finitemonkey 0.1.0-next.7 → 0.1.0-next.9

package/dist/finitemonkey.mjs

@@ -4441,11 +4441,11 @@ var requirement2 = (want, ctx) => {
 };
 var gitCheck = (check2, ctx) => {
   const wants = check2.require ?? ["committed"];
-  const missing = wants.flatMap((want) => {
+  const missing2 = wants.flatMap((want) => {
     const problem4 = requirement2(want, ctx);
     return problem4 === void 0 ? [] : [problem4];
   });
-  return missing.length > 0 ? failed(missing) : passed([note("gate.git.ok", { require: wants.join(", ") })]);
+  return missing2.length > 0 ? failed(missing2) : passed([note("gate.git.ok", { require: wants.join(", ") })]);
 };
 
 // src/guards/release/grants.ts
@@ -4611,6 +4611,7 @@ var LOCK_FILE = ".finitemonkey/lock.json";
 var BACKUPS_DIR = ".finitemonkey/backups";
 var LOCKS_DIR = ".finitemonkey/locks";
 var INSTALL_LOCK = ".finitemonkey/locks/install.lock";
+var VERIFY_SKILL = ".claude/skills/verify/SKILL.md";
 var LOCAL_BIN = "node_modules/finitemonkey/dist/finitemonkey.mjs";
 var VENDOR_BIN = ".finitemonkey/runtime/dist/finitemonkey.mjs";
 var VENDOR_PACKAGE = ".finitemonkey/runtime/package.json";
@@ -6506,10 +6507,10 @@ var symbolFindings = (context, pair, path, text6) => {
 var verifyFile = (context, pair) => {
   const path = resultPathOf(context, pair);
   if (pair.ours?.binary === true || pair.theirs?.binary === true) return binaryFindings(context, pair, path);
-  const missing = ["ours", "theirs"].flatMap(
+  const missing2 = ["ours", "theirs"].flatMap(
     (side) => created2(pair[side]) && path === void 0 ? [finding("missing-file", pair.key, side, pair.key)] : []
   );
-  if (missing.length > 0) return missing;
+  if (missing2.length > 0) return missing2;
   const copied = [pair.ours, pair.theirs].find((diff) => diff?.status === "copied");
   const baseSource = copied?.oldPath ?? (created2(pair.ours) || created2(pair.theirs) ? void 0 : pair.key);
   const baseText = baseSource === void 0 ? void 0 : blobText(context.runtime, context.repo, context.inputs.base, baseSource);
@@ -10816,34 +10817,49 @@ var mergeHooks = (hooks, isOwn, wanted) => {
 var withHooks = (settings, hooks) => {
   return setKey(settings, "hooks", Object.keys(hooks).length === 0 ? void 0 : hooks);
 };
-var withPermissions = (settings, deny2) => {
+var BLOCK_READS = "blockReadsOutsideWorkingDirectories";
+var withPermissions = (settings, lists) => {
   const permissions = asRecord(settings["permissions"]);
-  const next2 = setKey(permissions, "deny", deny2.length === 0 ? void 0 : deny2);
+  const withDeny = setKey(permissions, "deny", lists.deny.length === 0 ? void 0 : lists.deny);
+  const withAsk = setKey(withDeny, "ask", lists.ask.length === 0 ? void 0 : lists.ask);
+  const next2 = setKey(withAsk, BLOCK_READS, lists.blockReads);
   return setKey(settings, "permissions", Object.keys(next2).length === 0 ? void 0 : next2);
 };
+var missing = (wanted, existing) => wanted.filter((rule) => !existing.includes(rule));
+var withoutAdded = (existing, added) => existing.filter((rule) => typeof rule !== "string" || !added.includes(rule));
 var ownHookMatcher = (recorded) => (handler) => isOwnHandler(handler) || recorded.some((own) => JSON.stringify(own) === JSON.stringify(handler));
 var mergeSettings = (current, wanted, recorded) => {
   const schema = Object.keys(current).length === 0;
   const base = schema ? { $schema: SETTINGS_SCHEMA_URL } : current;
   const hooks = mergeHooks(asRecord(base["hooks"]), ownHookMatcher(recorded), wanted.hooks);
-  const existingDeny = asList(asRecord(base["permissions"])["deny"]);
-  const deny2 = wanted.deny.filter((rule) => !existingDeny.includes(rule));
+  const permissions = asRecord(base["permissions"]);
+  const existingDeny = asList(permissions["deny"]);
+  const existingAsk = asList(permissions["ask"]);
+  const deny2 = missing(wanted.deny, existingDeny);
+  const ask = missing(wanted.ask, existingAsk);
+  const blockReads = !(BLOCK_READS in permissions);
   const attribution = wanted.attributionOff && !("attribution" in base);
   const marketplace = wanted.marketplace && !hasEntry(base, "extraKnownMarketplaces", MARKETPLACE_KEY);
   const plugin = wanted.marketplace && !hasEntry(base, "enabledPlugins", PLUGIN_ID);
-  let settings = withPermissions(withHooks(base, hooks), [...existingDeny, ...deny2]);
+  let settings = withPermissions(withHooks(base, hooks), {
+    deny: [...existingDeny, ...deny2],
+    ask: [...existingAsk, ...ask],
+    blockReads: blockReads ? true : permissions[BLOCK_READS]
+  });
   if (attribution) settings = { ...settings, attribution: ATTRIBUTION_OFF };
   if (marketplace) settings = withEntry(settings, "extraKnownMarketplaces", MARKETPLACE_KEY, MARKETPLACE_ENTRY);
   if (plugin) settings = withEntry(settings, "enabledPlugins", PLUGIN_ID, true);
-  return { settings, added: { schema, deny: deny2, attribution, marketplace, plugin } };
+  return { settings, added: { schema, deny: deny2, ask, blockReads, attribution, marketplace, plugin } };
 };
 var sameAttribution = (value) => JSON.stringify(value) === JSON.stringify(ATTRIBUTION_OFF);
 var unmergeSettings = (current, added, recorded) => {
   const hooks = mergeHooks(asRecord(current["hooks"]), ownHookMatcher(recorded), {});
-  const deny2 = asList(asRecord(current["permissions"])["deny"]).filter(
-    (rule) => typeof rule !== "string" || !added.deny.includes(rule)
-  );
-  let settings = withPermissions(withHooks(current, hooks), deny2);
+  const permissions = asRecord(current["permissions"]);
+  let settings = withPermissions(withHooks(current, hooks), {
+    deny: withoutAdded(asList(permissions["deny"]), added.deny),
+    ask: withoutAdded(asList(permissions["ask"]), added.ask),
+    blockReads: added.blockReads && permissions[BLOCK_READS] === true ? void 0 : permissions[BLOCK_READS]
+  });
   if (added.attribution && sameAttribution(settings["attribution"])) {
     settings = setKey(settings, "attribution", void 0);
   }
@@ -11049,9 +11065,11 @@ var parseAdded = (value) => {
   const deny2 = strings2(value["deny"]);
   const { schema, attribution } = value;
   if (deny2 === void 0 || typeof schema !== "boolean" || typeof attribution !== "boolean") return void 0;
+  const ask = strings2(value["ask"]) ?? [];
+  const blockReads = value["blockReads"] === true;
   const marketplace = value["marketplace"] === true;
   const plugin = value["plugin"] === true;
-  return { schema, attribution, deny: deny2, marketplace, plugin };
+  return { schema, attribution, deny: deny2, ask, blockReads, marketplace, plugin };
 };
 var parseEntry2 = (value) => {
   if (!isRecord(value)) return void 0;
@@ -11098,6 +11116,42 @@ var parseLock = (text6) => {
 var renderLock = (lock) => `${JSON.stringify(lock, null, 2)}
 `;
 
+// src/install/ask-floor.ts
+var DEFAULT_BRANCHES = ["main", "master"];
+var pushTo = (branch) => [
+  `Bash(git push * ${branch})`,
+  `Bash(git push * ${branch} *)`,
+  `Bash(git push *:${branch})`,
+  `Bash(git push *:${branch} *)`
+];
+var ASK_FLOOR = {
+  push: DEFAULT_BRANCHES.flatMap(pushTo),
+  deploy: [
+    "Bash(npm publish *)",
+    "Bash(pnpm publish *)",
+    "Bash(yarn publish *)",
+    "Bash(yarn npm publish *)",
+    "Bash(bun publish *)",
+    "Bash(vercel * --prod*)",
+    "Bash(vercel --prod*)",
+    "Bash(netlify deploy * --prod*)",
+    "Bash(fly deploy *)",
+    "Bash(flyctl deploy *)",
+    "Bash(firebase deploy *)",
+    "Bash(wrangler deploy *)",
+    "Bash(serverless deploy *)",
+    "Bash(sls deploy *)",
+    "Bash(cdk deploy *)",
+    "Bash(terraform apply *)",
+    "Bash(tofu apply *)",
+    "Bash(pulumi up *)",
+    "Bash(kubectl apply *)",
+    "Bash(helm install *)",
+    "Bash(helm upgrade *)"
+  ]
+};
+var ASK_RULES = [...ASK_FLOOR.push, ...ASK_FLOOR.deploy];
+
 // src/install/claude-version.ts
 var ON_FAILURE_MIN = [2, 1, 295];
 var PROBE_MS = 8e3;
@@ -11119,6 +11173,23 @@ var detectClaude = (probe) => {
   return { version: parsed.join("."), failClosed: atLeast(parsed, ON_FAILURE_MIN) };
 };
 
+// src/install/claudeignore.ts
+var CLAUDEIGNORE_FILES = [".claudeignore", ".claude/.claudeignore"];
+var ruleFor = (raw) => {
+  const line2 = withoutCarriageReturn(raw).trim();
+  if (line2 === "" || line2.startsWith("#") || line2.startsWith("!") || line2.includes(")")) return void 0;
+  const anchored = line2.startsWith("/");
+  const body = (anchored ? line2.slice(1) : line2).replace(/\/+$/, "");
+  if (body === "" || body === "*" || body === "**") return void 0;
+  const path = line2.endsWith("/") ? `${body}/**` : body;
+  return `Read(${anchored || body.includes("/") ? "./" : ""}${path})`;
+};
+var claudeignoreRules = (texts) => [
+  ...new Set(
+    texts.flatMap((text6) => (text6 ?? "").split("\n")).map(ruleFor).filter((rule) => rule !== void 0)
+  )
+];
+
 // src/install/config-template.ts
 var configTemplate = (t, preset, lang) => [
   `# ${GENERATED_MARKER}`,
@@ -11277,6 +11348,33 @@ var withoutBlock = (text6) => {
   return [...lines3.slice(0, range.start), ...lines3.slice(range.end + 1)].join(eol);
 };
 
+// src/install/skill-template.ts
+var gateCommand2 = (runner) => {
+  const args = "gate --fast --json";
+  if (runner.kind === "local") return `node ${LOCAL_BIN} ${args}`;
+  if (runner.kind === "vendored") return `node ${VENDOR_BIN} ${args}`;
+  return isScript(runner.path) ? `node "${runner.path}" ${args}` : `"${runner.path}" ${args}`;
+};
+var verifySkillTemplate = (runner) => [
+  "---",
+  "name: verify",
+  "description: >-",
+  "  Use before every commit and before telling the person something works. Runs the fast gate through Finite Monkey so the result is recorded as evidence for the current tree instead of being taken on your word.",
+  "when_to_use: >-",
+  "  Trigger phrases include commit, run the tests, check it works, roda os testes, confere, verifica, prueba.",
+  "---",
+  "",
+  "# Verify: evidence, not claims",
+  "",
+  `1. From the project root, run \`${gateCommand2(runner)}\`.`,
+  "2. Read `data`; for every failing item, fix the cause, never the check.",
+  "3. Quote the command and its exit code when you report a result. A result from before your last edit no longer counts.",
+  "",
+  `<!-- ${GENERATED_MARKER} -->`,
+  ""
+].join("\n");
+var isOwnSkill = hasMarker;
+
 // src/install/vendor.ts
 var isBundle = (text6) => text6.startsWith("#!/usr/bin/env node") && text6.includes("finitemonkey");
 var isOwnPackage = (text6) => {
@@ -11318,6 +11416,8 @@ var joinAdded = (previous, next2) => previous === void 0 ? next2 : {
   schema: previous.schema || next2.schema,
   attribution: previous.attribution || next2.attribution,
   deny: union(previous.deny, next2.deny),
+  ask: union(previous.ask, next2.ask),
+  blockReads: previous.blockReads || next2.blockReads,
   marketplace: previous.marketplace || next2.marketplace,
   plugin: previous.plugin || next2.plugin
 };
@@ -11331,7 +11431,8 @@ var settingsItem = (project, detection, input, previous) => {
   const hooks = wantedHooks(detection);
   const wanted = {
     hooks,
-    deny: DENY_RULES,
+    deny: [...DENY_RULES, ...claudeignoreRules(CLAUDEIGNORE_FILES.map((path) => project.read(path)))],
+    ask: ASK_RULES,
     attributionOff: input.preset === "gabriel",
     marketplace: input.marketplace
   };
@@ -11365,18 +11466,21 @@ var generatedItem = (project, file, previous) => {
   }
   return { ...base, action: actionFor(before, template, "update"), after: template };
 };
-var generatedFiles = (input, vendor) => {
-  const config = { path: CONFIG_FILE, template: configTemplate(input.t, input.preset, input.lang), isOurs: hasMarker };
-  if (!vendor) return accept([config]);
+var generatedFiles = (input, runner, vendor) => {
+  const own = [
+    { path: CONFIG_FILE, template: configTemplate(input.t, input.preset, input.lang), isOurs: hasMarker },
+    { path: VERIFY_SKILL, template: verifySkillTemplate(runner), isOurs: isOwnSkill }
+  ];
+  if (!vendor) return accept(own);
   if (input.bundle === void 0) return reject({ kind: "bundle", detail: "the running finitemonkey is not a bundle" });
-  return accept([config, ...vendoredFiles(input.bundle, input.version)]);
+  return accept([...own, ...vendoredFiles(input.bundle, input.version)]);
 };
 var entryFor = (lock, path) => lock?.entries.find((entry2) => entry2.path === path);
 var buildPlan = (project, detection, input, previous) => {
   const settings = settingsItem(project, detection, input, entryFor(previous, SETTINGS_FILE));
   if (!settings.ok) return settings;
   const vendor = detection.runner.kind === "vendored" || entryFor(previous, VENDOR_BIN) !== void 0;
-  const files = generatedFiles(input, vendor);
+  const files = generatedFiles(input, detection.runner, vendor);
   if (!files.ok) return files;
   const generated = files.value.map((file) => generatedItem(project, file, entryFor(previous, file.path)));
   return accept({
@@ -11433,7 +11537,7 @@ var nextLock = (plan, version, now, backupDir, createdDirs) => ({
   preset: plan.preset,
   installedAt: plan.previous?.installedAt ?? now,
   updatedAt: now,
-  createdDirs: plan.previous?.createdDirs ?? createdDirs,
+  createdDirs: [.../* @__PURE__ */ new Set([...plan.previous?.createdDirs ?? [], ...createdDirs])],
   entries: plan.items.filter((item) => item.action !== "skip-foreign").map((item) => entryOf2(plan, item, backupDir))
 });
 var needsBackup = (plan, item) => item.before !== void 0 && plan.previous?.entries.find((entry2) => entry2.path === item.path)?.backup === void 0;
@@ -11449,7 +11553,8 @@ var writeAll = (project, items) => {
   }
   return accept(void 0);
 };
-var createdBy = (project) => [".claude", STATE_DIR].filter((dir) => !project.exists(dir));
+var OWN_DIRS = [dirname6(dirname6(VERIFY_SKILL)), dirname6(VERIFY_SKILL), ".claude", STATE_DIR];
+var createdBy = (project) => OWN_DIRS.filter((dir) => !project.exists(dir));
 var commit = (project, plan, version, createdDirs) => {
   const now = project.runtime.now();
   const changing = plan.items.filter((item) => CHANGING.includes(item.action));
@@ -12539,7 +12644,7 @@ var removalFor = (project, entry2, options) => {
 var planRemoval = (project, lock, options) => ({
   items: lock.entries.map((entry2) => removalFor(project, entry2, options)),
   purge: options.purge,
-  removeDirs: lock.createdDirs.filter((dir) => dir !== STATE_DIR)
+  removeDirs: lock.createdDirs.filter((dir) => dir !== STATE_DIR).toSorted((a, b) => b.split("/").length - a.split("/").length)
 });
 var applyItem = (project, item) => {
   if (item.action === "delete") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "finitemonkey",
-  "version": "0.1.0-next.7",
+  "version": "0.1.0-next.9",
   "description": "Claude Code hooks that stop a coding agent from saying done before the tests pass: a machine-checked definition of done, plus guardrails for secrets, git safety and production. Pre-release.",
   "type": "module",
   "license": "Apache-2.0",