halfcycle 0.3.31 → 0.3.32

package/dist/bin.js

@@ -8,13 +8,10 @@ import { join as join12 } from "node:path";
 // dist/install.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname2, join as join5, posix, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 
-// ../events/dist/result.js
-import { z as z2 } from "zod";
-
 // ../core/dist/guard-record.js
 import { z } from "zod";
 var severitySchema = z.enum(["info", "warn", "block"]);
@@ -138,7 +135,76 @@ function parseAccountStoreText(raw) {
   }
 }
 
+// ../core/dist/hook-wiring.js
+var SETTINGS_REL = ".claude/settings.json";
+var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
+var SESSION_START_MARKER_REL = ".claude/hooks/session-start-marker.sh";
+var GUARD_RUNNER_REL = ".claude/hooks/guard-runner.sh";
+var USER_PROMPT_REMINDER_REL = ".claude/hooks/user-prompt-reminder.sh";
+var SESSION_END_MARKER_REL = ".claude/hooks/session-end-marker.sh";
+var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
+var HALFCYCLE_HOOK_WIRING = [
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_START_MARKER_REL}`,
+    script: SESSION_START_MARKER_REL
+  },
+  {
+    event: "SessionStart",
+    matcher: null,
+    timeout: 10,
+    command: `bash ./${GUARD_RUNNER_REL} refresh-credential`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "UserPromptSubmit",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${USER_PROMPT_REMINDER_REL}`,
+    script: USER_PROMPT_REMINDER_REL
+  },
+  {
+    event: "PostToolUse",
+    matcher: WRITE_CAPABLE_TOOLS.join("|"),
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook post-tool-use`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "Stop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SubagentStop",
+    matcher: null,
+    timeout: 60,
+    command: `bash ./${GUARD_RUNNER_REL} hook subagent-stop`,
+    script: GUARD_RUNNER_REL
+  },
+  {
+    event: "SessionEnd",
+    matcher: null,
+    timeout: 5,
+    command: `bash ./${SESSION_END_MARKER_REL}`,
+    script: SESSION_END_MARKER_REL
+  }
+];
+var RETIRED_HOOK_COMMANDS = [];
+var HALFCYCLE_HOOK_COMMANDS = /* @__PURE__ */ new Set([
+  ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.command),
+  ...RETIRED_HOOK_COMMANDS
+]);
+var HALFCYCLE_HOOK_WIRING_PATHS = [
+  .../* @__PURE__ */ new Set([SETTINGS_REL, ...HALFCYCLE_HOOK_WIRING.map((entry) => entry.script), VENDORED_BIN_REL])
+];
+
 // ../events/dist/result.js
+import { z as z2 } from "zod";
 var firedGuardSchema = z2.object({
   guardId: z2.string(),
   patternRef: z2.string(),
@@ -1204,14 +1270,36 @@ halfcycle_env_file() {
 // dist/identity.js
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync as readFileSync3 } from "node:fs";
-import { join as join3 } from "node:path";
+import { isAbsolute, join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
 var PROJECT_IDENTITY_NOTE = 'projectId is NOT the engagement id \u2014 it identifies this repository/worktree to Halfcycle, not an engagement. The engagement id lives in .halfcycle/bundle.json, in its "engagementId" field.';
-function git(targetRepoRoot, args2) {
+var REPOSITORY_LOCATING_GIT_VARS = [
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_COMMON_DIR",
+  "GIT_DIR",
+  "GIT_GRAFT_FILE",
+  "GIT_IMPLICIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_NO_REPLACE_OBJECTS",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_PREFIX",
+  "GIT_REPLACE_REF_BASE",
+  "GIT_SHALLOW_FILE",
+  "GIT_WORK_TREE"
+];
+function gitEnvForNamedRepo() {
+  const env = { ...process.env };
+  for (const name of REPOSITORY_LOCATING_GIT_VARS)
+    delete env[name];
+  return env;
+}
+function git(targetRepoRoot, args2, stdin) {
   try {
     const out = execFileSync("git", ["-C", targetRepoRoot, ...args2], {
       encoding: "utf-8",
-      stdio: ["ignore", "pipe", "ignore"]
+      env: gitEnvForNamedRepo(),
+      ...stdin === void 0 ? {} : { input: stdin },
+      stdio: [stdin === void 0 ? "ignore" : "pipe", "pipe", "ignore"]
     });
     const trimmed = out.trim();
     return trimmed.length > 0 ? trimmed : null;
@@ -1236,6 +1324,38 @@ function readCommitCount(targetRepoRoot) {
   const count = Number.parseInt(out, 10);
   return Number.isFinite(count) ? count : null;
 }
+function readIgnoredPaths(targetRepoRoot, paths) {
+  if (paths.length === 0)
+    return null;
+  const out = git(targetRepoRoot, ["check-ignore", "-v", "-z", "--stdin"], paths.map((p) => `${p}\0`).join(""));
+  if (out === null)
+    return null;
+  const fields = out.split("\0");
+  if (fields[fields.length - 1] === "")
+    fields.pop();
+  if (fields.length % 4 !== 0)
+    return null;
+  const ignored = [];
+  for (let i = 0; i < fields.length; i += 4) {
+    const [source, line, pattern, path] = fields.slice(i, i + 4);
+    if (pattern.startsWith("!"))
+      continue;
+    const lineNumber = Number.parseInt(line, 10);
+    if (!Number.isFinite(lineNumber))
+      return null;
+    ignored.push({ path, pattern, source, line: lineNumber });
+  }
+  if (ignored.length === 0)
+    return null;
+  if (ignored.every((entry) => isAbsolute(entry.source)))
+    return ignored;
+  if (git(targetRepoRoot, ["rev-parse", "--show-prefix"]) === null)
+    return ignored;
+  const toplevel = git(targetRepoRoot, ["rev-parse", "--show-toplevel"]);
+  if (toplevel === null)
+    return null;
+  return ignored.map((entry) => isAbsolute(entry.source) ? entry : { ...entry, source: join3(toplevel, entry.source) });
+}
 function mintOrReadIdentity(targetRepoRoot) {
   const path = join3(targetRepoRoot, ".halfcycle", "project.json");
   if (existsSync(path)) {
@@ -1619,6 +1739,13 @@ function runBootstrapScan(targetRepo) {
 }
 
 // dist/install.js
+function renderNotShared(finding) {
+  const rule = `rule "${finding.pattern}" in ${finding.source}, line ${finding.line}`;
+  if (finding.others === 0) {
+    return `[halfcycle] Not shared: git ignores ${finding.path} (${rule}), which Halfcycle set up here, so it will not reach anyone else who gets a copy of this project.`;
+  }
+  return `[halfcycle] Not shared: git ignores ${finding.path} (${rule}) and ${finding.others} other file${finding.others === 1 ? "" : "s"} Halfcycle set up here, so they will not reach anyone else who gets a copy of this project.`;
+}
 var ZONE_B_DIR = ".workbench";
 var __filename = fileURLToPath(import.meta.url);
 var __dirname = dirname2(__filename);
@@ -1670,18 +1797,12 @@ var BUNDLE_PIN_REL = ".halfcycle/bundle.json";
 var PROJECT_IDENTITY_REL = ".halfcycle/project.json";
 var CREW_ROSTER_REL = ".halfcycle/crew.json";
 var CAPTURED_INDEX_REL = "test/fixtures/captured/manifest.json";
-var SETTINGS_REL = ".claude/settings.json";
 var GITIGNORE_REL = ".gitignore";
 function commandStubRel(name) {
   return `.claude/commands/${name}.md`;
 }
 var RETIRED_WRITE_SET_FILES = [];
-var RETIRED_HOOK_COMMANDS = [];
 var RETIRED_DENY_PATTERNS = [];
-function installerHookCommands() {
-  const settings = JSON.parse(generateSettingsJson());
-  return Object.values(settings.hooks ?? {}).flatMap((entries) => entries.flatMap((entry) => entry.hooks.map((h) => h.command)));
-}
 function closedWriteSet() {
   const files = /* @__PURE__ */ new Set([
     ...(readPluginManifest().commands ?? []).map((cmd) => commandStubRel(cmd.name)),
@@ -1707,7 +1828,7 @@ function closedWriteSet() {
     merged,
     dirs,
     ownedDirs,
-    hookCommands: /* @__PURE__ */ new Set([...installerHookCommands(), ...RETIRED_HOOK_COMMANDS]),
+    hookCommands: new Set(HALFCYCLE_HOOK_COMMANDS),
     denyRuleSha256: new Set([...DENY_PATTERNS, ...RETIRED_DENY_PATTERNS].map((rule) => sha256Hex(rule))),
     gitignoreLines: /* @__PURE__ */ new Set([GITIGNORE_HEADER, ...REQUIRED_GITIGNORE_ENTRIES, LEGACY_ENV_LOCAL_REL])
   };
@@ -1792,6 +1913,54 @@ function assertManifestInWriteSet(manifest, writeSet) {
     throw new Error(`[bundle install] the install record names paths outside the write set: ${strays.join(", ")}`);
   }
 }
+function findNotShared(targetRepo, manifest, collidedPaths) {
+  const merged = [
+    SETTINGS_REL,
+    ...manifest.mcp !== void 0 ? [MCP_REGISTRATION_REL] : [],
+    ...manifest.gitignore.created || manifest.gitignore.appended.length > 0 ? [GITIGNORE_REL] : []
+  ];
+  const collided = new Set(collidedPaths);
+  const dirVerdicts = /* @__PURE__ */ new Map();
+  const travelsThroughPlainDirs = (rel) => {
+    for (let dir = posix.dirname(rel); dir !== "."; dir = posix.dirname(dir)) {
+      let plain = dirVerdicts.get(dir);
+      if (plain === void 0) {
+        const abs = join5(targetRepo, dir);
+        plain = !lstatOrNull(abs)?.isSymbolicLink() && lstatOrNull(join5(abs, ".git")) === null;
+        dirVerdicts.set(dir, plain);
+      }
+      if (!plain)
+        return false;
+    }
+    return true;
+  };
+  const paths = [
+    .../* @__PURE__ */ new Set([
+      ...manifest.files.filter((f) => !("perMachine" in f)).map((f) => f.path),
+      ...merged,
+      INSTALL_MANIFEST_REL
+    ])
+  ].filter((rel) => !collided.has(rel)).filter((rel) => lstatOrNull(join5(targetRepo, rel)) !== null).filter(travelsThroughPlainDirs).sort();
+  const ignored = readIgnoredPaths(targetRepo, paths);
+  if (ignored === null)
+    return null;
+  const sorted = [...ignored].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  const named = sorted.find((entry) => entry.path === SETTINGS_REL) ?? sorted[0];
+  return {
+    path: named.path,
+    pattern: named.pattern,
+    source: named.source,
+    line: named.line,
+    others: sorted.length - 1
+  };
+}
+function lstatOrNull(path) {
+  try {
+    return lstatSync(path);
+  } catch {
+    return null;
+  }
+}
 function isPlainObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1906,9 +2075,15 @@ var DENY_PATTERNS = [
   "Bash(git push --no-verify:*)",
   "Bash(git commit --no-verify:*)"
 ];
-var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
 var USER_PROMPT_REMINDER_SENTENCE = "Where this project stands, and what order to work in, is recorded in the Halfcycle service and nowhere in this repository \u2014 call halfcycle_resolve before you answer or plan, because the files here will look complete and current and still be wrong about position.";
 function generateSettingsJson() {
+  const hooks = {};
+  for (const { event, matcher, timeout, command } of HALFCYCLE_HOOK_WIRING) {
+    (hooks[event] ??= []).push({
+      ...matcher === null ? {} : { matcher },
+      hooks: [{ type: "command", command, timeout }]
+    });
+  }
   const settings = {
     $schema: "https://json.schemastore.org/claude-code-settings.json",
     permissions: {
@@ -1916,88 +2091,10 @@ function generateSettingsJson() {
       // and is the machine owner's grant to make, not ours.
       deny: [...DENY_PATTERNS]
     },
-    hooks: {
-      SessionStart: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/session-start-marker.sh",
-              timeout: 5
-            }
-          ]
-        },
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh refresh-credential",
-              timeout: 10
-            }
-          ]
-        }
-      ],
-      UserPromptSubmit: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/user-prompt-reminder.sh",
-              timeout: 5
-            }
-          ]
-        }
-      ],
-      PostToolUse: [
-        {
-          matcher: WRITE_CAPABLE_TOOLS.join("|"),
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook post-tool-use",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      Stop: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook stop",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      SubagentStop: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/guard-runner.sh hook subagent-stop",
-              timeout: 60
-            }
-          ]
-        }
-      ],
-      SessionEnd: [
-        {
-          hooks: [
-            {
-              type: "command",
-              command: "bash ./.claude/hooks/session-end-marker.sh",
-              timeout: 5
-            }
-          ]
-        }
-      ]
-    }
+    hooks
   };
   return JSON.stringify(settings, null, 2) + "\n";
 }
-var VENDORED_BIN_REL = ".halfcycle/bin/bin.bundle.mjs";
 var GENERATED_GUARD_RUNNER_HEADER = "# Governance hook wrapper \u2014 generated by";
 function generateGuardRunnerWrapper() {
   return `#!/usr/bin/env bash
@@ -2219,14 +2316,16 @@ var CI_STANZA_KNOWN_HEADER_HASHES = [
 function isTrackedAndClean(targetRepo, relPath) {
   try {
     execFileSync2("git", ["-C", targetRepo, "ls-files", "--error-unmatch", "--", relPath], {
-      stdio: "ignore"
+      stdio: "ignore",
+      env: gitEnvForNamedRepo()
     });
   } catch {
     return false;
   }
   try {
     execFileSync2("git", ["-C", targetRepo, "diff", "--quiet", "HEAD", "--", relPath], {
-      stdio: "ignore"
+      stdio: "ignore",
+      env: gitEnvForNamedRepo()
     });
   } catch {
     return false;
@@ -2842,6 +2941,7 @@ async function install(options) {
   const installManifest = finishManifest(draft);
   assertManifestInWriteSet(installManifest, writeSet);
   recordOwned(report, join5(targetRepo, INSTALL_MANIFEST_REL), targetRepo, serializeManifest(installManifest), INSTALL_MANIFEST_REL);
+  const notShared = findNotShared(targetRepo, installManifest, report.collidedPaths);
   return {
     version: manifest.version,
     writtenPaths: report.writtenPaths,
@@ -2850,7 +2950,8 @@ async function install(options) {
     collidedPaths: report.collidedPaths,
     replacedPaths: report.replacedPaths,
     bootstrapScanRan: scanResult.ran,
-    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null
+    legacyCredentialKept: migration.outcome === "kept" ? { keys: migration.unbacked, missing: migration.missingForAdoption } : null,
+    notShared
   };
 }
 
@@ -4229,7 +4330,7 @@ function parseCloseRecord(path, parsed) {
 
 // dist/build-record/write.js
 import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename as basename2, join as join7, resolve as resolve2, relative as relative2, isAbsolute } from "node:path";
+import { basename as basename2, join as join7, resolve as resolve2, relative as relative2, isAbsolute as isAbsolute2 } from "node:path";
 
 // dist/build-record/template.js
 function severityLabel(seed) {
@@ -4283,7 +4384,7 @@ function renderBuildRecordMarkdown(record2) {
     `- **Tools:** ${record2.delivered.tools.join(", ")}`,
     `- **Dogfood:** ${record2.delivered.dogfood}`,
     "",
-    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guards fired during this phase.",
+    guardsList ? `Guards evaluated (results only): ${guardsList}. *(What a guard reported about this phase is recorded; the guard's own definition and its history are not.)*` : "No guard firing was recorded on this machine during this phase.",
     "",
     `## Acceptance (independent walk \u2014 walker ${record2.acceptance.walker})`,
     "",
@@ -4308,7 +4409,7 @@ function serialiseRecordJson(record2) {
 }
 function assertInsideOutDir(outDir, candidate, identity) {
   const rel = relative2(outDir, resolve2(candidate));
-  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute(rel) && rel === basename2(rel);
+  const isPlainFilename = rel !== "" && rel !== ".." && !isAbsolute2(rel) && rel === basename2(rel);
   if (!isPlainFilename) {
     throw new InvalidPhaseIdentityError(identity, BUILD_RECORD_DIR);
   }
@@ -4807,7 +4908,7 @@ var PLACEHOLDERS = {
 };
 
 // dist/uninstall.js
-import { lstatSync, readFileSync as readFileSync8, readdirSync, rmSync as rmSync2, rmdirSync, writeFileSync as writeFileSync7 } from "node:fs";
+import { lstatSync as lstatSync2, readFileSync as readFileSync8, readdirSync, rmSync as rmSync2, rmdirSync, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { dirname as dirname4, join as join10, relative as relative3, sep } from "node:path";
 var REMOVE_CREDENTIAL_FLAG = "--remove-credential";
@@ -4826,7 +4927,7 @@ function parseUninstallArgs(args2) {
 }
 function lexists(path) {
   try {
-    lstatSync(path);
+    lstatSync2(path);
     return true;
   } catch {
     return false;
@@ -4837,7 +4938,7 @@ function symlinkOnPath(root, rel) {
   for (const segment of rel.split("/")) {
     current = join10(current, segment);
     try {
-      if (lstatSync(current).isSymbolicLink())
+      if (lstatSync2(current).isSymbolicLink())
         return true;
     } catch {
       return false;
@@ -5222,7 +5323,7 @@ function removeRecordedFile(targetRepo, entry, writeSet, lists, name) {
   const abs = join10(targetRepo, path);
   let isFile;
   try {
-    isFile = lstatSync(abs).isFile();
+    isFile = lstatSync2(abs).isFile();
   } catch {
     return;
   }
@@ -5255,7 +5356,7 @@ function removeEmptyCreatedDir(targetRepo, dir, writeSet, lists, name) {
     return;
   const abs = join10(targetRepo, dir);
   try {
-    if (!lstatSync(abs).isDirectory() || readdirSync(abs).length > 0)
+    if (!lstatSync2(abs).isDirectory() || readdirSync(abs).length > 0)
       return;
   } catch {
     return;
@@ -5318,7 +5419,7 @@ function handleCredential(options, checked) {
   if (!lexists(dir))
     return { kind: "not-held", dir };
   try {
-    if (lstatSync(dir).isSymbolicLink())
+    if (lstatSync2(dir).isSymbolicLink())
       return { kind: "failed", dir, reason: "it is a symbolic link" };
     rmSync2(engagementEnvPath(engagementId, home), { force: true });
     rmSync2(notThisAccountMarkerPath(engagementId, home), { force: true });
@@ -5334,7 +5435,7 @@ function filesUnder(root, rel) {
   const walk = (dirRel) => {
     let names;
     try {
-      if (!lstatSync(join10(root, dirRel)).isDirectory())
+      if (!lstatSync2(join10(root, dirRel)).isDirectory())
         return;
       names = readdirSync(join10(root, dirRel));
     } catch {
@@ -5343,7 +5444,7 @@ function filesUnder(root, rel) {
     for (const entry of names.sort()) {
       const childRel = `${dirRel}/${entry}`;
       try {
-        if (lstatSync(join10(root, childRel)).isDirectory())
+        if (lstatSync2(join10(root, childRel)).isDirectory())
           walk(childRel);
         else
           out.push(childRel);
@@ -5816,6 +5917,9 @@ ${USAGE}`);
       process.stdout.write(`[halfcycle] Found: ${foundLine}
 `);
       process.stdout.write(`[halfcycle] Set up: ${written} file${written === 1 ? "" : "s"} written${merged > 0 ? ` (${merged} merged)` : ""}, ${credential ? "guards armed on every edit" : "not checked \u2014 this copy is not this account\u2019s project"}
+`);
+      if (result.notShared)
+        process.stdout.write(`${renderNotShared(result.notShared)}
 `);
       if (credential) {
         process.stdout.write(`[halfcycle] Next: open this folder in Claude Code \u2014 accept the workspace-trust prompt, it is expected \u2014 then run /halfcycle-setup and answer what it asks about your project