dotnet-production-agent-skills 0.3.2 → 0.3.3

package/README.md

@@ -293,6 +293,20 @@ The CLI installs and manages guidance; it does not route prompts or load every s
 
 The initial policy blocks force-push, destructive Git reset/clean/branch deletion, broad recursive deletion, and direct access to common credential-bearing files. Safe commands continue normally. Host configuration is written to `.codex/hooks.json`, `.github/hooks/dotnet-production-agent-skills.json`, `.claude/settings.json`, `.cursor/hooks.json`, or `.agents/hooks.json` for Antigravity.
 
+### Reject co-author trailers with Git
+
+After v0.3.3 is published, opt in from each repository:
+
+```sh
+npx dotnet-production-agent-skills@0.3.3 git-hook
+# Preview, or select another repository
+npx dotnet-production-agent-skills@0.3.3 git-hook --project <path> --dry-run
+```
+
+This installs an executable Git `commit-msg` hook that rejects case-insensitive `Co-authored-by:` lines in the final commit message, including `-m`, `-F`, template, and `--trailer` input. It rejects the commit without editing the message. Node.js must be available when Git runs. The installer respects Git's configured `core.hooksPath`, does not change Git configuration, and refuses to overwrite existing or modified hooks even with `--force`. For an existing hook manager, integrate the packaged `hooks/commit-msg` check manually. Skill install/update/uninstall does not manage this separately opted-in Git hook.
+
+This local hook covers Git CLI commits from any agent or developer. It does not validate PR descriptions or GitHub/API-created commits, and `--no-verify` or disabling hooks can bypass it. Use a required server-side PR check to enforce the policy before merging API-created or bypassed commits. See [Git hook documentation](https://git-scm.com/docs/githooks#_commit_msg).
+
 Terminal recovery guidance keeps commands anchored to the intended repository, separates executable lookup from repository selection, and forbids moving into Git/tool installation directories as a workaround. Copilot project instructions include the critical rules so they are available even before the focused `safe-terminal` skill is selected. Skills and instructions guide the model; the existing hooks do not enforce these directory/recovery rules. See the skill's [shell recovery examples](skills/safe-terminal/references/shell-recovery.md) for diagnostics and primary sources.
 
 Copilot project installs manage only the text between `<!-- dotnet-production-agent-skills:start -->` and `<!-- dotnet-production-agent-skills:end -->`. Existing team instructions outside those markers remain intact. Uninstall removes only the managed section. User-scope Copilot installs install skills into `~/.copilot/skills`; repository instructions apply only to project scope.
@@ -318,6 +332,7 @@ Commands:
   list         Display available skills and current installation status
   doctor       Validate skill metadata and report host installation health
   uninstall    Safely remove only skills tracked by this package
+  git-hook     Opt in to a Git commit-msg hook in the current/--project repository
 ```
 
 ### Options & Flags

package/RELEASE_NOTES.md

@@ -1,8 +1,30 @@
 # Release notes
 
+## v0.3.3 — Strict coding-agent authorship rules
+
+Prepared for release after PR #13 is merged; not yet published to npm.
+
+### Improved
+
+- Add an opt-in `git-hook` CLI command that installs a Git `commit-msg` hook rejecting case-insensitive `Co-authored-by:` lines in final commit messages. Respect `core.hooksPath`, support dry-run and explicit project paths, and preserve existing hooks without changing Git configuration.
+- Strengthen the `git-workflow` skill, managed Copilot project instructions, and global engineering guardrails to prohibit `Co-authored-by:` trailers, equivalent co-author metadata, AI/agent signatures, and generated-by footers in commits and pull requests.
+- Cover indirect attribution through commit trailers, templates, API fields, and Git author/committer identity overrides.
+- Require inspection of complete proposed commit/PR messages before creation and new commits before pushing. If tooling inserts attribution, stop before publishing and report the blocker without bypassing hooks or rewriting existing commits.
+
+### Compatibility and upgrade
+
+- Existing CLI targets, scopes, flags, and copy/link modes are unchanged. Git hook installation is separate from skill installation and updates.
+- After publication, run `npx dotnet-production-agent-skills@0.3.3 git-hook` inside each repository to opt in. Node.js must be available when Git runs. Existing hook managers require manual integration.
+- The Git hook rejects co-author trailers locally; AI footers and PR text remain covered by agent instructions. API-created commits and hook bypasses require a server-side required check for merge enforcement.
+- After publication, update installed skills with `npx dotnet-production-agent-skills@0.3.3 update --target all`. Add `--scope project` to refresh that project's managed Copilot instructions and installed skills. Review local edits before updating.
+
+### Validation
+
+`npm run validate` passed: all 31 skills validated, the TypeScript build passed, and all 23 tests passed. Git hook tests cover real commits with inline, file-based, and trailer-based messages, installer idempotency, conflict preservation, custom hook paths, and dry-run behavior. Whitespace checks passed.
+
 ## v0.3.2 — Repository-safe terminal recovery
 
-Prepared for publication; this version has not yet been published to npm.
+Released in [`dotnet-production-agent-skills@0.3.2`](https://www.npmjs.com/package/dotnet-production-agent-skills/v/0.3.2).
 
 ### Improved
 
@@ -21,7 +43,7 @@ Prepared for publication; this version has not yet been published to npm.
 
 - CLI targets, scopes, flags, and copy/link modes are unchanged.
 - These changes strengthen agent guidance; existing hooks do not enforce the new repository-directory recovery rules.
-- After publication, update installed skills with `npx dotnet-production-agent-skills@0.3.2 update --target all`. Run the update in project scope (`--scope project`) to refresh that project's managed Copilot instructions and installed skills. Review local edits before updating.
+- Update installed skills with `npx dotnet-production-agent-skills@0.3.2 update --target all`. Run the update in project scope (`--scope project`) to refresh that project's managed Copilot instructions and installed skills. Review local edits before updating.
 
 ### Validation
 

package/copilot/production-instructions.md

@@ -7,4 +7,6 @@ Do not introduce retries automatically. Add them only when requested or required
 When behavior changes, check whether existing tests need updating. Avoid redundant tests that slow CI.
 Run the smallest appropriate validation, build, or test command after changing code.
 
+Strict authorship rule for every coding agent: never add `Co-authored-by:` trailers (case-insensitive), co-author metadata, AI/agent signatures, credits, or generated-by footers to commits or pull request titles/descriptions. Do not inject attribution through `--trailer`, templates, API fields, or author/committer identity overrides. Inspect the complete proposed commit/PR text and remove automatically suggested attribution before creation; inspect the new commits' full messages before pushing. If a hook, tool, or host adds attribution, stop before publishing and report the blocker. Do not bypass hooks, change configuration, amend existing commits, or rewrite published history without explicit authorization. Apply the git-workflow skill for the full procedure.
+
 Before terminal commands, apply the safe-terminal skill and verify the actual shell and project working directory. After a failure, inspect the submitted/executed command and first actionable error before choosing a correction. Never add terminal control sequences or move into Git/tool installation folders as a workaround. Executable location and repository location are separate: keep commands in the project, verify Git's intended repository with `git -C "<project-path>" rev-parse --show-toplevel`, and use same-session executable lookup only for a genuine command-not-found error. Do not guess binary paths, switch shells, edit PATH/profiles/configuration, or reinstall tools to escape an unexplained failure. Retry only after an evidence-based correction; stop after at most three distinct corrections.

package/dist/src/cli.js

@@ -9,6 +9,7 @@ import { createInterface } from "node:readline/promises";
 import { changeInstructions, inspectInstructions } from "./copilot/instructions.js";
 import { changeHooks, hookTargets, inspectHooks, removeSharedHookScript } from "./hooks.js";
 import { validateSkills } from "./skills/validation.js";
+import { installGitHook } from "./git-hook.js";
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
 const SKILLS_ROOT = path.join(PACKAGE_ROOT, "skills");
 const MANIFEST_NAME = ".dotnet-agent-skills.json";
@@ -22,6 +23,7 @@ Commands:
   list         List packaged skills and installation state
   doctor       Validate packaged skills and inspect installation health
   uninstall    Remove only skills tracked by this package
+  git-hook     Opt in to a Git commit-msg hook in the current/--project repository
 
 Options:
   --target <all|shared|codex|copilot|claude|cursor|antigravity>
@@ -459,11 +461,13 @@ async function main() {
             console.log(usage());
             return;
         }
-        const commands = new Set(["install", "update", "list", "doctor", "uninstall"]);
+        const commands = new Set(["install", "update", "list", "doctor", "uninstall", "git-hook"]);
         if (!commands.has(parsed.command))
             throw new Error(`unknown command: ${parsed.command}`);
         const command = parsed.command;
-        if (command === "install" || command === "update")
+        if (command === "git-hook")
+            console.log(await installGitHook(parsed.options.project, PACKAGE_ROOT, parsed.options.dryRun));
+        else if (command === "install" || command === "update")
             await installOrUpdate(parsed.options, command);
         else if (command === "uninstall")
             await uninstall(parsed.options);

package/dist/src/git-hook.js

@@ -0,0 +1,32 @@
+import { spawnSync } from "node:child_process";
+import { chmod, lstat, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+export async function installGitHook(project, packageRoot, dryRun) {
+    const result = spawnSync("git", ["rev-parse", "--git-path", "hooks/commit-msg"], { cwd: project, encoding: "utf8" });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0)
+        throw new Error(result.stderr.trim() || "Git repository required for git-hook.");
+    const destination = path.resolve(project, result.stdout.trim());
+    const source = await readFile(path.join(packageRoot, "hooks", "commit-msg"), "utf8");
+    let exists = false;
+    try {
+        const entry = await lstat(destination);
+        exists = true;
+        if (!entry.isFile() || await readFile(destination, "utf8") !== source) {
+            throw new Error(`Existing commit-msg hook preserved at ${destination}. Integrate the packaged hooks/commit-msg check into your hook manager manually.`);
+        }
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    if (dryRun)
+        return `would ${exists ? "verify" : "install"} commit-msg hook: ${destination}`;
+    if (!exists) {
+        await mkdir(path.dirname(destination), { recursive: true });
+        await writeFile(destination, source, { flag: "wx", mode: 0o755 });
+    }
+    await chmod(destination, 0o755);
+    return `${exists ? "verified" : "installed"} commit-msg hook: ${destination}`;
+}

package/hooks/commit-msg

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+// dotnet-production-agent-skills: reject co-author attribution in the final message.
+(async () => {
+  const { readFile } = await import("node:fs/promises");
+  const file = process.argv[2];
+  if (!file) throw new Error("Expected the commit message file path.");
+  const message = await readFile(file, "utf8");
+  if (/^\s*co-authored-by\s*:/im.test(message)) {
+    process.stderr.write("Commit rejected: Co-authored-by trailers are forbidden. Remove the attribution and retry; do not bypass the hook.\n");
+    process.exitCode = 1;
+  }
+})().catch((error) => {
+  process.stderr.write(`Commit message validation failed: ${error.message}\n`);
+  process.exitCode = 1;
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dotnet-production-agent-skills",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Portable production .NET engineering skills for coding agents",
   "license": "MIT",
   "author": {

package/skills/git-workflow/SKILL.md

@@ -20,7 +20,15 @@ Branch names:
 
 Reuse a Jira ID from the current branch or user input. Never invent one; ask if the requested operation requires an unavailable ID.
 
-Commit messages begin with the Jira ID, for example `XDCI-12345 Add order webhook retry handling`. Do not add co-author, AI, or agent attribution.
+Commit messages begin with the Jira ID, for example `XDCI-12345 Add order webhook retry handling`.
+
+## Strict authorship policy
+
+- Never add `Co-authored-by:` trailers (case-insensitive), co-author metadata, or equivalent attribution to commits or pull requests. This applies to every coding agent, including GitHub Copilot, Codex, Claude, and Cursor.
+- Never append AI/agent signatures, credits, or footers such as "Generated with Copilot" or "Assisted by Claude" to commit messages or pull request titles/descriptions.
+- Do not supply attribution through `git commit --trailer`, commit-message templates, API fields, or another indirect mechanism. Do not change the configured Git author/committer identity or use `--author` to credit an agent.
+- Before creating a commit or pull request, inspect the complete proposed message, including its body and trailers, and remove any automatically suggested attribution. Before pushing, inspect the new commits' complete messages with `git log <base>..HEAD --format=full` and verify the same policy.
+- If a hook, tool, or host adds forbidden attribution, stop before publishing and report the blocker. Do not bypass hooks, change tool configuration, amend existing commits, or rewrite published history without explicit authorization.
 
 Before committing, confirm required validation and scan the intended changes for secrets/artifacts. Do not include unrelated changes. Do not change Git identity, credentials, credential helpers, or authentication configuration.