forge-workflow 0.0.8 → 0.0.10

package/lib/commands/test.js

@@ -60,19 +60,7 @@ function checkBeadsConnectivity(execFileSync) {
 	}
 }
 
-/**
- * Get changed files relative to main branch, mapped to test file paths.
- *
- * Falls back to `git diff --name-only HEAD` if merge-base fails.
- *
- * @param {string} _projectRoot - Project root (unused, git uses cwd)
- * @param {Function} execFileSync - Injected execFileSync
- * @returns {string[]} Array of test file paths (e.g. ['test/foo.test.js'])
- */
-function getAffectedTestFiles(_projectRoot, execFileSync) {
-	let diffRef;
-
-	// Detect default branch, then try merge-base
+function resolveBaseBranch(execFileSync) {
 	let baseBranch = 'main';
 	try {
 		baseBranch = execFileSync('git', ['rev-parse', '--abbrev-ref', 'origin/HEAD'], {
@@ -88,17 +76,39 @@ function getAffectedTestFiles(_projectRoot, execFileSync) {
 			} catch (_e2) { /* intentional: branch doesn't exist, try next name */ } // NOSONAR S2486
 		}
 	}
+	return baseBranch;
+}
 
+function resolveDiffRef(execFileSync, options = {}) {
+	if (options.sinceUpstream) {
+		try {
+			const upstreamRef = execFileSync('git', ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}'], {
+				encoding: 'utf8',
+				stdio: 'pipe',
+				timeout: 3000,
+			}).trim();
+			if (upstreamRef) {
+				return `${upstreamRef}...HEAD`;
+			}
+		} catch (_e) { // NOSONAR S2486
+			/* intentional: branch may not track a remote yet, fall back to base branch */
+		}
+	}
+
+	const baseBranch = resolveBaseBranch(execFileSync);
 	try {
 		const mergeBase = execFileSync('git', ['merge-base', 'HEAD', baseBranch], {
 			encoding: 'utf8',
 			timeout: 5000,
 		}).trim();
-		diffRef = `${mergeBase}...HEAD`;
+		return `${mergeBase}...HEAD`;
 	} catch (_e) { /* intentional: merge-base failed, fallback to diff against HEAD */ // NOSONAR S2486
-		diffRef = 'HEAD';
+		return 'HEAD';
 	}
+}
 
+function getChangedFiles(execFileSync, options = {}) {
+	const diffRef = resolveDiffRef(execFileSync, options);
 	let output;
 	try {
 		output = execFileSync('git', ['diff', '--name-only', diffRef], {
@@ -111,23 +121,111 @@ function getAffectedTestFiles(_projectRoot, execFileSync) {
 	}
 
 	if (!output) return [];
+	return output.split('\n').filter(Boolean);
+}
 
-	const changedFiles = output.split('\n').filter(Boolean);
-
-	// Map lib/*.js files to test/*.test.js
-	const testFiles = [];
+/**
+ * Get changed files relative to main branch, mapped to test file paths.
+ *
+ * Falls back to `git diff --name-only HEAD` if merge-base fails.
+ *
+ * @param {string} projectRoot - Project root for test file existence checks
+ * @param {Function} execFileSync - Injected execFileSync
+ * @param {Object} [fs] - Injected fs module
+ * @param {Object} [options] - Diff selection options
+ * @returns {string[]} Array of test file paths (e.g. ['test/foo.test.js'])
+ */
+function getAffectedTestFiles(projectRoot, execFileSync, fs = defaultFs, options = {}) {
+	const changedFiles = getChangedFiles(execFileSync, options);
+	const testFiles = new Set();
 	for (const file of changedFiles) {
-		if (file.startsWith('lib/') && file.endsWith('.js')) {
-			const relative = file.slice('lib/'.length);
-			const testFile = `test/${relative.replace(/\.js$/, '.test.js')}`;
-			testFiles.push(testFile);
+		for (const candidate of getTestCandidatesForChangedFile(file)) {
+			if (fs.existsSync(path.join(projectRoot, candidate))) {
+				testFiles.add(candidate);
+			}
 		}
 	}
 
-	return testFiles;
+	return Array.from(testFiles).sort((left, right) => left.localeCompare(right));
+}
+
+function getTestCandidatesForChangedFile(file) {
+	if (!file) return [];
+
+	if (file === 'lib/lefthook-check.js') {
+		return ['test/lefthook-check.test.js', 'test/runtime-health.test.js'];
+	}
+
+	if (file === 'lib/runtime-health.js') {
+		return ['test/runtime-health.test.js'];
+	}
+
+	if (file === 'scripts/test.js') {
+		return ['test/scripts/test-runner.test.js'];
+	}
+
+	if (file.startsWith('test/') && file.endsWith('.test.js')) {
+		return [file];
+	}
+
+	if (file.startsWith('lib/') && file.endsWith('.js')) {
+		const relative = file.slice('lib/'.length);
+		return [`test/${relative.replace(/\.js$/, '.test.js')}`];
+	}
+
+	if (file.startsWith('scripts/') && (file.endsWith('.js') || file.endsWith('.sh'))) {
+		const relative = file.slice('scripts/'.length).replace(/\.(js|sh)$/, '.test.js');
+		return [
+			`test/scripts/${relative}`,
+			`test/${relative}`,
+		];
+	}
+
+	if (file.startsWith('.github/workflows/')) {
+		const workflowName = path.basename(file, path.extname(file));
+		return [
+			`test/workflows/${workflowName}.test.js`,
+			'test/ci-workflow.test.js',
+		];
+	}
+
+	if (file.startsWith('.github/agentic-workflows/') || file === '.github/behavioral-test-scores.json') {
+		return [
+			'test/scripts/behavioral-judge.test.js',
+			'test/structural/agentic-workflow-sync.test.js',
+		];
+	}
+
+	if (file.startsWith('.claude/commands/') && file.endsWith('.md')) {
+		return [
+			'test/command-sync-check.test.js',
+			'test/structural/command-sync.test.js',
+		];
+	}
+
+	if (file.startsWith('.forge/')
+		|| file.startsWith('.cursor/')
+		|| file.startsWith('.cline/')
+		|| file.startsWith('.roo/')
+		|| file.startsWith('.kilocode/')
+		|| file.startsWith('.opencode/')
+		|| file.startsWith('.codex/skills/')
+		|| file.startsWith('.github/prompts/')) {
+		return [
+			'test/agent-gaps.test.js',
+			'test/command-sync-check.test.js',
+			'test/scripts/check-agents.test.js',
+			'test/structural/command-sync.test.js',
+		];
+	}
+
+	return [];
 }
 
 module.exports = {
+	getChangedFiles,
+	getAffectedTestFiles,
+	getTestCandidatesForChangedFile,
 	name: 'test',
 	description: 'Run tests with smart defaults (timeout, Beads skip, affected-only)',
 	usage: 'forge test [--affected]',
@@ -181,7 +279,9 @@ module.exports = {
 
 		// 5. --affected flag: find changed test files
 		if (flags['--affected'] || flags.affected) {
-			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync);
+			const affectedTests = getAffectedTestFiles(projectRoot, execFileSync, fs, {
+				sinceUpstream: flags.sinceUpstream || flags['--since-upstream'],
+			});
 			if (affectedTests.length > 0) {
 				testArgs = ['run', 'test', ...affectedTests];
 			}

package/lib/commands/validate.js

@@ -14,19 +14,91 @@ const path = require('node:path');
 
 // Constants
 const CHECK_TYPES = {
+	CONFLICT_MARKERS: 'conflictMarkers',
 	TYPE_CHECK: 'typeCheck',
 	LINT: 'lint',
 	SECURITY: 'security',
 	TESTS: 'tests',
 };
 
+const CONFLICT_MARKER_IGNORE_DIRS = new Set([
+	'.beads',
+	'.git',
+	'.next',
+	'coverage',
+	'dist',
+	'node_modules',
+]);
+const CONFLICT_MARKER_ALLOWED_DOT_DIRS = new Set([
+	'.claude',
+	'.cline',
+	'.codex',
+	'.cursor',
+	'.forge',
+	'.github',
+	'.husky',
+	'.kilocode',
+	'.opencode',
+	'.roo',
+	'.sonarlint',
+]);
+const CONFLICT_START_PATTERN = /^<<<<<<<(?: .*)?$/;
+const CONFLICT_DIVIDER_PATTERN = /^=======$/;
+const CONFLICT_END_PATTERN = /^>>>>>>>.*$/;
+const GIT_CONFLICT_SCAN_MAX_BUFFER = 16 * 1024 * 1024;
+const VALIDATION_COMMAND_TIMEOUT_MS = 600000;
+const VALIDATION_COMMAND_TIMEOUT_MINUTES = Math.round(VALIDATION_COMMAND_TIMEOUT_MS / 60000);
+
+function validationTimeoutMessage(label) {
+	return `${label} timed out after ${VALIDATION_COMMAND_TIMEOUT_MINUTES} minutes`;
+}
+
+function listConflictScanFiles(rootDir) {
+	try {
+		const output = execFileSync(
+			'git',
+			['ls-files', '-z', '--cached', '--others', '--exclude-standard'],
+			{ encoding: 'utf8', cwd: rootDir, timeout: 120000, maxBuffer: GIT_CONFLICT_SCAN_MAX_BUFFER },
+		);
+		return output
+			.split('\0')
+			.filter(file => file.length > 0)
+			.map(file => path.join(rootDir, file));
+	} catch (error) {
+		if (!isGitListingUnavailableError(error)) {
+			throw error;
+		}
+		return null;
+	}
+}
+
+function shouldSkipConflictScanPath(relativePath) {
+	const segments = String(relativePath || '')
+		.split(/[\\/]+/)
+		.filter(Boolean);
+	const directorySegments = segments.slice(0, -1);
+	return directorySegments.some(segment => (
+		(segment.startsWith('.') && !CONFLICT_MARKER_ALLOWED_DOT_DIRS.has(segment))
+		|| CONFLICT_MARKER_IGNORE_DIRS.has(segment)
+	));
+}
+
 function getExecOptions() {
-	return { encoding: 'utf8', cwd: process.cwd(), timeout: 120000 };
+	return { encoding: 'utf8', cwd: process.cwd(), timeout: VALIDATION_COMMAND_TIMEOUT_MS };
 }
 
 const ERROR_PATTERNS = {
 	COMMAND_NOT_FOUND: ['ENOENT', 'not found'],
 	NO_LOCK_FILE: ['requires an existing', 'package-lock'],
+	GIT_LISTING_UNAVAILABLE: [
+		'not a git repository',
+		'maxBuffer',           // git ls-files output exceeds maxBuffer
+		'ENOBUFS',             // OS-level buffer overflow
+		'ETIMEDOUT',           // subprocess timeout
+		'EPERM',               // permission denied
+		'EACCES',              // access denied
+		'spawnSync',           // general spawn failure
+	],
 };
 
 /**
@@ -39,6 +111,14 @@ function isCommandNotFound(error) {
 	);
 }
 
+function isGitListingUnavailableError(error) {
+	if (!error || typeof error.message !== 'string') {
+		return false;
+	}
+	return isCommandNotFound(error)
+		|| ERROR_PATTERNS.GIT_LISTING_UNAVAILABLE.some(pattern => error.message.includes(pattern));
+}
+
 /**
  * Parse number from regex match
  * @private
@@ -57,6 +137,131 @@ function getCheckStatus(check) {
 	return check.success ? 'PASS' : 'FAIL';
 }
 
+function scanForConflictMarkers(rootDir = process.cwd()) {
+	const filesWithMarkers = [];
+
+	function inspectFile(absolutePath) {
+		const relativePath = path.relative(rootDir, absolutePath) || path.basename(absolutePath);
+		if (shouldSkipConflictScanPath(relativePath)) {
+			return;
+		}
+
+		try {
+			if (!fs.lstatSync(absolutePath).isFile()) {
+				return;
+			}
+		} catch (error) {
+			if (!canSkipConflictScanStatError(error)) {
+				throw error;
+			}
+			return;
+		}
+
+		const startLine = findConflictMarkerStartLine(readConflictScanFile(absolutePath));
+		if (startLine === null) {
+			return;
+		}
+
+		filesWithMarkers.push({ path: relativePath, line: startLine });
+	}
+
+	function walk(currentDir) {
+		for (const entry of fs.readdirSync(currentDir, { withFileTypes: true })) {
+			if (shouldSkipConflictScanEntry(entry)) {
+				continue;
+			}
+
+			if (entry.isDirectory()) {
+				walk(path.join(currentDir, entry.name));
+				continue;
+			}
+
+			if (!entry.isFile()) {
+				continue;
+			}
+
+			inspectFile(path.join(currentDir, entry.name));
+		}
+	}
+
+	const trackedFiles = listConflictScanFiles(rootDir);
+	if (trackedFiles) {
+		for (const absolutePath of trackedFiles) {
+			inspectFile(absolutePath);
+		}
+	} else {
+		walk(rootDir);
+	}
+	filesWithMarkers.sort((left, right) => {
+		if (left.path === right.path) {
+			return left.line - right.line;
+		}
+		return left.path.localeCompare(right.path);
+	});
+
+	return {
+		success: filesWithMarkers.length === 0,
+		files: filesWithMarkers,
+		message: filesWithMarkers.length === 0
+			? 'No conflict markers found'
+			: `Conflict markers found in ${filesWithMarkers.length} file(s)`,
+	};
+}
+
+function shouldSkipConflictScanEntry(entry) {
+	return entry.isDirectory() && (
+		(entry.name.startsWith('.') && !CONFLICT_MARKER_ALLOWED_DOT_DIRS.has(entry.name))
+		|| CONFLICT_MARKER_IGNORE_DIRS.has(entry.name)
+	);
+}
+
+function canSkipConflictScanStatError(error) {
+	return Boolean(error && ['ENOENT', 'ENOTDIR', 'ELOOP'].includes(error.code));
+}
+
+function readConflictScanFile(absolutePath) {
+	try {
+		return fs.readFileSync(absolutePath, 'utf8');
+	} catch (_error) {
+		return null;
+	}
+}
+
+function findConflictMarkerStartLine(content) {
+	const lines = String(content || '').split(/\r?\n/);
+	let activeStartLine = null;
+	let sawDivider = false;
+
+	for (let index = 0; index < lines.length; index += 1) {
+		const line = lines[index];
+		const lineNumber = index + 1;
+		if (activeStartLine === null) {
+			if (CONFLICT_START_PATTERN.test(line)) {
+				activeStartLine = lineNumber;
+				sawDivider = false;
+			} else if (CONFLICT_END_PATTERN.test(line)) {
+				return lineNumber;
+			}
+			continue;
+		}
+
+		if (!sawDivider) {
+			if (CONFLICT_DIVIDER_PATTERN.test(line)) {
+				sawDivider = true;
+			} else if (CONFLICT_START_PATTERN.test(line)) {
+				activeStartLine = index + 1;
+			}
+			continue;
+		}
+
+		if (CONFLICT_END_PATTERN.test(line)) {
+			return activeStartLine;
+		}
+	}
+
+	return activeStartLine;
+}
+
 /**
  * Parse vulnerability counts from audit output
  * @private
@@ -109,7 +314,7 @@ async function runTypeCheck() {
 			return {
 				success: false,
 				duration: Date.now() - startTime,
-				message: 'Type check timed out after 2 minutes',
+				message: validationTimeoutMessage('Type check'),
 			};
 		}
 
@@ -166,7 +371,7 @@ async function runLint() {
 			return {
 				success: false,
 				duration: Date.now() - startTime,
-				message: 'Lint check timed out after 2 minutes',
+				message: validationTimeoutMessage('Lint check'),
 			};
 		}
 
@@ -238,7 +443,7 @@ async function runSecurityScan() { // NOSONAR S3776
 			return {
 				success: false,
 				duration: Date.now() - startTime,
-				message: 'Security audit timed out after 2 minutes',
+				message: validationTimeoutMessage('Security audit'),
 			};
 		}
 		// bun audit exits non-zero when vulnerabilities are found; stdout still contains the data
@@ -267,7 +472,7 @@ async function runSecurityScan() { // NOSONAR S3776
 					return {
 						success: false,
 						duration: Date.now() - startTime,
-						message: 'Security audit timed out after 2 minutes',
+						message: validationTimeoutMessage('Security audit'),
 					};
 				}
 				// npm audit exits non-zero when it finds any vulnerability - stdout still has JSON
@@ -322,7 +527,7 @@ async function runSecurityScan() { // NOSONAR S3776
 				return {
 					success: false,
 					duration: Date.now() - startTime,
-					message: 'Security audit timed out after 2 minutes',
+					message: validationTimeoutMessage('Security audit'),
 				};
 			}
 
@@ -365,7 +570,7 @@ async function runAllTests() {
 	const startTime = Date.now();
 
 	try {
-		const result = execFileSync('bun', ['test'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
+		const result = execFileSync('bun', ['test', '--timeout', '30000'], getExecOptions());  // NOSONAR S4036 - hardcoded CLI command, no user input, developer tool context
 
 		// Parse bun test output
 		const passed = parseNumber(/(\d+) pass/.exec(result));  // NOSONAR S5852 - bounded \d+ pattern
@@ -392,7 +597,7 @@ async function runAllTests() {
 				passed: 0,
 				failed: 0,
 				total: 0,
-				message: 'Test execution timed out after 2 minutes',
+				message: validationTimeoutMessage('Test execution'),
 			};
 		}
 
@@ -450,13 +655,29 @@ async function runAllTests() {
  * console.log(result.summary);
  */
 async function executeValidate(options = {}) { // NOSONAR S3776
-	const { skip = [], continueOnError = true } = options || {};
+	const { skip = [], continueOnError = true, rootDir = process.cwd() } = options || {};
 
 	const checks = {};
 	const failedChecks = [];
 	const errors = [];
 	const startTime = Date.now();
 
+	// 0. Conflict markers
+	if (!skip.includes(CHECK_TYPES.CONFLICT_MARKERS)) {
+		try {
+			checks.conflictMarkers = scanForConflictMarkers(rootDir);
+			if (!checks.conflictMarkers.success) {
+				failedChecks.push(CHECK_TYPES.CONFLICT_MARKERS);
+				if (!continueOnError) {
+					return buildResult(checks, failedChecks, errors, startTime);
+				}
+			}
+		} catch (error) {
+			errors.push(`Conflict marker scan error: ${error.message}`);
+			checks.conflictMarkers = { success: false, message: error.message };
+		}
+	}
+
 	// 1. Type checking
 	if (!skip.includes(CHECK_TYPES.TYPE_CHECK)) {
 		try {
@@ -535,6 +756,7 @@ function buildResult(checks, failedChecks, errors, startTime) {
 	// Build summary using getCheckStatus helper
 	const checkResults = [];
 	const checkLabels = {
+		conflictMarkers: 'Conflict Markers',
 		typeCheck: 'Type',
 		lint: 'Lint',
 		security: 'Security',
@@ -610,6 +832,7 @@ module.exports = {
 	runLint,
 	runSecurityScan,
 	runAllTests,
+	scanForConflictMarkers,
 	executeValidate,
 	executeDebugMode,
 };

package/lib/commands/worktree.js

@@ -3,6 +3,7 @@
 const { execFileSync, spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
+const { bootstrapBeads } = require('../beads-bootstrap');
 
 /**
  * Forge Worktree Command
@@ -10,8 +11,8 @@ const path = require('node:path');
  * Uses execFileSync (not execSync) to prevent command injection (OWASP A03).
  *
  * Subcommands:
- *   create <slug> — Create worktree at .worktrees/<slug> with branch + beads + install
- *   remove <slug> — Remove worktree via git worktree remove
+ *   create <slug> - Create worktree at .worktrees/<slug> with branch + beads + install
+ *   remove <slug> - Remove worktree via git worktree remove
  *
  * @module commands/worktree
  */
@@ -31,25 +32,10 @@ function detectPackageManager(projectRoot, fsApi) {
   return null;
 }
 
-/**
- * Copy .beads/ directory excluding daemon.lock.
- * @param {string} source - Source .beads path
- * @param {string} dest - Destination .beads path
- * @param {object} fsApi - fs module (for DI)
- */
-function copyBeadsDir(source, dest, fsApi) {
-  fsApi.mkdirSync(dest, { recursive: true });
-  const entries = fsApi.readdirSync(source);
-  for (const entry of entries) {
-    if (entry === 'daemon.lock') continue;
-    fsApi.cpSync(path.join(source, entry), path.join(dest, entry), { recursive: true });
-  }
-}
-
 /**
  * Stop a Dolt server running in a worktree to release file locks.
  * Tries graceful `bd dolt stop` first, then falls back to PID-based kill
- * from lock files. Never kills ALL Dolt processes — only the specific PID.
+ * from lock files. Never kills ALL Dolt processes - only the specific PID.
  *
  * @param {string} worktreePath - Absolute path to the worktree
  * @param {object} [opts] - Options for dependency injection
@@ -106,46 +92,29 @@ function branchExists(branchName, runFile) {
   }
 }
 
-/**
- * Set up Beads integration for a new worktree (symlink/junction/copy).
- * @param {string} worktreePath - Absolute path to the new worktree
- * @param {string} projectRoot - Absolute path to the project root
- * @param {string} platform - OS platform string (e.g. 'win32')
- * @param {object} fsApi - fs module (for DI)
- * @param {Function} exec - execFileSync-compatible function
- * @returns {string|null} Warning message if beads setup had issues, null otherwise
- */
-function setupBeads(worktreePath, projectRoot, platform, fsApi, exec) {
-  const beadsSource = path.resolve(projectRoot, '.beads');
-  const beadsDest = path.resolve(worktreePath, '.beads');
-
-  if (!fsApi.existsSync(beadsSource)) {
-    return 'Beads not installed — skipping .beads setup';
+function setupBeadsWithBootstrap(worktreePath, projectRoot, platform, fsApi, exec, options = {}) {
+  if (!fsApi.existsSync(path.resolve(projectRoot, '.beads'))) {
+    return 'Beads not installed - skipping .beads setup';
   }
 
-  // Try symlink first
-  try {
-    if (platform === 'win32') {
-      fsApi.symlinkSync(beadsSource, beadsDest, 'junction');
-    } else {
-      fsApi.symlinkSync(beadsSource, beadsDest);
-    }
-  } catch (symlinkErr) {
-    if (symlinkErr.code === 'EPERM') {
-      copyBeadsDir(beadsSource, beadsDest, fsApi);
-    } else {
-      throw symlinkErr;
-    }
-  }
+  const bootstrapResult = bootstrapBeads(worktreePath, {
+    _exec: exec,
+    _fs: fsApi,
+    _platform: platform,
+    mainProjectRoot: projectRoot,
+    _safeBeadsInit: options._safeBeadsInit,
+  });
 
-  // Verify beads accessible (warn if fails, don't block)
   try {
     exec('bd', ['--version'], { cwd: worktreePath, timeout: 5000, stdio: 'pipe' });
   } catch (_bdErr) { /* intentional: bd may not be on PATH */ // NOSONAR S2486
-    return 'Beads verification failed — .beads linked but bd may not work';
+    if (bootstrapResult.success === false && bootstrapResult.warning) {
+      return bootstrapResult.warning;
+    }
+    return 'Beads verification failed - .beads linked but bd may not work';
   }
 
-  return null;
+  return bootstrapResult.warning;
 }
 
 /**
@@ -179,13 +148,17 @@ async function handleCreate(slug, flags, projectRoot, opts) {
   const branchName = flags['--branch'] || flags.branch || `feat/${slug}`;
   const worktreesDir = path.resolve(projectRoot, '.worktrees');
 
-  // Guard: Detect bare repo state — worktrees created from bare repos produce broken branches
+  // Guard: Detect bare repo state - worktrees created from bare repos produce broken branches
   // git rev-parse --show-toplevel throws in a bare repo (no working tree)
   try {
     runFile('git', ['-C', projectRoot, 'rev-parse', '--show-toplevel'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
-  } catch (_e) { // NOSONAR S2486
+  } catch (error) {
     /* intentional: show-toplevel fails in bare repos */
-    return { success: false, error: 'Main repo is in bare state (no working tree). Clone fresh instead: git clone <url> /tmp/forge-<slug>' };
+    const errMsg = String(error?.stderr || error?.message || '').trim();
+    if (/must be run in a work tree|this operation must be run in a work tree/i.test(errMsg)) {
+      return { success: false, error: 'bare repo detected' };
+    }
+    return { success: false, error: errMsg || 'git rev-parse --show-toplevel failed' };
   }
 
   // Security: Validate slug doesn't contain path traversal (OWASP A01/A03)
@@ -217,7 +190,7 @@ async function handleCreate(slug, flags, projectRoot, opts) {
   }
 
   // Step 3: Beads integration
-  const beadsWarning = setupBeads(worktreePath, projectRoot, platform, fsApi, runFile);
+  const beadsWarning = setupBeadsWithBootstrap(worktreePath, projectRoot, platform, fsApi, runFile, opts);
 
   // Step 4: Run package install
   runInstall(worktreePath, projectRoot, runSpawn, fsApi);