create-cmp-cli 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-cmp-cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "The AI delivery harness for Kotlin/Compose Multiplatform — scaffolds a green-building app (Android + iOS) in minutes and holds AI-driven changes to a machine-enforced verify lane with a committed evidence receipt. Installs the `create-cmp` command.",
   "type": "module",
   "bin": {

package/template/gitignore

@@ -2,7 +2,10 @@
 .gradle
 /local.properties
 .DS_Store
-/build
+# Gradle build outputs — unanchored so module dirs (composeApp/build/, …) match too,
+# not just a root-level build/. Anchored `/build` misses composeApp/build/, which would
+# then get committed and destabilise the evidence receipt's inputs hash.
+build/
 /captures
 .externalNativeBuild
 .cxx

package/template/qa/lib/inputs-hash.mjs

@@ -33,9 +33,16 @@ function isExcluded(relPath) {
   return EXCLUDED_PREFIXES.some((prefix) => relPath === prefix || relPath.startsWith(`${prefix}/`));
 }
 
+// The verified surface is the set of files that WILL be committed: tracked files
+// PLUS untracked-but-not-ignored files (`--others --exclude-standard`). A freshly
+// generated feature's files are untracked when the lane runs and the receipt is
+// written, yet they land in the very same commit as the receipt — so they must be
+// hashed, or the committed receipt would never attest its own commit (and CI's
+// receipt-matches-HEAD gate would false-fail on every change). Gitignored scratch
+// (build outputs, qa-artifacts) is still excluded via --exclude-standard.
 function tryGitLsFiles(root) {
   try {
-    const out = execSync("git ls-files -z", { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const out = execSync("git ls-files -z --cached --others --exclude-standard", { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     return out.split("\0").filter(Boolean);
   } catch {
     return null;