create-claude-cabinet 0.46.0 → 0.48.0

package/lib/settings-merge.js

@@ -8,7 +8,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/git-guardrails.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/git-guardrails.sh',
         },
       ],
     },
@@ -17,7 +17,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/work-tracker-guard.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/work-tracker-guard.sh',
         },
       ],
     },
@@ -26,25 +26,30 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/cc-upstream-guard.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/cc-upstream-guard.sh',
         },
       ],
     },
     {
-      matcher: 'pib_create_action',
+      // pib tools arrive as `mcp__<server>__<tool>`, so the bare
+      // `pib_create_action` spelling never matched and this gate was silently
+      // dead since it shipped (audit cabinet-anthropic-insider-0001, run
+      // 09-20-25 — proven live: all 14 audit actions were created with no AC
+      // check). Match the real MCP tool name.
+      matcher: 'mcp__pib-db__pib_create_action',
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/action-quality-gate.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/action-quality-gate.sh',
         },
       ],
     },
     {
-      matcher: 'pib_complete_action',
+      matcher: 'mcp__pib-db__pib_complete_action',
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/action-completion-gate.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/action-completion-gate.sh',
         },
       ],
     },
@@ -55,7 +60,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/skill-telemetry.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/skill-telemetry.sh',
         },
       ],
     },
@@ -66,7 +71,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/skill-tool-telemetry.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/skill-tool-telemetry.sh',
         },
       ],
     },
@@ -75,7 +80,7 @@ const DEFAULT_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/memory-index-guard.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/memory-index-guard.sh',
         },
       ],
     },
@@ -133,7 +138,29 @@ const BASH_COMPRESS_HOOKS = {
       hooks: [
         {
           type: 'command',
-          command: '.claude/hooks/bash-output-compress.sh',
+          command: '$CLAUDE_PROJECT_DIR/.claude/hooks/bash-output-compress.sh',
+        },
+      ],
+    },
+  ],
+};
+
+// Maintainer-only ("repo-local") dev hooks — registered by mergeCcDevHooks()
+// ONLY when installing into the Claude Cabinet SOURCE repo (package.json
+// name === 'create-claude-cabinet'), never in a consumer install. node-check
+// mechanizes the CLAUDE.md "node -c after CLI edits" rule (architecture-0004).
+// The hook script is a tracked maintainer tool at scripts/node-check-hook.sh —
+// NOT a MODULES template, so it never ships to consumers. Registered durably
+// (re-added on every dogfood reinstall) rather than hand-added to the gitignored
+// settings.json, which the installer would silently regenerate away.
+const CC_DEV_HOOKS = {
+  PostToolUse: [
+    {
+      matcher: 'Edit|Write',
+      hooks: [
+        {
+          type: 'command',
+          command: '$CLAUDE_PROJECT_DIR/scripts/node-check-hook.sh',
         },
       ],
     },
@@ -156,6 +183,38 @@ const LEGACY_HOOK_COMMANDS = [
   'domain-memories.sh',
 ];
 
+// CC-owned hook commands ship with a `$CLAUDE_PROJECT_DIR/` prefix so they
+// resolve regardless of the hook's working directory. Older installs wrote them
+// bare-relative (`.claude/hooks/X.sh`), which break ("No such file or
+// directory") whenever a hook fires from a non-root cwd. bareForm() derives that
+// legacy spelling so a reinstall can REPLACE it (drop old, add prefixed) rather
+// than leave a broken duplicate.
+function bareForm(command) {
+  return (command || '').replace(/^\$CLAUDE_PROJECT_DIR\//, '');
+}
+
+// Every CC-owned hook command in a hook set, in its current spelling.
+function ccHookCommands(hookSet) {
+  return Object.values(hookSet)
+    .flatMap(entries => entries.flatMap(e => (e.hooks || []).map(h => h.command)));
+}
+
+// Remove every sub-hook whose command exactly matches one of `commands`, and
+// prune entries left empty. Exact-match on CC-owned command strings only — a
+// consumer's own hooks (different paths) are never touched.
+function dropHookCommands(settings, commands) {
+  const drop = new Set(commands.filter(Boolean));
+  for (const [event, entries] of Object.entries(settings.hooks || {})) {
+    if (!Array.isArray(entries)) continue;
+    settings.hooks[event] = entries
+      .map(entry => (entry.hooks && Array.isArray(entry.hooks))
+        ? { ...entry, hooks: entry.hooks.filter(h => !drop.has(h.command)) }
+        : entry)
+      .filter(entry => !entry.hooks || !Array.isArray(entry.hooks) || entry.hooks.length > 0);
+    if (settings.hooks[event].length === 0) delete settings.hooks[event];
+  }
+}
+
 /**
  * Merge PIB hooks into the project's .claude/settings.json.
  * Creates the file if it doesn't exist. Preserves existing hooks.
@@ -199,6 +258,21 @@ function mergeSettings(projectDir, { includeDb = true } = {}) {
     if (!settings.hooks[event]) continue;
   }
 
+  // Retire superseded CC hook entries so the DEFAULT_HOOKS forms below REPLACE
+  // them rather than duplicate — covering TWO kinds of drift:
+  //   (a) a changed command spelling (bare-relative `.claude/hooks/X.sh` →
+  //       `$CLAUDE_PROJECT_DIR/.claude/hooks/X.sh`, which resolves from any cwd);
+  //   (b) a changed MATCHER on an unchanged command (the bare `pib_create_action`
+  //       matcher → `mcp__pib-db__pib_create_action`). The merge loop below
+  //       dedups by COMMAND alone, so a stale-matcher entry would otherwise
+  //       survive untouched while the corrected entry was skipped as a dup —
+  //       exactly how the pib gate hooks stayed dead across reinstalls.
+  // Dropping every CURRENT-spelling CC command (and its bare form) forces a
+  // clean re-add with the correct current matcher. Exact-match on CC-owned
+  // commands only — consumer-authored hooks are left intact.
+  const ccCommands = ccHookCommands(DEFAULT_HOOKS);
+  dropHookCommands(settings, [...ccCommands, ...ccCommands.map(bareForm)]);
+
   // Merge each hook event type from DEFAULT_HOOKS
   for (const [event, newHooks] of Object.entries(DEFAULT_HOOKS)) {
     if (!settings.hooks[event]) {
@@ -254,7 +328,7 @@ function healUserSettings() {
     const filtered = entries.filter(entry => {
       if (!entry.hooks || !Array.isArray(entry.hooks)) return true;
       const hasRelativeCcHook = entry.hooks.some(h =>
-        /^\.claude\/hooks\//.test(h.command || '')
+        /^(\$CLAUDE_PROJECT_DIR\/)?\.claude\/hooks\//.test(h.command || '')
       );
       if (hasRelativeCcHook) removed++;
       return !hasRelativeCcHook;
@@ -338,6 +412,9 @@ function mergeBashCompressHooks(settingsPath) {
   const settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
   if (!settings.hooks) settings.hooks = {};
 
+  // Replace any superseded bare-relative form with the prefixed one (see mergeSettings).
+  dropHookCommands(settings, ccHookCommands(BASH_COMPRESS_HOOKS).map(bareForm));
+
   for (const [event, newHooks] of Object.entries(BASH_COMPRESS_HOOKS)) {
     if (!settings.hooks[event]) {
       settings.hooks[event] = newHooks;
@@ -358,4 +435,108 @@ function mergeBashCompressHooks(settingsPath) {
   fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
 }
 
-module.exports = { mergeSettings, healUserSettings, mergeWatchtowerHooks, mergeMuxHooks, mergeBashCompressHooks, DEFAULT_HOOKS, WATCHTOWER_HOOKS, MUX_HOOKS, BASH_COMPRESS_HOOKS, LEGACY_HOOK_COMMANDS };
+/**
+ * Register maintainer-only ("repo-local") dev hooks — but ONLY when installing
+ * into the Claude Cabinet SOURCE repo itself (target package.json
+ * name === 'create-claude-cabinet'). A silent no-op in every consumer project.
+ * Idempotent + reinstall-safe: drops the CC-owned dev commands (current + bare
+ * spellings) then re-adds them, so a reinstall REPLACES rather than duplicates.
+ * Returns true if it registered, false if it no-op'd (not the CC repo).
+ */
+function mergeCcDevHooks(projectDir) {
+  let pkgName = '';
+  try {
+    pkgName =
+      JSON.parse(fs.readFileSync(path.join(projectDir, 'package.json'), 'utf8'))
+        .name || '';
+  } catch {
+    /* no/invalid package.json → not the CC repo → no-op */
+  }
+  if (pkgName !== 'create-claude-cabinet') return false;
+
+  const settingsDir = path.join(projectDir, '.claude');
+  const settingsPath = path.join(settingsDir, 'settings.json');
+  if (!fs.existsSync(settingsDir)) fs.mkdirSync(settingsDir, { recursive: true });
+
+  let settings = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    } catch {
+      settings = {};
+    }
+  }
+  if (typeof settings !== 'object' || settings === null || Array.isArray(settings)) {
+    settings = {};
+  }
+  if (!settings.hooks) settings.hooks = {};
+
+  // Drop current + bare spellings so a reinstall replaces, not duplicates.
+  const devCommands = ccHookCommands(CC_DEV_HOOKS);
+  dropHookCommands(settings, [...devCommands, ...devCommands.map(bareForm)]);
+
+  for (const [event, newHooks] of Object.entries(CC_DEV_HOOKS)) {
+    if (!settings.hooks[event]) settings.hooks[event] = [];
+    for (const newHook of newHooks) settings.hooks[event].push(newHook);
+  }
+
+  fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+  return true;
+}
+
+/**
+ * Set `skillOverrides: "name-only"` for the given skills in .claude/settings.json
+ * (act:bee0fa16, cabinet-anthropic-insider-0002). Claude Code loads every skill's
+ * name+description into context so the model can auto-invoke by trigger keyword,
+ * under a budget of ~1% of the context window; when it overflows, the
+ * least-invoked skills' descriptions are dropped first — silently stripping the
+ * keywords that make them auto-invocable. cabinet-* skills are ~half that
+ * listing and are spawned by name (agentType), never auto-invoked by
+ * description, so "name-only" costs them nothing while freeing budget for the
+ * routing skills (orient/debrief/briefing/inbox/…) that DO need full keywords.
+ *
+ * Only-if-absent: an existing skillOverrides entry (a user who deliberately set
+ * a cabinet skill back to "on") is never clobbered. Idempotent — a reinstall
+ * re-applies only for skills with no entry yet (e.g. a newly-added cabinet
+ * member). Creates .claude/settings.json if absent. Returns the count added.
+ */
+function mergeSkillOverrides(projectDir, skillNames = []) {
+  if (!Array.isArray(skillNames) || skillNames.length === 0) return 0;
+  const settingsDir = path.join(projectDir, '.claude');
+  const settingsPath = path.join(settingsDir, 'settings.json');
+  if (!fs.existsSync(settingsDir)) fs.mkdirSync(settingsDir, { recursive: true });
+
+  let settings = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+    } catch {
+      settings = {};
+    }
+  }
+  if (typeof settings !== 'object' || settings === null || Array.isArray(settings)) {
+    settings = {};
+  }
+  if (
+    !settings.skillOverrides ||
+    typeof settings.skillOverrides !== 'object' ||
+    Array.isArray(settings.skillOverrides)
+  ) {
+    settings.skillOverrides = {};
+  }
+
+  let added = 0;
+  for (const name of skillNames) {
+    if (!name) continue;
+    if (!(name in settings.skillOverrides)) {
+      settings.skillOverrides[name] = 'name-only';
+      added++;
+    }
+  }
+  if (added > 0) {
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+  }
+  return added;
+}
+
+module.exports = { mergeSettings, healUserSettings, mergeWatchtowerHooks, mergeMuxHooks, mergeBashCompressHooks, mergeCcDevHooks, mergeSkillOverrides, DEFAULT_HOOKS, WATCHTOWER_HOOKS, MUX_HOOKS, BASH_COMPRESS_HOOKS, CC_DEV_HOOKS, LEGACY_HOOK_COMMANDS };

package/lib/site-audit-setup.js

@@ -10,12 +10,17 @@ const { execSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { tarballIsStale, writeSourceHash } = require('./installer-gate');
 
 const CC_HOME = path.join(os.homedir(), '.claude-cabinet');
 const SITE_AUDIT_BASE = path.join(CC_HOME, 'site-audit');
 
 function setupSiteAuditRuntime(opts = {}) {
   const dryRun = !!opts.dryRun;
+  const exec = opts.exec || execSync; // injectable for tests
+  // The heavy extract+install step (npm install, puppeteer, chromedriver) is
+  // injectable so the pack/skip/re-pack gate can be exercised in tests.
+  const installTarball = opts.installTarball || extractAndInstall;
   const runtimeSourceDir =
     opts.runtimeSourceDir || path.resolve(__dirname, '..', 'templates', 'site-audit-runtime');
 
@@ -43,20 +48,28 @@ function setupSiteAuditRuntime(opts = {}) {
     return { installPath: installDir, version, status: 'dry-run', results };
   }
 
-  if (fs.existsSync(tarballPath) && fs.statSync(tarballPath).size > 1024) {
-    // Tarball exists — ensure it's extracted and installed (may have been
-    // packed but not installed on a prior run)
-    extractAndInstall(path.join(SITE_AUDIT_BASE, version), tarballPath, results);
+  // Idempotency + equal-version fall-through: reuse the tarball ONLY when the
+  // runtime SOURCE content is unchanged (hash sidecar matches). A same-version
+  // reinstall carrying a template edit re-packs instead of hard-skipping (the
+  // tarball parallel to act:df1a1dc3; technical-debt-0003).
+  const staleness = tarballIsStale({ tarballPath, installDir, runtimeSourceDir });
+  if (!staleness.stale) {
+    // Tarball exists and source is unchanged — ensure it's extracted and
+    // installed (may have been packed but not installed on a prior run)
+    installTarball(path.join(SITE_AUDIT_BASE, version), tarballPath, results);
     updateCurrentBinSymlink(SITE_AUDIT_BASE, version);
     writeVersionPointer(versionPointer, version);
-    results.push(`@claude-cabinet/site-audit@${version} already installed (${tarballPath})`);
+    results.push(`@claude-cabinet/site-audit@${version} already installed, source unchanged (${tarballPath})`);
     return { installPath: installDir, version, status: 'skipped', results };
   }
+  if (staleness.reason === 'source-changed' || staleness.reason === 'no-source-hash') {
+    results.push(`@claude-cabinet/site-audit@${version} runtime source changed — re-packing`);
+  }
 
   if (fs.existsSync(tarballPath)) fs.unlinkSync(tarballPath);
 
   fs.mkdirSync(installDir, { recursive: true });
-  const packStdout = execSync(`npm pack --silent --pack-destination "${installDir}"`, {
+  const packStdout = exec(`npm pack --silent --pack-destination "${installDir}"`, {
     cwd: runtimeSourceDir,
     encoding: 'utf8',
   }).trim();
@@ -75,8 +88,11 @@ function setupSiteAuditRuntime(opts = {}) {
   }
 
   // Extract and install so the runtime is runnable (not just a tarball)
-  extractAndInstall(path.join(SITE_AUDIT_BASE, version), tarballPath, results);
+  installTarball(path.join(SITE_AUDIT_BASE, version), tarballPath, results);
 
+  // Record the runtime-source hash so the next same-version reinstall can
+  // skip when unchanged and re-pack when it changed.
+  writeSourceHash(installDir, staleness.sourceHash);
   writeVersionPointer(versionPointer, version);
   updateCurrentBinSymlink(SITE_AUDIT_BASE, version);
   results.push(`Installed @claude-cabinet/site-audit@${version}`);

package/lib/verify-setup.js

@@ -15,6 +15,7 @@ const { execSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
+const { tarballIsStale, writeSourceHash } = require('./installer-gate');
 
 const CC_HOME = path.join(os.homedir(), '.claude-cabinet');
 const VERIFY_BASE = path.join(CC_HOME, 'verify');
@@ -40,6 +41,7 @@ const VERIFY_BASE = path.join(CC_HOME, 'verify');
  */
 function setupVerifyRuntime(opts = {}) {
   const dryRun = !!opts.dryRun;
+  const exec = opts.exec || execSync; // injectable for tests
   const runtimeSourceDir =
     opts.runtimeSourceDir || path.resolve(__dirname, '..', 'templates', 'verify-runtime');
 
@@ -72,21 +74,27 @@ function setupVerifyRuntime(opts = {}) {
     return { installPath: installDir, version, status: 'dry-run', results };
   }
 
-  // 3. Idempotency check. Existence alone is not enough — an earlier
-  // stub-touch (e.g., a test fixture) can leave a 0-byte file at the
-  // tarball path. npm install on the consumer side then fails with
-  // ENODATA / TAR_BAD_ARCHIVE. Validate the file has non-trivial size
-  // before treating it as installed.
-  if (fs.existsSync(tarballPath) && fs.statSync(tarballPath).size > 1024) {
-    results.push(`cabinet-verify@${version} already installed (${tarballPath})`);
+  // 3. Idempotency + equal-version fall-through. A present, non-truncated
+  // tarball is reused ONLY when the runtime SOURCE content is unchanged (its
+  // hash sidecar still matches). A same-version reinstall that carries a
+  // template edit re-packs instead of hard-skipping — the tarball parallel
+  // to the per-file-manifest fix (act:df1a1dc3; technical-debt-0003). A
+  // truncated stub (earlier fixture touch → ENODATA/TAR_BAD_ARCHIVE on the
+  // consumer) also counts as stale.
+  const staleness = tarballIsStale({ tarballPath, installDir, runtimeSourceDir });
+  if (!staleness.stale) {
+    results.push(`cabinet-verify@${version} already installed, source unchanged (${tarballPath})`);
     // Even on skip, ensure the VERSION pointer is up-to-date so a later
     // version downgrade doesn't leave a stale pointer behind.
     writeVersionPointer(versionPointer, version);
     results.push(`Updated VERSION pointer: ${versionPointer}`);
     return { installPath: installDir, version, status: 'skipped', results };
   }
+  if (staleness.reason === 'source-changed' || staleness.reason === 'no-source-hash') {
+    results.push(`cabinet-verify@${version} runtime source changed — re-packing`);
+  }
 
-  // Remove a 0-byte stub before re-packing so the move below doesn't
+  // Remove a stale/stub tarball before re-packing so the move below doesn't
   // hit a "file exists" surprise.
   if (fs.existsSync(tarballPath)) {
     fs.unlinkSync(tarballPath);
@@ -96,7 +104,7 @@ function setupVerifyRuntime(opts = {}) {
   fs.mkdirSync(installDir, { recursive: true });
   // Run npm pack in the runtime source dir. --pack-destination writes
   // the tarball directly to installDir without an intermediate cwd move.
-  const packStdout = execSync(`npm pack --silent --pack-destination "${installDir}"`, {
+  const packStdout = exec(`npm pack --silent --pack-destination "${installDir}"`, {
     cwd: runtimeSourceDir,
     encoding: 'utf8',
   }).trim();
@@ -122,6 +130,9 @@ function setupVerifyRuntime(opts = {}) {
     );
   }
 
+  // Record the runtime-source hash so the next same-version reinstall can
+  // skip when the source is unchanged, and re-pack when it changed.
+  writeSourceHash(installDir, staleness.sourceHash);
   results.push(`Installed cabinet-verify@${version} to ${tarballPath}`);
 
   // 5. Write VERSION pointer

package/lib/watchtower-setup.js

@@ -34,7 +34,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const crypto = require('crypto');
+const { sha256 } = require('./installer-gate');
 
 const CC_HOME = path.join(os.homedir(), '.claude-cabinet');
 const GLOBAL_MANIFEST_PATH = path.join(CC_HOME, 'global-manifest.json');
@@ -76,6 +76,7 @@ function buildManagedFiles() {
   const shellRunners = [
     'watchtower-ring1-runner.sh',
     'watchtower-ring2-runner.sh',
+    'watchtower-ring4-runner.sh',
     'watchtower-status.sh',
   ];
   for (const name of shellRunners) {
@@ -110,10 +111,6 @@ function buildManagedFiles() {
 
 const MANAGED_FILES = buildManagedFiles();
 
-function sha256(content) {
-  return crypto.createHash('sha256').update(content).digest('hex');
-}
-
 function readGlobalManifest() {
   if (!fs.existsSync(GLOBAL_MANIFEST_PATH)) return { files: {} };
   try {
@@ -168,8 +165,27 @@ function refreshWatchtowerRuntime(opts = {}) {
     const content = fs.readFileSync(file.src);
     const hash = sha256(content);
 
-    if (manifest.files[file.dest] === hash) {
-      continue; // file unchanged
+    // Content-aware skip: compare the template hash to the runtime file's
+    // ACTUAL on-disk bytes, NOT the cached manifest. The manifest can lie — a
+    // hand-edited or externally-replaced runtime file still carries the hash
+    // the manifest recorded at last write, so a manifest-only check would skip
+    // it and leave the divergence running. Reading the real file makes the
+    // refresh self-healing: any runtime file that differs from the template
+    // (or is missing) is rewritten, so a reinstall reliably reconverges the
+    // runtime onto the template instead of silently leaving it stale.
+    let runtimeHash = null;
+    if (fs.existsSync(file.dest)) {
+      try {
+        runtimeHash = sha256(fs.readFileSync(file.dest));
+      } catch {
+        runtimeHash = null; // unreadable runtime file → treat as divergent
+      }
+    }
+
+    if (runtimeHash === hash) {
+      // Already in sync on disk. Keep the manifest honest as bookkeeping.
+      if (!dryRun) manifest.files[file.dest] = hash;
+      continue;
     }
 
     if (dryRun) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-claude-cabinet",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "Claude Cabinet — opinionated process scaffolding for Claude Code projects",
   "bin": {
     "create-claude-cabinet": "bin/create-claude-cabinet.js"