingEnabled.join(', ')}`);
+      }
+    }
+    selectedModules = [...new Set([...mandatoryKeys, ...existingEnabled, ...requested])];
     const skippedKeys = Object.keys(MODULES).filter(k => !selectedModules.includes(k));
     for (const k of skippedKeys) {
       skippedModules[k] = `Skipped by --modules flag`;
@@ -891,6 +910,19 @@ async function run() {
             continue;
           }
 
+          // Phase file customization guard — mirrors copy.js:48-59 for the
+          // single-file install path. If the destination path is a phase
+          // file and the on-disk content differs from upstream (operator
+          // edited it), preserve it. This keeps the documented "customize
+          // by editing the phase file" affordance intact across upgrades.
+          const isPhaseFile = tmpl.includes('/phases/') || tmpl.includes('\\phases\\');
+          if (isPhaseFile && existingContent.trim() !== '' && existingContent.trim() !== incoming.trim()) {
+            console.log(`  Preserved customized phase: ${tmpl}`);
+            totalSkipped++;
+            allManifest[mPath] = hashContent(existingContent);
+            continue;
+          }
+
           if (flags.yes || dirState === 'existing-install') {
             // If file is in the old manifest, it's upstream-managed — overwrite.
             // If not, it's project-created — skip.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-claude-cabinet",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "Claude Cabinet — opinionated process scaffolding for Claude Code projects",
   "bin": {
     "create-claude-cabinet": "bin/create-claude-cabinet.js"

package/templates/skills/orient/phases/verify-backfill.md

@@ -0,0 +1,107 @@
+# Verify-Plan Backfill
+
+**Contract: v0.x soft — may change before v1.0.** This phase is part
+of the `/verify` integration with `/orient`. Customization phase
+(opt-in), copied into your project only when the `verify` module is
+selected during `npx create-claude-cabinet`.
+
+**Runs:** after work-scan, before briefing. Pairs with
+[verify-coverage on /debrief] — verify-coverage catches drift on
+acts that already shipped; this phase catches the same gap on the
+*front* end, at planning time, on acts still pending.
+
+## What this phase does
+
+Surfaces pending plans in pib-db whose surface area touches UI but
+whose notes lack a `## Verify Plan` section. Advisory only — never
+auto-modifies an action. The operator decides whether to re-plan the
+act (adding the section) or accept the drift.
+
+## No-op guards
+
+This phase exits silently in two cases — checked in order:
+
+1. **The project has no `e2e/features/` directory.** Without the
+   runtime installed, there are no feature files to be out of sync
+   with. Skip.
+2. **No pending actions match the UI heuristic.** No Attention Items
+   entry, no warning.
+
+Detection for guard 1:
+
+```bash
+test -d e2e/features
+```
+
+If either guard trips, skip the phase entirely. No briefing line.
+
+## Detection algorithm
+
+1. **Query pib-db for pending UI-touching actions without a Verify
+   Plan section.** The default heuristic matches the surface-area path
+   patterns used by `verify-coverage.md`:
+
+   ```sql
+   SELECT fid, text, notes FROM actions
+   WHERE completed = 0
+     AND deleted_at IS NULL
+     AND (
+       notes LIKE '%webapp/frontend/%'
+       OR notes LIKE '%components/%'
+       OR notes LIKE '%pages/%'
+       OR notes LIKE '%app/%'
+     )
+     AND notes NOT LIKE '%## Verify Plan%'
+   ORDER BY created ASC;
+   ```
+
+   Run via `node scripts/pib-db.mjs query "<sql>"` or, if the project
+   has a `phases/ui-paths.md` override, substitute those paths.
+
+2. **Per match, judge whether it really is UI-touching.** The path
+   heuristic over-matches (e.g., an action that merely mentions
+   `webapp/frontend/` in a passing comment). Read the action's
+   `## Surface Area` section if present and confirm the listed files
+   include a UI path. If not, drop the match silently.
+
+3. **Cap at 5 entries.** If more than 5 match, list the 5
+   oldest-created and append a "(+N more — run /pulse for full list)"
+   note. Don't dump 20 entries into the orient briefing.
+
+## Output
+
+For each remaining match, emit one Attention Items entry:
+
+> **`<fid>`** — `<action text>`
+>   Pending plan touches UI but lacks a `## Verify Plan` section.
+>   Suggest: `/plan <fid>` to backfill the section, or accept drift —
+>   `/debrief` will flag this act on completion if it ships uncovered.
+
+The entries go in the briefing's **Attention Items** section,
+alongside any items surfaced by deferred-check, health-checks, etc.
+
+## What this phase does NOT do
+
+- It does not modify action notes. The operator runs `/plan <fid>`
+  to backfill, or chooses to accept the drift.
+- It does not file new actions or projects.
+- It does not block orient. Even with 5 backfill candidates, orient
+  completes; the Attention Items accumulate.
+- It does not look at *completed* acts — that's verify-coverage's job
+  on `/debrief`.
+
+## Tuning to reduce false positives
+
+Two common refinements:
+
+1. **Path override.** A project's `phases/ui-paths.md` (if defined)
+   replaces the default path list. See `verify-coverage.md` for the
+   same pattern.
+2. **Per-act opt-out.** An action can declare in its notes that it's
+   intentionally backend-only:
+   ```
+   ## Verify Coverage
+   Skip: this change is internal — no UI behavior changed.
+   ```
+   This phase reads that line and skips the act, same as
+   verify-coverage does.