javi-forge 1.35.1 → 1.37.0

package/dist/lib/secure-fs-transaction.js

@@ -65,14 +65,34 @@ function ancestorChain(leaf) {
  * manual-recovery guidance (never clobbers a concurrent change).
  */
 export async function runTransaction(input) {
+    // Seam validation (fail-closed): the topology is EITHER a `layout` OR the
+    // default Claude pair [asset, settings]. A caller with neither would deref
+    // `undefined.desired` deep in the engine — refuse up front with a clear error.
+    if (!input.layout && !(input.asset && input.settings)) {
+        throw new TxAbort("validate", "runTransaction requires `layout` or both `asset` and `settings`");
+    }
     const { secureFs, clock, nonce, projectDir } = input;
-    const claudeDir = path.join(projectDir, ".claude");
-    const hooksDir = path.join(claudeDir, "hooks");
+    // Container topology + write components. The default (no `layout`) is the exact
+    // Claude `.claude` → `.claude/hooks` nesting with [asset, settings]; a `layout`
+    // (Codex) supplies absolute containers parent-first and an ordered component
+    // list. Either way the proof primitives below are identical.
+    const containers = input.layout
+        ? input.layout.containers
+        : [
+            path.join(projectDir, ".claude"),
+            path.join(projectDir, ".claude", "hooks"),
+        ];
+    const components = input.layout
+        ? input.layout.components
+        : [
+            input.asset,
+            input.settings,
+        ];
     // The dirs the tool OWNS: their children include the executed asset and the
     // settings it is referenced from. Fixed and known to the core regardless of
     // the per-run write plan; each existing member is proved on EVERY anyWrite run
     // (Round-4/5 / JDA-401 + JDB5-001).
-    const managedContainers = new Set([claudeDir, hooksDir]);
+    const managedContainers = new Set(containers);
     const heldByPath = new Map();
     const heldOrder = [];
     const createdDirs = [];
@@ -80,7 +100,12 @@ export async function runTransaction(input) {
     const committed = [];
     const backups = [];
     const needsWrite = (c) => c.desired !== null;
-    const anyWrite = needsWrite(input.asset) || needsWrite(input.settings);
+    const anyWrite = components.some(needsWrite);
+    // A component writes into `container` when its parent dir IS the container or a
+    // descendant of it — used to decide which absent containers to create.
+    const writesInto = (container) => components.some((c) => needsWrite(c) &&
+        (path.dirname(c.path) === container ||
+            path.dirname(c.path).startsWith(`${container}${path.sep}`)));
     // The uniform per-held-dir gate. It runs the LENIENT ancestor ACL predicate on
     // EVERY held dir — including managed containers, which are ALSO proved strict by
     // `proveManagedContainer` right after they are gated (in ensureManagedContainer)
@@ -168,23 +193,23 @@ export async function runTransaction(input) {
         // pre-commit); one that is absent is CREATED only when a child is written
         // into it this run, else left alone (nothing to secure).
         if (anyWrite) {
-            const projectHandle = heldByPath.get(projectDir);
-            // .claude always ensured on anyWrite (holds settings; grandparent of
-            // the asset). createIfAbsent=true never returns null (opens, creates, or
-            // throws) → narrow non-null before passing as parent (JDA6-003).
-            const claudeHandle = await ensureManagedContainer(projectHandle, claudeDir, 
-            /* createIfAbsent */ true);
-            if (!claudeHandle) {
-                throw new TxAbort(`container ${claudeDir}`, "unexpected null handle");
+            // Ensure every managed container PARENT-FIRST. Each container's parent is
+            // already held (its dirname was gated in preflight or ensured by an earlier
+            // iteration). A container is CREATED only when a component writes into it
+            // or a descendant container this run; otherwise it is proved IF present,
+            // else left alone (JDB5-001). This generalizes the former hardcoded
+            // `.claude` → `.claude/hooks` pair without changing any proof primitive.
+            for (const container of containers) {
+                const parentHandle = heldByPath.get(path.dirname(container));
+                if (!parentHandle) {
+                    throw new TxAbort(`container ${container}`, "parent chain not held");
+                }
+                await ensureManagedContainer(parentHandle, container, 
+                /* createIfAbsent */ writesInto(container));
             }
-            // .claude/hooks: create when the asset writes into it; otherwise prove
-            // IF it exists (settings-only repair must still secure the hook's
-            // container — JDB5-001).
-            await ensureManagedContainer(claudeHandle, hooksDir, 
-            /* createIfAbsent */ needsWrite(input.asset));
         }
-        // --- CAPTURE + (FORCED) BACKUP + STAGE, asset then settings ---
-        for (const component of [input.asset, input.settings]) {
+        // --- CAPTURE + (FORCED) BACKUP + STAGE, in component order ---
+        for (const component of components) {
             if (!needsWrite(component))
                 continue;
             const parentPath = path.dirname(component.path);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.35.1",
+	"version": "1.37.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {