plumbbob 0.11.2 → 0.11.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "plumbbob",
   "displayName": "PlumbBob",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Attention-first build process — driver skills + a CLI that keep you the decider: guidance on the work, a latch on the record.",
   "author": { "name": "Rob McLarty", "email": "hello@robmclarty.com", "url": "https://robmclarty.com" },
   "homepage": "https://github.com/robmclarty/plumbbob#readme",

package/README.md

@@ -145,7 +145,7 @@ In Claude Code, inside any git repo with a clean tree:
    1. The bucket lives in memory, keyed by IP, refilling five tokens a minute.
    2. The clock is injected, so the test advances time instead of sleeping on it.
 
-   **Readout**: Step 1 - Add a token-bucket limiter
+   **Readout**: Step 1 - feat(limiter): add a token-bucket limiter
 
    ```text
    check        green: 7 of 7 checks
@@ -159,7 +159,7 @@ In Claude Code, inside any git repo with a clean tree:
 
    **Verdict**: ● Plumb
 
-   **Next Up**: Step 2 of 3 - Wire the limiter into POST /login (model: **Sonnet**, details: `.plumbbob/builds/2026-07-03-rate-limit-the-login-endpoint/intent.md:20`)
+   **Next Up**: Step 2 of 3 - feat(login): wire the limiter into POST /login (model: **Sonnet**, details: `.plumbbob/builds/2026-07-03-rate-limit-the-login-endpoint/intent.md:20`)
 
    **Your Call**:
 
@@ -186,7 +186,7 @@ In Claude Code, inside any git repo with a clean tree:
 
    **Verdict**: ● Plumb
 
-   **Next Up**: Step 2 of 3 - Wire the limiter into POST /login (model: **Sonnet**, details: `.plumbbob/builds/2026-07-03-rate-limit-the-login-endpoint/intent.md:20`)
+   **Next Up**: Step 2 of 3 - feat(login): wire the limiter into POST /login (model: **Sonnet**, details: `.plumbbob/builds/2026-07-03-rate-limit-the-login-endpoint/intent.md:20`)
    ```
 
    ![The boundary after looks good](docs/media/checkpoint-boundary.svg)

package/dist/lib/git.js

@@ -5,6 +5,7 @@
 // `--hard` only to plumbbob's own recorded checkpoint SHAs: never a
 // history-rewriting operation on anything pushed.
 import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 /**
  * Run git in `root` and return its trimmed stdout.
@@ -95,16 +96,30 @@ export function commitsSince(root, sha, excluding) {
     }
 }
 /**
- * The working tree's changes against the index, one entry per file, as
- * `git diff --numstat` reports them; a binary file counts 0/0.
+ * The step's whole product, one entry per file: everything changed since HEAD,
+ * staged or not, plus every non-ignored untracked file counted as all-added
+ * lines.
+ *
+ * That universe is the one `checkpoint`'s drift warning already uses after it
+ * stages, so the pause and the boundary measure the same thing. `diff HEAD`
+ * (rather than a working-tree diff merged with a cached one) nets a file
+ * staged and then edited again into a single row; `--no-renames` keeps a
+ * staged `git mv` as two plain paths instead of one `{old => new}` arrow,
+ * which is also the shape the seam row wants.
  *
  * This feeds the recap's `diff` and `seam` rows at the pause: information,
  * never a gate, so it is best-effort and never throws ([] on any failure).
  */
 export function diffNumstat(root) {
+    return [...trackedNumstat(root), ...untrackedNumstat(root)];
+}
+/**
+ * The tracked half of `diffNumstat`: what differs from HEAD, index included.
+ */
+function trackedNumstat(root) {
     let out;
     try {
-        out = runGit(root, ['diff', '--numstat']);
+        out = runGit(root, ['diff', '--numstat', '--no-renames', 'HEAD']);
     }
     catch {
         return [];
@@ -114,9 +129,59 @@ export function diffNumstat(root) {
     }
     return out.split('\n').map((line) => {
         const [added, removed, ...path] = line.split('\t');
-        return { added: toCount(added), removed: toCount(removed), path: path.join('\t') };
+        return { added: toCount(added), removed: toCount(removed), path: path.join('\t'), untracked: false };
     });
 }
+/**
+ * The untracked half of `diffNumstat`: every non-ignored new file, counted as
+ * all-added lines.
+ *
+ * The count is read in node rather than spawned per file: the alternative
+ * (`git diff --no-index --numstat /dev/null <path>`) exits 1 by design and
+ * prints the path in rename shape, so it needs an exit-1 catch and an arrow
+ * parser for every file. The trade-off, accepted: gitattributes are not
+ * consulted for a file git has never seen.
+ */
+function untrackedNumstat(root) {
+    let paths;
+    try {
+        paths = untrackedPaths(root);
+    }
+    catch {
+        return [];
+    }
+    return paths.map((path) => ({ added: addedLines(join(root, path)), removed: 0, path, untracked: true }));
+}
+/**
+ * The line count a numstat row would carry for a whole new file: newlines, plus
+ * one for an unterminated last line, the way git counts it.
+ *
+ * A NUL byte in the first 8000 bytes means binary, which numstat prints as `-`
+ * and `toCount` reads as 0. An unreadable file counts 0 as well, and the caller
+ * keeps its path either way: the seam row still has to see it.
+ */
+function addedLines(absolute) {
+    let buffer;
+    try {
+        buffer = readFileSync(absolute);
+    }
+    catch {
+        return 0;
+    }
+    if (buffer.subarray(0, 8000).includes(0)) {
+        return 0;
+    }
+    if (buffer.length === 0) {
+        return 0;
+    }
+    let lines = 0;
+    for (const byte of buffer) {
+        if (byte === 0x0a) {
+            lines += 1;
+        }
+    }
+    return buffer[buffer.length - 1] === 0x0a ? lines : lines + 1;
+}
 /**
  * A numstat count field as a number: `-` (a binary file) and anything else
  * unparseable read as 0.
@@ -126,22 +191,54 @@ function toCount(field) {
     return Number.isFinite(n) && n >= 0 ? n : 0;
 }
 /**
- * The raw `git diff` patch for `paths` (working tree against the index), or ''
- * when nothing differs or git refuses.
+ * The raw patch for `entries` (everything since HEAD, new files included), or
+ * '' when nothing differs or git refuses.
+ *
+ * Tracked paths come through one `git diff HEAD`; an untracked file has no
+ * blob to diff, so each goes through `git diff --no-index` against /dev/null,
+ * which prints the same `new file mode` header a staged new file gets. That
+ * form implies `--exit-code`, so a patch arrives as a thrown status 1 with the
+ * text on `stdout`. Entries counted at 0 added lines are skipped: they would
+ * produce nothing, and skipping them caps the spawns at the inline threshold.
  *
  * Only the pause's inline-diff fence reads this, and only after the numstat
  * count came in at 20 changed lines or fewer, so the patch is always small.
  * Best-effort like diffNumstat: information, never a gate.
  */
-export function diffPatch(root, paths) {
-    if (paths.length === 0) {
-        return '';
+export function diffPatch(root, entries) {
+    const tracked = entries.filter((e) => !e.untracked).map((e) => e.path);
+    const pieces = [];
+    if (tracked.length > 0) {
+        try {
+            pieces.push(runGit(root, ['diff', '--no-renames', 'HEAD', '--', ...tracked]));
+        }
+        catch {
+            // best-effort: a path git refuses drops out of the fence, the rest stays.
+        }
+    }
+    for (const entry of entries) {
+        if (!entry.untracked || entry.added === 0) {
+            continue;
+        }
+        pieces.push(noIndexPatch(root, entry.path));
     }
+    return pieces.filter((piece) => piece.length > 0).join('\n');
+}
+/**
+ * One untracked file's patch, `git diff --no-index` against /dev/null.
+ *
+ * The path stays repo-relative so the header reads `+++ b/src/new.ts`, the same
+ * shape `diff HEAD` prints for a staged new file. `--no-index` implies
+ * `--exit-code`: status 1 is the success case, and `encoding` is set on the
+ * spawn, so git's output arrives as a string on the error.
+ */
+function noIndexPatch(root, path) {
     try {
-        return runGit(root, ['diff', '--', ...paths]);
+        return runGit(root, ['diff', '--no-index', '--', '/dev/null', path]);
     }
-    catch {
-        return '';
+    catch (error) {
+        const failure = error;
+        return failure.status === 1 && typeof failure.stdout === 'string' ? failure.stdout.trim() : '';
     }
 }
 // --- mutation helpers (build-loop: done checkpoints, revert resets). Additive

package/dist/verbs/checkpoint.js

@@ -81,9 +81,9 @@ export async function checkpoint(cwd, args) {
             : notice({ fact: 'checkpoint refused', detail: ['the check is red'], remedy: 'fix it, then run it again' }));
         return 1;
     }
-    // The step's record, as the pause showed it: measured now, before the work
-    // is staged, since the seam and diff rows read the working tree the way the
-    // pause did. It lands in the build-log's Log beneath the dated line (the
+    // The step's record, as the pause showed it: built here, before the work is
+    // staged, though both measures now run against HEAD, so staging no longer
+    // moves them. It lands in the build-log's Log beneath the dated line (the
     // tracked ledger is the archive, and it rides the branch where a commit body
     // would not survive the squash); the commit body keeps its marker and the
     // lead prose only.

package/dist/verbs/handoff.js

@@ -15,12 +15,12 @@
 // it cannot narrate into.
 //
 // If the CLI can compute a recap row, the CLI does: the check row comes from
-// the last run's summary, the seam row from the SEAM marker against the
-// work-plane diff, the diff row from `git diff --numstat`. The model's part
-// (`.plumbbob/detail.md`) supplies only what takes judgment: the Summary, the
-// three judgment rows, and the recommendation; the Verdict folds the same
-// assembled rows worst-of with the step's accrued stats, so the fence shows
-// exactly what the fold saw.
+// the last run's summary, the seam and diff rows from the SEAM marker against
+// the step's whole product (everything changed since HEAD, staged or not, plus
+// each non-ignored new file). The model's part (`.plumbbob/detail.md`) supplies
+// only what takes judgment: the Summary, the three judgment rows, and the
+// recommendation; the Verdict folds the same assembled rows worst-of with the
+// step's accrued stats, so the fence shows exactly what the fold saw.
 //
 // Every tier's ending is emitted here, so no skill has to fake the furniture in
 // prose: `--plan` renders the plan-pause ending and `--driver` the driver
@@ -133,7 +133,11 @@ export function handoff(cwd, args = []) {
     const verdict = verdictLine(ladder, worst);
     const counts = countDiff(work);
     const changed = counts.added + counts.removed;
-    const inline = changed > 0 && changed <= INLINE_DIFF_MAX;
+    // The patch comes first so `· inline below` is a promise the fence keeps: a
+    // small change git can still print nothing for (a vanished path) falls back
+    // to the bare counts rather than pointing at a fence that never arrives.
+    const patch = changed > 0 && changed <= INLINE_DIFF_MAX ? diffPatch(root, work) : '';
+    const inline = patch.length > 0;
     const readout = recapLines(rows, {
         diff: diffRowValue(counts, inline),
         spent: spentRowValue(spentInputs(root, slug, current, summary)),
@@ -144,10 +148,7 @@ export function handoff(cwd, args = []) {
         parts.push([readoutLabel(current, steps), '', ...fence('text', readout)].join('\n'));
     }
     if (inline) {
-        const patch = diffPatch(root, work.map((e) => e.path));
-        if (patch.length > 0) {
-            parts.push(fence('diff', patch.split('\n')).join('\n'));
-        }
+        parts.push(fence('diff', patch.split('\n')).join('\n'));
     }
     parts.push(verdict, nextUpLine(nextUp, steps.length, where), yourCallBlock(current, checkGreen));
     return emit(withRecommendation(parts, parseRecommendation(detail)));
@@ -179,10 +180,10 @@ export function boundaryEnding(root, slug, step) {
  * nests it under the Log's dated line.
  *
  * Measured, not recalled: the check, seam, and diff rows are read the same way
- * the pause read them, so this has to be built before the work is staged (the
- * seam and diff rows read the working tree). Null when the detail file carries
- * nothing to record, so a hand-built step with no detail gets the bare dated
- * line it always did.
+ * the pause read them. Both measures run against HEAD, so staging no longer
+ * moves the counts and the caller's build-then-stage order is a nicety rather
+ * than a requirement. Null when the detail file carries nothing to record, so a
+ * hand-built step with no detail gets the bare dated line it always did.
  */
 export function stepRecord(root, slug, step, detail) {
     const summary = parseSummary(detail);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plumbbob",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Attention-first build process: 14 skills + a CLI that keep you the decider — guidance on the work, a latch on the record.",
   "keywords": [
     "claude-code",