crewforth 3.1.0 → 3.1.1

package/CHANGELOG.md

@@ -5,6 +5,19 @@ Crewforth was named Claude Starter Kit until 3.0.0.
 Notable changes to this project are recorded here. Format follows [Keep a Changelog](https://keepachangelog.com/en/),
 versioning follows [SemVer](https://semver.org/).
 
+## [3.1.1] — 2026-10-12
+
+### Fixed
+
+- **An update could write this machine's path into `.claude/git-shim`, a file projects commit.** The updater knew
+  the kit's own hooks directory only when `core.hooksPath` was spelled `.claude/hooks`. Spelled as an absolute path
+  (seen in a real project) it was taken for a hook chain of the project's own, and the shim named
+  `$ROOT//Users/<name>/…/.claude/hooks`: a path that does not exist, so nothing ran twice, but the user name and
+  the folder layout went into the repository. `core.hooksPath` is now read for what it names (the same directory,
+  whatever the spelling), a chain inside the repository is named from the root, and a chain outside it is kept in
+  the clone's git config (`crewforth.hookschain`) and read by the shim when it runs. A shim an earlier update
+  wrote for that case is removed by the next update.
+
 ## [3.1.0] — 2026-10-12
 
 ### Security

package/VERSION

@@ -1 +1 @@
-3.1.0
+3.1.1

package/adopt.sh

@@ -524,12 +524,53 @@ fi
 rowm 'git' "$GITKIND"   # every GITKIND value is a literal with its own table row
 
 # existing hook system (decision #5 — single-hooksPath clash with husky/lefthook)
-HOOKSYS="none"; SHIM_CHAIN=""
+# WHAT core.hooksPath NAMES, however it is spelled. It was matched as text against `.claude/hooks`, so the same
+# directory written as an absolute path (seen in a real project) was read as a hook chain of the project's own:
+# the shim then named `$ROOT//Users/<name>/…/.claude/hooks`, a path that does not exist and that carries the
+# machine's user name into a file projects commit; had it existed, every hook would have run twice.
+# Asked of the file system and of git, not of the spelling: `-ef` says whether two names are one directory, and
+# `git rev-parse --show-prefix` says where a directory is inside the repository.
+_hp_class(){  # $1 = a hooks path as configured -> HP_KIND: none | own | shim | in (HP_REL, from the root) | out (HP_ABS)
+  local p="$1" top pfx r
+  HP_KIND=none; HP_REL=""; HP_ABS=""
+  [ -n "$p" ] || return 0
+  case "$p" in '~/'*) p="$HOME/${p#\~/}" ;; esac
+  while :; do case "$p" in ?*/) p="${p%/}" ;; *) break ;; esac; done
+  case "$p" in
+    /*|[A-Za-z]:[/\\]*)
+      if [ -d "$p" ]; then
+        if [ -d .claude/hooks ] && [ "$p" -ef .claude/hooks ]; then HP_KIND=own; return 0; fi
+        if [ -d .claude/git-shim ] && [ "$p" -ef .claude/git-shim ]; then HP_KIND=shim; return 0; fi
+        top="$(git -C "$p" rev-parse --show-toplevel 2>/dev/null || true)"
+        if [ -n "$top" ] && [ "$top" -ef . ]; then
+          pfx="$(git -C "$p" rev-parse --show-prefix 2>/dev/null || true)"; pfx="${pfx%/}"
+          if [ -n "$pfx" ]; then HP_KIND=in; HP_REL="$pfx"; return 0; fi
+        fi
+      fi
+      # Not there, or git cannot place it (.git/hooks is not in the work tree): the spelling is what is left.
+      for r in "$PWD" "$(pwd -P 2>/dev/null || true)"; do
+        [ -n "$r" ] || continue
+        case "$p" in "$r"/?*) p="${p#"$r"/}"
+          case "$p" in .claude/hooks) HP_KIND=own ;; .claude/git-shim) HP_KIND=shim ;; *) HP_KIND=in; HP_REL="$p" ;; esac
+          return 0 ;;
+        esac
+      done
+      HP_KIND=out; HP_ABS="$p" ;;
+    *)
+      while :; do case "$p" in ./?*) p="${p#./}" ;; *) break ;; esac; done
+      case "$p" in .claude/hooks) HP_KIND=own; return 0 ;; .claude/git-shim) HP_KIND=shim; return 0 ;; esac
+      if [ -d "$p" ] && [ -d .claude/hooks ] && [ "$p" -ef .claude/hooks ]; then HP_KIND=own; return 0; fi
+      if [ -d "$p" ] && [ -d .claude/git-shim ] && [ "$p" -ef .claude/git-shim ]; then HP_KIND=shim; return 0; fi
+      HP_KIND=in; HP_REL="$p" ;;
+  esac
+}
+HOOKSYS="none"; SHIM_CHAIN=""; SHIM_OUT=0; CUR_OUT=0
 CURHP="$(git config --get core.hooksPath 2>/dev/null || true)"
-case "$CURHP" in
-  "") : ;;
-  .claude/hooks) HOOKSYS="Crewforth (already armed)"; CURHP="" ;;   # kit's OWN path — not a foreign chain (re-adopt must not shim itself)
-  .claude/git-shim)
+_hp_class "$CURHP"
+case "$HP_KIND" in
+  none) : ;;
+  own) HOOKSYS="Crewforth (already armed)"; CURHP="" ;;   # kit's OWN path — not a foreign chain (re-adopt must not shim itself)
+  shim)
     # Crewforth's shim, from an earlier run: git is pointed at it, and IT holds the project's own chain. That chain
     # is read back from the shim, or the next lines would see "no chain" and point git straight at .claude/hooks:
     # measured, the second update of a project with core.hooksPath=myhooks left its own pre-commit never running
@@ -540,14 +581,23 @@ case "$CURHP" in
       [ -f "$_sf" ] || continue
       while IFS= read -r _sl || [ -n "$_sl" ]; do
         _sl="${_sl%$'\r'}"
+        # (A shim written before this was fixed can hold `P="$ROOT//abs/path/$H"`: what is left after `$ROOT/` is
+        # the absolute path, and it is classed like any other.)
         case "$_sl" in 'P="'*'/$H"') _sl="${_sl#P=\"}"; _sl="${_sl%/\$H\"}"; _sl="${_sl#\$ROOT/}"
-          case "$_sl" in ''|.claude/hooks|.claude/git-shim) ;; *) SHIM_CHAIN="$_sl" ;; esac ;;
+          _hp_class "$_sl"
+          case "$HP_KIND" in in) SHIM_CHAIN="$HP_REL"; SHIM_OUT=0 ;; out) SHIM_CHAIN="$HP_ABS"; SHIM_OUT=1 ;; esac ;;
         esac
       done < "$_sf"
       [ -n "$SHIM_CHAIN" ] && break
     done
+    # A chain outside the repository is not written in the shim: it is in this clone's git config.
+    if [ -z "$SHIM_CHAIN" ]; then
+      _hp_class "$(git config --get crewforth.hookschain 2>/dev/null || true)"
+      case "$HP_KIND" in in) SHIM_CHAIN="$HP_REL"; SHIM_OUT=0 ;; out) SHIM_CHAIN="$HP_ABS"; SHIM_OUT=1 ;; esac
+    fi
     [ -n "$SHIM_CHAIN" ] && HOOKSYS="core.hooksPath=$SHIM_CHAIN" ;;
-  *) HOOKSYS="core.hooksPath=$CURHP" ;;
+  in)  CURHP="$HP_REL"; HOOKSYS="core.hooksPath=$CURHP" ;;
+  out) CURHP="$HP_ABS"; CUR_OUT=1; HOOKSYS="core.hooksPath=$CURHP" ;;
 esac
 [ -d .husky ] && HOOKSYS="husky (.husky/)"
 { [ -f lefthook.yml ] || [ -f .lefthook.yml ]; } && HOOKSYS="lefthook"
@@ -1627,9 +1677,9 @@ else HAND_SET="hook-aware merge (Crewforth hooks REFRESHED to current — new ev
 h1m 'Stage 4 — arm the git gates (SHIM via husky) + PROOF'
 
 # 4a) location of the existing hook chain (the shim calls this too)
-ORIG_HOOKS=""
-if [ -n "$CURHP" ]; then ORIG_HOOKS="$CURHP"
-elif [ -n "$SHIM_CHAIN" ]; then ORIG_HOOKS="$SHIM_CHAIN"   # the chain the shim of an earlier run already runs
+ORIG_HOOKS=""; ORIG_OUT=0
+if [ -n "$CURHP" ]; then ORIG_HOOKS="$CURHP"; ORIG_OUT="$CUR_OUT"
+elif [ -n "$SHIM_CHAIN" ]; then ORIG_HOOKS="$SHIM_CHAIN"; ORIG_OUT="$SHIM_OUT"   # the chain the shim of an earlier run already runs
 elif [ -d .husky ]; then ORIG_HOOKS=".husky"
 elif [ -x .git/hooks/pre-commit ] || [ -x .git/hooks/commit-msg ]; then ORIG_HOOKS=".git/hooks"; fi
 # never shim the kit onto its OWN hooks (re-adopt) — the shim would exec itself and recurse on every commit
@@ -1637,9 +1687,28 @@ case "$ORIG_HOOKS" in .claude/hooks|.claude/git-shim) ORIG_HOOKS="" ;; esac
 
 if [ -z "$ORIG_HOOKS" ]; then
   git config core.hooksPath .claude/hooks
+  git config --unset-all crewforth.hookschain 2>/dev/null || true
+  # A shim of an earlier run has no chain to run any more. It is Crewforth's own generated file (its second line
+  # says so), and one written before the fix above can hold a path of this machine: it goes, and nothing else does.
+  for hk in pre-commit commit-msg; do
+    if [ -f ".claude/git-shim/$hk" ] && grep -q '^# kit git-shim:' ".claude/git-shim/$hk" 2>/dev/null; then rm -f ".claude/git-shim/$hk"; fi
+  done
+  [ -d .claude/git-shim ] && rmdir .claude/git-shim 2>/dev/null || true
   say 'core.hooksPath -> .claude/hooks (no existing hook chain)'
 else
   mkdir -p .claude/git-shim
+  # THE SHIM HOLDS NO PATH OF THIS MACHINE. A chain inside the repository is named from the root. One outside it
+  # (a hooks directory in the user's home) is kept in this clone's git config, which is not committed, and the shim
+  # reads it when it runs.
+  if [ "$ORIG_OUT" = 1 ]; then
+    git config crewforth.hookschain "$ORIG_HOOKS"
+    _shp='C="$(git config --get crewforth.hookschain 2>/dev/null || true)"
+P=""
+[ -z "$C" ] || P="$C/$H"'
+  else
+    git config --unset-all crewforth.hookschain 2>/dev/null || true
+    _shp="P=\"\$ROOT/$ORIG_HOOKS/\$H\""
+  fi
   for hk in pre-commit commit-msg; do
     cat > ".claude/git-shim/$hk" <<SHIM
 #!/usr/bin/env bash
@@ -1648,7 +1717,7 @@ set -e
 H="\$(basename "\$0")"
 ROOT="\$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 K="\$ROOT/.claude/hooks/\$H"; [ -x "\$K" ] && "\$K" "\$@"
-P="\$ROOT/$ORIG_HOOKS/\$H"
+$_shp
 if   [ -x "\$P" ]; then "\$P" "\$@"
 elif [ -f "\$P" ]; then bash "\$P" "\$@"; fi
 exit 0

package/kit/owned-blobs.tsv

@@ -1,9 +1,10 @@
-# Generated by packaging/gen-legacy-blobs.sh from the final release tags v1.0.0..v3.0.4 (below VERSION 3.1.0) — do not edit by hand.
+# Generated by packaging/gen-legacy-blobs.sh from the final release tags v1.0.0..v3.1.0 (below VERSION 3.1.1) — do not edit by hand.
 # The flat files Crewforth owns: a copy whose bytes (CR aside) are one of these ids was never edited.
 # install_path	blob_sha1	first_tag	last_tag
 .claude/AGENT_TEMPLATE.md	075e2c26706c06f56af01652cd24c36918513bee	v3.0.0	v3.0.4
 .claude/AGENT_TEMPLATE.md	3fdc551d221ee3665b21ef8cc3563de861a9abe6	v1.4.0	v1.6.3
 .claude/AGENT_TEMPLATE.md	686fed306c873b45c245c77a95a8e6de6ee383d5	v1.7.0	v2.11.0
+.claude/AGENT_TEMPLATE.md	7ab19417b6ff3ac732e2c894be17ffb3ec091f7d	v3.1.0	v3.1.0
 .claude/AGENT_TEMPLATE.md	981df9ea27b6f1c5ab5cb509d40875a07603858d	v2.12.0	v2.13.0
 .claude/AGENT_TEMPLATE.md	b38b9c9b799156e07280ca886230524563acc75c	v1.0.5	v1.3.0
 .claude/AGENT_TEMPLATE.md	faec09e45543b75763c43bb24114a7b6355649ec	v1.0.0	v1.0.4
@@ -25,6 +26,7 @@
 .claude/DISCIPLINE.md	76d73a4e25c559ea361618862cde8480b1a6d8c2	v3.0.0	v3.0.0
 .claude/DISCIPLINE.md	b1ab7549b571dd2fc80d5777e0ae3185d29bd7b6	v2.13.0	v2.13.0
 .claude/DISCIPLINE.md	b7e1066451a8590e0a2607ad0a6fe80b21599c53	v1.1.3	v1.1.8
+.claude/DISCIPLINE.md	b90a067ee323a08146862b889293f8feb49f8e7e	v3.1.0	v3.1.0
 .claude/DISCIPLINE.md	bf062c2b51a9cf3cc4d0caac389c148cf6fdc977	v2.12.0	v2.12.0
 .claude/DISCIPLINE.md	c693f1bd5832ce570058c6eedcacb5dff13d89e8	v1.10.0	v1.10.0
 .claude/DISCIPLINE.md	d63a01a183c9a80d739c840a511d338dc2765820	v1.4.0	v1.4.4
@@ -41,3 +43,4 @@
 .claude/README.md	97d4dd1f7f1695052cc1d06cc43f5bcdc603c989	v1.0.0	v1.0.4
 .claude/README.md	a3419891cfda7385564008e4befc1007bc5364cb	v1.1.1	v1.7.0
 .claude/README.md	a3b76e0fa31267610d28b742c122a962f6db59c4	v3.0.1	v3.0.4
+.claude/README.md	b6c9b57a67d25b7e4781e4eb61ff9637e6abe5ef	v3.1.0	v3.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewforth",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Crewforth \u2014 your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"